sproutboat 0.2.1 → 0.4.0

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.2.1 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.4.0 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -11,16 +11,18 @@
 | --- | --- | --- |
 | `init` | `[name]` | Scaffold sproutboat.jsonc + src/index.js in ./<name>. |
 | `check` | `[project-dir]` | Validate the config and entry point without building. |
-| `build` | `[project-dir]` | Cross-compile the native-fetch worker (Porffor + Zig). |
+| `build` | `[project-dir]` | Cross-compile the native-fetch sprout (Porffor + Zig). |
 | `deploy` | `[project-dir] [--dry-run] [--artifact <dir>]` | Build (unless --artifact), print the report, upload. --dry-run stops before upload. |
 | `login` | `[--api-url <url>] [--token <token>]` | Device-code browser flow, or store <token> for <url> directly. |
 | `tail` | `[project-dir]` | Print the project's recent request logs. |
 | `versions` | `list [project-dir]` | List the project's deployed versions. |
 | `rollback` | `<version-id> [project-dir]` | Re-activate a previous version. |
+| `domains` | `[list | add <host> | verify <host> | rm <host>] [project-dir]` | Attach a custom domain to the project (TXT-verified). No sub-command lists. |
+| `secrets` | `[list | set <NAME> [value] | rm <NAME>] [project-dir]` | Manage encrypted project secrets (read as env.NAME). `set` takes the value from the arg or stdin; applies on next deploy. |
 | `delete` | `--yes [project-dir]` | Delete the project and every version. |
 
 ```
-usage: sproutboat <init [name] | check [project-dir] | build [project-dir] | deploy [project-dir] [--dry-run] [--artifact <dir>] | login [--api-url <url>] [--token <token>] | tail [project-dir] | versions list [project-dir] | rollback <version-id> [project-dir] | delete --yes [project-dir]>
+usage: sproutboat <init [name] | check [project-dir] | build [project-dir] | deploy [project-dir] [--dry-run] [--artifact <dir>] | login [--api-url <url>] [--token <token>] | tail [project-dir] | versions list [project-dir] | rollback <version-id> [project-dir] | domains [list | add <host> | verify <host> | rm <host>] [project-dir] | secrets [list | set <NAME> [value] | rm <NAME>] [project-dir] | delete --yes [project-dir]>
 ```
 
 ## Environment variables
@@ -32,12 +34,14 @@ usage: sproutboat <init [name] | check [project-dir] | build [project-dir] | dep
 | `SPROUTBOAT_ZIG` | Path to a Zig binary to use instead of downloading the pinned one. |
 | `SPROUTBOAT_UWS_TARBALL` | Path to a prebuilt uWebSockets (x86_64-linux-musl) tarball to seed the Porffor cache with, instead of downloading it (removes the first-build git + make need). |
 | `SPROUTBOAT_COMPILE_TIMEOUT_MS` | Porffor compile timeout in ms (default 600000). |
+| `SPROUTBOAT_VARS_JSON` | JSON object of baked `vars` (UPPER_SNAKE -> string), read by the wrapper when generating the sprout module. |
+| `SPROUTBOAT_BINDINGS_JSON` | The artifact's bindings.json, read by the wrapper to emit the `__sbInstallBindings` line. |
 | `SPROUTBOAT_CONFIG_DIR` | Directory for credentials.json (default ~/.config/sproutboat). |
 | `XDG_CONFIG_HOME` | Base for the default credentials dir when SPROUTBOAT_CONFIG_DIR is unset. |
 | `PORFFOR_VERSION` | Override the Porffor identity string recorded in the manifest. |
-| `SB_BROKER_PORT` | Loopback port of the binding broker, read by the compiled worker at runtime (set by the control plane, or by `src/broker.ts` for local runs). |
-| `SB_BROKER_TOKEN` | Per-deployment auth token the worker sends on every broker frame, and the broker sends back on scheduled/queue triggers (paired with SB_BROKER_PORT). |
-| `SB_WORKER_URL` | http://127.0.0.1:<PORT> of the worker; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it. |
+| `SB_BROKER_PORT` | Loopback port of the binding broker, read by the compiled sprout at runtime (set by the control plane, or by `src/broker.ts` for local runs). |
+| `SB_BROKER_TOKEN` | Per-deployment auth token the sprout sends on every broker frame, and the broker sends back on scheduled/queue triggers (paired with SB_BROKER_PORT). |
+| `SB_SPROUT_URL` | http://127.0.0.1:<PORT> of the sprout; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it. |
 
 ## Build toolchain (pinned)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "license": "MIT",
   "type": "module",
@@ -22,6 +22,16 @@
   "bin": {
     "sproutboat": "src/main.ts"
   },
+  "exports": {
+    "./runtime/config": "./src/config.ts",
+    "./runtime/source": "./src/source.ts",
+    "./runtime/manifest": "./src/manifest.ts",
+    "./runtime/assets": "./src/assets.ts",
+    "./runtime/broker": "./src/broker.ts",
+    "./runtime/wrap": "./src/wrap.ts",
+    "./runtime/prelude": "./src/native-fetch-prelude.js",
+    "./package.json": "./package.json"
+  },
   "files": [
     "src",
     "!src/*.test.ts",

package/src/assets.ts

@@ -3,7 +3,7 @@
  * directory next to the artifact and writes `assets.json` (this manifest); the
  * edge serves matching files directly (assets-first, like Cloudflare), and the
  * broker's `assets.get` op backs `env.<ASSETS>.fetch(request)` for the paths
- * the worker chooses to serve itself.
+ * the sprout chooses to serve itself.
  */
 import { createHash } from "node:crypto";
 import { readdirSync, readFileSync } from "node:fs";
@@ -36,6 +36,30 @@ export function contentType(name: string): string {
   return (dot >= 0 ? TYPES.get(name.slice(dot + 1).toLowerCase()) : undefined) ?? "application/octet-stream";
 }
 
+/**
+ * Resolve a request path to a manifest key the way a static host does:
+ *   - an exact hit wins;
+ *   - a directory path (`/docs/`) tries `/docs/index.html`;
+ *   - an extensionless path (`/docs`) tries `/docs.html`, then `/docs/index.html`.
+ * Returns the matched key, or `null`. This only picks which file to serve — no
+ * canonical redirects, and the caller still owns not-found handling. Mirrors
+ * Cloudflare's `html_handling: "auto-trailing-slash"` minus the 3xx responses.
+ */
+export function resolveAssetKey(path: string, has: (key: string) => boolean): string | null {
+  if (!path.startsWith("/")) path = `/${path}`;
+  if (path.endsWith("/")) {
+    const index = `${path}index.html`;
+    return has(index) ? index : null;
+  }
+  if (has(path)) return path;
+  const base = path.slice(path.lastIndexOf("/") + 1);
+  if (!base.includes(".")) {
+    if (has(`${path}.html`)) return `${path}.html`;
+    if (has(`${path}/index.html`)) return `${path}/index.html`;
+  }
+  return null;
+}
+
 /** Walk `dir` recursively, returning `{ "/path": {hash,size,type} }`. */
 export function walkAssets(dir: string) {
   const out: AssetFiles = {};

package/src/broker.ts

@@ -2,11 +2,11 @@
 /**
  * Per-deployment binding broker.
  *
- * A native-fetch worker has no syscalls of its own beyond an inbound HTTP
+ * A native-fetch sprout has no syscalls of its own beyond an inbound HTTP
  * server; the prelude's inline-C transport opens a loopback TCP connection to
  * this process for every `env.<KV>` / `env.<SECRET>` / `fetch()` call. The
  * supervisor starts one broker per deployment, on its own loopback port, and
- * passes `SB_BROKER_PORT` + `SB_BROKER_TOKEN` to the worker next to `$PORT`.
+ * passes `SB_BROKER_PORT` + `SB_BROKER_TOKEN` to the sprout next to `$PORT`.
  *
  * Wire frame (both directions): [u32 LE length][payload].
  *   request payload : "<token>\n<json>"
@@ -22,7 +22,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join, normalize, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import type { AssetManifest } from "./assets";
+import { resolveAssetKey, type AssetManifest } from "./assets";
 
 export type Bindings = {
   kv: string[];
@@ -47,11 +47,11 @@ export type BrokerOptions = {
   bindings?: Partial<Bindings>;
   secrets?: Record<string, string>;
   /**
-   * `http://127.0.0.1:<PORT>` of this deployment's worker. When set, the broker
-   * runs the cron scheduler and the queue consumer, delivering to the worker
+   * `http://127.0.0.1:<PORT>` of this deployment's sprout. When set, the broker
+   * runs the cron scheduler and the queue consumer, delivering to the sprout
    * with an `x-sb-trigger` header authenticated by `token`.
    */
-  workerUrl?: string;
+  sproutUrl?: string;
   /** Directory of published static assets (its sibling `assets.json` is the manifest). Backs `assets.get`. */
   assetsDir?: string;
   /** Injected in tests; defaults to the global `fetch`. */
@@ -109,6 +109,11 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
 
