sproutboat 0.11.5 → 0.11.7

package/CHANGELOG.md

@@ -8,7 +8,26 @@ a breaking change.
 Reconstructed from git history on 2026-09-03 for everything through v0.4.11;
 maintained going forward by the `release` skill.
 
-## [Unreleased]
+## [0.11.6] - 2026-09-15
+### Fixed
+- The 100% CPU livelock on a `fetch` handler that resolves a promise with a
+  plain object (baronunread/sproutboat#168). Root cause was
+  `__Porffor_promise_resolve`'s `.then` duck-type probe spinning forever on a
+  prototype-chain fixed point instead of terminating; patched in
+  `@sproutboat/toolchain` alongside the other local Porffor patches. Bumped
+  `@sproutboat/toolchain` to `^0.4.1` to pick it up.
+- `new Response(r2Object.body)` corrupted any binary R2 object (each byte
+  0x80-0xFF doubled on the wire): the runtime couldn't tell opaque bytes
+  apart from a Latin-1-range string, so it UTF-8-encoded them a second time
+  (baronunread/sproutboat#177). Added `R2Object.toResponse(init?)`, which
+  serves the bytes unmodified. Bumped `@sproutboat/runtime` to `^0.7.1` and
+  `@sproutboat/wire` to `^0.6.0` to pick this up, along with the R2
+  file-backed storage rework (baronunread/sproutboat#56) both depend on.
+- `sproutboat-env.d.ts`'s generated secret comment named the wrong command
+  (`secrets set`; the real one is `secrets put`), `SproutboatHandler` claimed
+  there is no `ctx`/`ctx.waitUntil` (shipped since #57/#171), and
+  `docs/standalone.md` still said a missing secret refuses the boot (0.11.1
+  changed that to throwing on first use instead).
 
 ## [0.11.5] - 2026-09-14
 ### Fixed

package/README.md

@@ -150,6 +150,10 @@ files in the project and from its own `node_modules`, and may also export
 is a global, not a parameter, and every binding call is synchronous.
 [`examples/kitchen-sink/`](examples/kitchen-sink) uses every binding.
 
+For objects larger than one request, use resumable R2 multipart uploads. The
+[large-object guide](docs/r2-large-objects.md) covers part sizing, browser
+chunking, resume state, cleanup, and the remaining download limitation.
+
 `sproutboat dev` runs against a real local broker, so bindings behave like
 production without a deploy — except `secrets`, which live only in the control
 plane. Put values in a `.dev.vars` file next to `sproutboat.jsonc`

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.5 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.7 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -74,7 +74,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/1f4ae4a+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/038f415+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.6.6",
-    "@sproutboat/toolchain": "^0.4.0",
-    "@sproutboat/wire": "^0.5.0",
+    "@sproutboat/runtime": "^0.9.3",
+    "@sproutboat/toolchain": "^0.4.5",
+    "@sproutboat/wire": "^0.7.0",
     "esbuild": "^0.28.2"
   },
   "devDependencies": {
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.5",
-    "@sproutboat/cli-darwin-x64": "0.11.5",
-    "@sproutboat/cli-linux-arm64": "0.11.5",
-    "@sproutboat/cli-linux-x64": "0.11.5"
+    "@sproutboat/cli-darwin-arm64": "0.11.7",
+    "@sproutboat/cli-darwin-x64": "0.11.7",
+    "@sproutboat/cli-linux-arm64": "0.11.7",
+    "@sproutboat/cli-linux-x64": "0.11.7"
   },
   "engines": {
     "node": ">=18"

package/src/compile.ts

@@ -209,6 +209,7 @@ export async function compileSprout(input: CompileInput): Promise<void> {
       input.compatibilityDate,
       input.appName,
       input.assets,
+      input.transport,
     ),
   );
 

