sproutboat 0.12.7 → 0.14.0

package/CHANGELOG.md

@@ -10,6 +10,37 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.14.0] - 2026-10-04
+
+### Changed
+
+- `fetch()` reaches any public address with no configuration, and never a
+  private or reserved one: loopback, private networks, link-local and cloud
+  metadata, and their IPv6 forms. The check runs on the resolved address at
+  connect time, in deployed sprouts and standalone binaries alike. Operators can
+  allow specific addresses with `SB_EGRESS_ALLOW`
+  (baronunread/sproutboat#174).
+- Every build writes `bindings.json`, so every deployment gets a broker.
+
+### Deprecated
+
+- `outbound` in `sproutboat.jsonc` is ignored with a warning, and will be
+  refused in a later release.
+
+### Fixed
+
+- `fetch()` to an IPv6 literal such as `http://[::1]:9/` works in standalone
+  binaries; `URL.hostname` used to come back as `[`.
+
+## [0.13.0] - 2026-10-04
+
+### Added
+
+- `sproutboat build` reads `_headers` and `_redirects` (Cloudflare Pages
+  format) from the assets directory and writes the rules into `assets.json`.
+  The deployed edge applies them: redirects before any file lookup, header
+  rules on edge-served files (baronunread/sproutboat#61).
+
 ## [0.12.7] - 2026-10-03
 
 ### Fixed
@@ -773,7 +804,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.7...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.14.0...HEAD
+[0.14.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.13.0...v0.14.0
+[0.13.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.7...v0.13.0
 [0.12.7]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.6...v0.12.7
 [0.12.6]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.5...v0.12.6
 [0.12.5]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.4...v0.12.5

package/README.md

@@ -133,7 +133,6 @@ complete export. Existing output files require `--force`.
   "analytics_engine_datasets": ["METRICS"],   // bare name only, no id
   "durable_objects": { "COUNTER": "Counter" },
   "ratelimiters": [{ "binding": "API", "limit": 100, "period": 60 }], // env.API.limit({ key })
-  "outbound": ["api.example.com"],
   "triggers": { "crons": ["*/5 * * * *"] },
   "assets": { "directory": "public", "binding": "ASSETS", "run_sprout_first": ["/api/*"] }
 }

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.12.7
+**Package:** `sproutboat` 0.14.0
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.12.7",
+  "version": "0.14.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -63,10 +63,10 @@
   "dependencies": {
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
-    "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.13.5",
+    "@sproutboat/config": "^0.5.0",
+    "@sproutboat/runtime": "^0.14.0",
     "@sproutboat/toolchain": "^0.4.24",
-    "@sproutboat/wire": "^0.9.3"
+    "@sproutboat/wire": "^0.11.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.12.7",
-    "@sproutboat/cli-darwin-x64": "0.12.7",
-    "@sproutboat/cli-linux-arm64": "0.12.7",
-    "@sproutboat/cli-linux-x64": "0.12.7"
+    "@sproutboat/cli-darwin-arm64": "0.14.0",
+    "@sproutboat/cli-darwin-x64": "0.14.0",
+    "@sproutboat/cli-linux-arm64": "0.14.0",
+    "@sproutboat/cli-linux-x64": "0.14.0"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
-import { walkAssets, type AssetManifest } from "./assets";
+import { readAssetRules, walkAssets, type AssetManifest } from "./assets";
 import { resourceRefs, type SproutboatConfig } from "./config";
 import { ensureSqliteObject } from "./sqlite";
 import { sqliteStamp } from "./sqlite";
@@ -138,7 +138,6 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const bindings = {
     kv: refsByKind.kv.map((ref) => ref.binding),
     secrets: input.config.secrets ?? [],
-    outbound: input.config.outbound ?? [],
     d1: refsByKind.d1.map((ref) => ref.binding),
     r2: refsByKind.r2.map((ref) => ref.binding),
     queues: refsByKind.queue.map((ref) => ref.binding),
@@ -166,14 +165,18 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   ) {
     throw new Error(`assets.directory "${input.config.assets?.directory}" not found — run your site build first`);
   }
-  const assetManifest: AssetManifest | undefined =
-    assetDir && input.config.assets
-      ? {
-          notFound: input.config.assets.not_found_handling ?? "none",
-          runSproutFirst: input.config.assets.run_sprout_first ?? false,
-          files: walkAssets(assetDir),
-        }
-      : undefined;
+  let assetManifest: AssetManifest | undefined;
+  if (assetDir && input.config.assets) {
+    assetManifest = {
+      notFound: input.config.assets.not_found_handling ?? "none",
+      runSproutFirst: input.config.assets.run_sprout_first ?? false,
+      files: walkAssets(assetDir),
+    };
+    // #61 — `_headers`/`_redirects` ride along for the edge to apply.
+    const rules = readAssetRules(assetDir);
+    if (rules.headers.length) assetManifest.headers = rules.headers;
+    if (rules.redirects.length) assetManifest.redirects = rules.redirects;
+  }
   // #15 — an embedded binary has no files beside it, so assets are baked into
   // the module. Read them from the source directory: the artifact copy happens
   // after the compile, and the compile is what needs them. Bytes travel as a
@@ -316,15 +319,10 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     await writeFile(resolve(artifactDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
     // Bindings live beside the manifest, not in it: the artifact manifest schema is
     // frozen at v2. The control plane reads this to configure the per-deployment
-    // broker (KV / D1 / R2 / queue names, secret names, outbound allowlist, cron
-    // schedules, Durable Object classes).
-    const hasBindings =
-      Object.values(bindings).some((value) => Array.isArray(value) && value.length > 0) ||
-      Object.keys(bindings.resources).length > 0 ||
-      Object.keys(bindings.vars).length > 0;
-    if (hasBindings) {
-      await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
-    } else await rm(resolve(artifactDir, "bindings.json"), { force: true });
+    // broker (KV / D1 / R2 / queue names, secret names, cron schedules, Durable
+    // Object classes). Written even when empty: its presence is what gives a
+    // deployment a broker, and fetch() needs one with no binding (#174).
+    await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
 
