sproutboat 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -10,6 +10,65 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-09-11
+### Added
+- Per-platform native CLI: `npm install sproutboat` pulls a prebuilt binary for
+  the host (`@sproutboat/cli-{darwin,linux}-{arm64,x64}`) behind a thin launcher
+  that preserves signals and embeds its own version, so the CLI runs without Bun
+  on `PATH`.
+- Porffor is fetched on the first build, not installed as a dependency: the
+  pinned commit is downloaded into `~/.cache/sproutboat`, SHA-256 verified, and
+  patched there. Installation clones nothing and runs no Git, Make or compiler.
+- `request.cf.clientIp` in standalone builds, from a server-set
+  `x-sb-remote-addr`, with `SB_TRUSTED_PROXIES` for `X-Forwarded-For` resolution
+  behind a reverse proxy (baronunread/sproutboat#163).
+- `env.<D1>.backup(name?)` — an online, integrity-checked single-file snapshot
+  of a D1 database via `VACUUM INTO`, on both the embedded and broker transports
+  (baronunread/sproutboat#164).
+- Rate Limiting binding: `ratelimiters: [{ binding, limit, period }]` in
+  `sproutboat.jsonc` gives `env.<NAME>.limit({ key }) -> { success }`, a
+  fixed-window counter on both transports (baronunread/sproutboat#69).
+- `crypto.subtle` subset: `digest` (SHA-256/384/512) and HMAC
+  `importKey` / `sign` / `verify`, backed by reference SHA-2 as inline C so it
+  works on both transports (baronunread/sproutboat#133). No ECDSA or AES yet.
+- `crypto.scryptVerify(password, salt, expected, { N, r, p })` — a verify-only
+  scrypt (RFC 7914) for migrating password hashes made by Node/Bun `scrypt`
+  (baronunread/sproutboat#153). Not a blessed KDF for new credentials.
+- `x-sb-cpu-ms`: per-invocation CPU time, carried on the handler response.
+
+### Fixed
+- `303` (and every other status not in Porffor's table) no longer resets the
+  connection on standalone builds (baronunread/sproutboat#156).
+- Handler `console.log` / `console.error` reach stderr, unbuffered, in
+  standalone builds instead of vanishing (baronunread/sproutboat#165).
+- `sproutboat dev` no longer leaves the previous sprout running across a
+  rebuild, delivers no triggers to a candidate that failed to start, and cleans
+  up every failed setup path on rebuild and on shutdown.
+- The Zig toolchain cache is hardened against a partial or concurrent download.
+
+### Changed
+- Porffor pin bumped alpha-4 → **alpha-5** (`1f4ae4ae`); the same `UWS_COMMIT`,
+  so no uWebSockets re-vendor.
+- Config parsing, the artifact manifest, the binding broker, the wire assets and
+  the whole native-fetch runtime (prelude + transports) now come from published
+  `@sproutboat/*` packages; the CLI keeps thin re-export shims. The Porffor pin
+  and its source patches moved to `@sproutboat/toolchain`.
+- Broker cron / queue / alarm delivery is gated by a local signal, so only a
+  promoted candidate runs timers.
+
+### Performance
+- Embedded transport caches prepared statements per database (FIFO, 32/db)
+  instead of recompiling the SQL on every binding op — the op boundary drops
+  from ~0.6 ms to tens of µs (baronunread/sproutboat#155).
+- The broker's due-queue and due-alarm polls are indexed.
+
+### Docs
+- `docs/standalone.md` documents the single-threaded execution model and the
+  `SO_REUSEPORT` multi-process recipe for scaling past one core
+  (baronunread/sproutboat#154); the embedded transport also sets
+  `PRAGMA busy_timeout` so shared-data-dir writers wait instead of failing.
+  Also: the client-IP behaviour and backing up D1.
+
 ## [0.9.0] - 2026-09-07
 ### Added
 - KV content management: `kv key get`, `put`, `delete`, and `list`; bounded
@@ -282,7 +341,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.8.0...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.9.0...v0.10.0
+[0.9.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.6.0...v0.6.1

package/README.md

@@ -8,6 +8,11 @@ https://sproutboat.com
 The CLI for [Sproutboat](https://github.com/baronunread/sproutboat). Compiles a
 `fetch` handler to a native binary and ships it to any Sproutboat control plane.
 