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
+  // WAL + NORMAL is the standard pairing: a write no longer fsyncs the WAL, so
+  // host power loss can drop the last few committed txns, but a process crash
+  // never can and the file never corrupts. Right trade for a single-VPS
+  // KV/queue/DO store; on real block storage this is ~10-100x on writes.
+  db.exec("PRAGMA synchronous = NORMAL");
   db.exec("CREATE TABLE IF NOT EXISTS kv (ns TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (ns, key))");
   db.exec(
     "CREATE TABLE IF NOT EXISTS r2 (bucket TEXT NOT NULL, key TEXT NOT NULL, body TEXT NOT NULL, size INTEGER NOT NULL, " +
@@ -158,6 +163,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       if (d1Dir) mkdirSync(d1Dir, { recursive: true });
       conn = new Database(d1Dir ? join(d1Dir, `${name}.sqlite`) : ":memory:", { create: true });
       conn.exec("PRAGMA journal_mode = WAL");
+      conn.exec("PRAGMA synchronous = NORMAL");
       d1Conns.set(name, conn);
     }
     return conn;
@@ -290,9 +296,9 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         const prefix = str(msg.prefix);
         const cursor = str(msg.cursor);
         const limit = Math.min(Math.max(Number(msg.limit) || 1000, 1), 1000);
-        const rows = db.query<R2Row, [string, string, string]>(
-          "SELECT * FROM r2 WHERE bucket = ? AND key LIKE ? || '%' AND key > ? ORDER BY key LIMIT " + (limit + 1),
-        ).all(bucket, prefix, cursor);
+        const rows = db.query<R2Row, [string, string, string, number]>(
+          "SELECT * FROM r2 WHERE bucket = ? AND key LIKE ? || '%' AND key > ? ORDER BY key LIMIT ?",
+        ).all(bucket, prefix, cursor, limit + 1);
         const truncated = rows.length > limit;
         const page = truncated ? rows.slice(0, limit) : rows;
         return {
@@ -335,9 +341,9 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         // query it via the SQL API). Exposed here so a dashboard can read back.
         const ds = requireAe(msg.dataset);
         const limit = Math.min(Math.max(Number(msg.limit) || 20, 1), 200);
-        const rows = db.query<{ ts: number; indexes_json: string; blobs_json: string; doubles_json: string }, [string]>(
-          "SELECT ts, indexes_json, blobs_json, doubles_json FROM ae WHERE dataset = ? ORDER BY ts DESC, rowid DESC LIMIT " + limit,
-        ).all(ds);
+        const rows = db.query<{ ts: number; indexes_json: string; blobs_json: string; doubles_json: string }, [string, number]>(
+          "SELECT ts, indexes_json, blobs_json, doubles_json FROM ae WHERE dataset = ? ORDER BY ts DESC, rowid DESC LIMIT ?",
+        ).all(ds, limit);
         const total = db.query<{ n: number }, [string]>("SELECT count(*) AS n FROM ae WHERE dataset = ?").get(ds);
         return {
           ok: true,
@@ -376,18 +382,17 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       case "do.storage.list": {
         const cls = requireDoClass(msg.cls);
         const limit = Math.min(Math.max(Number(msg.limit) || 1000, 1), 10000);
-        const rows = db.query<{ key: string; value: string }, [string, string, string]>(
-          "SELECT key, value FROM do_storage WHERE cls = ? AND id = ? AND key LIKE ? || '%' ORDER BY key LIMIT " + limit,
-        ).all(cls, str(msg.id), str(msg.prefix));
+        const rows = db.query<{ key: string; value: string }, [string, string, string, number]>(
+          "SELECT key, value FROM do_storage WHERE cls = ? AND id = ? AND key LIKE ? || '%' ORDER BY key LIMIT ?",
+        ).all(cls, str(msg.id), str(msg.prefix), limit);
         return { ok: true, entries: rows.map((r) => [r.key, r.value]) };
       }
 
       case "assets.get": {
         if (!bindings.assets) throw new Error("assets not bound");
-        let path = str(msg.path) || "/";
-        if (!path.startsWith("/")) path = `/${path}`;
-        if (path.endsWith("/")) path += "index.html";
-        const hit = readAsset(path);
+        const reqPath = str(msg.path) || "/";
+        const key = resolveAssetKey(reqPath, (k) => !!assetManifest?.files[k]);
+        const hit = key ? readAsset(key) : null;
         if (hit) return { ok: true, found: true, status: 200, type: hit.type, hash: hit.hash, body: hit.body };
         const nfh = assetManifest?.notFound ?? "none";
         if (nfh === "single-page-application") {
@@ -418,15 +423,15 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     }
   }
 
-  // --- cron + queue delivery (only when this broker knows its worker) --------
+  // --- cron + queue delivery (only when this broker knows its sprout) --------
   const timers: ReturnType<typeof setInterval>[] = [];
   const QUEUE_BATCH = 10;
   const QUEUE_MAX_ATTEMPTS = 5;
 
   async function deliverTrigger(kind: "scheduled" | "queue", body: unknown): Promise<Response | null> {
-    if (!opts.workerUrl) return null;
+    if (!opts.sproutUrl) return null;
     try {
-      return await doFetch(opts.workerUrl, {
+      return await doFetch(opts.sproutUrl, {
         method: "POST",
         headers: { "x-sb-trigger": kind, "x-sb-token": token, "content-type": "application/json" },
         body: JSON.stringify(body),
@@ -437,7 +442,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   }
 
   function drainQueuesOnce(): void {
-    if (!opts.workerUrl || bindings.queues.length === 0) return;
+    if (!opts.sproutUrl || bindings.queues.length === 0) return;
     const now = Date.now();
     for (const q of bindings.queues) {
       const rows = db.query<{ id: string; body: string; attempts: number }, [string, number, number]>(
@@ -453,7 +458,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         queue: q,
         messages: rows.map((r) => ({ id: r.id, body: r.body, timestamp: now, attempts: r.attempts + 1 })),
       }).then(async (res) => {
-        let ack: string[] = rows.map((r) => r.id); // default: ack all if the worker didn't say
+        let ack: string[] = rows.map((r) => r.id); // default: ack all if the sprout did not say
         let retry: string[] = [];
         if (res && res.ok) {
           try {
@@ -474,7 +479,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     }
   }
 
-  if (opts.workerUrl) {
+  if (opts.sproutUrl) {
     if (bindings.queues.length > 0) timers.push(setInterval(drainQueuesOnce, 500));
     if (bindings.crons.length > 0) {
       let lastTick = "";
@@ -569,7 +574,7 @@ if (import.meta.main) {
       "data-dir": { type: "string" },
       bindings: { type: "string" },
       secrets: { type: "string" },
-      "worker-url": { type: "string" },
+      "sprout-url": { type: "string" },
       "assets-dir": { type: "string" },
     },
   });
@@ -585,9 +590,9 @@ if (import.meta.main) {
     token: values.token ?? process.env.SB_BROKER_TOKEN,
     bindings,
     secrets,
-    workerUrl: values["worker-url"] ?? process.env.SB_WORKER_URL,
+    sproutUrl: values["sprout-url"] ?? process.env.SB_SPROUT_URL,
     assetsDir: values["assets-dir"],
   });
   const { port } = listen(broker, "127.0.0.1", Number(values.port ?? process.env.SB_BROKER_PORT ?? 0));
-  console.log(`sproutboat broker: 127.0.0.1:${port} db=${values.db ?? ":memory:"} worker=${values["worker-url"] ?? process.env.SB_WORKER_URL ?? "(none)"}`);
+  console.log(`sproutboat broker: 127.0.0.1:${port} db=${values.db ?? ":memory:"} sprout=${values["sprout-url"] ?? process.env.SB_SPROUT_URL ?? "(none)"}`);
 }

package/src/build.ts

@@ -3,7 +3,7 @@ import { cp, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { walkAssets, type AssetManifest } from "./assets";
 import type { SproutboatConfig } from "./config";
-import { compileWorker } from "./compile";
+import { compileSprout } from "./compile";
 import { ARTIFACT_SCHEMA_VERSION, CAPABILITY_PROFILE, RUNTIME, type ArtifactManifest } from "./manifest";
 import { ensureZig, esbuildVersion, porfforVersion, toolchainStamp } from "./toolchain";
 
