sproutboat 0.11.4 → 0.11.6

package/CHANGELOG.md

@@ -8,7 +8,44 @@ a breaking change.
 Reconstructed from git history on 2026-09-03 for everything through v0.4.11;
 maintained going forward by the `release` skill.
 
-## [Unreleased]
+## [0.11.6] - 2026-09-15
+### Fixed
+- The 100% CPU livelock on a `fetch` handler that resolves a promise with a
+  plain object (baronunread/sproutboat#168). Root cause was
+  `__Porffor_promise_resolve`'s `.then` duck-type probe spinning forever on a
+  prototype-chain fixed point instead of terminating; patched in
+  `@sproutboat/toolchain` alongside the other local Porffor patches. Bumped
+  `@sproutboat/toolchain` to `^0.4.1` to pick it up.
+- `new Response(r2Object.body)` corrupted any binary R2 object (each byte
+  0x80-0xFF doubled on the wire): the runtime couldn't tell opaque bytes
+  apart from a Latin-1-range string, so it UTF-8-encoded them a second time
+  (baronunread/sproutboat#177). Added `R2Object.toResponse(init?)`, which
+  serves the bytes unmodified. Bumped `@sproutboat/runtime` to `^0.7.1` and
+  `@sproutboat/wire` to `^0.6.0` to pick this up, along with the R2
+  file-backed storage rework (baronunread/sproutboat#56) both depend on.
+- `sproutboat-env.d.ts`'s generated secret comment named the wrong command
+  (`secrets set`; the real one is `secrets put`), `SproutboatHandler` claimed
+  there is no `ctx`/`ctx.waitUntil` (shipped since #57/#171), and
+  `docs/standalone.md` still said a missing secret refuses the boot (0.11.1
+  changed that to throwing on first use instead).
+
+## [0.11.5] - 2026-09-14
+### Fixed
+- Bumped `@sproutboat/runtime` to `^0.6.6`. `__sbEntry` called `handlers.fetch()`
+  (and the `scheduled`/`queue`/`alarm` trigger paths) with no try/catch at all:
+  any synchronous throw, or a rejected async handler promise, propagated all
+  the way up and crashed the whole process: not just the request that hit
+  it, but every other in-flight and future request on that sprout, until
+  whatever supervises it restarted the binary (baronunread/sproutboat#179). A
+  throwing/rejecting `fetch()` now returns a 500 instead. `scheduled()`/
+  `alarm()` still reply `204` either way (no failure signal existed before
+  this either); a throwing `queue()` falls through to the existing
+  default-ack pass, same as a handler that never calls `ack()`/`retry()` on
+  every message.
+- Upgrading the CLI is the only way to pick this up. The runtime prelude is
+  embedded in the CLI binary when that binary is built, so a project's own
+  `@sproutboat/runtime` dependency has no effect on `--standalone` or
+  `--target host` builds.
 
 ## [0.11.4] - 2026-09-14
 ### Fixed
@@ -507,7 +544,8 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.4...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.5...HEAD
+[0.11.5]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.4...v0.11.5
 [0.11.4]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.3...v0.11.4
 [0.11.3]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.2...v0.11.3
 [0.11.2]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.1...v0.11.2

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.4 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.6 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.6.5",
-    "@sproutboat/toolchain": "^0.4.0",
-    "@sproutboat/wire": "^0.5.0",
+    "@sproutboat/runtime": "^0.7.1",
+    "@sproutboat/toolchain": "^0.4.1",
+    "@sproutboat/wire": "^0.6.0",
     "esbuild": "^0.28.2"
   },
   "devDependencies": {
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.4",
-    "@sproutboat/cli-darwin-x64": "0.11.4",
-    "@sproutboat/cli-linux-arm64": "0.11.4",
-    "@sproutboat/cli-linux-x64": "0.11.4"
+    "@sproutboat/cli-darwin-arm64": "0.11.6",
+    "@sproutboat/cli-darwin-x64": "0.11.6",
+    "@sproutboat/cli-linux-arm64": "0.11.6",
+    "@sproutboat/cli-linux-x64": "0.11.6"
   },
   "engines": {
     "node": ">=18"

