sproutboat 0.4.11 → 0.5.0

package/src/native-fetch-prelude.js

@@ -11,6 +11,13 @@
 // Declared before it is referenced: a getter body that names a later top-level
 // class throws ReferenceError in Porffor (see patches/UPSTREAM.md draft B).
 
+// Duck-typing helpers, `typeof`-free (the repo's anti-slop lint bans `typeof`;
+// these express the same spec-mandated checks and are verified under Porffor
+// alpha-4 by examples/kitchen-sink/harness.ts).
+function __sbIsStr(v) { return Object(v) !== v && v === String(v); }
+function __sbIsFn(v) { return v instanceof Function; }
+function __sbIsObj(v) { return v !== null && Object(v) === v; }
+
 // #41 — cold-start phase marker. Runs as the first thing in the bundle: writes
 // the current wall-clock ms to $SB_STARTUP_FILE so the supervisor can split
 // cold-start into "spawn -> JS starts" (process + runtime bootstrap) and
@@ -59,13 +66,13 @@ function __sbTagCpu(res, t0) {
   const cpu = __sbCpuMs() - t0;
   try {
     const body = res && res.body;
-    if (typeof body === 'string' && !res.headers.has('set-cookie')) {
+    if (__sbIsStr(body) && !res.headers.has('set-cookie')) {
       const headers = {};
       res.headers.forEach(function (value, name) { headers[name] = value; });
       headers['x-sb-cpu-ms'] = (cpu >= 0 ? cpu : 0).toFixed(3);
       return new Response(body, { status: res.status, headers: headers });
     }
-  } catch (e) { /* fall through to the original response */ }
+  } catch { /* fall through to the original response */ }
   return res;
 }
 