+## Issues
+
+Tracked centrally in [baronunread/sproutboat](https://github.com/baronunread/sproutboat/issues)
+(label `area:cli`). Please file there.
+
 ## Overview
 
 Wrangler-shaped, MIT licensed. `build` and `deploy` cross-compile your handler
@@ -19,16 +24,23 @@ for agents: [sproutboat.com/llms.txt](https://sproutboat.com/llms.txt)).
 
 ## Using
 
-Sproutboat is a Bun tool. It needs **Bun 1.4+** on the machine you build from,
-and `bunx` rather than `npx`: the CLI runs on Bun's APIs, and `npm install`
-cannot resolve it today ([#134](https://github.com/baronunread/sproutboat/issues/134)).
+The npm package installs a small Node launcher and the matching native
+platform package, so `npm install -g sproutboat` and `npm exec sproutboat` work
+without Bun on `darwin` and `linux` for `arm64` and `x64`. The self-hosted
+runtime exports remain in the root package for Bun-based platform integrations.
 Nothing is needed on the machine that *runs* a sprout: that gets a static
 binary.
 
+The first build downloads the pinned Porffor source into
+`~/.cache/sproutboat`, verifies its SHA-256, applies Sproutboat's compiler
+patches there, and publishes the cache entry atomically. Installation itself
+does not clone Porffor or invoke Git, Make, or a compiler. Warm-cache builds can
+run offline.
+
 ```sh
-bunx sproutboat init hello
+npm exec sproutboat init hello
 cd hello
-bunx sproutboat dev        # runs it right here, no control plane needed
+npm exec sproutboat dev    # runs it right here, no control plane needed
 ```
 
 Happy with it? Ship it:
@@ -38,10 +50,10 @@ bunx sproutboat login --api-url https://control.example.com   # one browser appr
 bunx sproutboat deploy
 ```
 
-Or install it once with Bun and drop the `bunx`:
+Or install it once and drop the `npm exec`:
 