package/src/types-gen.ts

@@ -34,7 +34,7 @@ function entries(config: SproutboatConfig): Entry[] {
     out.push({ name, type: "string", note: `vars: ${JSON.stringify(value)}` });
   }
   for (const name of config.secrets ?? []) {
-    out.push({ name, type: "string", note: "secret, set with `sproutboat secrets set`" });
+    out.push({ name, type: "string", note: "secret, set with `sproutboat secrets put`" });
   }
   for (const { binding } of resourceRefs(config.kv_namespaces)) out.push({ name: binding, type: "KVNamespace" });
   for (const { binding } of resourceRefs(config.d1_databases)) out.push({ name: binding, type: "D1Database" });

package/types/sproutboat.d.ts

@@ -56,20 +56,46 @@ declare global {
 
   // ---------------------------------------------------------------- R2
 
+  interface R2HttpMetadata {
+    contentType?: string;
+    contentDisposition?: string;
+    contentEncoding?: string;
+    contentLanguage?: string;
+    cacheControl?: string;
+  }
+
   interface R2Object {
     key: string;
     size: number;
     etag: string;
+    /** `etag`, quoted, ready for an `ETag` response header. */
+    httpEtag: string;
     uploaded: string;
+    httpMetadata: R2HttpMetadata;
     customMetadata?: Record<string, string>;
     /**
      * The object as a string. An object is held whole in memory on the way in
      * and on the way out, so keep them small.
+     *
+     * `new Response(obj.body, ...)` corrupts any non-ASCII/binary content: the
+     * runtime cannot tell these bytes apart from a string a handler built, so
+     * it UTF-8-encodes them a second time (baronunread/sproutboat#177). Use
+     * `obj.toResponse()` instead for binary content — it serves the bytes
+     * unmodified.
      */
     body: string;
+    text(): string;
+    json(): unknown;
+    /**
+     * A `Response` that serves `body` byte-for-byte, unlike `new
+     * Response(obj.body, ...)` (see `body` above). `init.headers`/`.status`
+     * merge in as usual; `content-type` defaults from `httpMetadata` and
+     * `etag` from `httpEtag` when not set.
+     */
+    toResponse(init?: { status?: number; headers?: HeadersInit }): Response;
   }
 
-  type R2ObjectHead = Omit<R2Object, "body">;
+  type R2ObjectHead = Omit<R2Object, "body" | "text" | "json" | "toResponse">;
 
   interface R2Objects {
     objects: R2ObjectHead[];
@@ -78,6 +104,7 @@ declare global {
   }
 
   interface R2PutOptions {
+    httpMetadata?: R2HttpMetadata;
     customMetadata?: Record<string, string>;
   }
 
@@ -226,16 +253,22 @@ declare global {
     scheduledTime: number;
   }
 
+  /**
+   * `env` is a global, not a parameter. `ctx` is the second argument, and its
+   * only member is `waitUntil`: work that outlives the response, drained
+   * in-process and capped at 25s.
+   */
+  interface ExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+  }
+
   /**
    * The default export.
-   *
-   * `fetch` takes only a request: `env` is a global, and there is no `ctx`, so
-   * there is no `ctx.waitUntil`. Use a queue for work that outlives a response.
    */
   interface SproutboatHandler<QueueBody = unknown> {
-    fetch(request: Request): Response | Promise<Response>;
-    scheduled?(event: ScheduledEvent): void | Promise<void>;
-    queue?(batch: MessageBatch<QueueBody>): void | Promise<void>;
+    fetch(request: Request, ctx: ExecutionContext): Response | Promise<Response>;
+    scheduled?(event: ScheduledEvent, ctx: ExecutionContext): void | Promise<void>;
+    queue?(batch: MessageBatch<QueueBody>, ctx: ExecutionContext): void | Promise<void>;
   }
 
   /**