sproutboat 0.11.13 → 0.12.1

package/CHANGELOG.md

@@ -10,6 +10,37 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.12.1] - 2026-09-30
+
+### Fixed
+
+- `sproutboat` with no arguments linked the platform repository and said to
+  use `bunx`, not `npx`. The CLI has shipped as a self-contained binary since
+  0.11.0, so `npx` works; the help now links https://docs.sproutboat.com.
+- Handler types now declare `batch.ackAll()`/`retryAll()`, per-message
+  `delaySeconds` in `sendBatch()` and D1 `raw()`, matching the runtime.
+  Comments that said direct R2 uploads are unavailable standalone, and that an
+  un-acked queue message is redelivered, are corrected.
+
+### Changed
+
+- `examples/runtime-comparison` runs one Worker-style app on Node, workerd and
+  a standalone Sproutboat binary and checks every response;
+  `benchmarks/v0.12.0` holds the first tagged run, which sproutboat.com
+  renders.
+
+## [0.12.0] - 2026-09-28
+
+### Added
+- Run three original Cloudflare Worker examples unchanged: JSON responses,
+  cookie parsing, and redirects. The example suite now checks 21 native apps.
+- Pass `(request, env, ctx)` to fetch handlers using the 2026-09-28
+  compatibility date while preserving the earlier two-argument form for older apps.
+
+### Changed
+- Update to Porffor alpha 10 via `@sproutboat/toolchain@^0.4.14` and use
+  `@sproutboat/runtime@^0.13.0` for native request decoding and redirects.
+
 ## [0.11.13] - 2026-09-26
 
 ### Added
@@ -627,7 +658,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.13...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.1...HEAD
+[0.12.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.0...v0.12.1
+[0.12.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.13...v0.12.0
 [0.11.13]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.12...v0.11.13
 [0.11.12]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.11...v0.11.12
 [0.11.11]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.10...v0.11.11

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.13 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.12.1
 
 ## Commands
 
@@ -76,7 +76,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/de4eb58+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/08ac7ee+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.13",
+  "version": "0.12.1",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,23 +64,24 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.12.1",
-    "@sproutboat/toolchain": "^0.4.13",
+    "@sproutboat/runtime": "^0.13.0",
+    "@sproutboat/toolchain": "^0.4.14",
     "@sproutboat/wire": "^0.9.1"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
     "@types/bun": "1.4.0",
+    "cookie": "2.0.1",
     "lefthook": "2.1.12",
     "oxfmt": "0.66.0",
     "oxlint": "1.81.0",
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.13",
-    "@sproutboat/cli-darwin-x64": "0.11.13",
-    "@sproutboat/cli-linux-arm64": "0.11.13",
-    "@sproutboat/cli-linux-x64": "0.11.13"
+    "@sproutboat/cli-darwin-arm64": "0.12.1",
+    "@sproutboat/cli-darwin-x64": "0.12.1",
+    "@sproutboat/cli-linux-arm64": "0.12.1",
+    "@sproutboat/cli-linux-x64": "0.12.1"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { cp, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { walkAssets, type AssetManifest } from "./assets";
 import { resourceRefs, type SproutboatConfig } from "./config";
@@ -82,7 +82,13 @@ async function integrationIdentity(): Promise<string> {
   const files = ["build.ts", "compile.ts", "sqlite.ts", "bearssl.ts", "toolchain.ts"].map((file) =>
     resolve(import.meta.dir, file),
   );
-  files.push(Bun.resolveSync("@sproutboat/toolchain/patch", import.meta.dir));
+  // Hash the patch implementation and its local modules so a Unicode patch
+  // edit cannot reuse a binary compiled with earlier builtin semantics.
+  const patchDir = dirname(Bun.resolveSync("@sproutboat/toolchain/patch", import.meta.dir));
+  const toolchainFiles = (await readdir(patchDir))
+    .filter((file) => file.endsWith(".ts") && !file.endsWith(".test.ts"))
+    .sort();
+  files.push(...toolchainFiles.map((file) => resolve(patchDir, file)));
   return digest(Buffer.concat(await Promise.all(files.map((file) => readFile(file)))));
 }
 

package/src/bundle.ts

@@ -1,7 +1,7 @@
 /**
  * #89 — bundle the handler before Porffor sees it.
  *
- * Porffor alpha 9 supports ESM imports. We still bundle first so capability
+ * Porffor supports ESM imports. We still bundle first so capability
  * validation sees every dependency and the runtime wrapper receives one
  * controlled default export.
  *

package/src/surface.ts

@@ -7,7 +7,7 @@ import { bold, dim, leaf } from "./style";
 
 export const CLI_NAME = "sproutboat";
 export const TAGLINE = "Deploy JavaScript handlers as tiny native binaries on your own VPS.";
-export const REPO_URL = "https://github.com/baronunread/sproutboat";
+export const DOCS_URL = "https://docs.sproutboat.com";
 
 export type Group = "Develop" | "Ship" | "Storage" | "Configure" | "Account";
 
@@ -356,7 +356,7 @@ export function helpText(): string {
   lines.push(
     "",
     dim(`Run \`${CLI_NAME} <command>\` with no/invalid args to see that command's full usage.`),
-    dim(`Docs: ${REPO_URL}  ·  runs on Bun — use \`bunx\`, not \`npx\`.`),
+    dim(`Docs: ${DOCS_URL}`),
   );
   return lines.join("\n");
 }

package/src/toolchain.ts

@@ -38,7 +38,7 @@ const ZIG_SHA256 = {
 // frozen reference handlers and update its COMPAT.md for any new mismatch before
 // releasing — the alpha compiler's output can shift between pins. Checked by
 // hand at bump time, not in CI.
-// uWebSockets commit Porffor alpha-4 fetches for the native-fetch server.
+// uWebSockets commit Porffor alpha-10 fetches for the native-fetch server.
 const UWS_COMMIT = "360c276d";
 const UWS_COMMIT_FULL = "360c276d609d59af56ae6932adb95154ace9f15f";
 
@@ -678,7 +678,7 @@ export function porfforVersion(): string {
 
 export function esbuildVersion(): string {
   // Legacy artifact field, retained so older control planes can read manifests.
-  // Handler bundling uses Bun.build and Porffor alpha 9 needs no esbuild binary.
+  // Handler bundling uses Bun.build and Porffor alpha 10 needs no esbuild binary.
   return "unused";
 }
 

package/src/types-gen.ts

@@ -1,10 +1,9 @@
 /**
  * `sproutboat types` — the project's `env`, as TypeScript.
  *
- * In Workers `env` is a parameter, so an editor can infer it from a signature.
- * Here it is a global, which means nothing is inferable at all: `env.SESSIONS`
- * is an undeclared identifier until this file exists. That makes generated
- * types worth more here than they are there, not less.
+ * `env` remains available as a global in both compatibility modes. This file
+ * gives it the project's binding names and types. From 2026-09-28 it is also
+ * the second handler argument.
  *
  * The output declares `env` from `sproutboat.jsonc` and references the ambient
  * types shipped in `types/sproutboat.d.ts`, so binding *shapes* version with
@@ -75,6 +74,11 @@ export function generateTypes(config: SproutboatConfig): string {
         .join("\n")
     : "    // No bindings declared in sproutboat.jsonc yet.";
 
+  const handlerNote =
+    config.compatibility_date >= "2026-09-28"
+      ? "The same object is passed as the second handler argument: fetch(request, env, ctx)."
+      : "The handler signature is fetch(request, ctx); env is only a global.";
+
   return `${HEADER}
 /// <reference types="sproutboat/types" />
 
@@ -82,7 +86,7 @@ declare global {
   /**
    * Bindings from sproutboat.jsonc, for project "${config.name}".
    *
-   * A global, not a parameter: the handler signature is \`fetch(request)\`.
+   * ${handlerNote}
    * Every call on these is synchronous, so \`await\` is allowed and does
    * nothing.
    */

package/types/sproutboat.d.ts

@@ -6,9 +6,9 @@
  * generates a project's `sproutboat-env.d.ts`, which references this file and
  * declares `env` with that project's bindings.
  *
- * Two things differ from Cloudflare Workers and are the reason these exist:
- * `env` is a global rather than a parameter, so nothing is inferable from a
- * signature, and every binding call is synchronous.
+ * Bindings are synchronous. Before compatibility date 2026-09-28, `env` is a
+ * global only and `ctx` is the second handler argument. From that date, `env`
+ * is also passed as the second argument and `ctx` as the third.
  */
 
