sproutboat 0.8.0 → 0.10.0

package/src/build.ts

@@ -35,6 +35,17 @@ export type BuildInput = {
   /** #15 — `embedded` compiles SQLite into the sprout instead of a broker
    *  transport. Defaults to the broker transport. */
   transport?: Transport;
+  /**
+   * `dev` compiles at -O0, which is roughly three times faster and produces a
+   * bigger binary. Only for artifacts that cannot be deployed: `deploy` refuses
+   * a host build already, and this defaults to `release` so a caller has to ask
+   * for the fast path deliberately.
+   */
+  optimize?: "dev" | "release";
+  /** Reuse a previously compiled native sprout when only sidecar assets changed. */
+  reuseSproutPath?: string;
+  /** An isolated artifact directory, used by dev candidates to avoid mixing snapshots. */
+  outputDirectory?: string;
 };
 
 export type BuildOutput = {
@@ -60,7 +71,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
   const source = input.source ?? (await readFile(input.sourcePath));
   const sourceHash = digest(source);
   const artifactId = sourceHash.slice("sha256:".length, 24);
-  const artifactDir = resolve(input.projectDir, ".sproutboat/dist", artifactId);
+  const artifactDir = input.outputDirectory ?? resolve(input.projectDir, ".sproutboat/dist", artifactId);
   const sproutPath = resolve(artifactDir, "sprout");
   await mkdir(artifactDir, { recursive: true });
 
@@ -88,6 +99,7 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     do: Object.entries(input.config.durable_objects ?? {}).map(([binding, className]) => ({ binding, className })),
     services: input.config.services ?? [],
     crons: input.config.triggers?.crons ?? [],
+    ratelimiters: input.config.ratelimiters ?? [],
     assets: input.config.assets?.binding ?? "",
     // Baked plain values, read as env.NAME. The broker never serves these (they
     // are compiled in via SPROUTBOAT_VARS_JSON); they ride along so the control
@@ -138,21 +150,24 @@ export async function buildArtifact(input: BuildInput): Promise<BuildOutput> {
     bakedAssets = { manifest, files };
   }
 
-  await compileSprout({
-    sourcePath: input.sourcePath,
-    source: input.source,
-    outPath: sproutPath,
-    vars: input.config.vars ?? {},
-    bindings,
-    zigBin,
-    target: input.target,
-    compatibilityDate: input.config.compatibility_date,
-    transport: input.transport,
-    appName: input.config.name,
-    assets: bakedAssets,
-    extraLink,
-    extraCflags,
-  });
+  if (input.reuseSproutPath) await cp(input.reuseSproutPath, sproutPath);
+  else
+    await compileSprout({
+      sourcePath: input.sourcePath,
+      source: input.source,
+      outPath: sproutPath,
+      vars: input.config.vars ?? {},
+      bindings,
+      zigBin,
+      target: input.target,
+      compatibilityDate: input.config.compatibility_date,
+      transport: input.transport,
+      appName: input.config.name,
+      assets: bakedAssets,
+      extraLink,
+      extraCflags,
+      optimize: input.optimize,
+    });
 
   const sprout = await readFile(sproutPath);
   const manifest: ArtifactManifest = {

package/src/compile.ts

@@ -7,12 +7,25 @@
  * One-time per machine: the uWebSockets tree Porffor links is unpacked into
  * ~/.cache/porffor/deps/. `ensureUWebSockets()` extracts the prebuilt archive
  * shipped in `vendor/` so this needs no `git` or `make`; if that archive is
- * unusable it falls back to Porffor's own git + make path (needs both on PATH).
+ * unusable it stops with its specific integrity or archive error. Contributors
+ * may explicitly opt into Porffor's source fallback.
  */
+import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { ensurePorfforPatched } from "./patch-porffor";
-import { ensureUWebSockets, porfforRoot, UwsUnavailableError } from "./toolchain";
+import { ensureUWebSockets, ensureUWebSocketsHost, UwsUnavailableError } from "./toolchain";
+import { ensurePorffor } from "./porffor-toolchain";
+// The prelude + transports live in @sproutboat/runtime (next to wrap.ts, which
+// locates them by file URL). `preludePath`/`transportPath` read them from there
+// for a dev build; these text imports bake the same files into the `--compile`
+// binary, where there is no filesystem to read.
+// @ts-expect-error Bun's text loader supplies a string, while TypeScript resolves the JavaScript source itself.
+import embeddedPrelude from "@sproutboat/runtime/src/native-fetch-prelude.js" with { type: "text" };
+// @ts-expect-error See above.
+import embeddedBrokerTransport from "@sproutboat/runtime/src/transport-broker.js" with { type: "text" };
+// @ts-expect-error See above.
+import embeddedStandaloneTransport from "@sproutboat/runtime/src/transport-embedded.js" with { type: "text" };
 import {
   EMPTY_BINDINGS,
   preludePath,
@@ -22,6 +35,7 @@ import {
   type Bindings,
   type Transport,
 } from "./wrap";
+const PACKAGED = import.meta.url.includes("/$bunfs/");
 export type { Transport } from "./wrap";
 
