sproutboat 0.11.6 → 0.11.7

package/README.md

@@ -150,6 +150,10 @@ files in the project and from its own `node_modules`, and may also export
 is a global, not a parameter, and every binding call is synchronous.
 [`examples/kitchen-sink/`](examples/kitchen-sink) uses every binding.
 
+For objects larger than one request, use resumable R2 multipart uploads. The
+[large-object guide](docs/r2-large-objects.md) covers part sizing, browser
+chunking, resume state, cleanup, and the remaining download limitation.
+
 `sproutboat dev` runs against a real local broker, so bindings behave like
 production without a deploy — except `secrets`, which live only in the control
 plane. Put values in a `.dev.vars` file next to `sproutboat.jsonc`

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.6 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.7 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -74,7 +74,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/1f4ae4a+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/038f415+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.7.1",
-    "@sproutboat/toolchain": "^0.4.1",
-    "@sproutboat/wire": "^0.6.0",
+    "@sproutboat/runtime": "^0.9.3",
+    "@sproutboat/toolchain": "^0.4.5",
+    "@sproutboat/wire": "^0.7.0",
     "esbuild": "^0.28.2"
   },
   "devDependencies": {
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.6",
-    "@sproutboat/cli-darwin-x64": "0.11.6",
-    "@sproutboat/cli-linux-arm64": "0.11.6",
-    "@sproutboat/cli-linux-x64": "0.11.6"
+    "@sproutboat/cli-darwin-arm64": "0.11.7",
+    "@sproutboat/cli-darwin-x64": "0.11.7",
+    "@sproutboat/cli-linux-arm64": "0.11.7",
+    "@sproutboat/cli-linux-x64": "0.11.7"
   },
   "engines": {
     "node": ">=18"

package/src/compile.ts

@@ -209,6 +209,7 @@ export async function compileSprout(input: CompileInput): Promise<void> {
       input.compatibilityDate,
       input.appName,
       input.assets,
+      input.transport,
     ),
   );
 

package/src/dev.ts

@@ -15,7 +15,7 @@ import { mkdir, readFile, rm } from "node:fs/promises";
 import { connect } from "node:net";
 import { dirname, resolve } from "node:path";
 import { buildArtifact } from "./build";
-import { createBroker, listen, type Bindings, type Broker } from "./broker";
+import { createBroker, listen, listenTransfers, type Bindings, type Broker } from "./broker";
 import { jsonObject, parseJsonValue } from "./json";
 import { amber, dim, leaf, ok } from "./style";
 import type { SproutboatConfig } from "./config";
@@ -97,6 +97,8 @@ export type Running = {
   /** Set before a kill we initiated, so its exit code is not reported as a crash. */
   expected: boolean;
   port: number;
+  /** Private direct-transfer listener, absent in test candidates. */
+  transferPort?: number;
   enableDispatch: () => void;
   disableDispatch: () => void;
 };
@@ -142,10 +144,13 @@ async function start(input: DevInput, port: number): Promise<Running> {
       assetsDir: existsSync(assetsDir) ? assetsDir : undefined,
       dispatchEnabled: () => dispatchEnabled,
     });
-    let server: ReturnType<typeof listen>;
+    let server: ReturnType<typeof listen> | undefined;
+    let transferServer: ReturnType<typeof listenTransfers> | undefined;
     try {
       server = listen(broker, "127.0.0.1", 0);
+      transferServer = listenTransfers(broker, "127.0.0.1", 0);
     } catch (error) {
+      server?.stop();
       broker.close();
       throw error;
     }
@@ -156,14 +161,15 @@ async function start(input: DevInput, port: number): Promise<Running> {
         env: {
           ...process.env,
           PORT: String(port),
-          SB_BROKER_PORT: String(server.port),
+          SB_BROKER_PORT: String(server!.port),
           SB_BROKER_TOKEN: "sproutboat-dev",
         },
         stdout: "inherit",
         stderr: "inherit",
       });
     } catch (error) {
-      server.stop();
+      server?.stop();
+      transferServer?.stop();
       broker.close();
       throw error;
     }
@@ -173,11 +179,13 @@ async function start(input: DevInput, port: number): Promise<Running> {
       artifactDir,
       broker,
       stopBroker: () => {
-        server.stop();
+        server?.stop();
+        transferServer?.stop();
         broker.close();
       },
       expected: false,
       port,
+      transferPort: transferServer?.port,
       enableDispatch: () => {
         dispatchEnabled = true;
       },
@@ -262,6 +270,7 @@ export async function runDev(input: DevInput): Promise<void> {
   }
   running.enableDispatch();
   let activePort = running.port;
+  let activeTransferPort = running.transferPort;
   // Keep the public port stable while candidates boot on private ports. This is
   // what lets a failed startup leave the last known-good process reachable.
   let proxy: ReturnType<typeof Bun.serve>;
@@ -269,9 +278,13 @@ export async function runDev(input: DevInput): Promise<void> {
     proxy = Bun.serve({
       hostname: "127.0.0.1",
       port: input.port,
-      fetch(request) {
+      maxRequestBodySize: 5 * 1024 * 1024 * 1024,
+      fetch(request, server) {
         const target = new URL(request.url);
-        target.host = `127.0.0.1:${activePort}`;
+        const directTransfer = /^\/__sb\/r2\/transfer\/[A-Z][A-Z0-9_]*\/[0-9a-f]{24}$/.test(target.pathname);
+        if (directTransfer) server.timeout(request, 255);
+        if (directTransfer && !activeTransferPort) return new Response("direct transfers unavailable", { status: 503 });
+        target.host = `127.0.0.1:${directTransfer ? activeTransferPort : activePort}`;
         return fetch(target, {
           method: request.method,
           headers: request.headers,
@@ -373,6 +386,7 @@ export async function runDev(input: DevInput): Promise<void> {
             current = { ...current, ...next };
             const switchedAt = now();
             activePort = candidate.port;
+            activeTransferPort = candidate.transferPort;
             resetWatchers();
             stop(previous);
             watchExit(running);