package/src/dev.ts

@@ -15,7 +15,7 @@ import { mkdir, readFile, rm } from "node:fs/promises";
 import { connect } from "node:net";
 import { dirname, resolve } from "node:path";
 import { buildArtifact } from "./build";
-import { createBroker, listen, type Bindings, type Broker } from "./broker";
+import { createBroker, listen, listenTransfers, type Bindings, type Broker } from "./broker";
 import { jsonObject, parseJsonValue } from "./json";
 import { amber, dim, leaf, ok } from "./style";
 import type { SproutboatConfig } from "./config";
@@ -97,6 +97,8 @@ export type Running = {
   /** Set before a kill we initiated, so its exit code is not reported as a crash. */
   expected: boolean;
   port: number;
+  /** Private direct-transfer listener, absent in test candidates. */
+  transferPort?: number;
   enableDispatch: () => void;
   disableDispatch: () => void;
 };
@@ -142,10 +144,13 @@ async function start(input: DevInput, port: number): Promise<Running> {
       assetsDir: existsSync(assetsDir) ? assetsDir : undefined,
       dispatchEnabled: () => dispatchEnabled,
     });
-    let server: ReturnType<typeof listen>;
+    let server: ReturnType<typeof listen> | undefined;
+    let transferServer: ReturnType<typeof listenTransfers> | undefined;
     try {
       server = listen(broker, "127.0.0.1", 0);
+      transferServer = listenTransfers(broker, "127.0.0.1", 0);
     } catch (error) {
+      server?.stop();
       broker.close();
       throw error;
     }
@@ -156,14 +161,15 @@ async function start(input: DevInput, port: number): Promise<Running> {
         env: {
           ...process.env,
           PORT: String(port),
-          SB_BROKER_PORT: String(server.port),
+          SB_BROKER_PORT: String(server!.port),
           SB_BROKER_TOKEN: "sproutboat-dev",
         },
         stdout: "inherit",
         stderr: "inherit",
       });
     } catch (error) {
-      server.stop();
+      server?.stop();
+      transferServer?.stop();
       broker.close();
       throw error;
     }
@@ -173,11 +179,13 @@ async function start(input: DevInput, port: number): Promise<Running> {
       artifactDir,
       broker,
       stopBroker: () => {
-        server.stop();
+        server?.stop();
+        transferServer?.stop();
         broker.close();
       },
       expected: false,
       port,
+      transferPort: transferServer?.port,
       enableDispatch: () => {
         dispatchEnabled = true;
       },
@@ -262,6 +270,7 @@ export async function runDev(input: DevInput): Promise<void> {
   }
   running.enableDispatch();
   let activePort = running.port;
+  let activeTransferPort = running.transferPort;
   // Keep the public port stable while candidates boot on private ports. This is
   // what lets a failed startup leave the last known-good process reachable.
   let proxy: ReturnType<typeof Bun.serve>;
@@ -269,9 +278,13 @@ export async function runDev(input: DevInput): Promise<void> {
     proxy = Bun.serve({
       hostname: "127.0.0.1",
       port: input.port,
-      fetch(request) {
+      maxRequestBodySize: 5 * 1024 * 1024 * 1024,
+      fetch(request, server) {
         const target = new URL(request.url);
-        target.host = `127.0.0.1:${activePort}`;
+        const directTransfer = /^\/__sb\/r2\/transfer\/[A-Z][A-Z0-9_]*\/[0-9a-f]{24}$/.test(target.pathname);
+        if (directTransfer) server.timeout(request, 255);
+        if (directTransfer && !activeTransferPort) return new Response("direct transfers unavailable", { status: 503 });
+        target.host = `127.0.0.1:${directTransfer ? activeTransferPort : activePort}`;
         return fetch(target, {
           method: request.method,
           headers: request.headers,
@@ -373,6 +386,7 @@ export async function runDev(input: DevInput): Promise<void> {
             current = { ...current, ...next };
             const switchedAt = now();
             activePort = candidate.port;
+            activeTransferPort = candidate.transferPort;
             resetWatchers();
             stop(previous);
             watchExit(running);

package/src/types-gen.ts

@@ -34,7 +34,7 @@ function entries(config: SproutboatConfig): Entry[] {
     out.push({ name, type: "string", note: `vars: ${JSON.stringify(value)}` });
   }
   for (const name of config.secrets ?? []) {
-    out.push({ name, type: "string", note: "secret, set with `sproutboat secrets set`" });
+    out.push({ name, type: "string", note: "secret, set with `sproutboat secrets put`" });
   }
   for (const { binding } of resourceRefs(config.kv_namespaces)) out.push({ name: binding, type: "KVNamespace" });
   for (const { binding } of resourceRefs(config.d1_databases)) out.push({ name: binding, type: "D1Database" });

