sproutboat 0.7.0 → 0.9.0

package/src/broker.ts

@@ -23,6 +23,7 @@ import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join, normalize, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { resolveAssetKey, type AssetManifest } from "./assets";
+import { isSafeInteger } from "./json";
 import { isBoolean, isString, jsonObject, parseJsonValue, type JsonObject, type JsonValue } from "./json";
 
 export type Bindings = {
@@ -34,6 +35,8 @@ export type Bindings = {
   queues: string[];
   analytics: string[];
   do: Array<{ binding: string; className: string }>;
+  /** #48 — worker-to-worker: binding name -> the project it calls. */
+  services: Array<{ binding: string; service: string }>;
   crons: string[];
   /** Static-asset binding name, or `""` when assets are edge-only. */
   assets: string;
@@ -56,6 +59,21 @@ export type BrokerOptions = {
   db?: string;
   /** Directory for per-D1-binding SQLite files. Defaults to `<dirname(db)>/d1`, or in-memory when `db` is `:memory:`. */
   dataDir?: string;
+  /**
+   * #48 — where to send a service-binding call: the node's edge, on loopback.
+   * Forwarding through the edge rather than dialling the target sprout directly
+   * reuses everything the request path already does — routing, the process
+   * pool, cold start, metrics, logs — and means the broker needs no knowledge
+   * of where a deployment is running.
+   */
+  edgeUrl?: string;
+  /**
+   * #48 — binding name -> the target's hostname, resolved by the control plane
+   * at activation. Not part of the artifact: the same binary deploys to boxes
+   * with different domains, and a target can be redeployed without rebuilding
+   * its callers.
+   */
+  services?: Record<string, string>;
   /**
    * #74 — directory holding one `<resource-id>.sqlite` per account-level KV / R2 /
    * queue / D1 resource. Defaults to `<dirname(db)>/resources`, in-memory when
@@ -86,7 +104,8 @@ type D1Result = {
 };
 type R2Row = {
   key: string;
-  body: string;
+  /** TEXT from a v0 write, BLOB from a v1 one; sqlite hands each back as-is. */
+  body: string | Uint8Array;
   size: number;
   etag: string;
   uploaded: string;
@@ -110,9 +129,43 @@ export type Broker = {
   dispatch(msg: Frame): Promise<Frame>;
   /** Verify the token line and dispatch a raw "<token>\n<json>" payload. */
   handlePayload(payload: string): Promise<Frame>;
+  /**
+   * #63 — one wire frame in, one out, binary included.
+   *
+   * v0 payloads are `"<token>\n<json>"` and stay exactly as they were: a
+   * deployment built before this existed keeps working against a newer broker.
+   * v1 starts with a 0x01 marker and carries `[u32 LE json length][json][bytes]`,
+   * so an object body never has to be escaped into the JSON. A token's first
+   * character is never 0x01, which is what makes the two tellable apart without
+   * negotiation.
+   */
+  handleFrame(payload: Buffer): Promise<Buffer>;
   close(): void;
 };
 