 ```sh
-bun add -g sproutboat     # then: sproutboat deploy, sproutboat tail, ...
+npm install -g sproutboat # then: sproutboat deploy, sproutboat tail, ...
 ```
 
 `login` is one-time. It writes a long-lived token to
@@ -113,6 +125,7 @@ complete export. Existing output files require `--force`.
   "queues": ["JOBS"],
   "analytics_engine_datasets": ["METRICS"],   // bare name only, no id
   "durable_objects": { "COUNTER": "Counter" },
+  "ratelimiters": [{ "binding": "API", "limit": 100, "period": 60 }], // env.API.limit({ key })
   "outbound": ["api.example.com"],
   "triggers": { "crons": ["*/5 * * * *"] },
   "assets": { "directory": "public", "binding": "ASSETS", "run_sprout_first": ["/api/*"] }

package/SURFACE.md

@@ -44,6 +44,10 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `CC` | C compiler used to build uSockets for a host build (default `cc`). A host build needs one regardless: it is what Porffor compiles its own generated C with. |
 | `AR` | Archiver used to assemble uSockets.a for a host build (default `ar`). |
 | `SPROUTBOAT_COMPILE_TIMEOUT_MS` | Porffor compile timeout in ms (default 600000). |
+| `SPROUTBOAT_TOOLCHAIN_CACHE` | Managed Porffor and compiler cache root (default ~/.cache/sproutboat). |
+| `SPROUTBOAT_PORFFOR_DIR` | Contributor override for an existing Porffor source checkout. Required files are validated before use. |
+| `SPROUTBOAT_BUILD_UWS_FROM_SOURCE` | Set to 1 to explicitly allow the contributor-only Git and Make uWebSockets fallback. |
+| `SPROUTBOAT_CLI_VERSION` | CLI version embedded by the release executable build. Not normally set by users. |
 | `SPROUTBOAT_VARS_JSON` | JSON object of baked `vars` (UPPER_SNAKE -> string), read by the wrapper when generating the sprout module. |
 | `SPROUTBOAT_BINDINGS_JSON` | The artifact's bindings.json, read by the wrapper to emit the `__sbInstallBindings` line. |
 | `SPROUTBOAT_CONFIG_DIR` | Directory for credentials.json (default ~/.config/sproutboat). |
@@ -67,7 +71,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/a415d19+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/1f4ae4a+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/bin/sproutboat.cjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// npm only selects the packaged executable. The CLI itself always runs in Bun.
+const { spawn } = require("node:child_process");
+const { resolve } = require("node:path");
+
+const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
+const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
+if (!platform || !arch) {
+  console.error(`sproutboat: unsupported platform ${process.platform}/${process.arch}`);
+  process.exit(1);
+}
+const packageName = `@sproutboat/cli-${platform}-${arch}`;
+let executable;
+try {
+  executable = require.resolve(`${packageName}/bin/sproutboat`);
+} catch {
+  console.error(`sproutboat: optional package ${packageName} is missing for ${platform}/${arch}`);
+  console.error("Reinstall sproutboat without --omit=optional, or use a direct release download.");
+  process.exit(1);
+}
+const child = spawn(resolve(executable), process.argv.slice(2), { stdio: "inherit" });
+child.once("error", (error) => {
+  console.error(`sproutboat: could not start bundled executable: ${error.message}`);
+  process.exit(1);
+});
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => child.kill(signal));
+}
+child.once("exit", (code, signal) => {
+  if (signal) process.kill(process.pid, signal);
+  else process.exit(code ?? 1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -19,12 +19,14 @@
     "url": "git+https://github.com/baronunread/sproutboat-cli.git"
   },
   "bin": {
-    "sproutboat": "src/main.ts"
+    "sproutboat": "bin/sproutboat.cjs"
   },
   "files": [
     "CHANGELOG.md",
     "SURFACE.md",
     "src",
+    "bin/sproutboat.cjs",
+    "scripts",
     "types",
     "vendor"
   ],
@@ -37,7 +39,6 @@
     "./runtime/assets": "./src/assets.ts",
     "./runtime/broker": "./src/broker.ts",
     "./runtime/wrap": "./src/wrap.ts",
-    "./runtime/prelude": "./src/native-fetch-prelude.js",