 export {
@@ -54,6 +68,16 @@ export type CompileInput = {
   extraLink?: string[];
   /** #15 — flags for the compile step, so inline C can include BearSSL's header. */
   extraCflags?: string[];
+  /**
+   * How hard the C compiler works on the generated code.
+   *
+   * Porffor defaults to `-O3` (compiler/index.js reads `-O` from its own argv),
+   * which costs most of the build: `examples/hello` is 8.4s at -O3 against 2.9s
+   * at -O0 on an M-series host. `dev` pays that on every edit for a binary that
+   * never leaves the machine, so it compiles at -O0 and takes a ~55% larger
+   * file. Anything that could be deployed stays at -O3.
+   */
+  optimize?: "dev" | "release";
   /** Cross-compiler for `linux-x86_64`. Not needed, and not used, for `host`. */
   zigBin?: string;
   /**
@@ -73,9 +97,13 @@ export type CompileInput = {
  * `native-fetch-prelude.js` alone yields a module with no `__sbCall` at all.
  */
 export async function loadPrelude(transport: Transport = "broker"): Promise<string> {
-  const [core, chosen] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath(transport), "utf8")]);
+  const [core, chosen] = PACKAGED
+    ? [embeddedPrelude, transport === "embedded" ? embeddedStandaloneTransport : embeddedBrokerTransport]
+    : await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath(transport), "utf8")]);
   if (!core.includes(TRANSPORT_MARKER)) {
-    throw new Error("prelude is missing its transport marker — src/native-fetch-prelude.js changed shape");
+    throw new Error(
+      "prelude is missing its transport marker — @sproutboat/runtime/src/native-fetch-prelude.js changed shape",
+    );
   }
   return core.replace(TRANSPORT_MARKER, chosen);
 }
@@ -88,22 +116,51 @@ function compileEnv(path: string, extraLink?: string[], extraCflags?: string[])
   return { ...process.env, PATH: path, SB_EXTRA_LINK: link, SB_EXTRA_CFLAGS: cflags };
 }
 
+/**
+ * The argument list handed to Porffor, minus the launcher.
+ *
+ * Exported for the test: the one thing worth pinning is that `-O0` reaches only
+ * a build that cannot be deployed. `-s` strips at link, because the unstripped
+ * static-musl binary is ~90% DWARF that nothing needs at runtime (12 MB down to
+ * ~1.3 MB for the kitchen-sink). `--musl` is what makes it a cross-compile; a
+ * host build omits it and Porffor targets the machine it runs on.
+ */
+export function porfforArgs(
+  generatedPath: string,
+  outPath: string,
+  target: CompileInput["target"],
+  optimize: CompileInput["optimize"],
+): string[] {
+  const args = ["native", generatedPath, "-o", outPath];
+  if (target !== "host") args.push("--musl");
+  args.push("-s");
+  // Porffor reads -O from its own argv and defaults to -O3. -O0 is roughly
+  // three times faster to compile, so dev takes it and everything else does
+  // not: a deployable artifact is never built with it.
+  if (optimize === "dev" && target === "host") args.push("-O0");
+  return args;
+}
+
 /** Compile `sourcePath` to a native binary at `outPath` (mode 0555). */
 export async function compileSprout(input: CompileInput): Promise<void> {
-  await ensurePorfforPatched();
+  const porffor = await ensurePorffor();
+  await ensurePorfforPatched(porffor);
 