@@ -570,13 +577,13 @@ globalThis.__sbInstallBindings = function (target, bindings) {
     target[name] = {
       send(body, options) {
         const o = options || {};
-        __sbRpc('queue.send', { queue: name, body: typeof body === 'string' ? body : JSON.stringify(body), delaySeconds: o.delaySeconds || 0 });
+        __sbRpc('queue.send', { queue: name, body: __sbIsStr(body) ? body : JSON.stringify(body), delaySeconds: o.delaySeconds || 0 });
       },
       sendBatch(messages) {
         const list = [];
         for (let j = 0; j < (messages || []).length; j++) {
           const m = messages[j];
-          list.push({ body: typeof m.body === 'string' ? m.body : JSON.stringify(m.body), delaySeconds: (m.delaySeconds || 0) });
+          list.push({ body: __sbIsStr(m.body) ? m.body : JSON.stringify(m.body), delaySeconds: (m.delaySeconds || 0) });
         }
         __sbRpc('queue.send_batch', { queue: name, messages: list });
       },
@@ -616,8 +623,8 @@ globalThis.__sbInstallBindings = function (target, bindings) {
   if (bindings.assets) {
     target[bindings.assets] = {
       fetch(input) {
-        let path = typeof input === 'string' ? input : String(input && input.url || '/');
-        try { path = new URL(path, 'http://a').pathname; } catch (_e) { /* use as-is */ }
+        let path = __sbIsStr(input) ? input : String(input && input.url || '/');
+        try { path = new URL(path, 'http://a').pathname; } catch { /* use as-is */ }
         const r = __sbRpc('assets.get', { path });
         const headers = {};
         if (r.type) headers['content-type'] = r.type;
@@ -629,11 +636,11 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   if ((bindings.outbound || []).length > 0) {
     globalThis.fetch = function (input, init) {
-      const url = typeof input === 'string' ? input : String(input.url);
+      const url = __sbIsStr(input) ? input : String(input.url);
       const opts = init || {};
       const headers = [];
       if (opts.headers) {
-        if (typeof opts.headers.forEach === 'function') opts.headers.forEach((v, k) => headers.push([k, v]));
+        if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
         else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
       }
       const r = __sbRpc('fetch', {
@@ -668,18 +675,18 @@ function __sbMakeDONamespace(binding, className) {
       return { toString() { return 'uid:' + crypto.randomUUID(); } };
     },
     get(id) {
-      const idStr = typeof id === 'string' ? id : id.toString();
+      const idStr = __sbIsStr(id) ? id : id.toString();
       return {
         fetch(input, init) {
           let req;
-          if (input && typeof input === 'object' && typeof input.url === 'string' && !init) {
+          if (__sbIsObj(input) && __sbIsStr(input.url) && !init) {
             req = input;
           } else {
-            const url = typeof input === 'string' ? input : String((input && input.url) || 'https://do/');
+            const url = __sbIsStr(input) ? input : String((input && input.url) || 'https://do/');
             const opts = init || {};
             const headers = new Headers();
             if (opts.headers) {
-              if (typeof opts.headers.forEach === 'function') opts.headers.forEach((v, k) => headers.set(k, v));
+              if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.set(k, v));
               else for (const k in opts.headers) headers.set(k, opts.headers[k]);
             }
             req = new Request(url, { method: opts.method || 'GET', headers });
@@ -731,7 +738,7 @@ function __sbDOStorage(cls, id) {
       return r.found ? JSON.parse(r.value) : undefined;
     },
     put(key, value) {
-      if (key != null && typeof key === 'object') {
+      if (key != null && __sbIsObj(key)) {
         for (const k in key) __sbRpc('do.storage.put', { cls, id, key: String(k), value: JSON.stringify(key[k]) });
         return;
       }
@@ -787,28 +794,31 @@ globalThis.__sbEntry = function (handlers, request) {
   const trigger = request.headers.get('x-sb-trigger');
   if (!trigger) {
     // #28 — per-invocation CPU time. One fetch turn per process (serial), so the
-    // process CPU delta across the handler is this invocation's CPU. Covers both
-    // sync handlers and async ones (via `.then`); the delta spans the whole turn.
+    // process CPU delta across the handler is this invocation's CPU.
     // ponytail: serial-turn assumption; revisit if the profile ever allows
     // concurrent in-process requests.
+    //
+    // Sync handlers only. An async handler's promise is handed straight back:
+    // Porffor alpha-4's native-fetch server resolves the promise the handler
+    // itself returned, but never one derived from `.then()`, so chaining the
+    // tag on hangs the request forever. cpuMs is documented as absent for
+    // async handlers (see LogEvent in services/edge) — that is this.
     const __t0 = __sbCpuMs();
     const __res = handlers.fetch(request);
-    if (__res && typeof __res.then === 'function') {
-      return __res.then(function (resolved) { return __sbTagCpu(resolved, __t0); });
-    }
+    if (__res && __sbIsFn(__res.then)) return __res;
     return __sbTagCpu(__res, __t0);
   }
   if (!__sbTriggerAuthed(request)) return new Response('forbidden', { status: 403 });
 
   if (trigger === 'scheduled') {
-    if (typeof handlers.scheduled !== 'function') return new Response('no scheduled handler', { status: 404 });
+    if (!__sbIsFn(handlers.scheduled)) return new Response('no scheduled handler', { status: 404 });
     const body = __sbReadJson(request);
     handlers.scheduled({ cron: body.cron || '', scheduledTime: body.scheduledTime || Date.now(), noRetry() {} });
     return new Response('', { status: 204 });
   }
 
   if (trigger === 'queue') {
-    if (typeof handlers.queue !== 'function') return new Response('no queue handler', { status: 404 });
+    if (!__sbIsFn(handlers.queue)) return new Response('no queue handler', { status: 404 });
     const body = __sbReadJson(request);
     const acked = [];
     const retried = [];
@@ -845,8 +855,8 @@ globalThis.__sbEntry = function (handlers, request) {
 };
 
 function __sbReadJson(request) {
-  try { return JSON.parse(request.body == null ? '{}' : String(request.body)); } catch (e) { return {}; }
+  try { return JSON.parse(request.body == null ? '{}' : String(request.body)); } catch { return {}; }
 }
 function __sbTryParse(s) {
-  try { return JSON.parse(s); } catch (e) { return s; }
+  try { return JSON.parse(s); } catch { return s; }
 }

package/src/report.ts

@@ -5,7 +5,9 @@ import type { ArtifactManifest } from "./manifest";
 import { bold, dim, leaf, sprout } from "./style";
 