     "./package.json": "./package.json",
     "./types": "./types/sproutboat.d.ts"
   },
@@ -46,6 +47,7 @@
     "typecheck": "tsc --noEmit",
     "lint": "oxlint .",
     "examples": "bun examples/smoke.ts",
+    "build:cli": "bun scripts/build-cli.ts",
     "fmt": "oxfmt .",
     "fmt:check": "oxfmt --check .",
     "test": "bun test",
@@ -58,8 +60,13 @@
     "kitchen-sink:standalone": "bun examples/kitchen-sink/harness-standalone.ts"
   },
   "dependencies": {
-    "esbuild": "^0.28.2",
-    "porffor": "github:CanadaHonk/porffor#alpha-4"
+    "@sproutboat/artifact": "^0.2.0",
+    "@sproutboat/assets": "^0.2.0",
+    "@sproutboat/config": "^0.3.0",
+    "@sproutboat/runtime": "^0.4.0",
+    "@sproutboat/toolchain": "^0.3.0",
+    "@sproutboat/wire": "^0.4.0",
+    "esbuild": "^0.28.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -69,7 +76,13 @@
     "oxlint": "1.81.0",
     "typescript": "7.0.2"
   },
+  "optionalDependencies": {
+    "@sproutboat/cli-darwin-arm64": "0.10.0",
+    "@sproutboat/cli-darwin-x64": "0.10.0",
+    "@sproutboat/cli-linux-arm64": "0.10.0",
+    "@sproutboat/cli-linux-x64": "0.10.0"
+  },
   "engines": {
-    "bun": ">=1.4.0"
+    "node": ">=18"
   }
 }

package/scripts/build-cli.ts

@@ -0,0 +1,44 @@
+/** Build one platform package executable. npm's tiny root launcher resolves it. */
+import { chmod, copyFile, mkdir } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
+const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
+if (!platform || !arch) throw new Error(`unsupported release host ${process.platform}/${process.arch}`);
+const packageDir = resolve(import.meta.dir, "..", "platform-packages", `${platform}-${arch}`);
+const out = resolve(packageDir, "bin", "sproutboat");
+await mkdir(resolve(out, ".."), { recursive: true });
+// SAFETY: package.json is this release's manifest and npm requires its version.
+const version = ((await Bun.file(resolve(import.meta.dir, "..", "package.json")).json()) as { version: string })
+  .version;
+// SAFETY: every checked-in platform package manifest owns a required string version.
+const platformVersion = ((await Bun.file(resolve(packageDir, "package.json")).json()) as { version: string }).version;
+if (platformVersion !== version)
+  throw new Error(`platform package version ${platformVersion} does not match root ${version}`);
+const child = Bun.spawn(
+  [
+    process.execPath,
+    "build",
+    "--compile",
+    "--target=bun",
+    `--define:process.env.SPROUTBOAT_CLI_VERSION=${JSON.stringify(version)}`,
+    "--outfile",
+    out,
+    "src/main.ts",
+  ],
+  {
+    cwd: resolve(import.meta.dir, ".."),
+    stdout: "inherit",
+    stderr: "inherit",
+  },
+);
+if ((await child.exited) !== 0) process.exit(1);
+let esbuild: string;
+try {
+  esbuild = Bun.resolveSync(`@esbuild/${platform}-${arch}/bin/esbuild`, import.meta.dir);
+} catch {
+  throw new Error("matching esbuild binary is missing; run bun install before building a platform package");
+}
+const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
+await copyFile(esbuild, packagedEsbuild);
+await chmod(packagedEsbuild, 0o755);

package/src/assets.ts

@@ -1,121 +1,4 @@
-/**
- * Static-asset manifest. `sproutboat build` copies the project's `assets`
- * directory next to the artifact and writes `assets.json` (this manifest); the
- * edge serves matching files directly (assets-first, like Cloudflare), and the
- * broker's `assets.get` op backs `env.<ASSETS>.fetch(request)` for the paths
- * the sprout chooses to serve itself.
- */
-import { createHash } from "node:crypto";
-import { readdirSync, readFileSync } from "node:fs";
-import { join, posix } from "node:path";
-
-export type AssetEntry = { hash: string; size: number; type: string };
-/** `/absolute/posix/path` -> entry. Serialised into `assets.json`. */
-export type AssetFiles = { [path: string]: AssetEntry };
-export type AssetManifest = {
-  /** Fallback for requests that match no file, applied by the broker. */
-  notFound: "none" | "single-page-application" | "404-page";
