sproutboat 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -10,6 +10,46 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.28.0] - 2026-10-23
+
+Built on `@sproutboat/runtime` 0.28.0, `@sproutboat/toolchain` 0.14.0 and
+`@sproutboat/wire` 0.17.0.
+
+### Added
+
+- Request bodies stream from compatibility date `2026-10-27`, as in Workers.
+  The handler runs as soon as a request's headers arrive, and `request.body`
+  hands out the bytes as they come in. The server pauses the connection while
+  more than 1 MiB waits unread, so a 128 MiB upload read through the stream
+  peaks at 38 MiB. `text()`, `json()`, `arrayBuffer()` and `bytes()` still read
+  the whole body (as Promises). New example: `examples/upload`.
+- From the same date `SB_REQUEST_BODY_MAX` defaults to 100 MiB (it stays 1 MiB
+  before it, where the body is held whole). A larger `Content-Length` gets
+  `413 Payload Too Large` before the handler runs.
+- On the platform, `fetch()` and service bindings send a `ReadableStream`
+  request body as it is read, instead of reading it to the end first. A
+  streamed body can't follow a 307 or 308 redirect, as in Workers.
+
+Earlier dates are unchanged: the handler gets the whole body, and
+`request.text()` answers at once.
+
+## [0.27.0] - 2026-10-22
+
+Built on `@sproutboat/runtime` 0.27.1.
+
+### Fixed
+
+- Bodies of megabytes no longer take hundreds of megabytes of memory. Turning
+  bytes into text and text into bytes made one string per character, so reading
+  a 5 MiB R2 object with `text()` peaked at about 400 MiB, and R2 multipart
+  uploads with real (5 MiB) parts ran sproutd's workers out of memory. On a
+  standalone build, at 5 MiB: `put()` of a string 82 to 16 MiB, `get()` and
+  `text()` 400 to 26 MiB, `request.text()` 402 to 24 MiB.
+- R2 `uploadPart()` stores an `ArrayBuffer` or a typed array as its bytes, at
+  every date. It stored the text `[object ArrayBuffer]`.
+- From compatibility date `2026-10-26`, `uploadPart()` takes what `put()` takes
+  (a `ReadableStream` or a `Blob` too) and stores text as UTF-8, as in Workers.
+
 ## [0.26.0] - 2026-10-22
 
 Built on `@sproutboat/runtime` 0.27.0 and `@sproutboat/wire` 0.16.0.

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.26.0
+**Package:** `sproutboat` 0.28.0
 
 ## Commands
 
@@ -67,7 +67,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `SPROUTBOAT_DATA` | Data directory for a standalone binary, after --data and SB_DATA_DIR, before the ./<name>.data default (#15). |
 | `SB_CA_BUNDLE` | PEM bundle of extra certificate authorities a standalone binary should trust, on top of the compiled-in Mozilla root set (#15). Adds trust; nothing disables verification. |
 | `SB_FETCH_MAX_BYTES` | Largest outbound `fetch()` response body a sprout will read, in bytes (default 33554432). The size is the remote host's choice and the body is held whole, so this is the ceiling that stops one upstream exhausting memory. |
-| `SB_REQUEST_BODY_MAX` | Largest inbound request body the runtime accepts, in bytes (default 1048576). Anything larger is refused with 413 before the handler runs. |
+| `SB_REQUEST_BODY_MAX` | Largest inbound request body the runtime accepts, in bytes. From compatibility date 2026-10-27 bodies stream and the default is 104857600 (100 MiB); before it the body is held whole and the default is 1048576. A larger Content-Length is refused with 413 before the handler runs; a chunked body that grows past it closes the connection. |
 | `SB_EXTRA_CFLAGS` | Flags added to Porffor's native-fetch compile step, set by the build so inline C can include BearSSL's header (#15). |
 | `SB_EXTRA_LINK` | Objects to add to Porffor's native-fetch link line, set by the build so a standalone binary links SQLite and BearSSL (#15). |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.5.0",
-    "@sproutboat/runtime": "^0.27.0",
-    "@sproutboat/toolchain": "^0.13.0",
-    "@sproutboat/wire": "^0.16.0"
+    "@sproutboat/runtime": "^0.28.0",
+    "@sproutboat/toolchain": "^0.14.0",
+    "@sproutboat/wire": "^0.17.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.26.0",
-    "@sproutboat/cli-darwin-x64": "0.26.0",
-    "@sproutboat/cli-linux-arm64": "0.26.0",
-    "@sproutboat/cli-linux-x64": "0.26.0"
+    "@sproutboat/cli-darwin-arm64": "0.28.0",
+    "@sproutboat/cli-darwin-x64": "0.28.0",
+    "@sproutboat/cli-linux-arm64": "0.28.0",
+    "@sproutboat/cli-linux-x64": "0.28.0"
   },
   "engines": {
     "node": ">=18"

package/src/surface.ts

@@ -311,7 +311,7 @@ export const ENV_VARS: readonly EnvVar[] = [
   {
     name: "SB_REQUEST_BODY_MAX",
     purpose:
-      "Largest inbound request body the runtime accepts, in bytes (default 1048576). Anything larger is refused with 413 before the handler runs.",
+      "Largest inbound request body the runtime accepts, in bytes. From compatibility date 2026-10-27 bodies stream and the default is 104857600 (100 MiB); before it the body is held whole and the default is 1048576. A larger Content-Length is refused with 413 before the handler runs; a chunked body that grows past it closes the connection.",
   },
   {
     name: "SB_EXTRA_CFLAGS",