sproutboat 0.51.0 → 0.52.0

package/CHANGELOG.md

@@ -10,6 +10,40 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.52.0] - 2026-11-06
+
+Built on `@sproutboat/toolchain` 0.24.1, `@sproutboat/runtime` 0.42.2 and `@sproutboat/wire` 0.22.2. The compiler changes, so every app is recompiled on its next build. Nothing an app can observe changes apart from the two fixes below, so there is no new compatibility date.
+
+### Changed
+
+- **Standalone binaries and deploys now build with Porffor alpha 22** (was alpha 19). Binaries are about 5% smaller (hello 6.58 to 6.27 MB, stress 6.62 to 6.30 MB, linux-x64). Apps using jose, yaml, supabase-js and Neon (HTTP, and `Pool` over WebSocket) are checked route by route and give the same results as on alpha 19 and on Bun. Measured against alpha 19 on the same box: idle memory is 3 to 7% lower, requests per second are 5 to 15% lower, p50 latency is 3 to 8% higher, and p95 is up to about 30% (5 to 8 µs) higher on a request-heavy app. The module is composed the way sproutd's workers are, so no Node runtime module is linked, and it is served by the same uWebSockets server as before (WebSockets, streaming, graceful restart). LTO is on for optimized builds.
+- **Fallback:** `SPROUTBOAT_PORFFOR_CHANNEL=alpha-19` builds with the previous alpha 19 compiler for this release only; it will be removed in the next one. The compile cache is keyed by channel, so switching back and forth does not reuse the wrong binary. The artifact manifest and `sproutboat versions view` now report the Porffor release a build actually used (`alpha-22 (a081ebd)`).
+- **`build --standalone --with-restore` stays on alpha 19 for now.** Its offline `ltx-restore` command is built against alpha 19's native C API, which alpha 22 does not provide yet, so such a build uses the alpha 19 compiler. Setting `SPROUTBOAT_PORFFOR_CHANNEL=alpha-22` together with `--with-restore` is an error, not a link failure.
+
+### Fixed
+
+- **A `Uint8Array` or `ArrayBuffer` response body is sent with its real length.** On the alpha 22 server the bridge read the length from the buffer's flags word, so such a response went out with `Content-Length: 2147483647`. Found while qualifying alpha 22. No release ever shipped it, since alpha 19 was the default until now.
+- **Neon's `Pool` over WebSocket no longer hangs.** Alpha 22 linked its Node runtime's `process`, `setImmediate`, `clearImmediate` and `global` for any app that named them. pg-pool then queued on `process.nextTick`, and a standalone binary never drains that queue. These four names are now absent, as on alpha 19, so libraries no longer take their Node code paths.
+
+## [0.51.1] - 2026-11-05
+
+Built on `@sproutboat/runtime` 0.42.2, `@sproutboat/toolchain` 0.23.1 and `@sproutboat/wire` 0.22.2. Nothing an app can observe changes except latency, the refused address ranges below and the `startTls()` write order, so there is no new compatibility date.
+
+### Fixed
+
+- **Bytes written right after `socket.startTls()` no longer go out unencrypted.** On a `connect()` socket, the I/O thread took the start-TLS request and the app's queued writes in the same pass, and flushed all of them in plaintext before switching to TLS. Any write queued before the thread picked up the upgrade could leave in the clear. Only the bytes written before `startTls()` now go out in plaintext. Everything after waits until the TLS engine owns the socket, and new writes on the old plaintext socket reject, as in workerd. A failed plaintext flush is now a connection error. The egress tunnel also no longer stays paused on the discarded plain socket after an upgrade under backpressure.
+
+- The BearSSL source ships in the package (`vendor/bearssl`, 867 KB) and is read first, hash-verified, so builds no longer depend on bearssl.org being up. bearssl.org stays as the fallback, with bounded retry on 5xx. Every source, vendored or downloaded, is checked against the pinned sha256, so a bad file cannot change what gets built.
+- **A malformed `connect()` tunnel opening frame no longer ends the egress process.** A `tcp.open` head whose JSON did not parse used to throw out of the egress service's socket handler before the token was checked, which took egress down for every app. It now gets an `expected tcp.open` error frame and only that connection closes; the broker answers it as a bad request, and a refused head stops buffering whatever the client keeps sending.
+
+### Changed
+
+- **`fetch()` and `connect()` refuse more reserved address space** that carries no public service: AS112 and the old IPv4 anycast blocks (`192.31.196.0/24`, `192.52.193.0/24`, `192.88.99.0/24`, `192.175.48.0/24`), SIIT (`::ffff:0:0:0/96`), IETF protocol assignments including Teredo (`2001::/23`), `3fff::/20` and SRv6 (`5f00::/16`). This applies to the broker, the egress service and a standalone binary alike, and `SB_EGRESS_ALLOW` still overrides it.
+
+### Performance
+
+- **Outbound TCP sockets set `TCP_NODELAY`.** Nagle's algorithm and the peer's delayed ACK stalled every fresh HTTPS `fetch()` by about 44 ms on Linux, because each small TLS handshake flight waited for an ACK; a fresh fetch now takes about 1.4 ms. This covers `fetch()`, outbound WebSockets and `connect()` on a standalone binary, including sockets handed over by `SB_EGRESS_FD`, and the egress tunnel's connections to origins.
+
 ## [0.51.0] - 2026-11-03
 