+/** First byte of a v1 payload. */
+export const FRAME_V1 = 1;
+
+/** Wrap a payload in the [u32 LE length] header every frame carries. */
+export function frameOf(payload: Buffer): Buffer {
+  const out = Buffer.allocUnsafe(4 + payload.length);
+  out.writeUInt32LE(payload.length, 0);
+  payload.copy(out, 4);
+  return out;
+}
+
+/** Build a v1 payload: marker, json length, json, then the bytes. */
+export function encodeV1(json: Frame, binary?: Uint8Array): Buffer {
+  const body = Buffer.from(JSON.stringify(json), "utf8");
+  const bin = binary ?? new Uint8Array(0);
+  const out = Buffer.allocUnsafe(1 + 4 + body.length + bin.length);
+  out.writeUInt8(FRAME_V1, 0);
+  out.writeUInt32LE(body.length, 1);
+  body.copy(out, 5);
+  if (bin.length) Buffer.from(bin.buffer, bin.byteOffset, bin.length).copy(out, 5 + body.length);
+  return out;
+}
+
 export function createBroker(opts: BrokerOptions = {}): Broker {
   const bindings: Bindings = {
     kv: [],
@@ -123,6 +176,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     queues: [],
     analytics: [],
     do: [],
+    services: [],
     crons: [],
     assets: "",
     resources: {},
@@ -142,16 +196,19 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       assetManifest = JSON.parse(readFileSync(manifestPath, "utf8")) as AssetManifest;
     }
   }
-  const readAsset = (path: string): { type: string; hash: string; body: string } | null => {
+  const readAsset = (path: string): { type: string; hash: string; body: Uint8Array } | null => {
     if (!assetsDir || !assetManifest) return null;
     const entry = assetManifest.files[path];
     if (!entry) return null;
     // path keys are `/`-prefixed and `..`-free (walkAssets), but re-check.
     const abs = normalize(join(assetsDir, path));
     if (!abs.startsWith(assetsDir)) return null;
-    return { type: entry.type, hash: entry.hash, body: readFileSync(abs, "utf8") };
+    return { type: entry.type, hash: entry.hash, body: readFileSync(abs) };
   };
   const token = opts.token ?? "";
+  /** #63 §3 — replies to recent non-idempotent requests, keyed by op and id. */
+  const replayed = new Map<string, Frame>();
+  const serviceHosts = opts.services ?? {};
   const doFetch = opts.fetchImpl ?? fetch;
 
   const dbPath = opts.db ?? ":memory:";
@@ -193,6 +250,12 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     "CREATE TABLE IF NOT EXISTS ae (dataset TEXT NOT NULL, ts INTEGER NOT NULL, indexes_json TEXT NOT NULL, " +
       "blobs_json TEXT NOT NULL, doubles_json TEXT NOT NULL)",
   );
+  // #125 — at most one pending alarm per object, which is the Workers rule: a
+  // later setAlarm replaces the earlier one rather than queueing beside it.
+  db.exec(
+    "CREATE TABLE IF NOT EXISTS do_alarm (cls TEXT NOT NULL, id TEXT NOT NULL, at INTEGER NOT NULL, " +
+      "attempts INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (cls, id))",
+  );
 
   // #74 — one SQLite file per account-level resource id, opened on first use.
   const resourceDbs = new Map<string, Database>();
@@ -304,6 +367,16 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     };
   };
 
+  /** An object body as bytes, whichever storage class it came back in. */
+  const r2Bytes = (body: string | Uint8Array): Uint8Array =>
+    body instanceof Uint8Array ? body : new TextEncoder().encode(body);
+
+  /** An object body as text, for the v0 reply shape that carries it in JSON.
+   *  A binary object stored by a v1 client cannot survive this, which is why
+   *  v1 exists — but returning a decoded string beats returning `{"0":...}`. */
+  const r2Text = (body: string | Uint8Array): string =>
+    body instanceof Uint8Array ? new TextDecoder().decode(body) : body;
+
   const r2Row = (r: R2Row) => ({
     key: r.key,
     size: r.size,
@@ -313,6 +386,36 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     customMetadata: parseJsonValue(r.custom_json),
   });
 
