sproutboat 0.50.0 → 0.51.1

package/CHANGELOG.md

@@ -10,6 +10,34 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.51.1] - 2026-11-05
+
+Built on `@sproutboat/runtime` 0.42.2, `@sproutboat/toolchain` 0.23.1 and `@sproutboat/wire` 0.22.2. Nothing an app can observe changes except latency, the refused address ranges below and the `startTls()` write order, so there is no new compatibility date.
+
+### Fixed
+
+- **Bytes written right after `socket.startTls()` no longer go out unencrypted.** On a `connect()` socket, the I/O thread took the start-TLS request and the app's queued writes in the same pass, and flushed all of them in plaintext before switching to TLS. Any write queued before the thread picked up the upgrade could leave in the clear. Only the bytes written before `startTls()` now go out in plaintext. Everything after waits until the TLS engine owns the socket, and new writes on the old plaintext socket reject, as in workerd. A failed plaintext flush is now a connection error. The egress tunnel also no longer stays paused on the discarded plain socket after an upgrade under backpressure.
+
+- The BearSSL source ships in the package (`vendor/bearssl`, 867 KB) and is read first, hash-verified, so builds no longer depend on bearssl.org being up. bearssl.org stays as the fallback, with bounded retry on 5xx. Every source, vendored or downloaded, is checked against the pinned sha256, so a bad file cannot change what gets built.
+- **A malformed `connect()` tunnel opening frame no longer ends the egress process.** A `tcp.open` head whose JSON did not parse used to throw out of the egress service's socket handler before the token was checked, which took egress down for every app. It now gets an `expected tcp.open` error frame and only that connection closes; the broker answers it as a bad request, and a refused head stops buffering whatever the client keeps sending.
+
+### Changed
+
+- **`fetch()` and `connect()` refuse more reserved address space** that carries no public service: AS112 and the old IPv4 anycast blocks (`192.31.196.0/24`, `192.52.193.0/24`, `192.88.99.0/24`, `192.175.48.0/24`), SIIT (`::ffff:0:0:0/96`), IETF protocol assignments including Teredo (`2001::/23`), `3fff::/20` and SRv6 (`5f00::/16`). This applies to the broker, the egress service and a standalone binary alike, and `SB_EGRESS_ALLOW` still overrides it.
+
+### Performance
+
+- **Outbound TCP sockets set `TCP_NODELAY`.** Nagle's algorithm and the peer's delayed ACK stalled every fresh HTTPS `fetch()` by about 44 ms on Linux, because each small TLS handshake flight waited for an ACK; a fresh fetch now takes about 1.4 ms. This covers `fetch()`, outbound WebSockets and `connect()` on a standalone binary, including sockets handed over by `SB_EGRESS_FD`, and the egress tunnel's connections to origins.
+
+## [0.51.0] - 2026-11-03
+
+Built on `@sproutboat/runtime` 0.42.0, `@sproutboat/toolchain` 0.23.0 and `@sproutboat/wire` 0.22.0. The change below starts at a new compatibility date; earlier dates answer as before.
+
+### Added
+
+- **`connect()` from `cloudflare:sockets` from `2026-11-17`**: TCP sockets with `readable`, `writable`, `opened`, `closed`, `close()` and `startTls()`, on a standalone binary, under `sproutboat dev` and on a platform deploy. The same unmodified Postgres (`pg`, `postgres`) and Redis driver code that runs on workerd runs here, with no differences from workerd in the driver suites. Outbound policy is the one `fetch()` uses. Before the date, importing `cloudflare:sockets` fails the build with `cloudflare:sockets needs compatibility_date 2026-11-17 or later`.
+- **From the same date a driver bundles as it does for workerd**: the `workerd` export condition (`pg-cloudflare`, `postgres/cf`), a bundled `Buffer`, `process` and `global`, and shims for `net`, `tls`, `dns`, `fs` and `crypto` so the Node branch of a driver names `cloudflare:sockets` instead of failing the build. A named function expression that shadows a global builtin function is renamed, which sproutd admission needs.
+
 ## [0.50.0] - 2026-11-02
 
 Built on `@sproutboat/runtime` 0.41.0, `@sproutboat/toolchain` 0.22.0 and `@sproutboat/wire` 0.21.4. Each change below that an existing app could observe starts at a new compatibility date; earlier dates answer as before.