package/types/sproutboat.d.ts

@@ -74,8 +74,8 @@ declare global {
     httpMetadata: R2HttpMetadata;
     customMetadata?: Record<string, string>;
     /**
-     * The object as a string. An object is held whole in memory on the way in
-     * and on the way out, so keep them small.
+     * The object as a string. A get holds the object whole in memory, so keep
+     * downloads small until native download tickets are available.
      *
      * `new Response(obj.body, ...)` corrupts any non-ASCII/binary content: the
      * runtime cannot tell these bytes apart from a string a handler built, so
@@ -114,8 +114,48 @@ declare global {
     cursor?: string;
   }
 
+  interface R2UploadedPart {
+    partNumber: number;
+    etag: string;
+  }
+
+  interface R2MultipartUpload {
+    key: string;
+    uploadId: string;
+    uploadPart(partNumber: number, value: string): R2UploadedPart;
+    complete(parts: R2UploadedPart[]): R2ObjectHead;
+    abort(): void;
+  }
+
+  interface R2TransferTicket {
+    /** Same-origin reserved path. Send the file directly to this URL. */
+    url: string;
+    expiresAt: string;
+  }
+
+  interface R2UploadTicketOptions extends R2PutOptions {
+    /** Maximum accepted body size in bytes. Default 100 MiB. */
+    maxBytes?: number;
+    /** Ticket lifetime in seconds, clamped to 30-3600. */
+    expiresIn?: number;
+    /** Optional lowercase hexadecimal SHA-256 checksum. */
+    sha256?: string;
+  }
+
+  interface R2DownloadTicketOptions {
+    expiresIn?: number;
+  }
+
   interface R2Bucket {
     put(key: string, value: string, options?: R2PutOptions): void;
+    /** Starts a resumable upload whose individual parts stay memory-bounded. */
+    createMultipartUpload(key: string, options?: R2PutOptions): R2MultipartUpload;
+    /** Reconstructs a multipart handle after storing its key and upload id. */
+    resumeMultipartUpload(key: string, uploadId: string): R2MultipartUpload;
+    /** Broker-backed direct PUT. Not available in native standalone mode yet. */
+    createUploadUrl(key: string, options?: R2UploadTicketOptions): R2TransferTicket;
+    /** Broker-backed direct GET or HEAD, including Range. */
+    createDownloadUrl(key: string, options?: R2DownloadTicketOptions): R2TransferTicket;
     get(key: string): R2Object | null;
     /** Metadata without the body. */
     head(key: string): R2ObjectHead | null;