@@ -33,7 +33,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const sourceHash = digest(source);
   const artifactId = sourceHash.slice("sha256:".length, 24);
   const artifactDir = resolve(input.projectDir, ".sproutboat/dist", artifactId);
-  const workerPath = resolve(artifactDir, "worker");
+  const sproutPath = resolve(artifactDir, "sprout");
   await mkdir(artifactDir, { recursive: true });
 
   const bindings = {
@@ -50,15 +50,15 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   };
 
   const zigBin = await ensureZig();
-  await compileWorker({
+  await compileSprout({
     sourcePath: input.sourcePath,
-    outPath: workerPath,
+    outPath: sproutPath,
     vars: input.config.vars ?? {},
     bindings,
     zigBin,
   });
 
-  const worker = await readFile(workerPath);
+  const sprout = await readFile(sproutPath);
   const manifest: ArtifactManifest = {
     schemaVersion: ARTIFACT_SCHEMA_VERSION,
     project: input.config.name,
@@ -69,8 +69,8 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     esbuildVersion: esbuildVersion(),
     buildImage: toolchainStamp(),
     sourceHash,
-    binaryHash: digest(worker),
-    binarySize: (await stat(workerPath)).size,
+    binaryHash: digest(sprout),
+    binarySize: (await stat(sproutPath)).size,
     builtAt: new Date().toISOString(),
   };
   await writeFile(resolve(artifactDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);

package/src/compile.ts

@@ -13,81 +13,11 @@ import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { ensurePorfforPatched } from "./patch-porffor";
 import { ensureUWebSockets, porfforRoot, UwsUnavailableError } from "./toolchain";
+import { EMPTY_BINDINGS, preludePath, wrapNativeFetchHandler, type Bindings } from "./wrap";
 
-const preludePath = new URL("./native-fetch-prelude.js", import.meta.url);
-// The server honours $PORT at runtime (patches/porffor-render.patch); this baked
-// value is only a fallback for a directly-run binary.
-const DEFAULT_PORT = 8080;
-const COMPILE_TIMEOUT_MS = Number(process.env.SPROUTBOAT_COMPILE_TIMEOUT_MS || 600_000);
-
-/**
- * Binding names a project declares. `do` maps a binding name to a Durable Object
- * class name; `crons` are schedule expressions with no name.
- */
-export type Bindings = {
-  kv: string[];
-  secrets: string[];
-  outbound: string[];
-  d1: string[];
-  r2: string[];
-  queues: string[];
-  analytics: string[];
-  do: Array<{ binding: string; className: string }>;
-  crons: string[];
-  /** Static-asset binding name for `env.<NAME>.fetch(request)`; `""` when assets are edge-only. */
-  assets: string;
-};
-
-const EMPTY_BINDINGS: Bindings = { kv: [], secrets: [], outbound: [], d1: [], r2: [], queues: [], analytics: [], do: [], crons: [], assets: "" };
-
-function hasBindings(b: Bindings): boolean {
-  return (
-    b.kv.length > 0 || b.secrets.length > 0 || b.outbound.length > 0 || b.d1.length > 0 || b.r2.length > 0 ||
-    b.queues.length > 0 || b.analytics.length > 0 || b.do.length > 0 || b.assets !== ""
-  );
-}
+export { EMPTY_BINDINGS, preludePath, wrapNativeFetchHandler, type Bindings } from "./wrap";
 
-/**
- * Build the final native-fetch module: the prelude (Web API shims + the broker
- * binding shim + the trigger dispatcher), then `const env = {…}` with the baked
- * `vars`, then — if any binding is declared — one `__sbInstallBindings(env, …)`
- * line, then the user's source with its `export` keywords neutralised (so its
- * `export default {…}` becomes a plain object we can hand to the dispatcher),
- * then our single `export default { fetch }` that routes every request through
- * `__sbEntry` (HTTP → `handlers.fetch`; `x-sb-trigger` → scheduled / queue / DO).
- *
- * With no bindings and no `scheduled`/`queue`/DO the output behaves exactly like
- * a plain `export default { fetch }` worker.
- */
-export function wrapNativeFetchHandler(
-  source: string,
-  prelude: string,
-  vars: Record<string, string> = {},
-  bindings: Bindings = EMPTY_BINDINGS,
-): string {
-  if (!/\bexport\s+default\s*\{/.test(source) || !/\bfetch\s*\(/.test(source)) {
-    throw new Error("handler must default-export an object with a fetch(request) method");
-  }
-  // Neutralise the module's exports: its default object becomes `__sbHandlers`,
-  // and any `export class`/`function`/`const` (Durable Object classes, helpers)
-  // becomes a plain top-level declaration. Imports are already rejected upstream.
-  const neutralised = source
-    .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
-    .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
-
-  const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
-  const wire = hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "";
-  const registerDO = bindings.do.length
-    ? `__sbRegisterDO({ ${bindings.do.map((d) => `${d.className}: ${d.className}`).join(", ")} });\n`
-    : "";
-
-  return (
-    `${prelude}\n${env}${wire}` +
-    `${neutralised}\n` +
-    `${registerDO}` +
-    `export default {\n  port: ${DEFAULT_PORT},\n  fetch(request) { return __sbEntry(__sbHandlers, request); }\n};\n`
-  );
-}
+const COMPILE_TIMEOUT_MS = Number(process.env.SPROUTBOAT_COMPILE_TIMEOUT_MS || 600_000);
 
 export type CompileInput = {
   sourcePath: string;
@@ -98,7 +28,7 @@ export type CompileInput = {
 };
 
 /** Compile `sourcePath` to a native binary at `outPath` (mode 0555). */
-export async function compileWorker(input: CompileInput): Promise<void> {
+export async function compileSprout(input: CompileInput): Promise<void> {
   await ensurePorfforPatched();
 
   // Seed the Porffor uWebSockets cache from the prebuilt archive in `vendor/` so
@@ -124,7 +54,7 @@ export async function compileWorker(input: CompileInput): Promise<void> {
 
   const outDir = dirname(input.outPath);
   await mkdir(outDir, { recursive: true });
-  const generatedPath = resolve(outDir, "worker.generated.js");
+  const generatedPath = resolve(outDir, "sprout.generated.js");
   const [source, prelude] = await Promise.all([readFile(input.sourcePath, "utf8"), readFile(preludePath, "utf8")]);
   await writeFile(generatedPath, wrapNativeFetchHandler(source, prelude, input.vars, input.bindings ?? EMPTY_BINDINGS));
 
@@ -134,8 +64,11 @@ export async function compileWorker(input: CompileInput): Promise<void> {
   const binDir = resolve(porffor, "../.bin");
   const path = `${dirname(input.zigBin)}:${binDir}:${process.env.PATH ?? ""}`;
 
+  // `-s`: strip at link. The unstripped static-musl binary is ~90% DWARF that
+  // nothing needs at runtime (12 MB -> ~1.3 MB for the kitchen-sink). Porffor
+  // forwards `-s` straight to the `zig cc` link step.
   const child = Bun.spawn(
-    [process.execPath, launcher, "native", generatedPath, "-o", input.outPath, "--musl"],
+    [process.execPath, launcher, "native", generatedPath, "-o", input.outPath, "--musl", "-s"],
     { cwd: outDir, stdout: "pipe", stderr: "pipe", env: { ...process.env, PATH: path } },
   );
   let timedOut = false;

package/src/config.ts

@@ -10,7 +10,7 @@ export type SproutboatConfig = {
   kv_namespaces?: string[];
   /** Secret binding names, exposed as `env.<NAME>` (value fetched at use). */
   secrets?: string[];
-  /** Hostnames the worker's `fetch()` may reach (exact host match). */
+  /** Hostnames the sprout's `fetch()` may reach (exact host match). */
   outbound?: string[];
   /** D1 (SQLite) database binding names, exposed as `env.<NAME>`. */
   d1_databases?: string[];
@@ -35,7 +35,7 @@ export type AssetsConfig = {
   binding?: string;
   /** What to serve when a request matches no file (applied by the broker on `env.<BINDING>.fetch`). */
   not_found_handling?: "none" | "single-page-application" | "404-page";
-  /** `true` = run the worker before serving any asset; string[] = selective route patterns (`!` negates). */
+  /** `true` = run the sprout before serving any asset; string[] = selective route patterns (`!` negates). */
   run_sprout_first?: boolean | string[];
 };
 

package/src/main.ts

@@ -70,6 +70,16 @@ function parseUrlResponse(source: string): { url: string } | undefined {
   return record && isString(record.url) ? { url: record.url } : undefined;
 }
 