   // Seed the Porffor uWebSockets cache from the prebuilt archive in `vendor/` so
-  // the first build needs no `git` / `make`. Fall back to Porffor's own git+make
-  // path if the archive is missing or fails its checksum.
+  // the first build needs no `git` / `make`. The two targets keep separate
+  // cache trees and separate uSockets.a, so seed whichever this build wants.
+  // Fall back to Porffor's own git+make path if the archive is unusable.
   try {
-    await ensureUWebSockets();
+    if (input.target === "host") await ensureUWebSocketsHost();
+    else await ensureUWebSockets();
   } catch (error) {
     if (!(error instanceof UwsUnavailableError)) throw error;
+    if (process.env.SPROUTBOAT_BUILD_UWS_FROM_SOURCE !== "1") throw error;
     const haveGit = Bun.which("git");
     const haveMake = Bun.which("make");
     if (haveGit && haveMake) {
       console.warn(
-        `prebuilt uWebSockets unusable (${error.message.split("\n")[0]}); falling back to git + make (slower, one-time)`,
+        `prebuilt uWebSockets unusable (${error.message.split("\n")[0]}); explicit source build uses git + make`,
       );
     } else {
       const missing = [!haveGit && "git", !haveMake && "make"].filter(Boolean).join(" and ");
@@ -141,29 +198,24 @@ export async function compileSprout(input: CompileInput): Promise<void> {
     ),
   );
 
-  const porffor = porfforRoot();
   const launcher = resolve(porffor, "runtime/index.js");
-  // Porffor shells bare `zig` and `esbuild`; put both on PATH for the child.
   // A host build never shells `zig`, so it has no zigBin to contribute.
-  const binDir = resolve(porffor, "../.bin");
   const zigDir = input.zigBin ? `${dirname(input.zigBin)}:` : "";
-  const path = `${zigDir}${binDir}:${process.env.PATH ?? ""}`;
+  const packagedEsbuild = resolve(dirname(process.execPath), "esbuild");
+  const esbuild = existsSync(packagedEsbuild) ? packagedEsbuild : Bun.which("esbuild");
+  if (!esbuild)
+    throw new Error("the packaged esbuild executable is missing; reinstall the Sproutboat platform package");
+  const path = `${zigDir}${dirname(esbuild)}:${process.env.PATH ?? ""}`;
+  const command = PACKAGED
+    ? [process.execPath, "__porffor", launcher]
+    : [process.execPath, resolve(import.meta.dir, "main.ts"), "__porffor", launcher];
 
-  // `-s`: strip at link. The unstripped static-musl binary is ~90% DWARF that
-  // nothing needs at runtime (12 MB -> ~1.3 MB for the kitchen-sink). Porffor
-  // forwards `-s` straight to the `zig cc` link step.
-  // `--musl` is what makes it a cross-compile; a host build simply omits it and
-  // Porffor targets the machine it is running on.
-  const crossFlags = input.target === "host" ? [] : ["--musl"];
-  const child = Bun.spawn(
-    [process.execPath, launcher, "native", generatedPath, "-o", input.outPath, ...crossFlags, "-s"],
-    {
-      cwd: outDir,
-      stdout: "pipe",
-      stderr: "pipe",
-      env: compileEnv(path, input.extraLink, input.extraCflags),
-    },
-  );
+  const child = Bun.spawn([...command, ...porfforArgs(generatedPath, input.outPath, input.target, input.optimize)], {
+    cwd: outDir,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: compileEnv(path, input.extraLink, input.extraCflags),
+  });
   let timedOut = false;
   const timer = setTimeout(() => {
     timedOut = true;