+  /**
+   * An outbound response body, refused past a cap.
+   *
+   * The size is the remote host's choice, and the body is held whole: measured
+   * on a standalone binary, a 100 MB response took resident memory from 43 MB
+   * to 321 MB. One allowlisted upstream having a bad day should not be able to
+   * end the process. 32 MiB by default, and the same variable the embedded
+   * transport reads so both backends agree.
+   */
+  async function readCapped(response: Response, host: string): Promise<string> {
+    const cap = Number(process.env.SB_FETCH_MAX_BYTES) || 32 * 1024 * 1024;
+    const declared = Number(response.headers.get("content-length") || 0);
+    if (declared > cap) throw new Error(`response exceeds SB_FETCH_MAX_BYTES from ${host}`);
+    const reader = response.body?.getReader();
+    if (!reader) return "";
+    const parts: Uint8Array[] = [];
+    let total = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > cap) {
+        await reader.cancel();
+        throw new Error(`response exceeds SB_FETCH_MAX_BYTES from ${host}`);
+      }
+      parts.push(value);
+    }
+    return new TextDecoder().decode(Buffer.concat(parts));
+  }
+
   async function proxyFetch(msg: Frame): Promise<Frame> {
     let url: URL;
     try {
@@ -338,7 +441,53 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     });
     const outHeaders: Array<[string, string]> = [];
     res.headers.forEach((v, k) => outHeaders.push([k, v]));
-    return { ok: true, status: res.status, headers: outHeaders, body: await res.text() };
+    return { ok: true, status: res.status, headers: outHeaders, body: await readCapped(res, url.host) };
+  }
+
+  /**
+   * #48 — forward a service-binding call to the target deployment via the edge.
+   *
+   * The Host header is the whole routing decision: the edge matches a route by
+   * hostname, so this is exactly the request the outside world would make,
+   * minus the trip through the network (and therefore minus TLS and the
+   * default-deny egress rules, which is why this is not `fetch`).
+   */
+  async function serviceFetch(msg: Frame): Promise<Frame> {
+    const binding = str(msg.binding);
+    const declared = bindings.services.find((entry) => entry.binding === binding);
+    if (!declared) throw new Error(`service not bound: ${binding}`);
+    const host = serviceHosts[binding];
+    // Declared in the artifact but unresolved at activation: the target project
+    // does not exist, or is not deployed yet. Say which, rather than 502.
+    if (!host) throw new Error(`service ${binding} -> "${declared.service}" is not deployed on this control plane`);
+    if (!opts.edgeUrl) throw new Error(`service ${binding} cannot be called: this broker has no edge url`);
+
+    let path = "/";
+    try {
+      const parsed = new URL(str(msg.url));
+      path = `${parsed.pathname}${parsed.search}`;
+    } catch {
+      path = str(msg.url) || "/";
+      if (!path.startsWith("/")) path = `/${path}`;
+    }
+    const headers = new Headers();
+    if (Array.isArray(msg.headers)) {
+      for (const pair of msg.headers) {
+        if (Array.isArray(pair) && pair.length === 2) headers.set(str(pair[0]), str(pair[1]));
+      }
+    }
+    headers.set("host", host);
+    const method = str(msg.method || "GET").toUpperCase();
+    const target = new URL(path, opts.edgeUrl);
+    const res = await doFetch(target, {
+      method,
+      headers,
+      body: msg.body == null || method === "GET" || method === "HEAD" ? undefined : str(msg.body),
+      redirect: "manual",
+    });
+    const outHeaders: Array<[string, string]> = [];
+    res.headers.forEach((v, k) => outHeaders.push([k, v]));
+    return { ok: true, status: res.status, headers: outHeaders, body: await readCapped(res, host) };
   }
 
   async function dispatch(msg: Frame): Promise<Frame> {
@@ -378,6 +527,9 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
       case "fetch":
         return proxyFetch(msg);
 
+      case "service.fetch":
+        return serviceFetch(msg);
+
       case "d1.query": {
         const conn = d1(requireD1(msg.db));
         return { ok: true, ...d1Run(conn, str(msg.sql), sqlParams(msg.params)) };
@@ -425,7 +577,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
           .query<R2Row, [string, string]>("SELECT * FROM r2 WHERE bucket = ? AND key = ?")
           .get(bucket, str(msg.key));
         if (!row) return { ok: true, found: false };
-        return { ok: true, found: true, object: r2Row(row), body: msg.op === "r2.get" ? row.body : undefined };
+        return { ok: true, found: true, object: r2Row(row), body: msg.op === "r2.get" ? r2Text(row.body) : undefined };
       }
       case "r2.delete": {
         const { store, part: bucket } = storeFor("r2", requireR2(msg.bucket));
@@ -540,21 +692,62 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
         return { ok: true, entries: rows.map((r) => [r.key, r.value]) };
       }
 