+/** #55: `{ from, to }` when this deploy moves the live version onto a different
+ *  Porffor pin. Deployed artifacts are frozen at their build-time compiler, so
+ *  the pin only changes by redeploying — and the alpha compiler's output can
+ *  differ between pins. */
+function parsePorfforDrift(source: string): { from: string; to: string } | undefined {
+  const drift = (() => { try { return jsonObject(parseJsonValue(source))?.porfforDrift; } catch { return undefined; } })();
+  const record = drift && jsonObject(drift as JsonValue);
+  return record && isString(record.from) && isString(record.to) ? { from: record.from, to: record.to } : undefined;
+}
+
 function parseAuthorization(source: string): CliAuthorization | undefined {
   const record = jsonObject(parseJsonValue(source));
   if (!record || !isString(record.deviceCode) || !isString(record.userCode) || !isString(record.verificationUri) || !isSafeInteger(record.interval) || !isString(record.expiresAt)) return undefined;
@@ -166,8 +176,8 @@ async function deploy(args: string[]) {
     config = built.project.config;
   }
   const manifest = Bun.file(resolve(artifactDir, "manifest.json"));
-  const worker = Bun.file(resolve(artifactDir, "worker"));
-  if (!(await manifest.exists()) || !(await worker.exists())) fail("artifact must contain manifest.json and worker");
+  const sprout = Bun.file(resolve(artifactDir, "sprout"));
+  if (!(await manifest.exists()) || !(await sprout.exists())) fail("artifact must contain manifest.json and sprout");
   const manifestValidation = validateManifest(await manifest.json());
   if (!manifestValidation.ok) fail(`invalid artifact manifest: ${manifestValidation.errors.join(", ")}`);
   const artifactManifest: ArtifactManifest = manifestValidation.value;
@@ -176,7 +186,7 @@ async function deploy(args: string[]) {
   printDeployReport(
     config ?? { name: projectName, main: "", compatibility_date: "(prebuilt artifact)" },
     artifactManifest,
-    new Uint8Array(await worker.arrayBuffer()),
+    new Uint8Array(await sprout.arrayBuffer()),
     manifest.size,
   );
   if (dryRun) {
@@ -198,7 +208,26 @@ async function deploy(args: string[]) {
   }
   const form = new FormData();
   form.set("manifest", new File([await manifest.arrayBuffer()], "manifest.json", { type: "application/json" }));
-  form.set("worker", new File([await worker.arrayBuffer()], "worker", { type: "application/octet-stream" }));
+  form.set("sprout", new File([await sprout.arrayBuffer()], "sprout", { type: "application/octet-stream" }));
+
+  // #1 — ship the sidecars `sproutboat build` produced so the server can start
+  // the binding broker and serve static assets. Without bindings.json the broker
+  // never spawns and every KV/D1/R2/secret/queue/cron/DO call is dead on the box.
+  const bindingsFile = Bun.file(resolve(artifactDir, "bindings.json"));
+  if (await bindingsFile.exists()) {
+    form.set("bindings", new File([await bindingsFile.arrayBuffer()], "bindings.json", { type: "application/json" }));
+  }
+  const assetsManifestFile = Bun.file(resolve(artifactDir, "assets.json"));
+  if (await assetsManifestFile.exists()) {
+    const assetsManifest: { files?: Record<string, unknown> } = await assetsManifestFile.json();
+    form.set("assets_manifest", new File([await assetsManifestFile.arrayBuffer()], "assets.json", { type: "application/json" }));
+    for (const key of Object.keys(assetsManifest.files ?? {})) {
+      const file = Bun.file(resolve(artifactDir, "assets", `.${key}`));
+      if (!(await file.exists())) fail(`assets.json lists ${key} but assets${key} is missing — rebuild`);
+      form.append("asset", new File([await file.arrayBuffer()], key));
+    }
+  }
+
   const response = await fetch(`${apiUrl.replace(/\/$/, "")}/api/projects/${projectName}/deployments`, {
     method: "POST",
     headers: { "x-api-key": token },
@@ -209,6 +238,12 @@ async function deploy(args: string[]) {
   if (!deployed) fail("deployment response did not include a URL");
   console.log(`\nDeployed ${projectName}`);
   console.log(`  ${deployed.url}`);
+  const drift = parsePorfforDrift(body);
+  if (drift) {
+    console.warn(`\n! Porffor pin changed: ${drift.from} -> ${drift.to}`);
+    console.warn(`  The previous live version stays frozen at ${drift.from}; this one is built with ${drift.to}.`);
+    console.warn(`  The alpha compiler's output can differ between pins (see COMPAT.md) — roll back if this version misbehaves.`);
+  }
 }
 
 function parseLoginArgs(args: string[]) {
@@ -294,6 +329,89 @@ async function tail(args: string[]) {
   process.stdout.write(await responseText(response, "could not read logs"));
 }
 
+type DomainView = { hostname: string; verified: boolean; verification: { type: string; name: string; value: string } | null };
+function parseDomain(source: string): DomainView | undefined {
+  const record = jsonObject(parseJsonValue(source));
+  if (!record || !isString(record.hostname) || typeof record.verified !== "boolean") return undefined;
+  const v = jsonObject(record.verification ?? null);
+  const verification = v && isString(v.type) && isString(v.name) && isString(v.value) ? { type: v.type, name: v.name, value: v.value } : null;
+  return { hostname: record.hostname, verified: record.verified, verification };
+}
+function printDomain(domain: DomainView) {
+  const status = domain.verified ? "verified" : "unverified";
+  console.log(`${status.padEnd(10)} ${domain.hostname}`);
+  if (domain.verification) {
+    console.log(`  add this DNS record, then run: sproutboat domains verify ${domain.hostname}`);
+    console.log(`  ${domain.verification.type}  ${domain.verification.name}  "${domain.verification.value}"`);
+  }
+}
+
+async function domains(args: string[]) {
+  const sub = args[0] && !args[0].startsWith("-") && ["list", "add", "verify", "rm"].includes(args[0]) ? args.shift()! : "list";
+  const host = sub === "list" ? undefined : args.shift();
+  if (sub !== "list" && !host) fail(`usage: sproutboat domains ${sub} <hostname> [project-dir]`);
+  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+  const base = `${apiUrl}/api/projects/${project.config.name}/domains`;
+  const auth = { "x-api-key": token };
+
+  if (sub === "list") {
+    const response = await fetch(base, { headers: auth });
+    const body = await responseText(response, "could not list domains");
+    const list = parseJsonValue(body);
+    if (!Array.isArray(list)) fail("could not parse domains response");
+    if (list.length === 0) { console.log("no custom domains"); return; }
+    for (const entry of list) { const d = parseDomain(JSON.stringify(entry)); if (d) printDomain(d); }
+    return;
+  }
+  if (sub === "rm") {
+    const response = await fetch(`${base}/${host}`, { method: "DELETE", headers: auth });
+    await responseText(response, "delete rejected");
+    console.log(`Removed ${host}`);
+    return;
+  }
+  const url = sub === "add" ? base : `${base}/${host}/verify`;
+  const init = sub === "add"
+    ? { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ hostname: host }) }
+    : { method: "POST", headers: auth };
+  const response = await fetch(url, init);
+  const domain = parseDomain(await responseText(response, `${sub} rejected`));
+  if (!domain) fail(`${sub} response was not a domain record`);
+  printDomain(domain);
+}
+
+async function secrets(args: string[]) {
+  const sub = args[0] && ["list", "set", "rm"].includes(args[0]) ? args.shift()! : "list";
+  const name = sub === "list" ? undefined : args.shift();
+  if (sub !== "list" && !name) fail(`usage: sproutboat secrets ${sub} <NAME> [project-dir]`);
+  if (name && !/^[A-Z][A-Z0-9_]*$/.test(name)) fail("secret name must be UPPER_SNAKE_CASE");
+  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+  const base = `${apiUrl}/api/projects/${project.config.name}/secrets`;
+  const auth = { "x-api-key": token };
+
+  if (sub === "list") {
+    const body = await responseText(await fetch(base, { headers: auth }), "could not list secrets");
+    const parsed = jsonObject(parseJsonValue(body));
+    const names = parsed && Array.isArray(parsed.names) ? parsed.names.filter(isString) : [];
+    console.log(names.length ? names.join("\n") : "no secrets");
+    return;
+  }
+  if (sub === "rm") {
+    await responseText(await fetch(`${base}/${name}`, { method: "DELETE", headers: auth }), "delete rejected");
+    console.log(`Removed ${name}`);
+    return;
+  }
+  // set: value from the next arg, else stdin (keeps it out of shell history).
+  const value = args[1] && !args[1].startsWith("-") && args[1] !== project.directory
+    ? args[1]
+    : (await Bun.stdin.text()).replace(/\r?\n$/, "");
+  if (!value) fail("no value — pass it as an argument or pipe it on stdin");
+  await responseText(
+    await fetch(`${base}/${name}`, { method: "PUT", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ value }) }),
+    "set rejected",
+  );
+  console.log(`Set ${name} — applies on the next deploy or sprout restart`);
+}
+
 async function deleteProject(args: string[]) {
   if (args[0] !== "--yes") fail("refusing to delete without --yes");
   const [project, { apiUrl, token }] = await Promise.all([readProject(args[1]), apiCredentials()]);
@@ -316,6 +434,8 @@ switch (command) {
   case "deploy": await deploy(args); break;
   case "versions": await versions(args); break;
   case "rollback": await rollback(args); break;
+  case "domains": await domains(args); break;
+  case "secrets": await secrets(args); break;
   case "tail": await tail(args); break;
   case "delete": await deleteProject(args); break;
   default: usage();

