sproutboat 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -10,6 +10,64 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.21.0] - 2026-10-21
+
+### Changed
+
+- Apps compile with Porffor Alpha 19 (`@sproutboat/toolchain` 0.12.0).
+  Binaries are about 1.5% smaller, and build times are unchanged.
+- Alpha 19 brings JavaScript closer to V8, and the changes apply at every
+  compatibility date:
+  - `Error.prototype.stack` is an accessor;
+  - `instanceof` follows the spec, including `Symbol.hasInstance`;
+  - sloppy-mode functions box a primitive `this`;
+  - undeclared names are read from the global object;
+  - using a `let`, `const` or class binding before its declaration throws.
+
+### Fixed
+
+- `JSON.parse` with a reviver now gives the reviver the right `context.source`
+  when the input contains non-ASCII text.
+- `Map.groupBy` works, and private class fields no longer show up as
+  enumerable properties.
+
+## [0.20.0] - 2026-10-21
+
+### Added
+
+- Workers RPC over service bindings. A target whose default export extends
+  `WorkerEntrypoint` (from `cloudflare:workers`) exposes its methods:
+  `await env.SERVICE.add(2, 3)` runs `add(2, 3)` on it and resolves to the result.
+  - Arguments and results are copied as structured clone does (`Date`, binary data,
+    `Map`, `Set`, `undefined`, `NaN`, `-0`).
+  - An error the method throws rejects the call with the same class and message.
+  - `cloudflare:workers` also provides `DurableObject`, `RpcTarget` and `env`.
+- Compatibility date `2026-10-22` changes how `fetch()` and `env.SERVICE.fetch()`
+  behave in a deployed app:
+  - They return promises and no longer block. The app keeps serving other requests
+    while a call is in flight, concurrent calls overlap, and a deployment can call
+    itself through a binding.
+  - Responses stream: the call resolves when the headers arrive, and `response.body`
+    receives chunks as they come.
+  - Redirects are followed as Fetch does (`redirect: "manual"` and `"error"` work).
+  - A service-binding target that throws makes the caller throw the same error, and
+    the target sees the URL its caller passed.
+
+  Apps with an earlier `compatibility_date` keep getting a `Response` right away, as
+  before. Move the date to `2026-10-22` and rebuild to opt in.
+- `fetch()` and service bindings honour `init.signal`. Aborting stops the work
+  downstream too.
+
+### Fixed
+
+- Every `Set-Cookie` header of a fetched response is kept, not just the last one.
+- A fetched response without a `Content-Type` no longer gains `text/plain`.
+- `atob()` and `btoa()` were wrong for strings from `JSON.parse` or `TextDecoder`;
+  they are now correct for any string.
+- A `fetch` or service call is no longer retried once the broker may have run it.
+
+toolchain 0.11.0, runtime 0.21.1, wire 0.14.
+
 ## [0.19.0] - 2026-10-21
 
 ### Added

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.19.0
+**Package:** `sproutboat` 0.21.0
 
 ## Commands
 
@@ -76,7 +76,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/deda494+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/0c135ce+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.5.0",
-    "@sproutboat/runtime": "^0.19.2",
-    "@sproutboat/toolchain": "^0.10.2",
-    "@sproutboat/wire": "^0.13.2"
+    "@sproutboat/runtime": "^0.21.1",
+    "@sproutboat/toolchain": "^0.12.0",
+    "@sproutboat/wire": "^0.14.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.19.0",
-    "@sproutboat/cli-darwin-x64": "0.19.0",
-    "@sproutboat/cli-linux-arm64": "0.19.0",
-    "@sproutboat/cli-linux-x64": "0.19.0"
+    "@sproutboat/cli-darwin-arm64": "0.21.0",
+    "@sproutboat/cli-darwin-x64": "0.21.0",
+    "@sproutboat/cli-linux-arm64": "0.21.0",
+    "@sproutboat/cli-linux-x64": "0.21.0"
   },
   "engines": {
     "node": ">=18"