 Built on `@sproutboat/runtime` 0.42.0, `@sproutboat/toolchain` 0.23.0 and `@sproutboat/wire` 0.22.0. The change below starts at a new compatibility date; earlier dates answer as before.

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.51.0
+**Package:** `sproutboat` 0.52.0
 
 ## Commands
 
@@ -48,6 +48,8 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `CXX` | C++ compiler for a host build's native-fetch link step (default `c++` if present, else the vendored Zig cross-compiler targeting this host). |
 | `AR` | Archiver used to assemble uSockets.a for a host build (default `ar` if present, else Zig's). |
 | `SPROUTBOAT_COMPILE_TIMEOUT_MS` | Porffor compile timeout in ms (default 600000). |
+| `SPROUTBOAT_PORFFOR_CHANNEL` | Porffor channel for standalone builds: `alpha-22` (default) or `alpha-19` (the previous compiler, kept as a fallback for one release). |
+| `SPROUTBOAT_FLTO` | Overrides link-time optimization on alpha 22 builds: `1` turns it on, `0` turns it off. |
 | `SPROUTBOAT_TOOLCHAIN_CACHE` | Managed Porffor and compiler cache root (default ~/.cache/sproutboat). |
 | `SPROUTBOAT_PORFFOR_DIR` | Contributor override for an existing Porffor source checkout. Required files are validated before use. |
 | `SPROUTBOAT_BUILD_UWS_FROM_SOURCE` | Set to 1 to explicitly allow the contributor-only Git and Make uWebSockets fallback. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,9 +64,9 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.42.0",
-    "@sproutboat/toolchain": "^0.23.0",
-    "@sproutboat/wire": "^0.22.0"
+    "@sproutboat/runtime": "^0.42.2",
+    "@sproutboat/toolchain": "^0.24.1",
+    "@sproutboat/wire": "^0.22.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.85.0",
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.51.0",
-    "@sproutboat/cli-darwin-x64": "0.51.0",
-    "@sproutboat/cli-linux-arm64": "0.51.0",
-    "@sproutboat/cli-linux-x64": "0.51.0"
+    "@sproutboat/cli-darwin-arm64": "0.52.0",
+    "@sproutboat/cli-darwin-x64": "0.52.0",
+    "@sproutboat/cli-linux-arm64": "0.52.0",
+    "@sproutboat/cli-linux-x64": "0.52.0"
   },
   "engines": {
     "node": ">=18"

package/src/bearssl.ts

@@ -19,6 +19,9 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
+// @ts-expect-error Bun's file loader returns the embedded asset path in a compiled executable.
+import embeddedBearsslArchive from "../vendor/bearssl/bearssl-7bea48e.tar.gz" with { type: "file" };
+import { fetchPinned, type FetchPinnedOptions } from "./fetch-pinned";
 import { LINUX_TARGETS, type BuildTarget } from "./targets";
 import { resolveHostCompiler } from "./toolchain";
 