package/src/config.ts

@@ -1,379 +1,4 @@
-const slugPattern = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])?$/;
-
-/**
- * A storage binding entry (#74). Either a bare `"BINDING"` — resolved to an
- * ephemeral local resource for `sproutboat dev`, rejected by a real deploy — or
- * `{ binding, id }` pointing at an account-level resource created with
- * `sproutboat <kv|d1|r2|queues> create`. The id carries its own `<kind>_` prefix.
- */
-export type ResourceBinding = { binding: string; id: string };
-export type ResourceRef = string | ResourceBinding;
-
-/** Normalizes a storage-binding array to `{ binding, id? }` rows. */
-export function resourceRefs(field: readonly ResourceRef[] | undefined): Array<{ binding: string; id?: string }> {
-  return (field ?? []).map((entry) =>
-    isString(entry) ? { binding: entry } : { binding: entry.binding, id: entry.id },
-  );
-}
-
-/**
- * Rewrite a bare `"BINDING"` token inside `<field>: [ … ]` to
- * `{ "binding": "BINDING", "id": "<id>" }`, leaving the rest of the source
- * (comments, spacing) untouched — used by `deploy`'s auto-provisioner to pin an
- * id back into `sproutboat.jsonc`. Binding names are UPPER_SNAKE, so a plain
- * `"BINDING"` match inside the array is unambiguous. No-op if not found.
- */
-export function pinBindingId(source: string, field: string, binding: string, id: string): string {
-  const array = new RegExp(`("${field}"\\s*:\\s*\\[)([\\s\\S]*?)(\\])`);
-  // the bare token must be a whole array element — at the start of the array or
-  // right after a comma — never `"binding": "NAME"` inside an already-pinned
-  // { … } object.
-  const element = new RegExp(`(^\\s*|,\\s*)"${binding}"(\\s*,|\\s*$)`);
-  return source.replace(array, (whole, open: string, inner: string, close: string) =>
-    element.test(inner)
-      ? open + inner.replace(element, `$1{ "binding": "${binding}", "id": "${id}" }$2`) + close
-      : whole,
-  );
-}
-
-export type SproutboatConfig = {
-  $schema?: string;
-  name: string;
-  main: string;
-  compatibility_date: string;
-  vars?: Record<string, string>;
-  /** KV namespace bindings, exposed as `env.<NAME>`. */
-  kv_namespaces?: ResourceRef[];
-  /** Secret binding names, exposed as `env.<NAME>` (value fetched at use). */
-  secrets?: string[];
-  /** Hostnames the sprout's `fetch()` may reach (exact host match). */
-  outbound?: string[];
-  /** D1 (SQLite) database bindings, exposed as `env.<NAME>`. */
-  d1_databases?: ResourceRef[];
-  /** R2 (object storage) bucket bindings, exposed as `env.<NAME>`. */
-  r2_buckets?: ResourceRef[];
-  /** Queue producer bindings, exposed as `env.<NAME>.send()`. A `queue(batch)` handler consumes them. */
-  queues?: ResourceRef[];
-  /** Analytics Engine dataset binding names, exposed as `env.<NAME>.writeDataPoint()`. No id — the dataset is created on first write. */
-  analytics_engine_datasets?: string[];
-  /** Durable Object bindings: `{ BINDING_NAME: "ClassName" }`. The class is defined in the handler module. */
-  durable_objects?: Record<string, string>;
-  /** #48 — worker-to-worker calls: `env.<BINDING>.fetch(request)` reaches another
-   *  project on this control plane, resolved to its hostname at activation. */
-  services?: Array<{ binding: string; service: string }>;
-  /** Scheduled triggers, e.g. `{ "crons": ["0 3 * * *"] }` — a `scheduled(event)` handler runs on each tick. */
-  triggers?: { crons?: string[] };
-  /** Static assets: a directory served edge-first (like Cloudflare), optionally bound as `env.<BINDING>.fetch(request)`. */
-  assets?: AssetsConfig;
-};
-
-export type AssetsConfig = {
-  /** Project-relative directory of files to publish with the artifact. */
-  directory: string;
-  /** Optional binding name for `env.<BINDING>.fetch(request)`. */
-  binding?: string;
-  /** What to serve when a request matches no file (applied by the broker on `env.<BINDING>.fetch`). */
-  not_found_handling?: "none" | "single-page-application" | "404-page";
-  /** `true` = run the sprout before serving any asset; string[] = selective route patterns (`!` negates). */
-  run_sprout_first?: boolean | string[];
-};
-
-export type ConfigValidation = { ok: true; value: SproutboatConfig } | { ok: false; errors: string[] };
