sproutboat 0.9.0 → 0.10.0

package/src/manifest.ts

@@ -1,167 +1,4 @@
-export const ARTIFACT_SCHEMA_VERSION = 2;
-export const RUNTIME = "native-fetch";
-export const CAPABILITY_PROFILE = "http-sync-v0";
-
-/** The only target a deployed artifact may carry. Every box runs linux-x86_64. */
-export const DEPLOY_TARGET = "linux-x86_64";
-
-/**
- * `<arch>-<platform>` of the machine doing the build, e.g. `arm64-darwin`.
- * Only `sproutboat build --target host` produces one (#62): it runs on this
- * machine for local dev and is deliberately not portable, so `validateManifest`
- * rejects it and neither `deploy` nor the control plane will accept it.
- */
-export type HostTarget = `${string}-${string}`;
-export const hostTarget = (): HostTarget => `${process.arch}-${process.platform}`;
-
-export type ArtifactManifest = {
-  schemaVersion: 2;
-  project: string;
-  target: typeof DEPLOY_TARGET | HostTarget;
-  runtime: "native-fetch";
-  capabilityProfile: "http-sync-v0";
-  porfforVersion: string;
-  esbuildVersion: string;
-  /** Build provenance, e.g. `zig-musl/0.16.0+porffor/a415d19+uws/360c276d`. */
-  buildImage: string;
-  /**
-   * The project's `compatibility_date`, as `YYYY-MM-DD`. Optional: artifacts
-   * built before this field existed have none, and every reader must treat that
-   * as the baseline (see `BASELINE_COMPATIBILITY_DATE` in `wrap.ts`). This is
-   * how a runtime behaviour change ships without breaking deployed apps — new
-   * builds opt in by moving their date, old binaries keep the old semantics —
-   * so it is deliberately *not* part of `schemaVersion`, which stays frozen
-   * at 2.
-   */
-  compatibilityDate?: string;
-  sourceHash: `sha256:${string}`;
-  binaryHash: `sha256:${string}`;
-  binarySize: number;
-  builtAt: string;
-};
-
-export type ManifestValidation = { ok: true; value: ArtifactManifest } | { ok: false; errors: string[] };
-
-type JsonValue = string | number | boolean | null | ManifestJsonObject | JsonValue[];
-
-interface ManifestJsonObject {
-  readonly [key: string]: JsonValue;
-}
-
-type ManifestInput = JsonValue | undefined;
-
-function isRecord(value: ManifestInput): value is ManifestJsonObject {
-  return value !== null && Object(value) === value && !Array.isArray(value) && !(value instanceof Function);
-}
-
-function isString(value: ManifestInput): value is string {
-  return Object(value) !== value && value === String(value);
-}
-
-function sha256(value: ManifestInput): value is `sha256:${string}` {
-  return isString(value) && /^sha256:[a-f0-9]{64}$/.test(value);
-}
-
-function isPositiveInteger(value: ManifestInput): value is number {
-  return Number.isSafeInteger(value) && value === Number(value) && Number(value) > 0;
-}
-
-export function validateManifest(value: ManifestInput): ManifestValidation {
-  if (!isRecord(value)) return { ok: false, errors: ["manifest must be an object"] };
-  const errors: string[] = [];
-  const required = [
-    "schemaVersion",
-    "project",
-    "target",
-    "runtime",
-    "capabilityProfile",
-    "porfforVersion",
-    "esbuildVersion",
-    "buildImage",
-    "sourceHash",
-    "binaryHash",
-    "binarySize",
-    "builtAt",
-  ];
-  for (const field of required) if (!(field in value)) errors.push(`missing manifest field: ${field}`);
-  const schemaVersion = value.schemaVersion === ARTIFACT_SCHEMA_VERSION ? ARTIFACT_SCHEMA_VERSION : null;
-  if (schemaVersion === null) errors.push("schemaVersion must be 2");
-  const project =
-    isString(value.project) && /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])?$/.test(value.project) ? value.project : null;