-  /** `true` = every path to the sprout first; string[] = selective (leading `!` negates). */
-  runSproutFirst: boolean | string[];
-  files: AssetFiles;
-};
-
-const TYPES = new Map<string, string>([
-  ["html", "text/html; charset=utf-8"],
-  ["css", "text/css; charset=utf-8"],
-  ["js", "text/javascript; charset=utf-8"],
-  ["mjs", "text/javascript; charset=utf-8"],
-  ["json", "application/json; charset=utf-8"],
-  ["map", "application/json; charset=utf-8"],
-  ["txt", "text/plain; charset=utf-8"],
-  ["xml", "application/xml; charset=utf-8"],
-  ["svg", "image/svg+xml"],
-  ["png", "image/png"],
-  ["jpg", "image/jpeg"],
-  ["jpeg", "image/jpeg"],
-  ["gif", "image/gif"],
-  ["webp", "image/webp"],
-  ["avif", "image/avif"],
-  ["ico", "image/x-icon"],
-  ["woff2", "font/woff2"],
-  ["woff", "font/woff"],
-  ["ttf", "font/ttf"],
-  ["wasm", "application/wasm"],
-  ["webmanifest", "application/manifest+json"],
-]);
-
-export function contentType(name: string): string {
-  const dot = name.lastIndexOf(".");
-  return (dot >= 0 ? TYPES.get(name.slice(dot + 1).toLowerCase()) : undefined) ?? "application/octet-stream";
-}
-
-/**
- * Resolve a request path to a manifest key the way a static host does:
- *   - an exact hit wins;
- *   - a directory path (`/docs/`) tries `/docs/index.html`;
- *   - an extensionless path (`/docs`) tries `/docs.html`, then `/docs/index.html`.
- * Returns the matched key, or `null`. This only picks which file to serve — no
- * canonical redirects, and the caller still owns not-found handling. Mirrors
- * Cloudflare's `html_handling: "auto-trailing-slash"` minus the 3xx responses.
- */
-export function resolveAssetKey(path: string, has: (key: string) => boolean): string | null {
-  if (!path.startsWith("/")) path = `/${path}`;
-  if (path.endsWith("/")) {
-    const index = `${path}index.html`;
-    return has(index) ? index : null;
-  }
-  if (has(path)) return path;
-  const base = path.slice(path.lastIndexOf("/") + 1);
-  if (!base.includes(".")) {
-    if (has(`${path}.html`)) return `${path}.html`;
-    if (has(`${path}/index.html`)) return `${path}/index.html`;
-  }
-  return null;
-}
-
-/** Walk `dir` recursively, returning `{ "/path": {hash,size,type} }`. */
-export function walkAssets(dir: string) {
-  const out: AssetFiles = {};
-  const recurse = (abs: string, rel: string): void => {
-    for (const ent of readdirSync(abs, { withFileTypes: true })) {
-      if (ent.name.startsWith(".")) continue;
-      const childAbs = join(abs, ent.name);
-      const childRel = posix.join(rel, ent.name);
-      if (ent.isDirectory()) {
-        recurse(childAbs, childRel);
-        continue;
-      }
-      if (!ent.isFile()) continue;
-      const body = readFileSync(childAbs);
-      out[`/${childRel}`] = {
-        hash: createHash("sha256").update(body).digest("hex"),
-        size: body.byteLength,
-        type: contentType(ent.name),
-      };
-    }
-  };
-  recurse(dir, "");
-  return out;
-}
-
-/** Does `pathname` hit the sprout before assets, given a `runSproutFirst` spec? */
-export function isSproutFirst(spec: boolean | string[], pathname: string): boolean {
-  if (!Array.isArray(spec)) return spec;
-  let matched = false;
-  for (const raw of spec) {
-    const negate = raw.startsWith("!");
-    const pattern = negate ? raw.slice(1) : raw;
-    if (globMatch(pattern, pathname)) matched = !negate;
-  }
-  return matched;
-}
-
-/** `*` matches within a segment, `**` across segments. Anchored both ends. */
-function globMatch(pattern: string, path: string): boolean {
-  const rx = pattern
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-    .replace(/\*\*/g, " ")
-    .replace(/\*/g, "[^/]*")
-    .replace(/ /g, ".*");
-  return new RegExp(`^${rx}$`).test(path);
-}
+// Re-exported from @sproutboat/assets (moved verbatim). This shim keeps
+// every `./assets` importer and the `sproutboat/runtime/assets` export path
+// working; the implementation lives in the shared package.
+export * from "@sproutboat/assets";