package/src/native-fetch-prelude.js

@@ -11,6 +11,64 @@
 // Declared before it is referenced: a getter body that names a later top-level
 // class throws ReferenceError in Porffor (see patches/UPSTREAM.md draft B).
 
+// #41 — cold-start phase marker. Runs as the first thing in the bundle: writes
+// the current wall-clock ms to $SB_STARTUP_FILE so the supervisor can split
+// cold-start into "spawn -> JS starts" (process + runtime bootstrap) and
+// "JS starts -> listening" (module eval + server bind). No-op when unset.
+function __sbStartupMark() {
+  Porffor.c`
+    const char* __f = getenv("SB_STARTUP_FILE");
+    if (__f) {
+      struct timespec __ts;
+      clock_gettime(CLOCK_REALTIME, &__ts);
+      double __ms = (double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0;
+      char __buf[32];
+      int __n = snprintf(__buf, sizeof(__buf), "%.0f", __ms);
+      int __fd = open(__f, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      if (__fd >= 0) { write(__fd, __buf, (size_t)__n); close(__fd); }
+    }
+  `;
+}
+__sbStartupMark();
+
+// #28 — process CPU time in ms (CLOCK_PROCESS_CPUTIME_ID). Marshalled back as a
+// string via the same primitives as __sbEnv / __sbRandomBytes (proven working),
+// then parsed — Porffor's number boxing for a bare inline-C assignment is not
+// relied on. `__sbEntry` samples it around the handler for per-invocation CPU.
+function __sbCpuMs() {
+  let res = '';
+  Porffor.c`
+    struct timespec __ts;
+    clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
+    double __ms = (double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0;
+    char __b[32];
+    int __n = snprintf(__b, sizeof(__b), "%.3f", __ms);
+    if (__n > 0) res = porf_box((f64)porf_native_fetch_alloc_bytestring(__b, (size_t)__n), 195);
+  `;
+  return res === '' ? 0 : parseFloat(res);
+}
+
+// #28 — stamp `x-sb-cpu-ms` onto a handler Response. Porffor alpha-4's
+// native-fetch serializer only reads headers from the plain object passed to
+// `new Response(body, { headers })` — a later `.set()` or a `Headers` instance
+// is ignored on the wire — so the metric is carried by rebuilding the Response
+// with one extra header. Safe only for a string body (the norm under
+// http-sync-v0) with no Set-Cookie to comma-fold; anything else is returned
+// untouched and the edge simply omits cpuMs for that request.
+function __sbTagCpu(res, t0) {
+  const cpu = __sbCpuMs() - t0;
+  try {
+    const body = res && res.body;
+    if (typeof body === 'string' && !res.headers.has('set-cookie')) {
+      const headers = {};
+      res.headers.forEach(function (value, name) { headers[name] = value; });
+      headers['x-sb-cpu-ms'] = (cpu >= 0 ? cpu : 0).toFixed(3);
+      return new Response(body, { status: res.status, headers: headers });
+    }
+  } catch (e) { /* fall through to the original response */ }
+  return res;
+}
+
 class __SproutboatURLSearchParams {
   constructor(init) {
     this._keys = [];
@@ -118,13 +176,21 @@ __sbDefineURLAccessor('username', function () { return ''; });
 __sbDefineURLAccessor('password', function () { return ''; });
 
 // crypto.randomUUID / getRandomValues are absent in native-fetch. Provide them
-// so Worker code (request ids, cache keys, idempotency keys) runs.
-// ponytail: Math.random() is NOT cryptographically strong. Swap for a real
-// CSPRNG the moment Porffor exposes one — do not use these for tokens/secrets.
+// backed by the OS CSPRNG (`__sbRandomBytes` -> inline C -> /dev/urandom), so
+// tokens, idempotency keys and UUIDs are unpredictable. Deliberately no insecure
+// fallback — a silent downgrade to a weak source is worse than throwing.
 if (globalThis.crypto == null) globalThis.crypto = {};
 if (globalThis.crypto.getRandomValues == null) {
   globalThis.crypto.getRandomValues = function (view) {
-    for (let i = 0; i < view.length; i++) view[i] = Math.floor(Math.random() * 256);
+    const n = view.length >>> 0;
+    // WebCrypto caps a single call at 65536 bytes.
+    if (n > 65536) throw new RangeError("crypto.getRandomValues: byte length exceeds 65536");
+    if (n === 0) return view;
+    // One CSPRNG byte per element. Correct for Uint8Array (and randomUUID); a
+    // wider view gets its low byte filled, matching the previous polyfill's shape.
+    const bytes = __sbRandomBytes(String(n));
+    if (bytes.length !== n) throw new Error("crypto.getRandomValues: OS entropy source unavailable");
+    for (let i = 0; i < n; i++) view[i] = bytes.charCodeAt(i) & 0xff;
     return view;
   };
 }
@@ -151,62 +217,103 @@ if (globalThis.crypto.randomUUID == null) {
 
 // ---------------------------------------------------------------------------
 // Bindings: env.<KV>, env.<SECRET>, env.<D1>, env.<R2>, and globalThis.fetch,
-// backed by a Bun broker on a loopback TCP port. The transport is inline C — blocking
-// socket/connect/write/read per call (http-sync-v0: one worker event-loop turn
-// per request, so a blocking roundtrip is acceptable). Wire frame:
+// backed by a Bun broker on a loopback TCP port. The transport is inline C —
+// blocking write/read per call over ONE long-lived connection (http-sync-v0: one
+// sprout event-loop turn per request, so a blocking roundtrip is acceptable).
+// Wire frame:
 //   [u32 LE len][ <token> "\n" <json> ]   reply: [u32 LE len][ <json> ]
 // SB_BROKER_PORT / SB_BROKER_TOKEN are set by the supervisor next to $PORT.
 // If SB_BROKER_PORT is unset the shims below are never installed (compile.ts
 // only emits the __sbInstallBindings call when the project declares bindings),
-// so a plain worker is byte-for-byte unchanged.
-// ponytail: blocking IO, fresh connection per call, text values only. Connection
-// pooling + binary values + non-blocking = v2.
+// so a plain sprout is byte-for-byte unchanged.
+// ponytail: text values only; still AF_INET loopback, not AF_UNIX. A failed
+// exchange reconnects and resends once — a broker crash between "request applied"
+// and "reply read" can double-apply a non-idempotent op (queue.send, INSERT);
+// the old fresh-connection-per-call path just failed the call there instead.
+// Binary values + AF_UNIX = v2.
 