-  if (project === null) errors.push("project must be a valid slug");
-  const target = value.target === DEPLOY_TARGET ? value.target : null;
-  if (target === null) {
-    // A `--target host` artifact lands here: runnable where it was built, not
-    // on a box. Name that, so the failure reads as "wrong build" not "corrupt".
-    errors.push(
-      isString(value.target) && value.target !== DEPLOY_TARGET
-        ? `target must be ${DEPLOY_TARGET}, got ${value.target} — \`--target host\` builds are for local dev and cannot be deployed`
-        : `target must be ${DEPLOY_TARGET}`,
-    );
-  }
-  const runtime = value.runtime === RUNTIME ? value.runtime : null;
-  if (runtime === null) errors.push("runtime must be native-fetch");
-  const capabilityProfile = value.capabilityProfile === CAPABILITY_PROFILE ? value.capabilityProfile : null;
-  if (capabilityProfile === null) errors.push("capabilityProfile must be http-sync-v0");
-  const versions = ["porfforVersion", "esbuildVersion", "buildImage"] as const;
-  const [porfforVersion, esbuildVersion, buildImage] = versions.map((field) =>
-    isString(value[field]) && value[field] ? value[field] : null,
-  );
-  for (const [field, version] of versions.map(
-    (field, index) => [field, [porfforVersion, esbuildVersion, buildImage][index]] as const,
-  )) {
-    if (version === null) errors.push(`${field} must be a non-empty string`);
-  }
-  const sourceHash = sha256(value.sourceHash) ? value.sourceHash : null;
-  if (sourceHash === null) errors.push("sourceHash must be a sha256 digest");
-  const binaryHash = sha256(value.binaryHash) ? value.binaryHash : null;
-  if (binaryHash === null) errors.push("binaryHash must be a sha256 digest");
-  const binarySize = isPositiveInteger(value.binarySize) ? value.binarySize : null;
-  if (binarySize === null) errors.push("binarySize must be a positive integer");
-  const builtAt = isString(value.builtAt) && !Number.isNaN(Date.parse(value.builtAt)) ? value.builtAt : null;
-  if (builtAt === null) errors.push("builtAt must be an ISO-8601 timestamp");
-  // Optional by design: an artifact from before the field existed is valid and
-  // must stay deployable, so "absent" is not an error — only "present and
-  // malformed" is.
-  let compatibilityDate: string | undefined;
-  if (value.compatibilityDate !== undefined) {
-    if (isString(value.compatibilityDate) && /^\d{4}-\d{2}-\d{2}$/.test(value.compatibilityDate))
-      compatibilityDate = value.compatibilityDate;
-    else errors.push("compatibilityDate must be YYYY-MM-DD");
-  }
-  if (
-    errors.length ||
-    schemaVersion === null ||
-    project === null ||
-    target === null ||
-    runtime === null ||
-    capabilityProfile === null ||
-    porfforVersion === null ||
-    esbuildVersion === null ||
-    buildImage === null ||
-    sourceHash === null ||
-    binaryHash === null ||
-    binarySize === null ||
-    builtAt === null
-  )
-    return { ok: false, errors };
-  return {
-    ok: true,
-    value: {
-      ...value,
-      schemaVersion,
-      project,
-      target,
-      runtime,
-      capabilityProfile,
-      porfforVersion,
-      esbuildVersion,
-      buildImage,
-      sourceHash,
-      binaryHash,
-      binarySize,
-      builtAt,
-      compatibilityDate,
-    },
-  };
-}
+// Re-exported from @sproutboat/artifact (moved verbatim). This shim keeps
+// every `./manifest` importer and the `sproutboat/runtime/manifest` export
+// path working; the implementation lives in the shared package.
+export * from "@sproutboat/artifact";