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.50.0
+**Package:** `sproutboat` 0.51.1
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.50.0",
+  "version": "0.51.1",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.41.0",
-    "@sproutboat/toolchain": "^0.22.0",
-    "@sproutboat/wire": "^0.21.4"
+    "@sproutboat/runtime": "^0.42.2",
+    "@sproutboat/toolchain": "^0.23.1",
+    "@sproutboat/wire": "^0.22.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.50.0",
-    "@sproutboat/cli-darwin-x64": "0.50.0",
-    "@sproutboat/cli-linux-arm64": "0.50.0",
-    "@sproutboat/cli-linux-x64": "0.50.0"
+    "@sproutboat/cli-darwin-arm64": "0.51.1",
+    "@sproutboat/cli-darwin-x64": "0.51.1",
+    "@sproutboat/cli-linux-arm64": "0.51.1",
+    "@sproutboat/cli-linux-x64": "0.51.1"
   },
   "engines": {
     "node": ">=18"

package/src/bearssl.ts

@@ -19,6 +19,9 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+// @ts-expect-error Bun's file loader returns the embedded asset path in a compiled executable.
+import embeddedBearsslArchive from "../vendor/bearssl/bearssl-7bea48e.tar.gz" with { type: "file" };
+import { fetchPinned, type FetchPinnedOptions } from "./fetch-pinned";
 import { LINUX_TARGETS, type BuildTarget } from "./targets";
 import { resolveHostCompiler } from "./toolchain";
 
@@ -112,12 +115,22 @@ const run = (
     child.on("close", (code) => done({ code: code ?? 1, stderr }));
   });
 
+/**
+ * The pinned BearSSL source: the vendored copy (ships in the npm package, embedded in standalone
+ * binaries) first, bearssl.org only as a fallback. bearssl.org returned 502 for hours on 2026-11-04.
+ */
+export const bearsslVendorArchive = (): string => embeddedBearsslArchive;
+
+export const fetchBearsslTarball = (overrides: Partial<FetchPinnedOptions> = {}): Promise<Buffer> =>
+  fetchPinned({
+    localPath: bearsslVendorArchive(),
+    urls: [BEARSSL_URL],
+    sha256: BEARSSL_SHA256,
+    ...overrides,
+  });
+
 async function download(url: string, expected: string, to: string): Promise<Buffer> {
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`could not download ${url}: HTTP ${response.status}`);
-  const bytes = Buffer.from(await response.arrayBuffer());
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== expected) throw new Error(`checksum mismatch for ${url}: expected ${expected}, got ${digest}`);
+  const bytes = await fetchPinned({ urls: [url], sha256: expected });
   await writeFile(to, bytes);
   return bytes;
 }
@@ -143,7 +156,7 @@ async function sourceTree(): Promise<string> {
     await rm(tree, { recursive: true, force: true });
     if (!existsSync(tarball) || (await digest(tarball)) !== BEARSSL_SHA256) {
       await rm(tarball, { force: true });
-      await download(BEARSSL_URL, BEARSSL_SHA256, tarball);
+      await writeFile(tarball, await fetchBearsslTarball());
     }
     const stage = resolve(dir, `.bearssl-stage-${process.pid}-${crypto.randomUUID()}`);
     await mkdir(stage, { recursive: true });

package/src/bundle.ts

@@ -12,7 +12,8 @@
  * reaching for a Node API fails exactly as user code would.
  */
 import { relative } from "node:path";
-import { NODE_SHIMS } from "./node-shims";
+import { SOCKETS_DATE } from "@sproutboat/runtime";
+import { NODE_SHIMS, SOCKET_NODE_SHIMS } from "./node-shims";
 
 export type BundleResult = {
   /** One self-contained ESM module: what gets validated, hashed, and compiled. */
@@ -54,6 +55,86 @@ const nodeShimsPlugin: import("bun").BunPlugin = {
   },
 };
 