package/scripts/with-local-packages.ts

@@ -0,0 +1,193 @@
+#!/usr/bin/env bun
+/**
+ * Run a command against local `@sproutboat/{runtime,toolchain,wire}` checkouts.
+ *
+ *   bun scripts/with-local-packages.ts <path-to-sproutboat-packages> [--only runtime,toolchain,wire] -- <command...>
+ *
+ * Moves each `node_modules/@sproutboat/<pkg>` aside, symlinks
+ * `<packages>/packages/<pkg>` in its place, runs the command with inherited
+ * stdio, then puts the original entries back. The restore runs whatever the
+ * command does: a non-zero exit, a throw here, SIGINT or SIGTERM. Only SIGKILL
+ * can skip it, and the next run repairs that before it starts (the moved-aside
+ * entry is left in a known place for exactly that reason).
+ *
+ * Refuses to run in the main checkout when it has uncommitted changes. Work in
+ * progress lives there, and anything already running from it (a dev server, a
+ * watcher) would silently pick up the linked packages. Use a worktree instead.
+ */
+import { existsSync, lstatSync, readlinkSync, renameSync, rmSync, symlinkSync } from "node:fs";
+import { resolve } from "node:path";
+
+const PACKAGES = ["runtime", "toolchain", "wire"] as const;
+type Pkg = (typeof PACKAGES)[number];
+const isPkg = (value: string): value is Pkg => PACKAGES.some((pkg) => pkg === value);
+
+const USAGE =
+  "usage: bun scripts/with-local-packages.ts <path-to-sproutboat-packages> [--only runtime,toolchain,wire] -- <command...>";
+
+function fail(message: string): never {
+  console.error(`with-local-packages: ${message}`);
+  process.exit(2);
+}
+
+// ---- arguments ----------------------------------------------------------
+
+const argv = process.argv.slice(2);
+const separator = argv.indexOf("--");
+if (separator === -1) fail(`missing "--" before the command\n${USAGE}`);
+const ours = argv.slice(0, separator);
+const command = argv.slice(separator + 1);
+if (command.length === 0) fail(`no command after "--"\n${USAGE}`);
+
+let packagesRoot: string | undefined;
+let only: Pkg[] | undefined;
+for (let i = 0; i < ours.length; i++) {
+  const arg = ours[i];
+  if (arg === "--only" || arg.startsWith("--only=")) {
+    const value = arg === "--only" ? ours[++i] : arg.slice("--only=".length);
+    if (!value) fail(`--only needs a value\n${USAGE}`);
+    const names = value.split(",").map((name) => name.trim());
+    const unknown = names.filter((name) => !isPkg(name));
+    if (unknown.length) fail(`unknown package ${unknown.join(", ")} (expected ${PACKAGES.join(", ")})`);
+    only = names.filter(isPkg);
+  } else if (arg === "-h" || arg === "--help") {
+    console.log(USAGE);
+    process.exit(0);
+  } else if (arg.startsWith("-")) {
+    fail(`unknown option ${arg}\n${USAGE}`);
+  } else if (packagesRoot === undefined) {
+    packagesRoot = resolve(arg);
+  } else {
+    fail(`unexpected argument ${arg}\n${USAGE}`);
+  }
+}
+if (!packagesRoot) fail(`missing the path to a sproutboat-packages checkout\n${USAGE}`);
+if (!existsSync(resolve(packagesRoot, "packages")))
+  fail(`${packagesRoot} has no packages/ directory: is it a sproutboat-packages checkout?`);
+
+// ---- safety: never touch a dirty main checkout --------------------------
+
+const cliRoot = resolve(import.meta.dir, "..");
+function git(...args: string[]): string {
+  const result = Bun.spawnSync(["git", "-C", cliRoot, ...args], { stdout: "pipe", stderr: "pipe" });
+  if (result.exitCode !== 0) fail(`git ${args.join(" ")} failed: ${result.stderr.toString().trim()}`);
+  return result.stdout.toString().trim();
+}
+const gitDir = resolve(cliRoot, git("rev-parse", "--git-dir"));
+const commonDir = resolve(cliRoot, git("rev-parse", "--git-common-dir"));
+const linkedWorktree = gitDir !== commonDir;
+if (!linkedWorktree && git("status", "--porcelain") !== "") {
+  fail(
+    `refusing to run: ${cliRoot} is the main checkout and has uncommitted changes.\n` +
+      "Relinking its node_modules would change what that work runs against. Use a worktree:\n" +
+      `  git -C ${cliRoot} worktree add /tmp/sb-cli-local origin/main\n` +
+      "  cd /tmp/sb-cli-local && bun install --frozen-lockfile\n" +
+      `  bun scripts/with-local-packages.ts ${packagesRoot} -- <command...>`,
+  );
+}
+
+// ---- link ---------------------------------------------------------------
+
+const scope = resolve(cliRoot, "node_modules/@sproutboat");
+const entryPath = (pkg: Pkg) => resolve(scope, pkg);