 Porffor.c`
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <signal.h>
 #include <unistd.h>
 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <time.h>
 
 u32 porf_native_fetch_alloc_bytestring(const char* input, size_t len);
 int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_len, char** out_owned);
 
+// Fill buf with n bytes from the OS CSPRNG. /dev/urandom is present on Linux and
+// macOS and inside the bubblewrap sandbox; blocking is not a concern after the
+// pool is seeded. Returns 0, or -1 if the source could not be read in full.
+static int sb_os_random(unsigned char* buf, size_t n) {
+  int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
+  if (fd < 0) return -1;
+  size_t off = 0;
+  while (off < n) {
+    long r = read(fd, buf + off, n - off);
+    if (r <= 0) {
+      if (r < 0 && errno == EINTR) continue;
+      close(fd);
+      return -1;
+    }
+    off += (size_t)r;
+  }
+  close(fd);
+  return 0;
+}
+
 static int sb_io_all(int fd, unsigned char* buf, size_t len, int writing) {
   size_t done = 0;
   while (done < len) {
     long n = writing ? write(fd, buf + done, len - done) : read(fd, buf + done, len - done);
-    if (n <= 0) return -1;
+    if (n <= 0) {
+      if (n < 0 && errno == EINTR) continue;
+      return -1;
+    }
     done += (size_t)n;
   }
   return 0;
 }
 
-static int sb_broker_roundtrip(const char* req, size_t req_len, char** resp_out, size_t* resp_len_out) {
-  *resp_out = NULL;
-  *resp_len_out = 0;
+// One long-lived loopback connection to the broker, reused across every binding
+// call. The broker frames each request/reply independently and keeps the socket
+// open, so the steady-state per-call cost is just write + read — no socket(),
+// connect() handshake or close() each time. -1 = not connected.
+static int sb_broker_fd = -1;
 
+static int sb_broker_connect(void) {
   const char* port_s = getenv("SB_BROKER_PORT");
   if (!port_s) return -10;
-  int port = atoi(port_s);
-  const char* tok = getenv("SB_BROKER_TOKEN");
-  size_t tok_len = tok ? strlen(tok) : 0;
-
+  signal(SIGPIPE, SIG_IGN); // a dead broker must yield EPIPE, not kill the sprout
   int fd = socket(AF_INET, SOCK_STREAM, 0);
   if (fd < 0) return -1;
-
+  int one = 1;
+  setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
   struct sockaddr_in addr;
   memset(&addr, 0, sizeof(addr));
   addr.sin_family = AF_INET;
-  addr.sin_port = htons((unsigned short)port);
+  addr.sin_port = htons((unsigned short)atoi(port_s));
   addr.sin_addr.s_addr = htonl(0x7f000001u); // 127.0.0.1
   if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) != 0) { close(fd); return -2; }
+  sb_broker_fd = fd;
+  return 0;
+}
+
+// Send one framed request, read one framed reply, on the persistent fd.
+static int sb_broker_exchange(const char* req, size_t req_len, char** resp_out, size_t* resp_len_out) {
+  const char* tok = getenv("SB_BROKER_TOKEN");
+  size_t tok_len = tok ? strlen(tok) : 0;
 
   // frame body: token "\n" json
   size_t body_len = tok_len + 1 + req_len;
   unsigned char* frame = (unsigned char*)malloc(4 + body_len);
-  if (!frame) { close(fd); return -5; }
+  if (!frame) return -5;
   frame[0] = (unsigned char)(body_len & 0xff);
   frame[1] = (unsigned char)((body_len >> 8) & 0xff);
   frame[2] = (unsigned char)((body_len >> 16) & 0xff);
@@ -214,23 +321,40 @@ static int sb_broker_roundtrip(const char* req, size_t req_len, char** resp_out,
   if (tok_len) memcpy(frame + 4, tok, tok_len);
   frame[4 + tok_len] = '\n';
   if (req_len) memcpy(frame + 4 + tok_len + 1, req, req_len);
-  int wr = sb_io_all(fd, frame, 4 + body_len, 1);
+  int wr = sb_io_all(sb_broker_fd, frame, 4 + body_len, 1);
   free(frame);
-  if (wr != 0) { close(fd); return -3; }
+  if (wr != 0) return -3;
 
   unsigned char rhdr[4];
-  if (sb_io_all(fd, rhdr, 4, 0) != 0) { close(fd); return -4; }
+  if (sb_io_all(sb_broker_fd, rhdr, 4, 0) != 0) return -4;
   size_t rlen = (size_t)rhdr[0] | ((size_t)rhdr[1] << 8) | ((size_t)rhdr[2] << 16) | ((size_t)rhdr[3] << 24);
 
   char* buf = (char*)malloc(rlen ? rlen : 1);
-  if (!buf) { close(fd); return -5; }
-  if (rlen && sb_io_all(fd, (unsigned char*)buf, rlen, 0) != 0) { free(buf); close(fd); return -6; }
-  close(fd);
+  if (!buf) return -5;
+  if (rlen && sb_io_all(sb_broker_fd, (unsigned char*)buf, rlen, 0) != 0) { free(buf); return -6; }
 
   *resp_out = buf;
   *resp_len_out = rlen;
   return 0;
 }
+
+static int sb_broker_roundtrip(const char* req, size_t req_len, char** resp_out, size_t* resp_len_out) {
+  *resp_out = NULL;
+  *resp_len_out = 0;
+  // Two tries: a broker restart (or an idle-closed socket) invalidates the fd,
+  // so a failed exchange drops the connection and reconnects once before failing.
+  for (int attempt = 0; attempt < 2; attempt++) {
+    if (sb_broker_fd < 0) {
+      int rc = sb_broker_connect();
+      if (rc != 0) return rc;
+    }
+    int rc = sb_broker_exchange(req, req_len, resp_out, resp_len_out);
+    if (rc == 0) return 0;
+    close(sb_broker_fd);
+    sb_broker_fd = -1;
+  }
+  return -3;
+}
 `;
 
 // One request string in, one reply string out. `reqJson` is a parameter, so the
@@ -255,6 +379,30 @@ function __sbCall(reqJson) {
   return res;
 }
 
+// `nStr` is the decimal byte count as a string (same string-param pattern as
+// __sbEnv). Returns a bytestring of that many CSPRNG bytes, or '' on failure.
+function __sbRandomBytes(nStr) {
+  let out = '';
+  Porffor.c`
+    const char* __ns; size_t __nsl; char* __nso = 0;
+    porf_native_fetch_read_value(nStr, &__ns, &__nsl, &__nso);
+    char __nb[16];
+    size_t __k = __nsl < 15 ? __nsl : 15;
+    memcpy(__nb, __ns, __k); __nb[__k] = 0;
+    if (__nso) free(__nso);
+    long __n = atol(__nb);
+    if (__n > 0 && __n <= 65536) {
+      unsigned char* __b = (unsigned char*)malloc((size_t)__n);
+      if (__b) {
+        if (sb_os_random(__b, (size_t)__n) == 0)
+          out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__b, (size_t)__n), 195);
+        free(__b);
+      }
+    }
+  `;
+  return out;
+}
+
 function __sbRpc(op, extra) {
   const req = { op };
   if (extra) for (const k in extra) req[k] = extra[k];
@@ -312,7 +460,7 @@ function __sbMakeD1(dbName) {
 }
 
 // R2: a Cloudflare-shaped object. When `body` is present the sync accessors
-// mirror R2ObjectBody's async ones (a worker may `await` them harmlessly).
+// mirror R2ObjectBody's async ones (a sprout may `await` them harmlessly).
 function __sbR2Object(meta, body) {
   const obj = {
     key: meta.key,
@@ -359,9 +507,17 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   for (let i = 0; i < (bindings.secrets || []).length; i++) {
     const name = bindings.secrets[i];
+    // Fetch lazily, then freeze as a data property: a secret is process-lifetime
+    // immutable (a new value means a redeploy = a new process), so one broker
+    // round-trip on first read, zero after. A getter that RPCs on every access
+    // turns `'Bearer ' + env.KEY` in a loop into a syscall storm.
     Object.defineProperty(target, name, {
       configurable: true,
-      get() { return __sbRpc('secret.get', { name }).value; },
+      get() {
+        const value = __sbRpc('secret.get', { name }).value;
+        Object.defineProperty(target, name, { value, configurable: true, enumerable: true });
+        return value;
+      },
     });
   }
 
