sproutboat 0.8.0 → 0.10.0

package/src/main.ts

@@ -1,11 +1,13 @@
 #!/usr/bin/env bun
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, resolve } from "node:path";
+import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
+import { rmSync } from "node:fs";
+import { basename, dirname, relative, resolve } from "node:path";
 import { isBoolean, isSafeInteger, isString, jsonObject, parseJsonValue, type JsonObject } from "./json";
 import type { AssetFiles } from "./assets";
 import { parseConfig, pinBindingId, resourceRefs, type SproutboatConfig } from "./config";
 import { validateHttpSyncSource } from "./source";
 import { buildArtifact } from "./build";
+import { generateTypes, TYPES_FILE } from "./types-gen";
 import { bundleHandler, BundleError, type BundleResult } from "./bundle";
 import { runDev } from "./dev";
 import { buildStandalone } from "./standalone-build";
@@ -16,6 +18,19 @@ import { helpText, STORAGE_PRODUCTS, STORAGE_VERBS, type StorageProduct } from "
 import { notifyIfOutdated } from "./update-check";
 import { controlVersionWarning } from "./api-version";
 import { amber, bold, dim, leaf, ok, rose } from "./style";
+import { pathToFileURL } from "node:url";
+
+// A compiled Bun executable is not a general-purpose `bun` command. Porffor
+// is acquired after installation, so run its external ESM launcher through an
+// explicit private mode inside the packaged runtime.
+const internalModeAt = process.argv.slice(1, 3).indexOf("__porffor") + 1;
+if (internalModeAt > 0) {
+  const launcher = process.argv[internalModeAt + 1];
+  if (!launcher) throw new Error("internal Porffor mode requires a launcher path");
+  process.argv.splice(1, internalModeAt + 1, launcher);
+  await import(pathToFileURL(launcher).href);
+  process.exit(0);
+}
 
 const defaultApiUrl = "https://dashboard.sproutboat.com";
 
@@ -163,7 +178,9 @@ function usageError(what: string, usage: string): never {
   process.exit(2);
 }
 
-async function readProject(directory = process.cwd()) {
+/** Read the project identity and configuration without touching application code.
+ * Management commands must remain usable when a local checkout is incomplete. */
+async function readProjectConfig(directory = process.cwd()) {
   const projectDirectory = resolve(directory);
   const configPath = resolve(projectDirectory, "sproutboat.jsonc");
   let configSource: string;
@@ -174,25 +191,31 @@ async function readProject(directory = process.cwd()) {
   }
   const parsed = parseConfig(configSource);
   if (!parsed.ok) fail(parsed.errors.join("\n"));
-  const sourcePath = resolve(projectDirectory, parsed.value.main);
+  return { directory: projectDirectory, config: parsed.value };
+}
+
+/** Full build input: configuration plus entry point, resolved imports and checks. */
+async function readProject(directory = process.cwd()) {
+  const project = await readProjectConfig(directory);
+  const sourcePath = resolve(project.directory, project.config.main);
   let source: string;
   try {
     source = await readFile(sourcePath, "utf8");
   } catch {
-    fail(`entry point not found: ${parsed.value.main}`);
+    fail(`entry point not found: ${project.config.main}`);
   }
   // #89 — resolve imports first, then hold the *bundled* module to the
   // capability rules. Validating the entry file instead would let a dependency
   // smuggle in a Node API the handler is not allowed to touch.
   let bundle: BundleResult;
   try {
-    bundle = await bundleHandler(sourcePath, projectDirectory);
+    bundle = await bundleHandler(sourcePath, project.directory);
   } catch (cause) {
     fail(cause instanceof BundleError ? cause.message : String(cause));
   }
-  const supported = validateHttpSyncSource(bundle.code, (parsed.value.outbound ?? []).length > 0);
+  const supported = validateHttpSyncSource(bundle.code, (project.config.outbound ?? []).length > 0);
   if (!supported.ok) fail(supported.errors.join("\n"));
-  return { directory: projectDirectory, config: parsed.value, sourcePath, source, bundle };
+  return { ...project, sourcePath, source, bundle };
 }
 
 async function init(name = "hello") {
@@ -231,6 +254,35 @@ async function check(directory?: string) {
   console.log(ok(`check passed — ${project.config.name} (${project.config.main}, native-fetch)`));
 }
 