package/types/sproutboat.d.ts

@@ -56,20 +56,46 @@ declare global {
 
   // ---------------------------------------------------------------- R2
 
+  interface R2HttpMetadata {
+    contentType?: string;
+    contentDisposition?: string;
+    contentEncoding?: string;
+    contentLanguage?: string;
+    cacheControl?: string;
+  }
+
   interface R2Object {
     key: string;
     size: number;
     etag: string;
+    /** `etag`, quoted, ready for an `ETag` response header. */
+    httpEtag: string;
     uploaded: string;
+    httpMetadata: R2HttpMetadata;
     customMetadata?: Record<string, string>;
     /**
-     * The object as a string. An object is held whole in memory on the way in
-     * and on the way out, so keep them small.
+     * The object as a string. A get holds the object whole in memory, so keep
+     * downloads small until native download tickets are available.
+     *
+     * `new Response(obj.body, ...)` corrupts any non-ASCII/binary content: the
+     * runtime cannot tell these bytes apart from a string a handler built, so
+     * it UTF-8-encodes them a second time (baronunread/sproutboat#177). Use
+     * `obj.toResponse()` instead for binary content — it serves the bytes
+     * unmodified.
      */
     body: string;
+    text(): string;
+    json(): unknown;
+    /**
+     * A `Response` that serves `body` byte-for-byte, unlike `new
+     * Response(obj.body, ...)` (see `body` above). `init.headers`/`.status`
+     * merge in as usual; `content-type` defaults from `httpMetadata` and
+     * `etag` from `httpEtag` when not set.
+     */
+    toResponse(init?: { status?: number; headers?: HeadersInit }): Response;
   }
 
-  type R2ObjectHead = Omit<R2Object, "body">;
+  type R2ObjectHead = Omit<R2Object, "body" | "text" | "json" | "toResponse">;
 
   interface R2Objects {
     objects: R2ObjectHead[];
@@ -78,6 +104,7 @@ declare global {
   }
 
   interface R2PutOptions {
+    httpMetadata?: R2HttpMetadata;
     customMetadata?: Record<string, string>;
   }
 
@@ -87,8 +114,48 @@ declare global {
     cursor?: string;
   }
 
+  interface R2UploadedPart {
+    partNumber: number;
+    etag: string;
+  }
+
+  interface R2MultipartUpload {
+    key: string;
+    uploadId: string;
+    uploadPart(partNumber: number, value: string): R2UploadedPart;
+    complete(parts: R2UploadedPart[]): R2ObjectHead;
+    abort(): void;
+  }
+
+  interface R2TransferTicket {
+    /** Same-origin reserved path. Send the file directly to this URL. */
+    url: string;
+    expiresAt: string;
+  }
+
+  interface R2UploadTicketOptions extends R2PutOptions {
+    /** Maximum accepted body size in bytes. Default 100 MiB. */
+    maxBytes?: number;
+    /** Ticket lifetime in seconds, clamped to 30-3600. */
+    expiresIn?: number;
+    /** Optional lowercase hexadecimal SHA-256 checksum. */
+    sha256?: string;
+  }
+
+  interface R2DownloadTicketOptions {
+    expiresIn?: number;
+  }
+
   interface R2Bucket {
     put(key: string, value: string, options?: R2PutOptions): void;
+    /** Starts a resumable upload whose individual parts stay memory-bounded. */
+    createMultipartUpload(key: string, options?: R2PutOptions): R2MultipartUpload;
+    /** Reconstructs a multipart handle after storing its key and upload id. */
+    resumeMultipartUpload(key: string, uploadId: string): R2MultipartUpload;
+    /** Broker-backed direct PUT. Not available in native standalone mode yet. */
+    createUploadUrl(key: string, options?: R2UploadTicketOptions): R2TransferTicket;
+    /** Broker-backed direct GET or HEAD, including Range. */
+    createDownloadUrl(key: string, options?: R2DownloadTicketOptions): R2TransferTicket;
     get(key: string): R2Object | null;
     /** Metadata without the body. */
     head(key: string): R2ObjectHead | null;
@@ -226,16 +293,22 @@ declare global {
     scheduledTime: number;
   }
 
+  /**
+   * `env` is a global, not a parameter. `ctx` is the second argument, and its
+   * only member is `waitUntil`: work that outlives the response, drained
+   * in-process and capped at 25s.
+   */
+  interface ExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+  }
+
   /**
    * The default export.
-   *
-   * `fetch` takes only a request: `env` is a global, and there is no `ctx`, so
-   * there is no `ctx.waitUntil`. Use a queue for work that outlives a response.
    */
   interface SproutboatHandler<QueueBody = unknown> {
-    fetch(request: Request): Response | Promise<Response>;
-    scheduled?(event: ScheduledEvent): void | Promise<void>;
-    queue?(batch: MessageBatch<QueueBody>): void | Promise<void>;
+    fetch(request: Request, ctx: ExecutionContext): Response | Promise<Response>;
+    scheduled?(event: ScheduledEvent, ctx: ExecutionContext): void | Promise<void>;
+    queue?(batch: MessageBatch<QueueBody>, ctx: ExecutionContext): void | Promise<void>;
   }
 
   /**