 // Read from package.json so the banner never drifts from the published version.
-export const CLI_VERSION = (JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string }).version;
+// SAFETY: our own package.json, shipped beside src/ by the `files` field; npm requires `version`.
+const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string };
+export const CLI_VERSION = packageJson.version;
 
 function bytes(n: number): string {
   if (n < 1024) return `${n} B`;

package/src/source.ts

@@ -1,10 +1,22 @@
+import { neutraliseExports } from "./wrap";
+
 export type SourceValidation = { ok: true } | { ok: false; errors: string[] };
 
+// Checked against the *bundled* module (#89), not the entry file: after
+// bundling there are no imports left to reject, and a dependency reaching for a
+// Node API has to fail exactly as hand-written code would. A bare specifier
+// that resolves to nothing never gets this far — the bundler fails first.
 const alwaysForbidden: Array<[RegExp, string]> = [
-  [/^\s*import\s/m, "imports are not supported"],
+  [/^\s*import\s/m, "an import survived bundling — only static imports can be resolved at build time"],
+  [/\bimport\s*\(/, "dynamic import() is not supported: nothing can resolve it at build time"],
   [/\brequire\s*\(/, "CommonJS require is not supported"],
   [/\b(WebSocket|XMLHttpRequest)\s*\(/, "WebSocket / XMLHttpRequest are not supported"],
   [/\b(process|Bun|Deno|Buffer|node:)\b/, "Node, Bun, and Deno APIs are not supported"],
+  // Porffor alpha-4 compiles `new Proxy(...)` and then ignores the handler: a
+  // trapped property reads back as `undefined`, with no throw. Rejecting it
+  // here is the difference between a build error and a 502 nobody can explain.
+  // It is why itty-router and other Proxy-based routers do not work yet.
+  [/\bnew\s+Proxy\s*\(|\bProxy\s*\.\s*revocable\s*\(/, "Proxy is not supported by the compiler: its traps are silently ignored and the property reads back as undefined"],
 ];
 
 const fetchWithoutAllowlist: [RegExp, string] = [
@@ -17,7 +29,10 @@ export function validateHttpSyncSource(source: string, outboundAllowed = false):
   // The default export must be an object literal with a `fetch` method. A module
   // may also declare Durable Object classes / helpers before it, so this is not
   // anchored to the start of the file.
-  if (!/\bexport\s+default\s*\{/.test(source) || !/\bfetch\s*\(/.test(source)) {
+  // A hand-written file exports inline; a bundled one re-exports at the end.
+  // `neutraliseExports` is the same reader the compiler uses, so `check` cannot
+  // accept a module the build would then reject.
+  if (neutraliseExports(source) === null || !/\bfetch\s*\(/.test(source)) {
     errors.push("handler must default-export an object with fetch(request)");
   }
   for (const [pattern, message] of alwaysForbidden) if (pattern.test(source)) errors.push(message);

package/src/surface.ts

@@ -9,7 +9,7 @@ export const CLI_NAME = "sproutboat";
 export const TAGLINE = "Deploy JavaScript handlers as tiny native binaries on your own VPS.";
 export const REPO_URL = "https://github.com/baronunread/sproutboat";
 