+      // #125 — alarms. `at` is epoch ms; setting one replaces any pending alarm
+      // for that object, and attempts resets because this is a fresh schedule.
+      case "do.alarm.set":
+        db.query(
+          "INSERT INTO do_alarm (cls, id, at, attempts) VALUES (?1,?2,?3,0) " +
+            "ON CONFLICT (cls, id) DO UPDATE SET at = ?3, attempts = 0",
+        ).run(requireDoClass(msg.cls), str(msg.id), Math.trunc(Number(msg.at) || 0));
+        return { ok: true };
+      case "do.alarm.get": {
+        const row = db
+          .query<{ at: number }, [string, string]>("SELECT at FROM do_alarm WHERE cls = ? AND id = ?")
+          .get(requireDoClass(msg.cls), str(msg.id));
+        return { ok: true, at: row ? row.at : null };
+      }
+      case "do.alarm.delete": {
+        const r = db.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?").run(requireDoClass(msg.cls), str(msg.id));
+        return { ok: true, deleted: r.changes > 0 };
+      }
+
       case "assets.get": {
         if (!bindings.assets) throw new Error("assets not bound");
         const reqPath = str(msg.path) || "/";
         const key = resolveAssetKey(reqPath, (k) => !!assetManifest?.files[k]);
         const hit = key ? readAsset(key) : null;
-        if (hit) return { ok: true, found: true, status: 200, type: hit.type, hash: hit.hash, body: hit.body };
+        if (hit)
+          return {
+            ok: true,
+            found: true,
+            status: 200,
+            type: hit.type,
+            hash: hit.hash,
+            body: new TextDecoder().decode(hit.body),
+          };
         const nfh = assetManifest?.notFound ?? "none";
         if (nfh === "single-page-application") {
           const shell = readAsset("/index.html");
           if (shell)
-            return { ok: true, found: true, status: 200, type: shell.type, hash: shell.hash, body: shell.body };
+            return {
+              ok: true,
+              found: true,
+              status: 200,
+              type: shell.type,
+              hash: shell.hash,
+              body: new TextDecoder().decode(shell.body),
+            };
         }
         if (nfh === "404-page") {
           const page = readAsset("/404.html");
-          if (page) return { ok: true, found: false, status: 404, type: page.type, body: page.body };
+          if (page)
+            return {
+              ok: true,
+              found: false,
+              status: 404,
+              type: page.type,
+              body: new TextDecoder().decode(page.body),
+            };
         }
         return { ok: true, found: false, status: 404, body: "Not Found" };
       }
@@ -564,6 +757,140 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     }
   }
 