+/**
+ * Porffor lists the global builtin functions on the global object of every unit, and a function
+ * named like one of them (postgres: `export const escapeIdentifier = function escape(str) {}`)
+ * drops the entry from that unit alone, so a sproutd app that does it no longer matches the
+ * runtime's common code and is rejected at admission. A named function expression's name is only
+ * visible inside itself, so renaming it is safe unless the body calls itself by that name.
+ */
+const SHADOWED_BUILTIN_FUNCTIONS =
+  /([=(:,?&|]\s*|\breturn\s+)function\s+(escape|unescape|eval|isNaN|isFinite|parseInt|parseFloat|encodeURI|encodeURIComponent|decodeURI|decodeURIComponent)\s*\(/g;
+
+/** What a driver reads off `process`: an empty environment and a microtask for nextTick. */
+const PROCESS_STUB = `
+const env = {};
+function nextTick(fn, ...args) { Promise.resolve().then(() => fn(...args)); }
+const process = { env, platform: "linux", arch: "wasm32", version: "v20.0.0", versions: {}, argv: [], browser: true, nextTick, emitWarning() {}, cwd() { return "/"; }, stderr: { write() {} }, stdout: { write() {} }, on() {}, off() {}, once() {}, emit() {} };
+export default process;
+`;
+
+/**
+ * Node libraries use `Buffer` and `process` as free globals. Bun's browser target does not
+ * inject them for a CommonJS file, so a dependency that never imports Buffer would throw a
+ * ReferenceError at runtime. This gives every dependency file that uses one a local binding to the
+ * bundled implementation (the `buffer` package, which Porffor compiles; see the toolchain notes on
+ * typed array method dispatch). Applied only to node_modules, never to the handler's own code.
+ */
+const nodeGlobalsPlugin: import("bun").BunPlugin = {
+  name: "sproutboat-node-globals",
+  setup(build) {
+    build.onResolve({ filter: /^sb-node-process$/ }, () => ({ path: "sb-node-process", namespace: "sb-node-global" }));
+    build.onLoad({ filter: /.*/, namespace: "sb-node-global" }, () => ({ contents: PROCESS_STUB, loader: "js" }));
+    build.onLoad({ filter: /node_modules\/.*\.(?:c?js|mjs)$/ }, async (args) => {
+      const original = await Bun.file(args.path).text();
+      const text = original.replace(
+        SHADOWED_BUILTIN_FUNCTIONS,
+        (_m, lead: string, name: string) => `${lead}function ${name}_sb(`,
+      );
+      const usesBuffer =
+        /(?:^|[^.\w$])Buffer\s*[.(]/m.test(text) &&
+        !/\b(?:import|require)\b[^;\n]*\bBuffer\b/.test(text) &&
+        !/(?:const|let|var)\s+\{?\s*Buffer\b/.test(text);
+      const usesProcess =
+        /(?:^|[^.\w$])process\s*\./m.test(text) &&
+        !/\b(?:import|require)\b[^;\n]*\bprocess\b/.test(text) &&
+        !/(?:const|let|var|function)\s+\{?\s*process\b/.test(text);
+      const usesGlobal =
+        /(?:^|[^.\w$])global\s*\./m.test(text) && !/(?:const|let|var|function)\s+\{?\s*global\b/.test(text);
+      if (!usesBuffer && !usesProcess && !usesGlobal)
+        return text === original ? undefined : { contents: text, loader: "js" };
+      const esm = /^\s*(?:import|export)\s/m.test(text);
+      let prefix = "";
+      if (usesBuffer) prefix += esm ? `import { Buffer } from "buffer";\n` : `var { Buffer } = require("buffer");\n`;
+      if (usesProcess)
+        prefix += esm
+          ? `import process from "sb-node-process";\n`
+          : `var process = require("sb-node-process").default;\n`;
+      if (usesGlobal) prefix += "var global = globalThis;\n";
+      return { contents: prefix + text, loader: "js" };
+    });
+  },
+};
+
+const socketShimSpecifiers = new RegExp(
+  `^(${Object.keys(SOCKET_NODE_SHIMS)
+    .map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+    .join("|")})$`,
+);
+
+/** The Node built-ins a driver names, replaced from the sockets date: see SOCKET_NODE_SHIMS. */
+const socketShimsPlugin: import("bun").BunPlugin = {
+  name: "sproutboat-socket-shims",
+  setup(build) {
+    build.onResolve({ filter: socketShimSpecifiers }, (args) => ({ path: args.path, namespace: "sb-socket-shim" }));
+    build.onLoad({ filter: /.*/, namespace: "sb-socket-shim" }, (args) => ({
+      // SAFETY: onResolve above only routes specifiers built from SOCKET_NODE_SHIMS's own keys here.
+      contents: (SOCKET_NODE_SHIMS as Record<string, string>)[args.path],
+      loader: "js",
+    }));
+  },
+};
+
 /** Bun reports resolution failures on `AggregateError.errors`; its own message is just "Bundle failed". */
 function bundleDetail(cause: unknown): string {
   const errors = cause instanceof AggregateError ? cause.errors : [];
@@ -63,7 +144,15 @@ function bundleDetail(cause: unknown): string {
 }
 