-export type Group = "Develop" | "Ship" | "Configure" | "Account";
+export type Group = "Develop" | "Ship" | "Storage" | "Configure" | "Account";
 
 export type Command = {
   name: string;
@@ -22,39 +22,84 @@ export type Command = {
   summary: string;
 };
 
+/**
+ * The storage products. Each is its own command with the same five verbs over
+ * its own `/api/<segment>` collection.
+ *
+ * Wrangler nests two of its four (`kv namespace create`, `r2 bucket create`)
+ * and leaves `d1 create` and `queues create` flat. That nesting separates a
+ * container from its contents, which the verb already does — so ours are
+ * uniform, and contents take their own noun when they exist (`kv key get`).
+ */
+export type StorageProduct = {
+  /** Command name, URL segment, and the dashboard's product page. */
+  name: "kv" | "d1" | "r2" | "queues";
+  /** One of them, for buttons and messages: "namespace", "bucket". */
+  noun: string;
+  /** Many of them, for list output and empty states. */
+  plural: string;
+  emoji: string;
+};
+
+export const STORAGE_PRODUCTS: readonly StorageProduct[] = [
+  { name: "kv", noun: "namespace", plural: "KV namespaces", emoji: "🗄" },
+  { name: "d1", noun: "database", plural: "D1 databases", emoji: "🛢" },
+  { name: "r2", noun: "bucket", plural: "R2 buckets", emoji: "🪣" },
+  { name: "queues", noun: "queue", plural: "queues", emoji: "📨" },
+];
+
+/** Every storage product answers to exactly these, in this order. */
+export const STORAGE_VERBS = ["list", "create", "info", "rename", "delete"] as const;
+
+const STORAGE_ARGS = "<list | create <name> | info <name> | rename <name> <new> | delete <name>>";
+
+const storageCommands: readonly Command[] = STORAGE_PRODUCTS.map((product) => ({
+  name: product.name,
+  group: "Storage" as const,
+  emoji: product.emoji,
+  args: STORAGE_ARGS,
+  brief: `<${STORAGE_VERBS.join(" | ")}>`,
+  summary: `${product.plural[0].toUpperCase()}${product.plural.slice(1)}. \`create\` prints the id to bind from sproutboat.jsonc${product.name === "queues" ? "; consumers are not implemented yet" : ""}.`,
+}));
+
 export const COMMANDS: readonly Command[] = [
   { name: "init", group: "Develop", emoji: "🌱", args: "[name]",
     summary: "Scaffold sproutboat.jsonc + src/index.js in ./<name>." },
   { name: "check", group: "Develop", emoji: "🔍", args: "[project-dir]",
     summary: "Validate the config and entry point without building." },
-  { name: "build", group: "Develop", emoji: "🔨", args: "[project-dir]",
-    summary: "Cross-compile the native-fetch sprout (Porffor + Zig)." },
+  { name: "dev", group: "Develop", emoji: "⚡", args: "[project-dir] [--port <n>] [--no-watch]", brief: "[project-dir] [--port <n>]",
+    summary: "Run the project on this machine against a real broker, rebuilding on save." },
+  { name: "build", group: "Develop", emoji: "🔨", args: "[project-dir] [--target host]", brief: "[project-dir]",
+    summary: "Cross-compile the native-fetch sprout (Porffor + Zig). `--target host` builds for this machine instead, to run locally — not deployable." },
 
   { name: "deploy", group: "Ship", emoji: "🚀",
     args: "[project-dir] [--dry-run] [--artifact <dir>] [--no-wait] [--no-provision]", brief: "[project-dir] [--dry-run]",
     summary: "Build (unless --artifact), auto-provision id-less storage bindings and pin their ids into sproutboat.jsonc, print the report, upload, wait until the URL serves. The control plane skips an upload that matches the live artifact byte-for-byte. --dry-run stops before upload; --no-wait skips the health check; --no-provision leaves id-less bindings as ephemeral deploy-scoped stores." },
-  { name: "versions", group: "Ship", emoji: "📜", args: "list [project-dir]",
-    summary: "List the project's deployed versions." },
+  { name: "versions", group: "Ship", emoji: "📜", args: "<list | view <version-id>> [project-dir]", brief: "<list | view>",
+    summary: "List the project's deployed versions, or show one version's artifact and bindings." },
   { name: "rollback", group: "Ship", emoji: "⏮", args: "<version-id> [project-dir]", brief: "<version-id>",
     summary: "Re-activate a previous version." },
   { name: "tail", group: "Ship", emoji: "📡", args: "[project-dir] [--sprout]",
     summary: "Print recent request logs; --sprout prints the running sprout + broker stdout/stderr instead." },
 
+  ...storageCommands,
+
   { name: "domains", group: "Configure", emoji: "🌐",
-    args: "[list | add <host> | verify <host> | rm <host>] [project-dir]", brief: "[list | add | verify | rm]",
+    args: "<list | add <host> | verify <host> | delete <host>> [project-dir]", brief: "<list | add | verify | delete>",
     summary: "Attach a custom domain to the project (TXT-verified). No sub-command lists." },
   { name: "secrets", group: "Configure", emoji: "🔑",
-    args: "[list | set <NAME> [value] | rm <NAME>] [project-dir]", brief: "[list | set | rm]",
-    summary: "Manage encrypted project secrets (read as env.NAME). `set` takes the value from the arg or stdin; applies on next deploy." },
-  { name: "resource", group: "Configure", emoji: "📦",
-    args: "[list [kind] | create <kind> <name> | rename <id> <name> | delete <id>]", brief: "[list | create | rename | delete]",
-    summary: "Manage account-level storage resources (kv | d1 | r2 | queue). `create` prints the id to reference from sproutboat.jsonc bindings." },
+    args: "<list | put <NAME> [--value <value>] | delete <NAME>> [project-dir]", brief: "<list | put | delete>",
+    summary: "Manage encrypted project secrets (read as env.NAME). `put` reads the value from stdin unless --value is given, so it stays out of shell history; applies on next deploy." },
   { name: "delete", group: "Configure", emoji: "🗑",
     args: "[project-dir] [--name <project>] --yes", brief: "[project-dir] --yes",
     summary: "Delete the project, every version, and its route." },
 
   { name: "login", group: "Account", emoji: "🔓", args: "[--api-url <url>] [--token <token>]", brief: "[--token <token>]",
     summary: "Device-code browser flow, or store <token> for <url> directly." },
+  { name: "logout", group: "Account", emoji: "🔒", args: "[--api-url <url>]",
+    summary: "Forget the stored credential for the active endpoint, or for <url>." },
+  { name: "whoami", group: "Account", emoji: "👤", args: "",
+    summary: "Show the active endpoint and the account the stored token belongs to." },
 ];
 
 export type EnvVar = { name: string; purpose: string };
@@ -77,7 +122,7 @@ export const ENV_VARS: readonly EnvVar[] = [
   { name: "SB_SPROUT_URL", purpose: "http://127.0.0.1:<PORT> of the sprout; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it." },
 ];
 
-const GROUP_ORDER: readonly Group[] = ["Develop", "Ship", "Configure", "Account"];
+const GROUP_ORDER: readonly Group[] = ["Develop", "Ship", "Storage", "Configure", "Account"];
 
 /** One-line usage string, e.g. for `usage()` and SURFACE.md. */
 export function usageLine(): string {

package/src/toolchain.ts

@@ -13,14 +13,17 @@ import { dirname, resolve } from "node:path";
 
 export const ZIG_VERSION = "0.16.0";
 
+/** The `<arch>-<os>` platforms ziglang.org publishes a tarball for that we pin. */
+type ZigPlatform = "x86_64-linux" | "aarch64-linux" | "x86_64-macos" | "aarch64-macos";
+
 // sha256 of the official ziglang.org tarballs for ZIG_VERSION, keyed by
 // `<arch>-<os>` (the download naming). Bump alongside ZIG_VERSION.
-const ZIG_SHA256: Record<string, string> = {
+const ZIG_SHA256 = {
   "x86_64-linux": "70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00",
   "aarch64-linux": "ea4b09bfb22ec6f6c6ceac57ab63efb6b46e17ab08d21f69f3a48b38e1534f17",
   "x86_64-macos": "0387557ed1877bc6a2e1802c8391953baddba76081876301c522f52977b52ba7",
   "aarch64-macos": "b23d70deaa879b5c2d486ed3316f7eaa53e84acf6fc9cc747de152450d401489",
-};
+} satisfies Record<ZigPlatform, string>;
 
 // Pinned Porffor identity — must match the `porffor` entry in package.json
 // (`github:CanadaHonk/porffor#alpha-4`, commit a415d19). PORFFOR_VERSION overrides.
@@ -43,7 +46,7 @@ const UWS_COMMIT_FULL = "360c276d609d59af56ae6932adb95154ace9f15f";
 // or the `uws-prebuild` workflow.
 const UWS_TARBALL_SHA256 = "e83736f3f8cf9d56a1ebe6ea61625a7af12386763374d47c14cff472ada7484a";
 
-function platformKey(): string {
+function platformKey(): ZigPlatform {
   const arch = process.arch === "arm64" ? "aarch64" : process.arch === "x64" ? "x86_64" : null;
   const os = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "macos" : null;
   if (!arch || !os) throw new Error(`no pinned Zig for ${process.platform}/${process.arch} — set SPROUTBOAT_ZIG to a zig ${ZIG_VERSION} binary`);

package/src/update-check.ts

@@ -7,6 +7,7 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { configDirectory } from "./credentials";
+import { isSafeInteger, isString, jsonObject, parseJsonValue } from "./json";
 import { dim } from "./style";
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
@@ -14,6 +15,14 @@ const REGISTRY = "https://registry.npmjs.org/sproutboat/latest";
 
 type Cache = { checkedAt: number; latest: string };
 
+/** Decode our own cache file, which a stale version or a partial write can corrupt. */
+function parseCache(source: string): Cache | undefined {
+  const record = jsonObject(parseJsonValue(source));
+  return record && isSafeInteger(record.checkedAt) && isString(record.latest)
+    ? { checkedAt: record.checkedAt, latest: record.latest }
+    : undefined;
+}
+
 function cachePath(): string {
   return resolve(configDirectory(), "update-check.json");
 }
@@ -30,15 +39,15 @@ function isNewer(latest: string, current: string): boolean {
 
 async function latestVersion(): Promise<string | undefined> {
   try {
-    const cached = JSON.parse(await readFile(cachePath(), "utf8")) as Cache;
-    if (Date.now() - cached.checkedAt < CACHE_TTL_MS && typeof cached.latest === "string") return cached.latest;
+    const cached = parseCache(await readFile(cachePath(), "utf8"));
+    if (cached && Date.now() - cached.checkedAt < CACHE_TTL_MS) return cached.latest;
   } catch { /* no cache yet, or unreadable — fetch below */ }
 
   try {
     const response = await fetch(REGISTRY, { signal: AbortSignal.timeout(1000), headers: { accept: "application/json" } });
     if (!response.ok) return undefined;
-    const latest = ((await response.json()) as { version?: string }).version;
-    if (typeof latest !== "string") return undefined;
+    const latest = jsonObject(parseJsonValue(await response.text()))?.version;
+    if (!isString(latest)) return undefined;
     await writeFile(cachePath(), JSON.stringify({ checkedAt: Date.now(), latest } satisfies Cache)).catch(() => {});
     return latest;
   } catch { /* offline / slow / DNS — skip silently */ }

package/src/wrap.ts

@@ -44,6 +44,43 @@ function hasBindings(b: Bindings): boolean {
   );
 }
 
+/**
+ * Turn the module's exports into plain top-level declarations, so the handler
+ * object is reachable as `__sbHandlers` and Durable Object classes stay
+ * addressable by name.
+ *
+ * Two shapes reach us. A hand-written file exports inline
+ * (`export default { fetch }`), while a bundled one declares everything first
+ * and re-exports at the end (`export { src_default as default, Counter }`) —
+ * #89 made the second shape the normal case. Returns null when neither matches.
+ */
+export function neutraliseExports(source: string): string | null {
+  if (/\bexport\s+default\s*\{/.test(source)) {
+    return source
+      .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
+      .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
+  }
+  // Not anchored to a line: a minified bundle puts the whole module on one
+  // line. Bundlers emit exactly one such block, at the end.
+  const blocks = [...source.matchAll(/export\s*\{([^}]*)\}\s*;?/g)];
+  const block = blocks[blocks.length - 1];
+  if (block === undefined) return null;
+  let handler: string | null = null;
+  const aliases: string[] = [];
+  for (const entry of block[1].split(",").map((part) => part.trim()).filter(Boolean)) {
+    const parts = entry.match(/^(\S+)(?:\s+as\s+(\S+))?$/);
+    if (parts === null) continue;
+    const local = parts[1];
+    const exported = parts[2] ?? local;
+    if (exported === "default") handler = local;
+    // `export { Counter as Counter }` needs no alias; a renamed one does, so
+    // `durable_objects` in the config can still name the class it expects.
+    else if (exported !== local) aliases.push(`const ${exported} = ${local};`);
+  }
+  if (handler === null) return null;
+  return source.replace(block[0], [`const __sbHandlers = ${handler};`, ...aliases].join("\n"));
+}
+
 /**
  * Build the final native-fetch module: the prelude (Web API shims + the broker
  * binding shim + the trigger dispatcher), then `const env = {…}` with the baked
@@ -70,15 +107,10 @@ export function wrapNativeFetchHandler(
   bindings: Bindings = EMPTY_BINDINGS,
   port: number = DEFAULT_PORT,
 ): string {
-  if (!/\bexport\s+default\s*\{/.test(source) || !/\bfetch\s*\(/.test(source)) {
+  const neutralised = neutraliseExports(source);
+  if (neutralised === null || !/\bfetch\s*\(/.test(source)) {
     throw new Error("handler must default-export an object with a fetch(request) method");
   }
-  // Neutralise the module's exports: its default object becomes `__sbHandlers`,
-  // and any `export class`/`function`/`const` (Durable Object classes, helpers)
-  // becomes a plain top-level declaration. Imports are already rejected upstream.
-  const neutralised = source
-    .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
-    .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
 
   const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
   const wire = hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "";
@@ -105,15 +137,13 @@ function isVarsString(value: VarsJson): value is string {
 /** `SPROUTBOAT_VARS_JSON` (set by the build) → a validated flat string map. */
 export function readVarsFromEnv(): Record<string, string> {
   const raw = process.env.SPROUTBOAT_VARS_JSON;
-  const vars: Record<string, string> = {};
-  if (!raw) return vars;
+  if (!raw) return {};
   const parsed: VarsJson = JSON.parse(raw);
   if (!isVarsObject(parsed)) throw new Error("SPROUTBOAT_VARS_JSON must be a JSON object");
-  for (const [key, value] of Object.entries(parsed)) {
+  return Object.fromEntries(Object.entries(parsed).map(([key, value]): [string, string] => {
     if (!/^[A-Z][A-Z0-9_]*$/.test(key) || !isVarsString(value)) throw new Error(`SPROUTBOAT_VARS_JSON.${key} must map an UPPER_SNAKE name to a string`);
-    vars[key] = value;
-  }
-  return vars;
+    return [key, value];
+  }));
 }
 
 /**