sproutboat 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -10,6 +10,28 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.14.0] - 2026-10-04
+
+### Changed
+
+- `fetch()` reaches any public address with no configuration, and never a
+  private or reserved one: loopback, private networks, link-local and cloud
+  metadata, and their IPv6 forms. The check runs on the resolved address at
+  connect time, in deployed sprouts and standalone binaries alike. Operators can
+  allow specific addresses with `SB_EGRESS_ALLOW`
+  (baronunread/sproutboat#174).
+- Every build writes `bindings.json`, so every deployment gets a broker.
+
+### Deprecated
+
+- `outbound` in `sproutboat.jsonc` is ignored with a warning, and will be
+  refused in a later release.
+
+### Fixed
+
+- `fetch()` to an IPv6 literal such as `http://[::1]:9/` works in standalone
+  binaries; `URL.hostname` used to come back as `[`.
+
 ## [0.13.0] - 2026-10-04
 
 ### Added
@@ -782,7 +804,8 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.13.0...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.14.0...HEAD
+[0.14.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.13.0...v0.14.0
 [0.13.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.7...v0.13.0
 [0.12.7]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.6...v0.12.7
 [0.12.6]: https://github.com/baronunread/sproutboat-cli/compare/v0.12.5...v0.12.6

package/README.md

@@ -133,7 +133,6 @@ complete export. Existing output files require `--force`.
   "analytics_engine_datasets": ["METRICS"],   // bare name only, no id
   "durable_objects": { "COUNTER": "Counter" },
   "ratelimiters": [{ "binding": "API", "limit": 100, "period": 60 }], // env.API.limit({ key })
-  "outbound": ["api.example.com"],
   "triggers": { "crons": ["*/5 * * * *"] },
   "assets": { "directory": "public", "binding": "ASSETS", "run_sprout_first": ["/api/*"] }
 }

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.13.0
+**Package:** `sproutboat` 0.14.0
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -63,10 +63,10 @@
   "dependencies": {
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
-    "@sproutboat/config": "^0.4.0",
-    "@sproutboat/runtime": "^0.13.5",
+    "@sproutboat/config": "^0.5.0",
+    "@sproutboat/runtime": "^0.14.0",
     "@sproutboat/toolchain": "^0.4.24",
-    "@sproutboat/wire": "^0.9.3"
+    "@sproutboat/wire": "^0.11.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.13.0",
-    "@sproutboat/cli-darwin-x64": "0.13.0",
-    "@sproutboat/cli-linux-arm64": "0.13.0",
-    "@sproutboat/cli-linux-x64": "0.13.0"
+    "@sproutboat/cli-darwin-arm64": "0.14.0",
+    "@sproutboat/cli-darwin-x64": "0.14.0",
+    "@sproutboat/cli-linux-arm64": "0.14.0",
+    "@sproutboat/cli-linux-x64": "0.14.0"
   },
   "engines": {
     "node": ">=18"

package/src/build.ts

@@ -138,7 +138,6 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const bindings = {
     kv: refsByKind.kv.map((ref) => ref.binding),
     secrets: input.config.secrets ?? [],
-    outbound: input.config.outbound ?? [],
     d1: refsByKind.d1.map((ref) => ref.binding),
     r2: refsByKind.r2.map((ref) => ref.binding),
     queues: refsByKind.queue.map((ref) => ref.binding),
@@ -320,15 +319,10 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     await writeFile(resolve(artifactDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
     // Bindings live beside the manifest, not in it: the artifact manifest schema is
     // frozen at v2. The control plane reads this to configure the per-deployment
-    // broker (KV / D1 / R2 / queue names, secret names, outbound allowlist, cron
-    // schedules, Durable Object classes).
-    const hasBindings =
-      Object.values(bindings).some((value) => Array.isArray(value) && value.length > 0) ||
-      Object.keys(bindings.resources).length > 0 ||
-      Object.keys(bindings.vars).length > 0;
-    if (hasBindings) {
-      await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
-    } else await rm(resolve(artifactDir, "bindings.json"), { force: true });
+    // broker (KV / D1 / R2 / queue names, secret names, cron schedules, Durable
+    // Object classes). Written even when empty: its presence is what gives a
+    // deployment a broker, and fetch() needs one with no binding (#174).
+    await writeFile(resolve(artifactDir, "bindings.json"), `${JSON.stringify(bindings, null, 2)}\n`);
 
     // Static assets: copy the directory next to the artifact and record a manifest
     // the edge serves from directly (assets-first) and the broker reads for

package/src/main.ts

@@ -212,6 +212,7 @@ async function readProjectConfig(directory = process.cwd()) {
   }
   const parsed = parseConfig(configSource);
   if (!parsed.ok) fail(parsed.errors.join("\n"));
+  for (const warning of parsed.warnings) console.warn(amber(`! ${warning}`));
   return { directory: projectDirectory, config: parsed.value };
 }
 
@@ -234,7 +235,7 @@ async function readProject(directory = process.cwd()) {
   } catch (cause) {
     fail(cause instanceof BundleError ? cause.message : String(cause));
   }
-  const supported = validateHttpSyncSource(bundle.code, (project.config.outbound ?? []).length > 0);
+  const supported = validateHttpSyncSource(bundle.code);
   if (!supported.ok) fail(supported.errors.join("\n"));
   return { ...project, sourcePath, source, bundle };
 }

package/src/report.ts

@@ -66,7 +66,6 @@ function bindingRows(config: SproutboatConfig): string[][] {
     rows.push([`env.${name}`, "durable object", className]);
   for (const rl of config.ratelimiters ?? [])
     rows.push([`env.${rl.binding}`, "rate limiter", `${rl.limit} / ${rl.period}s`]);
-  for (const host of config.outbound ?? []) rows.push([`fetch()`, "outbound", host]);
   for (const cron of config.triggers?.crons ?? []) rows.push([`scheduled()`, "cron", cron]);
   if (config.assets?.binding) rows.push([`env.${config.assets.binding}`, "assets", config.assets.directory ?? ""]);
   return rows;

package/src/standalone-build.ts

@@ -29,7 +29,7 @@ export type StandaloneBuildResult = { outPath: string; bytes: number };
  * Outbound `fetch` is absent from this list: http and https both work, with
  * BearSSL and the Mozilla root set compiled in.
  */
-export function unsupportedBindings(bindings: Pick<Partial<Bindings>, "services" | "outbound">): string[] {
+export function unsupportedBindings(bindings: Pick<Partial<Bindings>, "services">): string[] {
   const reasons: string[] = [];
   if ((bindings.services ?? []).length > 0) {
     reasons.push("service bindings call another deployment through an edge, which a standalone binary has none of");