package/src/patch-porffor.ts

@@ -1,144 +1,5 @@
-/**
- * Make Porffor's generated native-fetch server read its listen port from $PORT
- * at runtime (falling back to the compiled `port:` value). Porffor renders the
- * server as C text in `compiler/render.js`; we splice two lines into
- * `porf_native_fetch_get_port()`.
- *
- * Done as an idempotent in-place edit rather than a `postinstall` hook: package
- * managers block dependency lifecycle scripts by default, so a published
- * `postinstall` would silently not run. This is called from the build path
- * instead, where it always runs.
- *
- * Tracked upstream in patches/UPSTREAM.md — once Porffor reads $PORT (or exposes
- * env to handlers) this whole file goes away.
- */
-import { readFile, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { porfforRoot } from "./toolchain";
-
-// Each edit below is independent and idempotent, with its own marker: a file
-// patched by an older version of this file must still receive the newer edits.
-const ANCHOR = "f64 porf_native_fetch_get_port(void) {\n";
-
-/** Port from $PORT (the supervisor and `sproutboat dev` set it). */
-const ENV_INJECT =
-  '  const char* __sb_port = getenv("PORT");\n' +
-  "  if (__sb_port && *__sb_port) { long __sb_v = strtol(__sb_port, NULL, 10); if (__sb_v > 0 && __sb_v < 65536) return (f64)__sb_v; }\n";
-const ENV_MARKER = 'getenv("PORT")';
-
-// #15 — no `--port` flag: Porffor's native-fetch entry point calls
-// `porf_init(0, NULL)` (see porf_native_fetch_runtime_init in render.js), so a
-// native-fetch binary never sees argv at all. A standalone binary takes its
-// port and data directory from the environment instead, which is what systemd
-// and docker set anyway. Worth an upstream note alongside the $PORT ask.
-
-/**
- * #15 — let the build add objects to the native-fetch link line.
- *
- * Porffor builds `linkArgs` as a fixed array, so an embedded backend that needs
- * SQLite compiled into the sprout has nowhere to put it. `CXX` is not a way in:
- * a musl (deploy) build overrides it outright. This splices one spread of
- * `SB_EXTRA_LINK` before `-lm`, inert unless the variable is set.
- */
-const LINK_ANCHOR = "          uSocketsArchive,\n          '-lm'\n";
-const LINK_INJECT =
-  "          ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
-const LINK_MARKER = "SB_EXTRA_LINK";
-
-/**
- * #15 — and the same for the compile step, so the prelude's inline C can
- * `#include <bearssl.h>`. The link patch alone is not enough: Porffor compiles
- * the generated C from stdin with a fixed argument list, so there is otherwise
- * no way to add an include path.
- */
-const CFLAGS_ANCHOR = "          '-xc', '-', '-c',\n";
-const CFLAGS_INJECT =
-  "          ...(process.env.SB_EXTRA_CFLAGS ? process.env.SB_EXTRA_CFLAGS.split(' ').filter(Boolean) : []),\n";
-const CFLAGS_MARKER = "SB_EXTRA_CFLAGS";
-
-/**
- * #56 — make the inbound request-body limit configurable.
- *
- * Porffor's uWebSockets shim hardcodes 1 MiB and answers anything larger with a
- * bare `413 request body too large` before the handler runs, so a project can
- * neither accept a bigger upload nor say anything useful about the refusal.
- *
- * The default stays 1 MiB: a larger body is held in memory whole, so raising it
- * is a decision about this deployment's memory, not something to inherit.
- */
-const BODY_ANCHOR = "static const size_t REQUEST_BODY_MAX_BYTES = 1024u * 1024u;";
-const BODY_INJECT = `static size_t sb_request_body_max(void) {
-  static size_t cached = 0;
-  if (cached == 0) {
-    const char* raw = getenv("SB_REQUEST_BODY_MAX");
-    long parsed = raw && *raw ? atol(raw) : 0;
-    cached = parsed > 0 ? (size_t)parsed : 1024u * 1024u;
-  }
-  return cached;
-}
-#define REQUEST_BODY_MAX_BYTES sb_request_body_max()`;
-const BODY_MARKER = "sb_request_body_max";
-
-let done = false;
-
-/** The uWebSockets shim source, which is where the body limit lives. */
-async function patchBodyLimit(): Promise<void> {
-  const file = resolve(porfforRoot(), "compiler/uwebsockets.js");
-  const src = await readFile(file, "utf8");
-  if (src.includes(BODY_MARKER)) return;
-  if (!src.includes(BODY_ANCHOR)) {
-    throw new Error(
-      `could not patch Porffor's request body limit: anchor not found in ${file}. ` +
-        "Porffor's uWebSockets shim changed — check patches/UPSTREAM.md.",
-    );
-  }
-  await writeFile(file, src.replace(BODY_ANCHOR, BODY_INJECT));
-}
-
-async function patchCompilerArgs(): Promise<void> {
-  const file = resolve(porfforRoot(), "compiler/index.js");
-  let src = await readFile(file, "utf8");
-  let changed = false;
-  for (const [marker, anchor, inject, what] of [
-    [LINK_MARKER, LINK_ANCHOR, LINK_INJECT, "extra link args"],
-    [CFLAGS_MARKER, CFLAGS_ANCHOR, CFLAGS_INJECT, "extra compiler flags"],
-  ] as const) {
-    if (src.includes(marker)) continue;
-    const at = src.indexOf(anchor);
-    if (at === -1) {
-      throw new Error(
-        `could not patch Porffor for ${what}: anchor not found in ${file}. ` +
-          "Porffor's native-fetch build changed — check patches/UPSTREAM.md.",
-      );
-    }
-    // After the anchor for cflags (the args follow it), before it for the link
-    // line (the object list ends with it).
-    src =
-      marker === CFLAGS_MARKER
-        ? src.slice(0, at + anchor.length) + inject + src.slice(at + anchor.length)
-        : src.slice(0, at) + inject + src.slice(at);
-    changed = true;
-  }
-  if (changed) await writeFile(file, src);
-}
-
-export async function ensurePorfforPatched(): Promise<void> {
-  if (done) return;
-  await patchCompilerArgs();
-  await patchBodyLimit();
-  const file = resolve(porfforRoot(), "compiler/render.js");
-  const src = await readFile(file, "utf8");
-  if (src.includes(ENV_MARKER)) {
-    done = true;
-    return;
-  }
-  const anchorAt = src.indexOf(ANCHOR);
-  if (anchorAt === -1) {
-    throw new Error(
-      `could not patch Porffor for $PORT: anchor not found in ${file}. ` +
-        "Porffor's native-fetch renderer changed — check patches/UPSTREAM.md.",
-    );
-  }
-  await writeFile(file, src.slice(0, anchorAt + ANCHOR.length) + ENV_INJECT + src.slice(anchorAt + ANCHOR.length));
-  done = true;
-}
+// Re-exported from @sproutboat/toolchain (moved verbatim). This shim keeps
+// every `./patch-porffor` importer working; the patch passes now live in the
+// shared package (`@sproutboat/toolchain/patch`) so the CLI and the monorepo
+// apply the same set. Mirrors src/broker.ts -> @sproutboat/wire.
+export { ensurePorfforPatched, patchRenderJs, patchUwebsockets } from "@sproutboat/toolchain";