     // Static assets: copy the directory next to the artifact and record a manifest
     // the edge serves from directly (assets-first) and the broker reads for

package/src/main.ts

@@ -212,6 +212,7 @@ async function readProjectConfig(directory = process.cwd()) {
   }
   const parsed = parseConfig(configSource);
   if (!parsed.ok) fail(parsed.errors.join("\n"));
+  for (const warning of parsed.warnings) console.warn(amber(`! ${warning}`));
   return { directory: projectDirectory, config: parsed.value };
 }
 
@@ -234,7 +235,7 @@ async function readProject(directory = process.cwd()) {
   } catch (cause) {
     fail(cause instanceof BundleError ? cause.message : String(cause));
   }
-  const supported = validateHttpSyncSource(bundle.code, (project.config.outbound ?? []).length > 0);
+  const supported = validateHttpSyncSource(bundle.code);
   if (!supported.ok) fail(supported.errors.join("\n"));
   return { ...project, sourcePath, source, bundle };
 }

package/src/report.ts

@@ -66,7 +66,6 @@ function bindingRows(config: SproutboatConfig): string[][] {
     rows.push([`env.${name}`, "durable object", className]);
   for (const rl of config.ratelimiters ?? [])
     rows.push([`env.${rl.binding}`, "rate limiter", `${rl.limit} / ${rl.period}s`]);
-  for (const host of config.outbound ?? []) rows.push([`fetch()`, "outbound", host]);
   for (const cron of config.triggers?.crons ?? []) rows.push([`scheduled()`, "cron", cron]);
   if (config.assets?.binding) rows.push([`env.${config.assets.binding}`, "assets", config.assets.directory ?? ""]);
   return rows;

package/src/standalone-build.ts

@@ -29,7 +29,7 @@ export type StandaloneBuildResult = { outPath: string; bytes: number };
  * Outbound `fetch` is absent from this list: http and https both work, with
  * BearSSL and the Mozilla root set compiled in.
  */
-export function unsupportedBindings(bindings: Pick<Partial<Bindings>, "services" | "outbound">): string[] {
+export function unsupportedBindings(bindings: Pick<Partial<Bindings>, "services">): string[] {
   const reasons: string[] = [];
   if ((bindings.services ?? []).length > 0) {
     reasons.push("service bindings call another deployment through an edge, which a standalone binary has none of");