+  /**
+   * #63 — the ops that carry bytes rather than escaping them into the frame.
+   * Everything else goes through `dispatch` untouched.
+   */
+  async function dispatchBinary(msg: Frame, binary: Uint8Array): Promise<{ reply: Frame; bytes?: Uint8Array }> {
+    if (msg.op === "r2.put") {
+      // The body arrived as bytes; store it as a blob rather than a string, so
+      // a put costs one copy instead of an escape, a parse and a re-encode.
+      const { store, part: bucket } = storeFor("r2", requireR2(msg.bucket));
+      const etag = createHash("sha256").update(binary).digest("hex");
+      const uploaded = new Date().toISOString();
+      store
+        .query(
+          "INSERT INTO r2 (bucket, key, body, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7,?8) " +
+            "ON CONFLICT (bucket, key) DO UPDATE SET body=?3, size=?4, etag=?5, uploaded=?6, http_json=?7, custom_json=?8",
+        )
+        .run(
+          bucket,
+          str(msg.key),
+          binary,
+          binary.byteLength,
+          etag,
+          uploaded,
+          JSON.stringify(msg.httpMetadata ?? {}),
+          JSON.stringify(msg.customMetadata ?? {}),
+        );
+      return {
+        reply: { ok: true, object: { key: str(msg.key), size: binary.byteLength, etag, uploaded } },
+      };
+    }
+
+    if (msg.op === "r2.get") {
+      const { store, part: bucket } = storeFor("r2", requireR2(msg.bucket));
+      const row = store
+        .query<R2Row, [string, string]>("SELECT * FROM r2 WHERE bucket = ? AND key = ?")
+        .get(bucket, str(msg.key));
+      if (!row) return { reply: { ok: true, found: false } };
+      return { reply: { ok: true, found: true, object: r2Row(row) }, bytes: r2Bytes(row.body) };
+    }
+
+    if (msg.op === "assets.get") {
+      if (!bindings.assets) throw new Error("assets not bound");
+      const reqPath = str(msg.path) || "/";
+      const key = resolveAssetKey(reqPath, (candidate) => !!assetManifest?.files[candidate]);
+      let hit = key ? readAsset(key) : null;
+      let found = Boolean(hit);
+      let status = hit ? 200 : 404;
+      if (!hit && assetManifest?.notFound === "single-page-application") {
+        hit = readAsset("/index.html");
+        found = Boolean(hit);
+        status = hit ? 200 : 404;
+      } else if (!hit && assetManifest?.notFound === "404-page") {
+        hit = readAsset("/404.html");
+      }
+      if (!hit) return { reply: { ok: true, found: false, status: 404 }, bytes: new TextEncoder().encode("Not Found") };
+      return {
+        reply: { ok: true, found, status, type: hit.type, hash: hit.hash },
+        bytes: hit.body,
+      };
+    }
+
+    return { reply: await dispatchOnce(msg) };
+  }
+
+  /** One wire frame in, one out. See `handleFrame` on the Broker type. */
+  async function handleFrame(payload: Buffer): Promise<Buffer> {
+    if (payload.length === 0 || payload[0] !== FRAME_V1) {
+      return encodeFrame(await handlePayload(payload.toString("utf8")));
+    }
+    try {
+      const jsonLen = payload.readUInt32LE(1);
+      const msg = jsonObject(parseJsonValue(payload.subarray(5, 5 + jsonLen).toString("utf8")));
+      if (!msg) throw new Error("request frame was not a JSON object");
+      if (token && str(msg.token) !== token) return frameOf(encodeV1({ ok: false, error: "unauthorized" }));
+      const binary = new Uint8Array(payload.subarray(5 + jsonLen));
+      const { reply, bytes } = await dispatchBinary(msg, binary);
+      return frameOf(encodeV1(reply, bytes));
+    } catch (e) {
+      return frameOf(encodeV1({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+    }
+  }
+
+  /**
+   * #63 §3 — ops that must not be applied twice.
+   *
+   * The transport retries the same bytes when a connection dies, and a broker
+   * that already applied a request but never got its reply out would otherwise
+   * apply it again: a second queue message, a second INSERT. Reads are absent
+   * deliberately — replaying a `d1.query` costs nothing and caching its reply
+   * could hold megabytes.
+   */
+  const REPLAYABLE = new Set([
+    "kv.put",
+    "kv.delete",
+    "queue.send",
+    "queue.send_batch",
+    "d1.query",
+    "d1.exec",
+    "d1.batch",
+    "r2.put",
+    "r2.delete",
+    "do.storage.put",
+    "do.storage.delete",
+    "do.storage.delete_all",
+    "do.alarm.set",
+    "do.alarm.delete",
+    "ae.write",
+  ]);
+
+  /** How many recent replies to keep. A resend follows its original within
+   *  milliseconds, so this only has to outlive a reconnect, not a session. */
+  const REPLAY_WINDOW = 256;
+
+  /**
+   * Run `msg`, or replay what it answered last time. Keyed by the id the sprout
+   * put on the request; a request without one is always run.
+   */
+  async function dispatchOnce(msg: Frame): Promise<Frame> {
+    const id = isSafeInteger(msg.id) ? msg.id : null;
+    const op = str(msg.op);
+    if (id === null || !REPLAYABLE.has(op)) return dispatch(msg);
+    const key = `${op}:${id}`;
+    const seen = replayed.get(key);
+    if (seen) return seen;
+    const reply = await dispatch(msg);
+    replayed.set(key, reply);
+    // Insertion-ordered, so the oldest key is the first one out.
+    if (replayed.size > REPLAY_WINDOW) {
+      const oldest = replayed.keys().next().value;
+      if (oldest !== undefined) replayed.delete(oldest);
+    }
+    return reply;
+  }
+
   async function handlePayload(payload: string): Promise<Frame> {
     const nl = payload.indexOf("\n");
     const gotToken = nl === -1 ? "" : payload.slice(0, nl);
@@ -572,7 +899,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     try {
       const msg = jsonObject(parseJsonValue(json));
       if (!msg) throw new Error("request frame was not a JSON object");
-      return await dispatch(msg);
+      return await dispatchOnce(msg);
     } catch (e) {
       return { ok: false, error: e instanceof Error ? e.message : String(e) };
     }
@@ -583,7 +910,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   const QUEUE_BATCH = 10;
   const QUEUE_MAX_ATTEMPTS = 5;
 