+async function types(directory?: string) {
+  const project = await readProject(directory);
+  const path = resolve(project.directory, TYPES_FILE);
+  await writeFile(path, generateTypes(project.config));
+  console.log(ok(`wrote ${relative(process.cwd(), path) || TYPES_FILE}`));
+  console.log(dim("  Commit it. Add it to tsconfig `include` if your project has one."));
+}
+
+/**
+ * Rewrite the generated types when the config has moved on, and only then.
+ *
+ * Called from `dev` and `deploy` so a binding added to sproutboat.jsonc cannot
+ * sit unreflected in the editor. It writes only when the content actually
+ * differs, which keeps it out of the way of git and of file watchers.
+ */
+async function refreshTypes(projectDir: string, config: SproutboatConfig): Promise<void> {
+  const path = resolve(projectDir, TYPES_FILE);
+  const wanted = generateTypes(config);
+  try {
+    if ((await readFile(path, "utf8")) === wanted) return;
+  } catch {
+    // No file yet: only write one if the project already opted in by having a
+    // tsconfig. Generating into a plain JavaScript project is noise.
+    if (!(await Bun.file(resolve(projectDir, "tsconfig.json")).exists())) return;
+  }
+  await writeFile(path, wanted);
+  console.log(dim(`  ${TYPES_FILE} refreshed from sproutboat.jsonc`));
+}
+
 async function build(directory?: string, target: "linux-x86_64" | "host" = "linux-x86_64") {
   const project = await readProject(directory);
   console.log(
@@ -287,6 +339,7 @@ async function dev(args: string[]) {
   if (!Number.isSafeInteger(port) || port < 1 || port > 65_535)
     usageError(`invalid --port: ${portArg}`, "dev [project-dir] [--port <n>] [--no-watch]");
   const project = await readProject(directory);
+  await refreshTypes(project.directory, project.config);
   console.log(dim(`Building ${project.config.name} for this machine (${hostTarget()})…`));
   await runDev({
     projectDir: project.directory,
@@ -297,7 +350,11 @@ async function dev(args: string[]) {
     watch: !args.includes("--no-watch"),
     // Re-read from disk on every rebuild: the point of watching is that the
     // files changed, so the bundle captured at startup is stale by definition.
-    rebuild: async () => (await readProject(directory)).bundle.code,
+    rebuild: async () => {
+      const next = await readProject(directory);
+      await refreshTypes(next.directory, next.config);
+      return { config: next.config, sourcePath: next.sourcePath, source: next.bundle.code };
+    },
   });
 }
 
@@ -410,6 +467,8 @@ async function deploy(args: string[]) {
     projectName = built.project.config.name;
     artifactDir = built.artifact.artifactDir;
     config = built.project.config;
+    // After provisioning: ids may have been pinned into the config just now.
+    await refreshTypes(built.project.directory, built.project.config);
   }
   const manifest = Bun.file(resolve(artifactDir, "manifest.json"));
   const sprout = Bun.file(resolve(artifactDir, "sprout"));
@@ -597,7 +656,7 @@ async function versions(args: string[]) {
   if (sub === "view") {
     const id = args.shift();
     if (!id) usageError("versions view: missing <version-id>", "versions view <version-id> [project-dir]");
-    const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+    const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(args[0]), apiCredentials()]);
     const body = await responseText(
       await fetch(`${apiUrl}/api/projects/${project.config.name}/deployments/${encodeURIComponent(id)}`, {
         headers: { "x-api-key": token },
@@ -628,7 +687,7 @@ async function versions(args: string[]) {
     return;
   }
 