@@ -112,12 +115,22 @@ const run = (
     child.on("close", (code) => done({ code: code ?? 1, stderr }));
   });
 
+/**
+ * The pinned BearSSL source: the vendored copy (ships in the npm package, embedded in standalone
+ * binaries) first, bearssl.org only as a fallback. bearssl.org returned 502 for hours on 2026-11-04.
+ */
+export const bearsslVendorArchive = (): string => embeddedBearsslArchive;
+
+export const fetchBearsslTarball = (overrides: Partial<FetchPinnedOptions> = {}): Promise<Buffer> =>
+  fetchPinned({
+    localPath: bearsslVendorArchive(),
+    urls: [BEARSSL_URL],
+    sha256: BEARSSL_SHA256,
+    ...overrides,
+  });
+
 async function download(url: string, expected: string, to: string): Promise<Buffer> {
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`could not download ${url}: HTTP ${response.status}`);
-  const bytes = Buffer.from(await response.arrayBuffer());
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== expected) throw new Error(`checksum mismatch for ${url}: expected ${expected}, got ${digest}`);
+  const bytes = await fetchPinned({ urls: [url], sha256: expected });
   await writeFile(to, bytes);
   return bytes;
 }
@@ -143,7 +156,7 @@ async function sourceTree(): Promise<string> {
     await rm(tree, { recursive: true, force: true });
     if (!existsSync(tarball) || (await digest(tarball)) !== BEARSSL_SHA256) {
       await rm(tarball, { force: true });
-      await download(BEARSSL_URL, BEARSSL_SHA256, tarball);
+      await writeFile(tarball, await fetchBearsslTarball());
     }
     const stage = resolve(dir, `.bearssl-stage-${process.pid}-${crypto.randomUUID()}`);
     await mkdir(stage, { recursive: true });

package/src/build.ts

@@ -7,7 +7,7 @@ import { queueSettings, resourceRefs, type SproutboatConfig } from "./config";
 import { ensureSqliteObject } from "./sqlite";
 import { sqliteStamp } from "./sqlite";
 import { bearsslStamp, ensureBearssl } from "./bearssl";
-import { compileSprout, loadPrelude, type Transport } from "./compile";
+import { compileSprout, loadPrelude, porfforChannel, type Transport } from "./compile";
 import { compileCached } from "./compile-cache";
 import type { BuildTarget } from "./targets";
 import {
@@ -20,6 +20,7 @@ import {
 } from "./manifest";
 import { ensureZig, esbuildVersion, porfforVersion, toolchainStamp } from "./toolchain";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_COMMIT_FULL } from "./porffor-toolchain";
+import { A21_STANDALONE_FINGERPRINT } from "@sproutboat/toolchain/a21";
 import { version as toolchainPackageVersion } from "@sproutboat/toolchain/package.json" with { type: "json" };
 import { version as cliVersion } from "../package.json" with { type: "json" };
 import { reachesSubtle, wrapNativeFetchHandler } from "./wrap";
@@ -336,6 +337,13 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       toolchain: toolchainStamp(),
       toolchainPackageVersion,
       porffor: [PORFFOR_COMMIT_FULL, PORFFOR_ARCHIVE_SHA256],
+      // the alpha 22 channel is a different compiler, server and prelude shape (compile.ts porfforChannel)
+      channel: porfforChannel(input.withRestore),
+      // the alpha 22 channel's own inputs: the patched tree, the shim, the bridge, the build recipe, LTO
+      channelInputs:
+        porfforChannel(input.withRestore) === "alpha-22"
+          ? [A21_STANDALONE_FINGERPRINT, process.env.SPROUTBOAT_FLTO ?? ""]
+          : null,
       native: embedded ? [sqliteStamp(), bearsslStamp()] : subtle ? [bearsslStamp()] : [],
       integration: await integrationIdentity(),
       nativeRestore: input.withRestore ? NATIVE_RESTORE_IDENTITY : null,
@@ -427,7 +435,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
       target: host ? hostTarget() : target === "linux-arm64" ? target : DEPLOY_TARGET,
       runtime: RUNTIME,
       capabilityProfile: CAPABILITY_PROFILE,
-      porfforVersion: porfforVersion(),
+      porfforVersion: porfforVersion(porfforChannel(input.withRestore)),
       esbuildVersion: esbuildVersion(),
       buildImage: toolchainStamp(),
       compatibilityDate: input.config.compatibility_date,