-  async function deliverTrigger(kind: "scheduled" | "queue", body: JsonObject): Promise<Response | null> {
+  async function deliverTrigger(kind: "scheduled" | "queue" | "alarm", body: JsonObject): Promise<Response | null> {
     if (!opts.sproutUrl) return null;
     try {
       return await doFetch(opts.sproutUrl, {
@@ -643,8 +970,48 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
     }
   }
 
+  const ALARM_MAX_ATTEMPTS = 5;
+
+  /**
+   * #125 — fire alarms that are due.
+   *
+   * Claim-then-deliver, not deliver-then-delete: `alarm()` is allowed to call
+   * `setAlarm()` for its next run, and that write lands *during* delivery. If
+   * we deleted afterwards we would erase the alarm the handler just scheduled,
+   * which is how a self-rescheduling object silently stops. Deleting first
+   * means the handler's row is a fresh insert nothing else touches.
+   *
+   * A failed delivery re-arms with the queue consumer's policy — 5s apart, five
+   * attempts — and `DO NOTHING` so a re-arm never overwrites an alarm the
+   * handler set itself.
+   */
+  function fireAlarmsOnce(): void {
+    if (!opts.sproutUrl || bindings.do.length === 0) return;
+    const now = Date.now();
+    const due = db
+      .query<{ cls: string; id: string; at: number; attempts: number }, [number]>(
+        "SELECT cls, id, at, attempts FROM do_alarm WHERE at <= ? ORDER BY at LIMIT 10",
+      )
+      .all(now);
+    if (due.length === 0) return;
+    const claim = db.query("DELETE FROM do_alarm WHERE cls = ? AND id = ?");
+    const rearm = db.query(
+      "INSERT INTO do_alarm (cls, id, at, attempts) VALUES (?1,?2,?3,?4) ON CONFLICT (cls, id) DO NOTHING",
+    );
+    for (const row of due) {
+      claim.run(row.cls, row.id);
+      void deliverTrigger("alarm", { cls: row.cls, id: row.id, scheduledTime: row.at }).then((res) => {
+        if (res && res.ok) return;
+        const attempts = row.attempts + 1;
+        if (attempts >= ALARM_MAX_ATTEMPTS) return; // give up rather than spin forever
+        rearm.run(row.cls, row.id, Date.now() + 5_000, attempts);
+      });
+    }
+  }
+
   if (opts.sproutUrl) {
     if (bindings.queues.length > 0) timers.push(setInterval(drainQueuesOnce, 500));
+    if (bindings.do.length > 0) timers.push(setInterval(fireAlarmsOnce, 500));
     if (bindings.crons.length > 0) {
       let lastTick = "";
       timers.push(
@@ -664,6 +1031,7 @@ export function createBroker(opts: BrokerOptions = {}): Broker {
   return {
     dispatch,
     handlePayload,
+    handleFrame,
     close: () => {
       for (const t of timers) clearInterval(t);
       for (const conn of d1Conns.values()) conn.close();
@@ -712,28 +1080,41 @@ export type BrokerServer = { port: number; stop(): void };
 