-
-type JsonValue = string | number | boolean | null | ConfigJsonObject | JsonValue[];
-
-interface ConfigJsonObject {
-  readonly [key: string]: JsonValue;
-}
-
-type ConfigInput = JsonValue | undefined;
-
-function isRecord(value: ConfigInput): value is ConfigJsonObject {
-  return value !== null && Object(value) === value && !Array.isArray(value) && !(value instanceof Function);
-}
-
-function isString(value: ConfigInput): value is string {
-  return Object(value) !== value && value === String(value);
-}
-
-function isProjectSlug(value: string): boolean {
-  return slugPattern.test(value);
-}
-
-function validateConfig(value: ConfigInput): ConfigValidation {
-  const errors: string[] = [];
-  if (!isRecord(value)) return { ok: false, errors: ["config must be an object"] };
-  const allowed = new Set([
-    "$schema",
-    "name",
-    "main",
-    "compatibility_date",
-    "vars",
-    "kv_namespaces",
-    "secrets",
-    "outbound",
-    "d1_databases",
-    "r2_buckets",
-    "queues",
-    "analytics_engine_datasets",
-    "durable_objects",
-    "services",
-    "triggers",
-    "assets",
-  ]);
-  for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push(`unsupported config field: ${key}`);
-  const name = isString(value.name) && isProjectSlug(value.name) ? value.name : null;
-  if (name === null) {
-    errors.push("name must be a 3–32 character lowercase slug");
-  }
-  const main = isString(value.main) && value.main.startsWith("src/") && !value.main.includes("..") ? value.main : null;
-  if (main === null) {
-    errors.push("main must be a relative entry point under src/");
-  }
-  const compatibility_date =
-    isString(value.compatibility_date) && /^\d{4}-\d{2}-\d{2}$/.test(value.compatibility_date)
-      ? value.compatibility_date
-      : null;
-  if (compatibility_date === null) {
-    errors.push("compatibility_date must use YYYY-MM-DD");
-  }
-  const schema = value.$schema === undefined ? undefined : isString(value.$schema) ? value.$schema : null;
-  if (schema === null) errors.push("$schema must be a string");
-  let vars: Record<string, string> | undefined;
-  if (value.vars !== undefined) {
-    if (!isRecord(value.vars)) errors.push("vars must be an object of plain string values");
-    else {
-      vars = {};
-      for (const [key, item] of Object.entries(value.vars)) {
-        if (!/^[A-Z][A-Z0-9_]*$/.test(key) || !isString(item))
-          errors.push(`vars.${key} must be a string environment name`);
-        else vars[key] = item;
-      }
-    }
-  }
-  const bindingName = /^[A-Z][A-Z0-9_]*$/;
-  const hostPattern = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
-  const stringArray = (
-    field: "secrets" | "outbound" | "analytics_engine_datasets",
-    item: RegExp,
-    label: string,
-  ): string[] | undefined => {
-    if (value[field] === undefined) return undefined;
-    const raw = value[field];
-    if (!Array.isArray(raw)) {
-      errors.push(`${field} must be an array of ${label}`);
-      return undefined;
-    }
-    const out: string[] = [];
-    for (const entry of raw) {
-      if (!isString(entry) || !item.test(entry)) errors.push(`${field} entries must be ${label}`);
-      else out.push(entry);
-    }
-    return out;
-  };
-
-  /**
-   * A storage-binding array (#74): each entry is a bare `"BINDING"` or
-   * `{ binding: "BINDING", id: "<kind>_<24hex>" }`. `kind` is the field's own
-   * resource kind, so an r2 id can't be pasted into `kv_namespaces`.
-   */
-  const resourceArray = (
-    field: "kv_namespaces" | "d1_databases" | "r2_buckets" | "queues",
-    kind: string,
-  ): ResourceRef[] | undefined => {
-    if (value[field] === undefined) return undefined;
-    const raw = value[field];
-    if (!Array.isArray(raw)) {
-      errors.push(`${field} must be an array of binding names or { binding, id } objects`);
-      return undefined;
-    }
-    const idPattern = new RegExp(`^${kind}_[0-9a-f]{24}$`);
-    const out: ResourceRef[] = [];
-    for (const entry of raw) {
-      if (isString(entry)) {
-        if (bindingName.test(entry)) out.push(entry);
-        else errors.push(`${field}: "${entry}" must be an UPPER_SNAKE binding name`);
-      } else if (
-        isRecord(entry) &&