package/src/compile.ts

@@ -20,10 +20,20 @@ import {
   ensureUWebSocketsHost,
   ensureUWebSocketsStandalone,
   resolveHostCompiler,
+  uwsCommitFull,
   UwsUnavailableError,
 } from "./toolchain";
 import { isLinuxTarget, LINUX_TARGETS, linuxTriple, type BuildTarget } from "./targets";
 import { ensurePorffor } from "./porffor-toolchain";
+import {
+  buildStandaloneA21,
+  composeStandaloneA21,
+  ensurePorfforA21,
+  SHARED_PRELUDE_FILE,
+  STANDALONE_A21_COMPILE_FLAGS,
+  standaloneChannel,
+  type StandaloneChannel,
+} from "@sproutboat/toolchain/a21";
 // The prelude + transports live in @sproutboat/runtime (next to wrap.ts, which
 // locates them by file URL). `preludePath`/`transportPath` read them from there
 // for a dev build; these text imports bake the same files into the `--compile`
@@ -56,6 +66,29 @@ export {
 
 const COMPILE_TIMEOUT_MS = Number(process.env.SPROUTBOAT_COMPILE_TIMEOUT_MS || 600_000);
 
+/**
+ * The Porffor channel a native compile uses: `alpha-22` by default (the alpha 21 line's compiler with
+ * the toolchain's alpha 19 server shim over its bridge; sproutd-alpha22-standalone-port.md), or
+ * `alpha-19` (`SPROUTBOAT_PORFFOR_CHANNEL=alpha-19`: Porffor's native-fetch server, the fallback pin
+ * kept for one release). The toolchain's `standaloneChannel()` decides, so the CLI and the runtime's
+ * native tests agree on the default.
+ *
+ * `--with-restore` stays on alpha 19: its restore objects are built against alpha 19's native-fetch
+ * C API, which the alpha 22 bridge does not provide, so they do not link there. Unless the channel is
+ * set explicitly, such a build uses the alpha 19 compiler; `SPROUTBOAT_PORFFOR_CHANNEL=alpha-22` with
+ * `--with-restore` is an error rather than a link failure.
+ */
+export type PorfforChannel = StandaloneChannel;
+export function porfforChannel(withRestore = false): PorfforChannel {
+  const channel = standaloneChannel();
+  if (!withRestore || channel === "alpha-19") return channel;
+  if (process.env.SPROUTBOAT_PORFFOR_CHANNEL)
+    throw new Error(
+      "--with-restore is not available on Porffor alpha 22 yet: unset SPROUTBOAT_PORFFOR_CHANNEL or set it to alpha-19",
+    );
+  return "alpha-19";
+}
+
 export type CompileInput = {
   sourcePath: string;
   /** Stable compiler input for dev rebuilds, independent of the candidate binary path. */
@@ -334,6 +367,22 @@ export async function compileSprout(input: CompileInput): Promise<void> {
       })
     : [];
 