+const backupPath = (pkg: Pkg) => resolve(scope, `.${pkg}.with-local-packages-backup`);
+const exists = (path: string) => {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** Put one package's original entry back. Synchronous so the exit hook can use it. */
+function restore(pkg: Pkg): void {
+  const entry = entryPath(pkg);
+  const backup = backupPath(pkg);
+  if (!exists(backup)) return;
+  if (exists(entry)) {
+    // Only ever remove our own symlink, never a real directory.
+    if (!lstatSync(entry).isSymbolicLink()) {
+      console.error(`with-local-packages: ${entry} is not a symlink, leaving ${backup} for you to inspect`);
+      return;
+    }
+    rmSync(entry);
+  }
+  renameSync(backup, entry);
+}
+
+// A run killed with SIGKILL leaves a backup behind: repair that first.
+for (const pkg of PACKAGES) {
+  if (exists(backupPath(pkg))) {
+    console.error(`with-local-packages: restoring node_modules/@sproutboat/${pkg} left over from an interrupted run`);
+    restore(pkg);
+  }
+}
+
+const requested = only ?? PACKAGES.filter((pkg) => existsSync(resolve(packagesRoot!, "packages", pkg, "package.json")));
+if (requested.length === 0) fail(`no runtime, toolchain or wire package under ${packagesRoot}/packages`);
+for (const pkg of requested) {
+  if (!existsSync(resolve(packagesRoot, "packages", pkg, "package.json")))
+    fail(`${packagesRoot}/packages/${pkg} has no package.json`);
+  if (!exists(entryPath(pkg))) fail(`node_modules/@sproutboat/${pkg} is missing: run bun install first`);
+}
+if (!existsSync(resolve(packagesRoot, "node_modules")))
+  console.error(
+    `with-local-packages: warning: ${packagesRoot} has no node_modules; ` +
+      "the linked packages resolve their own imports from there, so run bun install in it if anything fails to resolve",
+  );
+
+const linked: Pkg[] = [];
+let restored = false;
+function restoreAll(): void {
+  if (restored) return;
+  restored = true;
+  for (const pkg of linked.toReversed()) {
+    try {
+      restore(pkg);
+    } catch (error) {
+      console.error(`with-local-packages: could not restore ${pkg}: ${String(error)}`);
+      process.exitCode = 1;
+    }
+  }
+  const leftover = linked.filter((pkg) => exists(backupPath(pkg)));
+  if (leftover.length === 0) console.error(`with-local-packages: restored ${linked.join(", ")}`);
+}
+// The last line of defence: runs on any exit this process gets to see.
+process.on("exit", restoreAll);
+
+let child: ReturnType<typeof Bun.spawn> | undefined;
+let signalled: NodeJS.Signals | undefined;
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"] as const) {
+  process.on(signal, () => {
+    // A second signal means "stop now": kill the command, the restore still runs.
+    if (signalled && child) child.kill("SIGKILL");
+    signalled = signal;
+    // Ctrl-C already reached the command through the process group; SIGTERM
+    // and SIGHUP sent to this process alone are passed on.
+    if (child && signal !== "SIGINT") child.kill(signal);
+    if (!child) {
+      restoreAll();
+      process.exit(128 + (signal === "SIGINT" ? 2 : signal === "SIGTERM" ? 15 : 1));
+    }
+  });
+}
+
+try {
+  for (const pkg of requested) {
+    const target = resolve(packagesRoot, "packages", pkg);
+    renameSync(entryPath(pkg), backupPath(pkg));
+    linked.push(pkg);
+    symlinkSync(target, entryPath(pkg), "dir");
+    console.error(`with-local-packages: @sproutboat/${pkg} -> ${readlinkSync(entryPath(pkg))}`);
+  }
+
+  child = Bun.spawn(command, { cwd: process.cwd(), stdio: ["inherit", "inherit", "inherit"] });
+  const code = await child.exited;
+  restoreAll();
+  if (signalled) process.exit(128 + (signalled === "SIGINT" ? 2 : signalled === "SIGTERM" ? 15 : 1));
+  process.exit(child.signalCode ? 1 : code);
+} catch (error) {
+  restoreAll();
+  fail(error instanceof Error ? error.message : String(error));
+}

package/src/bundle.ts

@@ -79,6 +79,9 @@ export async function bundleHandler(entryPath: string, projectDir: string): Prom
       splitting: false,
       sourcemap: "none",
       plugins: [nodeShimsPlugin],
+      // WorkerEntrypoint, DurableObject, RpcTarget and env are runtime globals; the
+      // compiler turns this import into them, so it stays in the bundle as written.
+      external: ["cloudflare:workers"],
     });
   } catch (cause) {
     // An unresolvable specifier arrives as an AggregateError whose `errors`