-        isString(entry.binding) &&
-        isString(entry.id) &&
-        bindingName.test(entry.binding) &&
-        idPattern.test(entry.id) &&
-        Object.keys(entry).every((key) => key === "binding" || key === "id")
-      ) {
-        out.push({ binding: entry.binding, id: entry.id });
-      } else {
-        errors.push(`${field} entries must be an UPPER_SNAKE name or { binding: "NAME", id: "${kind}_…" }`);
-      }
-    }
-    return out;
-  };
-
-  const secrets = stringArray("secrets", bindingName, "binding names (UPPER_SNAKE_CASE)");
-  const outbound = stringArray("outbound", hostPattern, "hostnames");
-  // Analytics Engine datasets aren't provisioned — the dataset name springs into
-  // existence on first writeDataPoint(), so there's no resource id to bind (#74).
-  const analytics_engine_datasets = stringArray(
-    "analytics_engine_datasets",
-    bindingName,
-    "binding names (UPPER_SNAKE_CASE)",
-  );
-  const kv_namespaces = resourceArray("kv_namespaces", "kv");
-  const d1_databases = resourceArray("d1_databases", "d1");
-  const r2_buckets = resourceArray("r2_buckets", "r2");
-  const queues = resourceArray("queues", "queue");
-
-  let durable_objects: Record<string, string> | undefined;
-  if (value.durable_objects !== undefined) {
-    if (!isRecord(value.durable_objects)) {
-      errors.push('durable_objects must be an object of { BINDING_NAME: "ClassName" }');
-    } else {
-      durable_objects = {};
-      for (const [binding, className] of Object.entries(value.durable_objects)) {
-        if (!bindingName.test(binding) || !isString(className) || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(className)) {
-          errors.push(`durable_objects.${binding} must map an UPPER_SNAKE binding to a class identifier`);
-        } else durable_objects[binding] = className;
-      }
-    }
-  }
-
-  let services: Array<{ binding: string; service: string }> | undefined;
-  if (value.services !== undefined) {
-    if (!Array.isArray(value.services)) {
-      errors.push('services must be an array of { binding: "NAME", service: "project-name" }');
-    } else {
-      services = [];
-      for (const entry of value.services) {
-        const row = isRecord(entry) ? entry : null;
-        const binding = row && isString(row.binding) ? row.binding : "";
-        const service = row && isString(row.service) ? row.service : "";
-        if (!bindingName.test(binding) || !isProjectSlug(service)) {
-          errors.push('services entries must be { binding: "UPPER_SNAKE", service: "project-name" }');
-        } else if (services.some((s) => s.binding === binding)) {
-          errors.push(`services: duplicate binding ${binding}`);
-        } else services.push({ binding, service });
-      }
-    }
-  }
-
-  let triggers: { crons?: string[] } | undefined;
-  if (value.triggers !== undefined) {
-    if (!isRecord(value.triggers)) {
-      errors.push("triggers must be an object with an optional `crons` array");
-    } else {
-      triggers = {};
-      if (value.triggers.crons !== undefined) {
-        const raw = value.triggers.crons;
-        if (!Array.isArray(raw) || raw.some((c) => !isString(c) || c.trim().split(/\s+/).length !== 5)) {
-          errors.push("triggers.crons must be an array of 5-field cron expressions");
-        } else triggers.crons = raw.map((c) => String(c).trim());
-      }
-    }
-  }
-
-  let assets: AssetsConfig | undefined;
-  if (value.assets !== undefined) {
-    if (!isRecord(value.assets)) {
-      errors.push("assets must be an object with a `directory`");
-    } else {
-      const raw = value.assets;
-      const dir =
-        isString(raw.directory) && raw.directory.length > 0 && !raw.directory.includes("..")
-          ? raw.directory.replace(/^\.\//, "").replace(/\/$/, "")
-          : null;
-      if (dir === null) errors.push("assets.directory must be a project-relative path");
-      const binding =
-        raw.binding === undefined
-          ? undefined
-          : isString(raw.binding) && bindingName.test(raw.binding)
-            ? raw.binding
-            : null;
-      if (binding === null) errors.push("assets.binding must be a binding name (UPPER_SNAKE_CASE)");
-      const nfh =