package/src/porffor-toolchain.ts

@@ -0,0 +1,5 @@
+// Re-exported from @sproutboat/toolchain (moved verbatim). This shim keeps
+// every `./porffor-toolchain` importer working; the pin, the patches and the
+// fetch/verify/cache logic now live in the shared package so the CLI and the
+// monorepo cannot drift apart. Mirrors src/broker.ts -> @sproutboat/wire.
+export * from "@sproutboat/toolchain";

package/src/report.ts

@@ -1,15 +1,11 @@
-import { readFileSync } from "node:fs";
 import { gzipSync } from "bun";
 import { resourceRefs, type SproutboatConfig } from "./config";
 import type { ArtifactManifest } from "./manifest";
 import { bold, dim, leaf, sprout } from "./style";
 
-// Read from package.json so the banner never drifts from the published version.
-// SAFETY: our own package.json, shipped beside src/ by the `files` field; npm requires `version`.
-const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as {
-  version: string;
-};
-export const CLI_VERSION = packageJson.version;
+// `bun build --compile` has no package-relative filesystem at runtime. The
+// release build injects this value; source development keeps the package value.
+export const CLI_VERSION = process.env.SPROUTBOAT_CLI_VERSION ?? "0.9.0";
 
 function bytes(n: number): string {
   if (n < 1024) return `${n} B`;
@@ -65,6 +61,8 @@ function bindingRows(config: SproutboatConfig): string[][] {
   list(config.analytics_engine_datasets, "analytics");
   for (const [name, className] of Object.entries(config.durable_objects ?? {}))
     rows.push([`env.${name}`, "durable object", className]);
+  for (const rl of config.ratelimiters ?? [])
+    rows.push([`env.${rl.binding}`, "rate limiter", `${rl.limit} / ${rl.period}s`]);
   for (const host of config.outbound ?? []) rows.push([`fetch()`, "outbound", host]);
   for (const cron of config.triggers?.crons ?? []) rows.push([`scheduled()`, "cron", cron]);
   if (config.assets?.binding) rows.push([`env.${config.assets.binding}`, "assets", config.assets.directory ?? ""]);