 /** Bundle `entryPath` into a single module, resolving imports from `projectDir`. */
-export async function bundleHandler(entryPath: string, projectDir: string): Promise<BundleResult> {
+export async function bundleHandler(
+  entryPath: string,
+  projectDir: string,
+  options: { compatibilityDate?: string } = {},
+): Promise<BundleResult> {
+  // From the sockets date a driver bundles as it does for workerd: its "workerd" export condition,
+  // Node's free `Buffer`/`process`/`global` bound to bundled code, and net/tls/dns/fs/crypto shims
+  // that name cloudflare:sockets when the driver takes its Node path.
+  const sockets = options.compatibilityDate !== undefined && options.compatibilityDate >= SOCKETS_DATE;
   let built: Awaited<ReturnType<typeof Bun.build>>;
   try {
     built = await Bun.build({
@@ -78,10 +167,11 @@ export async function bundleHandler(entryPath: string, projectDir: string): Prom
       minify: false,
       splitting: false,
       sourcemap: "none",
-      plugins: [nodeShimsPlugin],
+      conditions: sockets ? ["workerd", "worker"] : undefined,
+      plugins: sockets ? [nodeShimsPlugin, socketShimsPlugin, nodeGlobalsPlugin] : [nodeShimsPlugin],
       // WorkerEntrypoint, DurableObject, RpcTarget and env are runtime globals; the
       // compiler turns this import into them, so it stays in the bundle as written.
-      external: ["cloudflare:workers"],
+      external: ["cloudflare:workers", "cloudflare:sockets"],
     });
   } catch (cause) {
     // An unresolvable specifier arrives as an AggregateError whose `errors`

package/src/fetch-pinned.ts

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+type Fetcher = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+export type FetchPinnedOptions = {
+  /** A vendored copy read from disk before any network source. Used only if its hash matches. */
+  localPath?: string;
+  /** Ordered download sources, tried after the vendored copy. Every one must serve the same bytes. */
+  urls: readonly string[];
+  /** Lowercase hex sha256 of the exact bytes. A source that serves anything else is rejected. */
+  sha256: string;
+  /** A verified copy is kept here (written atomically) and reused while its hash matches. */
+  cachePath?: string;
+  fetcher?: Fetcher;
+  /** Attempts per source for a 5xx or a network error. 4xx and a hash mismatch are never retried. */
+  attempts?: number;
+  /** First backoff; doubles each retry. */
+  backoffMs?: number;
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+};
+
+const sha256Hex = (bytes: Uint8Array): string => createHash("sha256").update(bytes).digest("hex");
+
+/** A failure that will not change on retry: a 4xx, or bytes that fail the pin. */
+class Permanent extends Error {}
+
+/**
+ * Return a build-time dependency's bytes, only if they hash to the pinned sha256: first the vendored
+ * file (`localPath`), then the ordered download list. The pin is what makes every source safe: one
+ * that has different bytes (a tampered vendored file included) is skipped, so the list can only
+ * improve availability, never change what gets built. A 5xx or a network error is retried with exponential backoff (bounded); a 4xx or a
+ * hash mismatch moves straight on to the next source.
+ */
+export async function fetchPinned(options: FetchPinnedOptions): Promise<Buffer> {
+  const sha256 = options.sha256.toLowerCase();
+  const fetcher: Fetcher = options.fetcher ?? fetch;
+  const attempts = Math.max(1, options.attempts ?? 3);
+  const sleep = options.sleep ?? ((ms: number) => Bun.sleep(ms));
+  if (options.localPath && existsSync(options.localPath)) {
+    const vendored = await readFile(options.localPath);
+    if (sha256Hex(vendored) === sha256) return vendored;
+    console.warn(
+      `fetchPinned: vendored ${options.localPath} does not match the pinned sha256, falling back to download`,
+    );
+  }
+  if (options.cachePath && existsSync(options.cachePath)) {
+    const cached = await readFile(options.cachePath);
+    if (sha256Hex(cached) === sha256) return cached;
+    await rm(options.cachePath, { force: true });
+  }
+  const failures: string[] = [];
+  for (const url of options.urls) {
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      if (attempt > 0) await sleep((options.backoffMs ?? 500) * 2 ** (attempt - 1));
+      try {
+        const response = await fetcher(url, { signal: AbortSignal.timeout(options.timeoutMs ?? 60_000) });
+        if (response.status >= 500) throw new Error(`HTTP ${response.status}`);
+        if (!response.ok) throw new Permanent(`HTTP ${response.status}`);
+        const bytes = Buffer.from(await response.arrayBuffer());
+        const got = sha256Hex(bytes);
+        if (got !== sha256) throw new Permanent(`sha256 mismatch (expected ${sha256}, got ${got})`);
+        if (options.cachePath) {
+          await mkdir(dirname(options.cachePath), { recursive: true });
+          const stage = `${options.cachePath}.${process.pid}.tmp`;
+          await writeFile(stage, bytes);
+          await rename(stage, options.cachePath);
+        }
+        return bytes;
+      } catch (error) {
+        failures.push(`${url}: ${error instanceof Error ? error.message : String(error)}`);
+        if (error instanceof Permanent) break;
+      }
+    }
+  }
+  throw new Error(`could not download a verified copy (sha256 ${sha256}) from any source:\n  ${failures.join("\n  ")}`);
+}

package/src/main.ts

@@ -234,7 +234,9 @@ async function readProject(directory = process.cwd()) {
   // smuggle in a Node API the handler is not allowed to touch.
   let bundle: BundleResult;
   try {
-    bundle = await bundleHandler(sourcePath, project.directory);
+    bundle = await bundleHandler(sourcePath, project.directory, {
+      compatibilityDate: project.config.compatibility_date,
+    });
   } catch (cause) {
     fail(cause instanceof BundleError ? cause.message : String(cause));
   }

package/src/node-shims.ts

@@ -386,3 +386,85 @@ export const NODE_SHIMS = {
   "node:querystring": NODE_QUERYSTRING_SHIM,
   "node:url": NODE_URL_SHIM,
 } satisfies Record<string, string>;
+
+// From the sockets date (2026-11-17), for drivers that carry a Node code path next to their Workers one.
+/**
+ * node:net, node:tls, node:dns, node:fs and node:util/types for drivers that carry a Node code path
+ * next to their Workers one (pg, mysql2). The Workers path never calls them: every function throws
+ * a message that names cloudflare:sockets, so a driver that does take the Node path says why.
+ */
+const unavailable = (what: string) =>
+  `function unavailable() { throw new Error("${what} is not available in a compiled handler; use cloudflare:sockets (connect())"); }\n`;
+const NODE_NET_SHIM =
+  unavailable("the net module") +
+  `class Socket { constructor() { unavailable(); } }
+const ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/;
+function isIP(x) { return ipv4.test(String(x)) ? 4 : String(x).indexOf(":") >= 0 && /^[0-9a-fA-F:.]+$/.test(String(x)) ? 6 : 0; }
+function connect() { unavailable(); }
+export { Socket, isIP, connect };
+export default { Socket, isIP, connect, createConnection: connect };
+`;
+const NODE_TLS_SHIM =
+  unavailable("the tls module") +
+  `function connect() { unavailable(); }
+export { connect };
+export default { connect };
+`;
+const NODE_DNS_SHIM =
+  unavailable("the dns module") +
+  `function lookup() { unavailable(); }
+export { lookup };
+export default { lookup, promises: { lookup } };
+`;
+const NODE_FS_SHIM =
+  unavailable("the fs module") +
+  `function readFileSync() { unavailable(); }
+function existsSync() { return false; }
+function statSync() { unavailable(); }
+function createReadStream() { unavailable(); }
+export { readFileSync, existsSync, statSync, createReadStream };
+export default { readFileSync, existsSync, statSync, createReadStream };
+`;
+const NODE_UTIL_TYPES_SHIM = `
+const isDate = (v) => v instanceof Date;
+const isTypedArray = (v) => ArrayBuffer.isView(v) && !(v instanceof DataView);
+const isUint8Array = (v) => v instanceof Uint8Array;
+const isArrayBuffer = (v) => v instanceof ArrayBuffer;
+const isPromise = (v) => v instanceof Promise;
+const isRegExp = (v) => v instanceof RegExp;
+export { isDate, isTypedArray, isUint8Array, isArrayBuffer, isPromise, isRegExp };
+export default { isDate, isTypedArray, isUint8Array, isArrayBuffer, isPromise, isRegExp };
+`;
+
+/**
+ * node:crypto as a Workers handler has it: the Web Crypto global, not the Node API. pg asks for
+ * `crypto.webcrypto || globalThis.crypto` and for createHash("md5") inside a try, so a createHash
+ * that throws sends it to crypto.subtle. Bun's default polyfill (crypto-browserify) is 20k lines,
+ * and its elliptic-curve code does not compile under Porffor.
+ */
+const NODE_CRYPTO_SHIM = `
+function unavailable() { throw new Error("this crypto function is not available; use crypto.subtle"); }
+const webcrypto = globalThis.crypto;
+function randomBytes(n) { return webcrypto.getRandomValues(new Uint8Array(n)); }
+function randomUUID() { return webcrypto.randomUUID(); }
+function createHash() { unavailable(); }
+function createHmac() { unavailable(); }
+export { webcrypto, randomBytes, randomUUID, createHash, createHmac };
+export default { webcrypto, randomBytes, randomUUID, createHash, createHmac, getRandomValues: (a) => webcrypto.getRandomValues(a), subtle: webcrypto.subtle };
+`;
+
+/** Replaces Bun's browser polyfills, in a bundle at the sockets date or later (see bundle.ts). */
+export const SOCKET_NODE_SHIMS = {
+  "node:crypto": NODE_CRYPTO_SHIM,
+  crypto: NODE_CRYPTO_SHIM,
+  "node:net": NODE_NET_SHIM,
+  net: NODE_NET_SHIM,
+  "node:tls": NODE_TLS_SHIM,
+  tls: NODE_TLS_SHIM,
+  "node:dns": NODE_DNS_SHIM,
+  dns: NODE_DNS_SHIM,
+  "node:fs": NODE_FS_SHIM,
+  fs: NODE_FS_SHIM,
+  "node:util/types": NODE_UTIL_TYPES_SHIM,
+  "util/types": NODE_UTIL_TYPES_SHIM,
+} satisfies Record<string, string>;

package/vendor/bearssl/LICENSE.txt

@@ -0,0 +1,21 @@
+Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+
+Permission is hereby granted, free of charge, to any person obtaining 
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be 
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/bearssl/README.md

@@ -0,0 +1,14 @@
+# Vendored BearSSL source
+
+`bearssl-7bea48e.tar.gz` is the BearSSL source snapshot the CLI builds embedded sprouts against. It ships in the
+npm package (and is embedded in standalone binaries), so a build needs no network access to bearssl.org, which
+returned HTTP 502 for hours on 2026-11-04.
+
+- Origin: https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=7bea48e5e850ab4cafbe68d3765cdaba13a86d6f;sf=tgz
+- Commit: `7bea48e5e850ab4cafbe68d3765cdaba13a86d6f` (`7bea48e5`; `git get-tar-commit-id` agrees)
+- sha256: `ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372`
+- License: MIT, see `LICENSE.txt` (copied from the tarball)
+
+`src/bearssl.ts` pins the sha256 and `fetchPinned` (`src/fetch-pinned.ts`) rejects this file if it does not match,
+then falls back to bearssl.org. To update: replace the tarball, then change `BEARSSL_COMMIT`, `BEARSSL_SHA256` and
+the import path in `src/bearssl.ts`.