-        raw.not_found_handling === "none" ||
-        raw.not_found_handling === "single-page-application" ||
-        raw.not_found_handling === "404-page"
-          ? raw.not_found_handling
-          : undefined;
-      if (raw.not_found_handling !== undefined && nfh === undefined) {
-        errors.push('assets.not_found_handling must be "none", "single-page-application", or "404-page"');
-      }
-      let rwf: boolean | string[] | undefined;
-      const rwfRaw = raw.run_sprout_first;
-      if (rwfRaw === true || rwfRaw === false) rwf = rwfRaw;
-      else if (Array.isArray(rwfRaw) && rwfRaw.every((p) => isString(p) && /^!?\//.test(p))) {
-        rwf = rwfRaw.map((p) => String(p));
-      } else if (rwfRaw !== undefined) {
-        errors.push("assets.run_sprout_first must be a boolean or an array of route patterns");
-      }
-      if (dir !== null && binding !== null) {
-        assets = { directory: dir };
-        if (binding !== undefined) assets.binding = binding;
-        if (nfh !== undefined) assets.not_found_handling = nfh;
-        if (rwf !== undefined) assets.run_sprout_first = rwf;
-      }
-    }
-  }
-
-  const resourceNames = (refs: ResourceRef[] | undefined): string[] => resourceRefs(refs).map((ref) => ref.binding);
-  const bindingSlots = [
-    ...resourceNames(kv_namespaces),
-    ...(secrets ?? []),
-    ...resourceNames(d1_databases),
-    ...resourceNames(r2_buckets),
-    ...resourceNames(queues),
-    ...(analytics_engine_datasets ?? []),
-    ...Object.keys(durable_objects ?? {}),
-    ...(services ?? []).map((entry) => entry.binding),
-    ...Object.keys(vars ?? {}),
-    ...(assets?.binding ? [assets.binding] : []),
-  ];
-  if (new Set(bindingSlots).size !== bindingSlots.length) errors.push("vars and binding names must not collide");
-
-  if (errors.length || name === null || main === null || compatibility_date === null || schema === null)
-    return { ok: false, errors };
-  const config: SproutboatConfig = { name, main, compatibility_date };
-  if ("$schema" in value) config.$schema = schema;
-  if ("vars" in value) config.vars = vars;
-  if ("kv_namespaces" in value) config.kv_namespaces = kv_namespaces;
-  if ("secrets" in value) config.secrets = secrets;
-  if ("outbound" in value) config.outbound = outbound;
-  if ("d1_databases" in value) config.d1_databases = d1_databases;
-  if ("r2_buckets" in value) config.r2_buckets = r2_buckets;
-  if ("queues" in value) config.queues = queues;
-  if ("analytics_engine_datasets" in value) config.analytics_engine_datasets = analytics_engine_datasets;
-  if ("durable_objects" in value) config.durable_objects = durable_objects;
-  if ("services" in value) config.services = services;
-  if ("triggers" in value) config.triggers = triggers;
-  if ("assets" in value) config.assets = assets;
-  return { ok: true, value: config };
-}
-
-export function parseConfig(source: string): ConfigValidation {
-  try {
-    // Config files intentionally support comments and trailing commas, but not
-    // arbitrary JavaScript expressions.
-    let json = "";
-    let quoted = false;
-    for (let index = 0; index < source.length; index++) {
-      const character = source[index];
-      if (character === '"' && source[index - 1] !== "\\") quoted = !quoted;
-      if (!quoted && character === "/" && source[index + 1] === "/") {
-        index = source.indexOf("\n", index);
-        if (index < 0) break;
-        json += "\n";
-      } else if (!quoted && character === "/" && source[index + 1] === "*") {
-        index = source.indexOf("*/", index + 2);
-        if (index < 0) throw new SyntaxError("unterminated block comment");
-        index++;
-      } else json += character;
-    }
-    json = json.replace(/,\s*([}\]])/g, "$1");
-    return validateConfig(JSON.parse(json));
-  } catch (error) {
-    return {
-      ok: false,
-      errors: [`invalid sproutboat.jsonc: ${error instanceof Error ? error.message : String(error)}`],
-    };
-  }
-}
+// Re-exported from @sproutboat/config (moved verbatim). This shim keeps
+// every `./config` importer and the `sproutboat/runtime/config` export path
+// working; the implementation lives in the shared package.
+export * from "@sproutboat/config";