-  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(args[0]), apiCredentials()]);
   const response = await fetch(`${apiUrl}/api/projects/${project.config.name}/deployments`, {
     headers: { "x-api-key": token },
   });
@@ -643,7 +702,7 @@ async function versions(args: string[]) {
 async function rollback(args: string[]) {
   const id = args[0];
   if (!id) usageError("rollback: missing <version-id>", "rollback <version-id> [project-dir]");
-  const [project, { apiUrl, token }] = await Promise.all([readProject(args[1]), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(args[1]), apiCredentials()]);
   const response = await fetch(`${apiUrl}/api/projects/${project.config.name}/deployments/${id}/activate`, {
     method: "POST",
     headers: { "x-api-key": token },
@@ -657,7 +716,7 @@ async function rollback(args: string[]) {
 async function tail(args: string[]) {
   const sproutLog = args.includes("--sprout");
   const dir = args.find((arg) => !arg.startsWith("-"));
-  const [project, { apiUrl, token }] = await Promise.all([readProject(dir), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(dir), apiCredentials()]);
   const path = sproutLog ? "logs/sprout" : "logs/recent";
   const response = await fetch(`${apiUrl}/api/projects/${project.config.name}/${path}`, {
     headers: { "x-api-key": token },
@@ -712,7 +771,7 @@ async function domains(args: string[]) {
   const host = sub === "list" ? undefined : args.shift();
   if (sub !== "list" && !host)
     usageError(`domains ${sub}: missing <hostname>`, `domains ${sub} <hostname> [project-dir]`);
-  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(args[0]), apiCredentials()]);
   const base = `${apiUrl}/api/projects/${project.config.name}/domains`;
   const auth = { "x-api-key": token };
 
@@ -769,7 +828,7 @@ async function secrets(args: string[]) {
   const name = sub === "list" ? undefined : positional.shift();
   if (sub !== "list" && !name) usageError(`secrets ${sub}: missing <NAME>`, `secrets ${sub} <NAME> [project-dir]`);
   if (name && !/^[A-Z][A-Z0-9_]*$/.test(name)) fail("secret name must be UPPER_SNAKE_CASE");
-  const [project, { apiUrl, token }] = await Promise.all([readProject(positional[0]), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProjectConfig(positional[0]), apiCredentials()]);
   const base = `${apiUrl}/api/projects/${project.config.name}/secrets`;
   const auth = { "x-api-key": token };
 
@@ -897,6 +956,194 @@ async function storage(key: string, args: string[]) {
   console.log(ok(`deleted ${product.noun} ${name}`));
 }
 
+function option(args: string[], name: string): string | undefined {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : undefined;
+}
+
+async function writeAtomic(
+  path: string,
+  chunks: AsyncIterable<string> | readonly string[],
+  overwrite: boolean,
+): Promise<void> {
+  const destination = resolve(path);
+  if (!overwrite && (await Bun.file(destination).exists())) fail(`${path} already exists; pass --force to replace it`);
+  await mkdir(dirname(destination), { recursive: true });
+  const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`;
+  const cleanup = () => {
+    try {
+      rmSync(temporary, { force: true });
+    } catch {
+      /* best effort during process shutdown */
+    }
+  };
+  process.once("exit", cleanup);
+  const file = await open(temporary, "wx", 0o600);
+  try {
+    for await (const chunk of chunks) await file.write(chunk);
+    await file.sync();
+    await file.close();
+    await rename(temporary, destination);
+    process.off("exit", cleanup);
+  } catch (error) {
+    await file.close().catch(() => undefined);
+    cleanup();
+    process.off("exit", cleanup);
+    throw error;
+  }
+}
+
+async function kvContents(args: string[]): Promise<void> {
+  const area = args.shift();
+  if (!area || !["key", "bulk", "export"].includes(area))
+    usageError("kv: unknown contents command", "kv <key | bulk | export> ...");
+  const namespace = area === "export" ? args.shift() : args[1];
+  if (!namespace) usageError(`kv ${area}: missing <namespace>`, `kv ${area} <namespace> ...`);
+  const { apiUrl, token } = await apiCredentials();
+  const rows = await storageRows(`${apiUrl}/api/kv`, { "x-api-key": token }, STORAGE_PRODUCTS[0]);
+  const id = idForName(rows, namespace, STORAGE_PRODUCTS[0]);
+  const base = `${apiUrl}/api/kv/${id}`;
+  const auth = { "x-api-key": token };
+
+  if (area === "key") {
+    const verb = args.shift();
+    args.shift();
+    if (!verb || !["list", "get", "put", "delete"].includes(verb))
+      usageError("kv key: unknown operation", "kv key <list | get | put | delete> <namespace> ...");
+    if (verb === "list") {
+      const query = new URLSearchParams();
+      for (const flag of ["--prefix", "--cursor", "--limit"] as const) {
+        const value = option(args, flag);
+        if (value !== undefined) query.set(flag.slice(2), value);
+      }
+      const body = await responseText(await fetch(`${base}/keys?${query}`, { headers: auth }), "list rejected");
+      console.log(body);
+      return;
+    }
+    const key = args.shift();
+    if (!key) usageError(`kv key ${verb}: missing <key>`, `kv key ${verb} <namespace> <key>`);
+    const url = `${base}/keys/${encodeURIComponent(key)}`;
+    if (verb === "get") {
+      const body = await responseText(await fetch(url, { headers: auth }), "get rejected");
+      const record = jsonObject(parseJsonValue(body));
+      if (!record || !isString(record.value)) fail("get response did not contain a value");
+      const output = option(args, "--output");
+      if (output) await writeAtomic(output, [record.value], args.includes("--force"));
+      else console.log(args.includes("--text") ? record.value : JSON.stringify({ key, value: record.value }, null, 2));
+      return;
+    }
+    if (verb === "put") {
+      const path = option(args, "--path");
+      const positional = args.find((arg, index) => !arg.startsWith("-") && args[index - 1] !== "--path");
+      if (path && positional)
+        usageError(
+          "kv key put: use a value or --path, not both",
+          "kv key put <namespace> <key> [value] [--path <file>]",
+        );
+      const value = path ? await readFile(resolve(path), "utf8") : (positional ?? (await Bun.stdin.text()));
+      await responseText(
+        await fetch(url, {
+          method: "PUT",
+          headers: { ...auth, "content-type": "application/json" },
+          body: JSON.stringify({ value }),
+        }),
+        "put rejected",
+      );
+      console.log(ok(`set ${key}`));
+      return;
+    }
+    if (!args.includes("--yes")) fail(`this permanently deletes "${key}"; re-run with --yes`);
+    await responseText(await fetch(url, { method: "DELETE", headers: auth }), "delete rejected");
+    console.log(ok(`deleted ${key}`));
+    return;
+  }
+
+  if (area === "bulk") {
+    const verb = args.shift();
+    args.shift();
+    const input = args.shift();
+    if (!verb || !["get", "put", "delete"].includes(verb) || !input)
+      usageError(
+        "kv bulk: expected an operation, namespace, and JSON file",
+        "kv bulk <get | put | delete> <namespace> <file>",
+      );
+    if (verb === "delete" && !args.includes("--yes")) fail("bulk deletion requires --yes");
+    const parsed = parseJsonValue(await readFile(resolve(input), "utf8"));
+    if (!Array.isArray(parsed) || parsed.length === 0) fail("bulk input must be a non-empty JSON array");
+    const responses: unknown[] = [];
+    let changed = 0;
+    const failures: unknown[] = [];
+    for (let start = 0; start < parsed.length; start += 100) {
+      const body = await responseText(
+        await fetch(`${base}/bulk/${verb}`, {
+          method: "POST",
+          headers: { ...auth, "content-type": "application/json" },
+          body: JSON.stringify(parsed.slice(start, start + 100)),
+        }),
+        `bulk ${verb} rejected`,
+      );
+      const result = parseJsonValue(body);
+      if (verb === "get" && Array.isArray(result)) responses.push(...result);
+      else {
+        const summary = jsonObject(result);
+        changed += Number(summary?.written ?? summary?.deleted ?? 0);
+        if (Array.isArray(summary?.failures)) failures.push(...summary.failures);
+      }
+    }
+    const result = verb === "get" ? responses : { [verb === "put" ? "written" : "deleted"]: changed, failures };
+    const output = option(args, "--output");
+    if (output) await writeAtomic(output, [JSON.stringify(result, null, 2) + "\n"], args.includes("--force"));
+    else console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  const output = option(args, "--output");
+  if (!output)
+    usageError(
+      "kv export: missing --output <file>",
+      "kv export <namespace> --output <dump.json> [--prefix <prefix>] [--force]",
+    );
+  const prefix = option(args, "--prefix") ?? "";
+  async function* dump(): AsyncGenerator<string> {
+    yield "[\n";
+    let cursor = "";
+    let first = true;
+    do {
+      const query = new URLSearchParams({ prefix, limit: "100" });
+      if (cursor) query.set("cursor", cursor);
+      const listed = jsonObject(
+        parseJsonValue(
+          await responseText(await fetch(`${base}/keys?${query}`, { headers: auth }), "export list rejected"),
+        ),
+      );
+      const keys = Array.isArray(listed?.keys) ? listed.keys.filter(isString) : [];
+      if (keys.length) {
+        const values = parseJsonValue(
+          await responseText(
+            await fetch(`${base}/bulk/get`, {
+              method: "POST",
+              headers: { ...auth, "content-type": "application/json" },
+              body: JSON.stringify(keys),
+            }),
+            "export read rejected",
+          ),
+        );
+        if (!Array.isArray(values)) fail("export response was not an array");
+        for (const entry of values) {
+          const record = jsonObject(entry);
+          if (!record || !isString(record.key) || !isString(record.value)) continue;
+          yield `${first ? "" : ",\n"}  ${JSON.stringify({ key: record.key, value: record.value })}`;
+          first = false;
+        }
+      }
+      cursor = isString(listed?.cursor) ? listed.cursor : "";
+    } while (cursor);
+    yield "\n]\n";
+  }
+  await writeAtomic(output, dump(), args.includes("--force"));
+  console.log(ok(`exported ${namespace} to ${output}`));
+}
+
 async function deleteProject(args: string[]) {
   // `sproutboat delete [project-dir] [--name <project>] --yes` — flags in any order.
   const positional: string[] = [];
@@ -911,7 +1158,7 @@ async function deleteProject(args: string[]) {
   }
 
   const { apiUrl, token } = await apiCredentials();
-  const name = explicitName ?? (await readProject(positional[0])).config.name;
+  const name = explicitName ?? (await readProjectConfig(positional[0])).config.name;
   if (!confirmed) fail(`this permanently removes "${name}", every version, and its route — re-run with --yes`);
 
   const url = `${apiUrl}/api/projects/${encodeURIComponent(name)}?confirm=${encodeURIComponent(name)}`;
@@ -963,6 +1210,9 @@ switch (command) {
   case "check":
     await check(args[0]);
     break;
+  case "types":
+    await types(args[0]);
+    break;
   case "dev":
     await dev(args);
     break;
@@ -998,6 +1248,9 @@ switch (command) {
     await secrets(args);
     break;
   case "kv":
+    if (["key", "bulk", "export"].includes(args[0] ?? "")) await kvContents(args);
+    else await storage(command, args);
+    break;
   case "d1":
   case "r2":
   case "queues":

package/src/manifest.ts

@@ -1,167 +1,4 @@
-export const ARTIFACT_SCHEMA_VERSION = 2;
-export const RUNTIME = "native-fetch";
-export const CAPABILITY_PROFILE = "http-sync-v0";
-
-/** The only target a deployed artifact may carry. Every box runs linux-x86_64. */
-export const DEPLOY_TARGET = "linux-x86_64";
-
-/**
- * `<arch>-<platform>` of the machine doing the build, e.g. `arm64-darwin`.
- * Only `sproutboat build --target host` produces one (#62): it runs on this
- * machine for local dev and is deliberately not portable, so `validateManifest`
- * rejects it and neither `deploy` nor the control plane will accept it.
- */
-export type HostTarget = `${string}-${string}`;
-export const hostTarget = (): HostTarget => `${process.arch}-${process.platform}`;
-
-export type ArtifactManifest = {
-  schemaVersion: 2;
-  project: string;
-  target: typeof DEPLOY_TARGET | HostTarget;
-  runtime: "native-fetch";
-  capabilityProfile: "http-sync-v0";
-  porfforVersion: string;
-  esbuildVersion: string;
-  /** Build provenance, e.g. `zig-musl/0.16.0+porffor/a415d19+uws/360c276d`. */
-  buildImage: string;
-  /**
-   * The project's `compatibility_date`, as `YYYY-MM-DD`. Optional: artifacts
-   * built before this field existed have none, and every reader must treat that
-   * as the baseline (see `BASELINE_COMPATIBILITY_DATE` in `wrap.ts`). This is
-   * how a runtime behaviour change ships without breaking deployed apps — new
-   * builds opt in by moving their date, old binaries keep the old semantics —
-   * so it is deliberately *not* part of `schemaVersion`, which stays frozen
-   * at 2.
-   */
-  compatibilityDate?: string;
-  sourceHash: `sha256:${string}`;
-  binaryHash: `sha256:${string}`;
-  binarySize: number;
-  builtAt: string;
-};
-
-export type ManifestValidation = { ok: true; value: ArtifactManifest } | { ok: false; errors: string[] };
-
-type JsonValue = string | number | boolean | null | ManifestJsonObject | JsonValue[];
-
-interface ManifestJsonObject {
-  readonly [key: string]: JsonValue;
-}
-
-type ManifestInput = JsonValue | undefined;
-
-function isRecord(value: ManifestInput): value is ManifestJsonObject {
-  return value !== null && Object(value) === value && !Array.isArray(value) && !(value instanceof Function);
-}
-
-function isString(value: ManifestInput): value is string {
-  return Object(value) !== value && value === String(value);
-}
-
-function sha256(value: ManifestInput): value is `sha256:${string}` {
-  return isString(value) && /^sha256:[a-f0-9]{64}$/.test(value);
-}
-
-function isPositiveInteger(value: ManifestInput): value is number {
-  return Number.isSafeInteger(value) && value === Number(value) && Number(value) > 0;
-}
-
-export function validateManifest(value: ManifestInput): ManifestValidation {
-  if (!isRecord(value)) return { ok: false, errors: ["manifest must be an object"] };
-  const errors: string[] = [];
-  const required = [
-    "schemaVersion",
-    "project",
-    "target",
-    "runtime",
-    "capabilityProfile",
-    "porfforVersion",
-    "esbuildVersion",
-    "buildImage",
-    "sourceHash",
-    "binaryHash",
-    "binarySize",
-    "builtAt",
-  ];
-  for (const field of required) if (!(field in value)) errors.push(`missing manifest field: ${field}`);
-  const schemaVersion = value.schemaVersion === ARTIFACT_SCHEMA_VERSION ? ARTIFACT_SCHEMA_VERSION : null;
-  if (schemaVersion === null) errors.push("schemaVersion must be 2");
-  const project =
-    isString(value.project) && /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])?$/.test(value.project) ? value.project : null;
-  if (project === null) errors.push("project must be a valid slug");
-  const target = value.target === DEPLOY_TARGET ? value.target : null;
-  if (target === null) {
-    // A `--target host` artifact lands here: runnable where it was built, not
-    // on a box. Name that, so the failure reads as "wrong build" not "corrupt".
-    errors.push(
-      isString(value.target) && value.target !== DEPLOY_TARGET
-        ? `target must be ${DEPLOY_TARGET}, got ${value.target} — \`--target host\` builds are for local dev and cannot be deployed`
-        : `target must be ${DEPLOY_TARGET}`,
-    );
-  }
-  const runtime = value.runtime === RUNTIME ? value.runtime : null;
-  if (runtime === null) errors.push("runtime must be native-fetch");
-  const capabilityProfile = value.capabilityProfile === CAPABILITY_PROFILE ? value.capabilityProfile : null;
-  if (capabilityProfile === null) errors.push("capabilityProfile must be http-sync-v0");
-  const versions = ["porfforVersion", "esbuildVersion", "buildImage"] as const;
-  const [porfforVersion, esbuildVersion, buildImage] = versions.map((field) =>
-    isString(value[field]) && value[field] ? value[field] : null,
-  );
-  for (const [field, version] of versions.map(
-    (field, index) => [field, [porfforVersion, esbuildVersion, buildImage][index]] as const,
-  )) {
-    if (version === null) errors.push(`${field} must be a non-empty string`);
-  }
-  const sourceHash = sha256(value.sourceHash) ? value.sourceHash : null;
-  if (sourceHash === null) errors.push("sourceHash must be a sha256 digest");
-  const binaryHash = sha256(value.binaryHash) ? value.binaryHash : null;
-  if (binaryHash === null) errors.push("binaryHash must be a sha256 digest");
-  const binarySize = isPositiveInteger(value.binarySize) ? value.binarySize : null;
-  if (binarySize === null) errors.push("binarySize must be a positive integer");
-  const builtAt = isString(value.builtAt) && !Number.isNaN(Date.parse(value.builtAt)) ? value.builtAt : null;
-  if (builtAt === null) errors.push("builtAt must be an ISO-8601 timestamp");
-  // Optional by design: an artifact from before the field existed is valid and
-  // must stay deployable, so "absent" is not an error — only "present and
-  // malformed" is.
-  let compatibilityDate: string | undefined;
-  if (value.compatibilityDate !== undefined) {
-    if (isString(value.compatibilityDate) && /^\d{4}-\d{2}-\d{2}$/.test(value.compatibilityDate))
-      compatibilityDate = value.compatibilityDate;
-    else errors.push("compatibilityDate must be YYYY-MM-DD");
-  }
-  if (
-    errors.length ||
-    schemaVersion === null ||
-    project === null ||
-    target === null ||
-    runtime === null ||
-    capabilityProfile === null ||
-    porfforVersion === null ||
-    esbuildVersion === null ||
-    buildImage === null ||
-    sourceHash === null ||
-    binaryHash === null ||
-    binarySize === null ||
-    builtAt === null
-  )
-    return { ok: false, errors };
-  return {
-    ok: true,
-    value: {
-      ...value,
-      schemaVersion,
-      project,
-      target,
-      runtime,
-      capabilityProfile,
-      porfforVersion,
-      esbuildVersion,
-      buildImage,
-      sourceHash,
-      binaryHash,
-      binarySize,
-      builtAt,
-      compatibilityDate,
-    },
-  };
-}
+// Re-exported from @sproutboat/artifact (moved verbatim). This shim keeps
+// every `./manifest` importer and the `sproutboat/runtime/manifest` export
+// path working; the implementation lives in the shared package.
+export * from "@sproutboat/artifact";