@@ -454,7 +610,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
   }
 
   // Static assets: env.<ASSETS>.fetch(request) -> broker `assets.get`. The edge
-  // already serves matching files directly; the worker only calls this for paths
+  // already serves matching files directly; the sprout only calls this for paths
   // it wants to own (SPA fallback, auth-gated files). Text assets only — binary
   // files go through the edge (the broker frame is UTF-8 JSON).
   if (bindings.assets) {
@@ -494,13 +650,13 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 };
 
 // ---------------------------------------------------------------------------
-// Durable Objects. The class runs here in the sandboxed worker. There is exactly
-// one worker process per deployment (the supervisor model) and the native-fetch
+// Durable Objects. The class runs here in the sandboxed sprout. There is exactly
+// one sprout process per deployment (the supervisor model) and the native-fetch
 // runtime processes one turn at a time, so calls to a given object id are
 // already serialized — `env.<NS>.get(id).fetch()` invokes the instance directly,
 // no round-trip. Only `state.storage.*` goes to the broker (so object state
-// outlives a worker restart), scoped to (class, id).
-// ponytail: serialization relies on the single worker process; a multi-worker
+// outlives a sprout restart), scoped to (class, id).
+// ponytail: serialization relies on the single sprout process; a multi-sprout
 // deployment needs the broker to hold a per-id lock (cloud). Storage ops are one
 // key at a time; blockConcurrencyWhile just runs the fn.
 
@@ -509,8 +665,7 @@ function __sbMakeDONamespace(binding, className) {
     idFromName(name) { return { toString() { return 'name:' + String(name); }, name: String(name) }; },
     idFromString(hex) { return { toString() { return String(hex); } }; },
     newUniqueId() {
-      const id = (globalThis.crypto && crypto.randomUUID ? crypto.randomUUID() : String(Math.random()).slice(2));
-      return { toString() { return 'uid:' + id; } };
+      return { toString() { return 'uid:' + crypto.randomUUID(); } };
     },
     get(id) {
       const idStr = typeof id === 'string' ? id : id.toString();
@@ -630,7 +785,19 @@ function __sbTriggerAuthed(request) {
 
 globalThis.__sbEntry = function (handlers, request) {
   const trigger = request.headers.get('x-sb-trigger');
-  if (!trigger) return handlers.fetch(request);
+  if (!trigger) {
+    // #28 — per-invocation CPU time. One fetch turn per process (serial), so the
+    // process CPU delta across the handler is this invocation's CPU. Covers both
+    // sync handlers and async ones (via `.then`); the delta spans the whole turn.
+    // ponytail: serial-turn assumption; revisit if the profile ever allows
+    // concurrent in-process requests.
+    const __t0 = __sbCpuMs();
+    const __res = handlers.fetch(request);
+    if (__res && typeof __res.then === 'function') {
+      return __res.then(function (resolved) { return __sbTagCpu(resolved, __t0); });
+    }
+    return __sbTagCpu(__res, __t0);
+  }
   if (!__sbTriggerAuthed(request)) return new Response('forbidden', { status: 403 });
 
   if (trigger === 'scheduled') {

package/src/report.ts

@@ -27,11 +27,11 @@ function table(headers: string[], rows: string[][], align: boolean[] = []): stri
 export function printDeployReport(
   config: SproutboatConfig,
   manifest: ArtifactManifest,
-  worker: Uint8Array,
+  sprout: Uint8Array,
   manifestBytes: number,
 ): void {
-  const gz = gzipSync(Uint8Array.from(worker)).length;
-  const total = worker.length + manifestBytes;
+  const gz = gzipSync(Uint8Array.from(sprout)).length;
+  const total = sprout.length + manifestBytes;
 
   console.log(`\n🌱 sproutboat ${CLI_VERSION}`);
   console.log("─".repeat(19));
@@ -44,12 +44,12 @@ export function printDeployReport(
   console.log(table(
     ["File", "Type", "Size"],
     [
-      ["worker", manifest.runtime, bytes(worker.length)],
+      ["sprout", manifest.runtime, bytes(sprout.length)],
       ["manifest.json", "json", bytes(manifestBytes)],
     ],
     [false, false, true],
   ));
-  console.log(`Total upload: ${bytes(total)}  (worker gzip: ${bytes(gz)})`);
+  console.log(`Total upload: ${bytes(total)}  (sprout gzip: ${bytes(gz)})`);
   console.log();
 
   const vars = Object.entries(config.vars ?? {});

package/src/surface.ts

@@ -10,12 +10,14 @@ export type Command = { name: string; args: string; summary: string };
 export const COMMANDS: readonly Command[] = [
   { name: "init", args: "[name]", summary: "Scaffold sproutboat.jsonc + src/index.js in ./<name>." },
   { name: "check", args: "[project-dir]", summary: "Validate the config and entry point without building." },
-  { name: "build", args: "[project-dir]", summary: "Cross-compile the native-fetch worker (Porffor + Zig)." },
+  { name: "build", args: "[project-dir]", summary: "Cross-compile the native-fetch sprout (Porffor + Zig)." },
   { name: "deploy", args: "[project-dir] [--dry-run] [--artifact <dir>]", summary: "Build (unless --artifact), print the report, upload. --dry-run stops before upload." },
   { name: "login", args: "[--api-url <url>] [--token <token>]", summary: "Device-code browser flow, or store <token> for <url> directly." },
   { name: "tail", args: "[project-dir]", summary: "Print the project's recent request logs." },
   { name: "versions", args: "list [project-dir]", summary: "List the project's deployed versions." },
   { name: "rollback", args: "<version-id> [project-dir]", summary: "Re-activate a previous version." },
+  { name: "domains", args: "[list | add <host> | verify <host> | rm <host>] [project-dir]", summary: "Attach a custom domain to the project (TXT-verified). No sub-command lists." },
+  { name: "secrets", args: "[list | set <NAME> [value] | rm <NAME>] [project-dir]", summary: "Manage encrypted project secrets (read as env.NAME). `set` takes the value from the arg or stdin; applies on next deploy." },
   { name: "delete", args: "--yes [project-dir]", summary: "Delete the project and every version." },
 ];
 
@@ -27,12 +29,14 @@ export const ENV_VARS: readonly EnvVar[] = [
   { name: "SPROUTBOAT_ZIG", purpose: "Path to a Zig binary to use instead of downloading the pinned one." },
   { name: "SPROUTBOAT_UWS_TARBALL", purpose: "Path to a prebuilt uWebSockets (x86_64-linux-musl) tarball to seed the Porffor cache with, instead of downloading it (removes the first-build git + make need)." },
   { name: "SPROUTBOAT_COMPILE_TIMEOUT_MS", purpose: "Porffor compile timeout in ms (default 600000)." },
+  { name: "SPROUTBOAT_VARS_JSON", purpose: "JSON object of baked `vars` (UPPER_SNAKE -> string), read by the wrapper when generating the sprout module." },
+  { name: "SPROUTBOAT_BINDINGS_JSON", purpose: "The artifact's bindings.json, read by the wrapper to emit the `__sbInstallBindings` line." },
   { name: "SPROUTBOAT_CONFIG_DIR", purpose: "Directory for credentials.json (default ~/.config/sproutboat)." },
   { name: "XDG_CONFIG_HOME", purpose: "Base for the default credentials dir when SPROUTBOAT_CONFIG_DIR is unset." },
   { name: "PORFFOR_VERSION", purpose: "Override the Porffor identity string recorded in the manifest." },
-  { name: "SB_BROKER_PORT", purpose: "Loopback port of the binding broker, read by the compiled worker at runtime (set by the control plane, or by `src/broker.ts` for local runs)." },
-  { name: "SB_BROKER_TOKEN", purpose: "Per-deployment auth token the worker sends on every broker frame, and the broker sends back on scheduled/queue triggers (paired with SB_BROKER_PORT)." },
-  { name: "SB_WORKER_URL", purpose: "http://127.0.0.1:<PORT> of the worker; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it." },
+  { name: "SB_BROKER_PORT", purpose: "Loopback port of the binding broker, read by the compiled sprout at runtime (set by the control plane, or by `src/broker.ts` for local runs)." },
+  { name: "SB_BROKER_TOKEN", purpose: "Per-deployment auth token the sprout sends on every broker frame, and the broker sends back on scheduled/queue triggers (paired with SB_BROKER_PORT)." },
+  { name: "SB_SPROUT_URL", purpose: "http://127.0.0.1:<PORT> of the sprout; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it." },
 ];
 