 declare global {
@@ -52,6 +52,8 @@ declare global {
     /** The first row, or one column of it when named. `null` if there are none. */
     first<T = Record<string, unknown>>(): T | null;
     first<T = unknown>(column: string): T | null;
+    /** Rows as arrays of column values. */
+    raw<T = unknown[]>(): T[];
   }
 
   interface D1Database {
@@ -81,8 +83,8 @@ declare global {
     httpMetadata: R2HttpMetadata;
     customMetadata?: Record<string, string>;
     /**
-     * The object as a string. A get holds the object whole in memory, so keep
-     * downloads small until native download tickets are available.
+     * The object as a string. A get holds the object whole in memory, so serve
+     * large objects with `createDownloadUrl` instead.
      *
      * `new Response(obj.body, ...)` corrupts any non-ASCII/binary content: the
      * runtime cannot tell these bytes apart from a string a handler built, so
@@ -159,9 +161,9 @@ declare global {
     createMultipartUpload(key: string, options?: R2PutOptions): R2MultipartUpload;
     /** Reconstructs a multipart handle after storing its key and upload id. */
     resumeMultipartUpload(key: string, uploadId: string): R2MultipartUpload;
-    /** Broker-backed direct PUT. Not available in native standalone mode yet. */
+    /** Direct PUT to a one-use URL, streamed to storage without passing through the handler. */
     createUploadUrl(key: string, options?: R2UploadTicketOptions): R2TransferTicket;
-    /** Broker-backed direct GET or HEAD, including Range. */
+    /** Direct GET or HEAD from a one-use URL, including Range. */
     createDownloadUrl(key: string, options?: R2DownloadTicketOptions): R2TransferTicket;
     get(key: string): R2Object | null;
     /** Metadata without the body. */
@@ -179,14 +181,14 @@ declare global {
   interface Queue<Body = unknown> {
     /** Returns immediately. The batch reaches `queue()` out of band. */
     send(body: Body, options?: QueueSendOptions): void;
-    sendBatch(messages: Array<{ body: Body }>): void;
+    sendBatch(messages: Array<{ body: Body; delaySeconds?: number }>): void;
   }
 
   interface QueueMessage<Body = unknown> {
     id: string;
     timestamp: number;
     body: Body;
-    /** Mark as handled. Without this the message is redelivered. */
+    /** Mark as handled. A message neither acked nor retried counts as acked. */
     ack(): void;
     /** Hand it back for another attempt. */
     retry(): void;
@@ -195,6 +197,8 @@ declare global {
   interface MessageBatch<Body = unknown> {
     queue: string;
     messages: Array<QueueMessage<Body>>;
+    ackAll(): void;
+    retryAll(): void;
   }
 
   // --------------------------------------------------- Durable Objects
@@ -273,8 +277,8 @@ declare global {
    *
    * `crypto.scryptVerify` is a Sproutboat extension (#153), not WebCrypto: it
    * re-derives a scrypt hash and compares it in constant time, for migrating
-   * password hashes made by Node/Bun `scrypt`. Verify-only on purpose; new
-   * credentials should use HMAC/PBKDF2 via `crypto.subtle`.
+   * password hashes made by Node/Bun `scrypt`. Verify-only on purpose; derive
+   * new credentials with HMAC via `crypto.subtle`.
    */
   interface Crypto {
     scryptVerify(
@@ -300,11 +304,7 @@ declare global {
     scheduledTime: number;
   }
 
-  /**
-   * `env` is a global, not a parameter. `ctx` is the second argument, and its
-   * only member is `waitUntil`: work that outlives the response, drained
-   * in-process and capped at 25s.
-   */
+  /** Work that outlives the response, drained in-process and capped at 25s. */
   interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
   }
@@ -318,6 +318,13 @@ declare global {
     queue?(batch: MessageBatch<QueueBody>, ctx: ExecutionContext): void | Promise<void>;
   }
 
+  /** Handler signature for compatibility dates from 2026-09-28. */
+  interface WorkersHandler<Bindings = Record<string, unknown>, QueueBody = unknown> {
+    fetch(request: Request, env: Bindings, ctx: ExecutionContext): Response | Promise<Response>;
+    scheduled?(event: ScheduledEvent, env: Bindings, ctx: ExecutionContext): void | Promise<void>;
+    queue?(batch: MessageBatch<QueueBody>, env: Bindings, ctx: ExecutionContext): void | Promise<void>;
+  }
+
   /**
    * What a Durable Object class implements. Declare it above the default
    * export and name it in `durable_objects`.