+  if (porfforChannel(input.withRestore) === "alpha-22") {
+    await compileSproutA21(input, {
+      alpha19Root: porffor,
+      generatedPath,
+      launch: PACKAGED
+        ? [process.execPath, "__porffor"]
+        : [process.execPath, resolve(import.meta.dir, "main.ts"), "__porffor"],
+      path,
+      hostCompiler,
+      restoreObjects,
+      uwsVariant,
+    });
+    await chmod(input.outPath, 0o555);
+    return;
+  }
+
   const child = Bun.spawn(
     [...command, ...porfforArgs(generatedPath, input.outPath, input.target, input.optimize, hostCompiler?.usingZig)],
     {
@@ -369,3 +418,81 @@ export async function compileSprout(input: CompileInput): Promise<void> {
   }
   await chmod(input.outPath, 0o555);
 }
+
+/**
+ * The alpha 22 channel's native compile (sproutd-alpha22-standalone-port.md): the generated module is
+ * compiled in sproutd's worker shape (the toolchain composes `shared-prelude.js` from it: alpha 19
+ * helper names, the alpha 19 web classes, the dispatch shim), the alpha 22 compiler renders the split
+ * C units, and the toolchain's build recipe compiles them with the native-fetch bridge and the alpha
+ * 19 uWebSockets shim rewritten over flat data, then links with this build's native objects (SQLite,
+ * BearSSL, the restore objects) and the uSockets this target already has. Same inputs, same outputs,
+ * same environment variables as the alpha 19 path; the only switch is `SPROUTBOAT_PORFFOR_CHANNEL`.
+ */
+async function compileSproutA21(
+  input: CompileInput,
+  build: {
+    alpha19Root: string;
+    generatedPath: string;
+    launch: string[];
+    path: string;
+    hostCompiler?: { cc: string[]; cxx: string[]; usingZig: boolean };
+    restoreObjects: string[];
+    uwsVariant?: string;
+  },
+): Promise<void> {
+  const alpha22 = await ensurePorfforA21("alpha-22");
+  const dir = dirname(build.generatedPath);
+  const composed = composeStandaloneA21(await readFile(build.generatedPath, "utf8"), build.alpha19Root);
+  // beside sprout.generated.js (which stays the wrapped module, for emit-only, dev and the cache key)
+  await writeFile(resolve(dir, SHARED_PRELUDE_FILE), composed.sharedPrelude);
+  const entry = resolve(dir, "sprout.a22.js");
+  await writeFile(entry, composed.entry);
+  const unitsDir = resolve(dir, "units-a22");
+  await rm(unitsDir, { recursive: true, force: true }).catch(() => {});
+  // the compiler's own build cache (keyed by entry path) is not used: `c` only renders
+  const render = Bun.spawn(
+    [
+      ...build.launch,
+      resolve(alpha22, "runtime/index.js"),
+      "c",
+      entry,
+      "-o",
+      `${unitsDir}/`,
+      ...STANDALONE_A21_COMPILE_FLAGS,
+    ],
+    { cwd: dir, stdout: "pipe", stderr: "pipe", env: { ...process.env, PATH: build.path } },
+  );
+  const [code, stdout, stderr] = await Promise.all([
+    render.exited,
+    new Response(render.stdout).text(),
+    new Response(render.stderr).text(),
+  ]);
+  if (code !== 0) throw new Error(`Porffor (alpha 22) render failed: ${(stderr || stdout).trim() || `exit ${code}`}`);
+
+  const host = input.target === "host";
+  const triple = host ? undefined : linuxTriple(input.target);
+  const cc = host ? build.hostCompiler!.cc : [input.zigBin!, "cc", "-target", triple!];
+  const cxx = host ? build.hostCompiler!.cxx : [input.zigBin!, "c++", "-target", triple!];
+  const uwsDir = resolve(
+    homedir(),
+    ".cache/porffor/deps",
+    host ? `uWebSockets-${uwsCommitFull()}` : `uWebSockets-${uwsCommitFull()}-musl-${build.uwsVariant ?? "sa-x86_64"}`,
+  );
+  await buildStandaloneA21({
+    unitsDir,
+    alpha19Root: build.alpha19Root,
+    outPath: input.outPath,
+    cc,
+    cxx,
+    uwsDir,
+    extraLink: [...(input.extraLink ?? []), ...build.restoreObjects],
+    extraCflags: [...(input.extraCflags ?? []), ...(input.withRestore ? ["-Dmain=sb_app_main"] : [])],
+    optimize: input.optimize === "dev" && host ? 0 : 3,
+    // LTO on for every optimized build, zig's musl cross builds included (romeo, M4: +11% req/s on hello,
+    // +7% on stress, and 4% smaller); SPROUTBOAT_FLTO=0 turns it off for measurements
+    flto: process.env.SPROUTBOAT_FLTO ? process.env.SPROUTBOAT_FLTO === "1" : !(input.optimize === "dev" && host),
+    musl: !host,
+    strip: true,
+  });
+  if (!(await Bun.file(input.outPath).exists())) throw new Error("alpha 22 build produced no binary");
+}

package/src/fetch-pinned.ts

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
+type Fetcher = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+export type FetchPinnedOptions = {
+  /** A vendored copy read from disk before any network source. Used only if its hash matches. */
+  localPath?: string;
+  /** Ordered download sources, tried after the vendored copy. Every one must serve the same bytes. */
+  urls: readonly string[];
+  /** Lowercase hex sha256 of the exact bytes. A source that serves anything else is rejected. */
+  sha256: string;
+  /** A verified copy is kept here (written atomically) and reused while its hash matches. */
+  cachePath?: string;
+  fetcher?: Fetcher;
+  /** Attempts per source for a 5xx or a network error. 4xx and a hash mismatch are never retried. */
+  attempts?: number;
+  /** First backoff; doubles each retry. */
+  backoffMs?: number;
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+};
+
+const sha256Hex = (bytes: Uint8Array): string => createHash("sha256").update(bytes).digest("hex");
+
+/** A failure that will not change on retry: a 4xx, or bytes that fail the pin. */
+class Permanent extends Error {}
+
+/**
+ * Return a build-time dependency's bytes, only if they hash to the pinned sha256: first the vendored
+ * file (`localPath`), then the ordered download list. The pin is what makes every source safe: one
+ * that has different bytes (a tampered vendored file included) is skipped, so the list can only
+ * improve availability, never change what gets built. A 5xx or a network error is retried with exponential backoff (bounded); a 4xx or a
+ * hash mismatch moves straight on to the next source.
+ */
+export async function fetchPinned(options: FetchPinnedOptions): Promise<Buffer> {
+  const sha256 = options.sha256.toLowerCase();
+  const fetcher: Fetcher = options.fetcher ?? fetch;
+  const attempts = Math.max(1, options.attempts ?? 3);
+  const sleep = options.sleep ?? ((ms: number) => Bun.sleep(ms));
+  if (options.localPath && existsSync(options.localPath)) {
+    const vendored = await readFile(options.localPath);
+    if (sha256Hex(vendored) === sha256) return vendored;
+    console.warn(
+      `fetchPinned: vendored ${options.localPath} does not match the pinned sha256, falling back to download`,
+    );
+  }
+  if (options.cachePath && existsSync(options.cachePath)) {
+    const cached = await readFile(options.cachePath);
+    if (sha256Hex(cached) === sha256) return cached;
+    await rm(options.cachePath, { force: true });
+  }
+  const failures: string[] = [];
+  for (const url of options.urls) {
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      if (attempt > 0) await sleep((options.backoffMs ?? 500) * 2 ** (attempt - 1));
+      try {
+        const response = await fetcher(url, { signal: AbortSignal.timeout(options.timeoutMs ?? 60_000) });
+        if (response.status >= 500) throw new Error(`HTTP ${response.status}`);
+        if (!response.ok) throw new Permanent(`HTTP ${response.status}`);
+        const bytes = Buffer.from(await response.arrayBuffer());
+        const got = sha256Hex(bytes);
+        if (got !== sha256) throw new Permanent(`sha256 mismatch (expected ${sha256}, got ${got})`);
+        if (options.cachePath) {
+          await mkdir(dirname(options.cachePath), { recursive: true });
+          const stage = `${options.cachePath}.${process.pid}.tmp`;
+          await writeFile(stage, bytes);
+          await rename(stage, options.cachePath);
+        }
+        return bytes;
+      } catch (error) {
+        failures.push(`${url}: ${error instanceof Error ? error.message : String(error)}`);
+        if (error instanceof Permanent) break;
+      }
+    }
+  }
+  throw new Error(`could not download a verified copy (sha256 ${sha256}) from any source:\n  ${failures.join("\n  ")}`);
+}

package/src/surface.ts

@@ -237,6 +237,15 @@ export const ENV_VARS: readonly EnvVar[] = [
     purpose: "Archiver used to assemble uSockets.a for a host build (default `ar` if present, else Zig's).",
   },
   { name: "SPROUTBOAT_COMPILE_TIMEOUT_MS", purpose: "Porffor compile timeout in ms (default 600000)." },
+  {
+    name: "SPROUTBOAT_PORFFOR_CHANNEL",
+    purpose:
+      "Porffor channel for standalone builds: `alpha-22` (default) or `alpha-19` (the previous compiler, kept as a fallback for one release).",
+  },
+  {
+    name: "SPROUTBOAT_FLTO",
+    purpose: "Overrides link-time optimization on alpha 22 builds: `1` turns it on, `0` turns it off.",
+  },
   {
     name: "SPROUTBOAT_TOOLCHAIN_CACHE",
     purpose: "Managed Porffor and compiler cache root (default ~/.cache/sproutboat).",

package/src/toolchain.ts

@@ -16,6 +16,12 @@ import { dirname, resolve } from "node:path";
 // @ts-expect-error Bun's file loader returns the embedded asset path in a compiled executable.
 import embeddedUwsArchive from "../vendor/uwebsockets-360c276d-musl.tar.xz" with { type: "file" };
 import { BEARSSL_VERSION } from "./bearssl";
+import {
+  PORFFOR_A22_CHANNEL,
+  PORFFOR_A22_COMMIT,
+  standaloneChannel,
+  type StandaloneChannel,
+} from "@sproutboat/toolchain/a21";
 import { cachedPorfforRoot, PORFFOR_CHANNEL, PORFFOR_COMMIT } from "./porffor-toolchain";
 import { SQLITE_VERSION } from "./sqlite";
 import { LINUX_TARGETS, type LinuxTarget } from "./targets";
@@ -443,7 +449,7 @@ export function inspectToolchain(): ToolchainDoctor {
   };
 }
 
-function uwsCommitFull(): string {
+export function uwsCommitFull(): string {
   try {
     const src = readFileSync(resolve(porfforRoot(), "compiler/uwebsockets.js"), "utf8");
     return /UWS_COMMIT\s*=\s*['"]([0-9a-f]{40})/.exec(src)?.[1] ?? UWS_COMMIT_FULL;
@@ -672,8 +678,10 @@ export function porfforRoot(start = import.meta.dir): string {
   }
 }
 
-export function porfforVersion(): string {
+/** The Porffor release a build compiles with, on the standalone channel it uses (default: the environment's). */
+export function porfforVersion(channel: StandaloneChannel = standaloneChannel()): string {
   if (process.env.PORFFOR_VERSION) return process.env.PORFFOR_VERSION;
+  if (channel === "alpha-22") return `${PORFFOR_A22_CHANNEL} (${PORFFOR_A22_COMMIT})`;
   return `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }
 

package/vendor/bearssl/LICENSE.txt

@@ -0,0 +1,21 @@
+Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+
+Permission is hereby granted, free of charge, to any person obtaining 
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be 
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/bearssl/README.md

@@ -0,0 +1,14 @@
+# Vendored BearSSL source
+
+`bearssl-7bea48e.tar.gz` is the BearSSL source snapshot the CLI builds embedded sprouts against. It ships in the
+npm package (and is embedded in standalone binaries), so a build needs no network access to bearssl.org, which
+returned HTTP 502 for hours on 2026-11-04.
+
+- Origin: https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=7bea48e5e850ab4cafbe68d3765cdaba13a86d6f;sf=tgz
+- Commit: `7bea48e5e850ab4cafbe68d3765cdaba13a86d6f` (`7bea48e5`; `git get-tar-commit-id` agrees)
+- sha256: `ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372`
+- License: MIT, see `LICENSE.txt` (copied from the tarball)
+
+`src/bearssl.ts` pins the sha256 and `fetchPinned` (`src/fetch-pinned.ts`) rejects this file if it does not match,
+then falls back to bearssl.org. To update: replace the tarball, then change `BEARSSL_COMMIT`, `BEARSSL_SHA256` and
+the import path in `src/bearssl.ts`.