 /** One-line usage string, e.g. for `usage()` and `--help`. */

package/src/toolchain.ts

@@ -24,6 +24,10 @@ const ZIG_SHA256: Record<string, string> = {
 
 // Pinned Porffor identity — must match the `porffor` entry in package.json
 // (`github:CanadaHonk/porffor#alpha-4`, commit a415d19). PORFFOR_VERSION overrides.
+// When bumping this pin (#55): run the monorepo's `bun run diff` against the
+// frozen reference handlers and update its COMPAT.md for any new mismatch before
+// releasing — the alpha compiler's output can shift between pins. Checked by
+// hand at bump time, not in CI.
 const PORFFOR_CHANNEL = "alpha-4";
 const PORFFOR_COMMIT = "a415d19";
 

package/src/wrap.ts

@@ -0,0 +1,151 @@
+/**
+ * The build-independent half of sprout compilation: the binding/trigger wrapper
+ * that turns a user's `export default { fetch }` into a native-fetch module, plus
+ * the `Bindings` shape and the `SPROUTBOAT_*_JSON` env readers.
+ *
+ * This module has no imports on purpose — the monorepo consumes it via the
+ * `sproutboat/runtime/wrap` export to drive its own (host-native, non-musl)
+ * compile path without pulling in `toolchain.ts` / `patch-porffor.ts`.
+ */
+
+/** The prelude file (Web API shims + broker binding shim + trigger dispatcher).
+ *  It is read as text and string-prepended before Porffor sees it, never
+ *  imported — callers do `readFile(preludePath, "utf8")`. */
+export const preludePath = new URL("./native-fetch-prelude.js", import.meta.url);
+
+// The server honours $PORT at runtime (patches/porffor-render.patch); this baked
+// value is only a fallback for a directly-run binary.
+const DEFAULT_PORT = 8080;
+
+/**
+ * Binding names a project declares. `do` maps a binding name to a Durable Object
+ * class name; `crons` are schedule expressions with no name.
+ */
+export type Bindings = {
+  kv: string[];
+  secrets: string[];
+  outbound: string[];
+  d1: string[];
+  r2: string[];
+  queues: string[];
+  analytics: string[];
+  do: Array<{ binding: string; className: string }>;
+  crons: string[];
+  /** Static-asset binding name for `env.<NAME>.fetch(request)`; `""` when assets are edge-only. */
+  assets: string;
+};
+
+export const EMPTY_BINDINGS: Bindings = { kv: [], secrets: [], outbound: [], d1: [], r2: [], queues: [], analytics: [], do: [], crons: [], assets: "" };
+
+function hasBindings(b: Bindings): boolean {
+  return (
+    b.kv.length > 0 || b.secrets.length > 0 || b.outbound.length > 0 || b.d1.length > 0 || b.r2.length > 0 ||
+    b.queues.length > 0 || b.analytics.length > 0 || b.do.length > 0 || b.assets !== ""
+  );
+}
+
+/**
+ * Build the final native-fetch module: the prelude (Web API shims + the broker
+ * binding shim + the trigger dispatcher), then `const env = {…}` with the baked
+ * `vars`, then — if any binding is declared — one `__sbInstallBindings(env, …)`
+ * line, then the user's source with its `export` keywords neutralised (so its
+ * `export default {…}` becomes a plain object we can hand to the dispatcher),
+ * then our single `export default { fetch }` that routes every request through
+ * `__sbEntry` (HTTP → `handlers.fetch`; `x-sb-trigger` → scheduled / queue / DO).
+ *
+ * With no bindings and no `scheduled`/`queue`/DO the output behaves exactly like
+ * a plain `export default { fetch }` sprout.
+ *
+ * `port` is only the baked fallback in `export default { port }`; the runtime
+ * reads `$PORT` first. The monorepo's bench path overrides it.
+ *
+ * ponytail: the sprout process is long-lived, so a handler that mutates `env`
+ * leaks that change to later requests. Freeze upstream once Porffor supports
+ * Object.freeze in native mode.
+ */
+export function wrapNativeFetchHandler(
+  source: string,
+  prelude: string,
+  vars: Record<string, string> = {},
+  bindings: Bindings = EMPTY_BINDINGS,
+  port: number = DEFAULT_PORT,
+): string {
+  if (!/\bexport\s+default\s*\{/.test(source) || !/\bfetch\s*\(/.test(source)) {
+    throw new Error("handler must default-export an object with a fetch(request) method");
+  }
+  // Neutralise the module's exports: its default object becomes `__sbHandlers`,
+  // and any `export class`/`function`/`const` (Durable Object classes, helpers)
+  // becomes a plain top-level declaration. Imports are already rejected upstream.
+  const neutralised = source
+    .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
+    .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
+
+  const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
+  const wire = hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "";
+  const registerDO = bindings.do.length
+    ? `__sbRegisterDO({ ${bindings.do.map((d) => `${d.className}: ${d.className}`).join(", ")} });\n`
+    : "";
+
+  return (
+    `${prelude}\n${env}${wire}` +
+    `${neutralised}\n` +
+    `${registerDO}` +
+    `export default {\n  port: ${port},\n  fetch(request) { return __sbEntry(__sbHandlers, request); }\n};\n`
+  );
+}
+
+type VarsJson = string | number | boolean | null | { readonly [key: string]: VarsJson } | VarsJson[];
+function isVarsObject(value: VarsJson): value is { readonly [key: string]: VarsJson } {
+  return value !== null && Object(value) === value && !Array.isArray(value);
+}
+function isVarsString(value: VarsJson): value is string {
+  return Object(value) !== value && value === String(value);
+}
+
+/** `SPROUTBOAT_VARS_JSON` (set by the build) → a validated flat string map. */
+export function readVarsFromEnv(): Record<string, string> {
+  const raw = process.env.SPROUTBOAT_VARS_JSON;
+  const vars: Record<string, string> = {};
+  if (!raw) return vars;
+  const parsed: VarsJson = JSON.parse(raw);
+  if (!isVarsObject(parsed)) throw new Error("SPROUTBOAT_VARS_JSON must be a JSON object");
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(key) || !isVarsString(value)) throw new Error(`SPROUTBOAT_VARS_JSON.${key} must map an UPPER_SNAKE name to a string`);
+    vars[key] = value;
+  }
+  return vars;
+}
+
+/**
+ * `SPROUTBOAT_BINDINGS_JSON` (the artifact's `bindings.json`, passed by the
+ * build) → a `Bindings` shape. Every field is re-validated here; unknown keys
+ * are dropped and a missing / empty payload is `EMPTY_BINDINGS`, so an old build
+ * with no bindings still compiles.
+ */
+export function readBindingsFromEnv(): Bindings {
+  const raw = process.env.SPROUTBOAT_BINDINGS_JSON;
+  if (!raw) return EMPTY_BINDINGS;
+  const parsed: VarsJson = JSON.parse(raw);
+  if (!isVarsObject(parsed)) throw new Error("SPROUTBOAT_BINDINGS_JSON must be a JSON object");
+  const strings = (v: VarsJson): string[] => (Array.isArray(v) ? v.filter(isVarsString) : []);
+  const dos: Array<{ binding: string; className: string }> = [];
+  if (Array.isArray(parsed.do)) {
+    for (const entry of parsed.do) {
+      if (isVarsObject(entry) && isVarsString(entry.binding) && isVarsString(entry.className)) {
+        dos.push({ binding: entry.binding, className: entry.className });
+      }
+    }
+  }
+  return {
+    kv: strings(parsed.kv),
+    secrets: strings(parsed.secrets),
+    outbound: strings(parsed.outbound),
+    d1: strings(parsed.d1),
+    r2: strings(parsed.r2),
+    queues: strings(parsed.queues),
+    analytics: strings(parsed.analytics),
+    do: dos,
+    crons: strings(parsed.crons),
+    assets: isVarsString(parsed.assets) ? parsed.assets : "",
+  };
+}