 /** Start the TCP listener. Returns the bound port. */
 export function listen(broker: Broker, hostname: string, port: number): BrokerServer {
-  const server = Bun.listen<{ buf: Buffer }>({
+  // Chunks are held in a list and joined once, when a whole frame has arrived.
+  // Concatenating on every chunk copies the accumulated buffer each time, which
+  // is quadratic in the body size: an 8 MB object arriving in 64 KB pieces
+  // copied hundreds of megabytes before anything was parsed.
+  const server = Bun.listen<{ chunks: Buffer[]; size: number }>({
     hostname,
     port,
     socket: {
       open(socket) {
-        socket.data = { buf: Buffer.alloc(0) };
+        socket.data = { chunks: [], size: 0 };
       },
       async data(socket, chunk) {
         const state = socket.data;
-        state.buf = state.buf.length ? Buffer.concat([state.buf, chunk]) : chunk;
+        state.chunks.push(chunk);
+        state.size += chunk.length;
         for (;;) {
-          if (state.buf.length < 4) return;
-          const len = state.buf.readUInt32LE(0);
+          if (state.size < 4) return;
+          if (state.chunks.length > 1) {
+            state.chunks = [Buffer.concat(state.chunks, state.size)];
+          }
+          const buf = state.chunks[0];
+          const len = buf.readUInt32LE(0);
           if (len > MAX_FRAME) {
             socket.write(encodeFrame({ ok: false, error: "frame too large" }));
             socket.end();
             return;
           }
-          if (state.buf.length < 4 + len) return;
-          const payload = Buffer.from(state.buf.subarray(4, 4 + len)).toString("utf8");
-          state.buf = Buffer.from(state.buf.subarray(4 + len));
-          socket.write(encodeFrame(await broker.handlePayload(payload)));
+          if (state.size < 4 + len) return;
+          // Kept as bytes: a v1 frame carries binary after its JSON, and
+          // decoding the whole payload as utf8 would corrupt it.
+          const payload = buf.subarray(4, 4 + len);
+          const rest = buf.subarray(4 + len);
+          state.chunks = rest.length ? [Buffer.from(rest)] : [];
+          state.size = rest.length;
+          socket.write(await broker.handleFrame(payload));
         }
       },
     },
@@ -753,6 +1134,8 @@ if (import.meta.main) {
       secrets: { type: "string" },
       "sprout-url": { type: "string" },
       "assets-dir": { type: "string" },
+      "edge-url": { type: "string" },
+      services: { type: "string" },
     },
   });
   // SAFETY: --bindings and --secrets are the artifact's own bindings.json /
@@ -764,6 +1147,22 @@ if (import.meta.main) {
   const secrets: Record<string, string> | undefined = values.secrets
     ? (JSON.parse(readFileSync(values.secrets, "utf8")) as Record<string, string>)
     : undefined;
+  // #48 — binding -> hostname, resolved by the control plane at activation and
+  // passed as JSON. Malformed input disables service calls rather than taking
+  // the broker down: every other binding still works.
+  let services: Record<string, string> | undefined;
+  if (values.services) {
+    try {
+      const parsed = jsonObject(parseJsonValue(values.services));
+      if (parsed) {
+        services = Object.fromEntries(
+          Object.entries(parsed).flatMap(([binding, host]) => (isString(host) ? [[binding, host] as const] : [])),
+        );
+      }
+    } catch {
+      console.error("sproutboat broker: --services is not valid JSON; service bindings disabled");
+    }
+  }
   const broker = createBroker({
     db: values.db,
     dataDir: values["data-dir"],
@@ -773,6 +1172,8 @@ if (import.meta.main) {
     secrets,
     sproutUrl: values["sprout-url"] ?? process.env.SB_SPROUT_URL,
     assetsDir: values["assets-dir"],
+    edgeUrl: values["edge-url"],
+    services,
   });
   const { port } = listen(broker, "127.0.0.1", Number(values.port ?? process.env.SB_BROKER_PORT ?? 0));
   console.log(