package/src/source.ts

@@ -1,44 +1,4 @@
-import { neutraliseExports } from "./wrap";
-
-export type SourceValidation = { ok: true } | { ok: false; errors: string[] };
-
-// Checked against the *bundled* module (#89), not the entry file: after
-// bundling there are no imports left to reject, and a dependency reaching for a
-// Node API has to fail exactly as hand-written code would. A bare specifier
-// that resolves to nothing never gets this far — the bundler fails first.
-const alwaysForbidden: Array<[RegExp, string]> = [
-  [/^\s*import\s/m, "an import survived bundling — only static imports can be resolved at build time"],
-  [/\bimport\s*\(/, "dynamic import() is not supported: nothing can resolve it at build time"],
-  [/\brequire\s*\(/, "CommonJS require is not supported"],
-  [/\b(WebSocket|XMLHttpRequest)\s*\(/, "WebSocket / XMLHttpRequest are not supported"],
-  [/\b(process|Bun|Deno|Buffer|node:)\b/, "Node, Bun, and Deno APIs are not supported"],
-  // Porffor alpha-4 compiles `new Proxy(...)` and then ignores the handler: a
-  // trapped property reads back as `undefined`, with no throw. Rejecting it
-  // here is the difference between a build error and a 502 nobody can explain.
-  // It is why itty-router and other Proxy-based routers do not work yet.
-  [
-    /\bnew\s+Proxy\s*\(|\bProxy\s*\.\s*revocable\s*\(/,
-    "Proxy is not supported by the compiler: its traps are silently ignored and the property reads back as undefined",
-  ],
-];
-
-const fetchWithoutAllowlist: [RegExp, string] = [
-  /(?:\breturn\s+|\bawait\s+|=\s*)fetch\s*\(/,
-  "outbound networking needs an `outbound` host allowlist in sproutboat.jsonc",
-];
-
-export function validateHttpSyncSource(source: string, outboundAllowed = false): SourceValidation {
-  const errors: string[] = [];
-  // The default export must be an object literal with a `fetch` method. A module
-  // may also declare Durable Object classes / helpers before it, so this is not
-  // anchored to the start of the file.
-  // A hand-written file exports inline; a bundled one re-exports at the end.
-  // `neutraliseExports` is the same reader the compiler uses, so `check` cannot
-  // accept a module the build would then reject.
-  if (neutraliseExports(source) === null || !/\bfetch\s*\(/.test(source)) {
-    errors.push("handler must default-export an object with fetch(request)");
-  }
-  for (const [pattern, message] of alwaysForbidden) if (pattern.test(source)) errors.push(message);
-  if (!outboundAllowed && fetchWithoutAllowlist[0].test(source)) errors.push(fetchWithoutAllowlist[1]);
-  return errors.length ? { ok: false, errors } : { ok: true };
-}
+// Re-exported from @sproutboat/runtime (moved verbatim with wrap.ts).
+// This shim keeps every `./source` importer and the
+// `sproutboat/runtime/source` export path working.
+export * from "@sproutboat/runtime";

package/src/surface.ts

@@ -206,6 +206,22 @@ export const ENV_VARS: readonly EnvVar[] = [
   },
   { name: "AR", purpose: "Archiver used to assemble uSockets.a for a host build (default `ar`)." },
   { name: "SPROUTBOAT_COMPILE_TIMEOUT_MS", purpose: "Porffor compile timeout in ms (default 600000)." },
+  {
+    name: "SPROUTBOAT_TOOLCHAIN_CACHE",
+    purpose: "Managed Porffor and compiler cache root (default ~/.cache/sproutboat).",
+  },
+  {
+    name: "SPROUTBOAT_PORFFOR_DIR",
+    purpose: "Contributor override for an existing Porffor source checkout. Required files are validated before use.",
+  },
+  {
+    name: "SPROUTBOAT_BUILD_UWS_FROM_SOURCE",
+    purpose: "Set to 1 to explicitly allow the contributor-only Git and Make uWebSockets fallback.",
+  },
+  {
+    name: "SPROUTBOAT_CLI_VERSION",
+    purpose: "CLI version embedded by the release executable build. Not normally set by users.",
+  },
   {
     name: "SPROUTBOAT_VARS_JSON",
     purpose: