sproutboat 0.9.0 → 0.10.0

package/src/toolchain.ts

@@ -7,14 +7,17 @@
  */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { chmod, mkdir, readFile, rm } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
+// @ts-expect-error Bun's file loader returns the embedded asset path in a compiled executable.
+import embeddedUwsArchive from "../vendor/uwebsockets-360c276d-musl.tar.xz" with { type: "file" };
+import { cachedPorfforRoot, PORFFOR_CHANNEL, PORFFOR_COMMIT } from "./porffor-toolchain";
 
 export const ZIG_VERSION = "0.16.0";
 
 /** The `<arch>-<os>` platforms ziglang.org publishes a tarball for that we pin. */
-type ZigPlatform = "x86_64-linux" | "aarch64-linux" | "x86_64-macos" | "aarch64-macos";
+export type ZigPlatform = "x86_64-linux" | "aarch64-linux" | "x86_64-macos" | "aarch64-macos";
 
 // sha256 of the official ziglang.org tarballs for ZIG_VERSION, keyed by
 // `<arch>-<os>` (the download naming). Bump alongside ZIG_VERSION.
@@ -25,17 +28,12 @@ const ZIG_SHA256 = {
   "aarch64-macos": "b23d70deaa879b5c2d486ed3316f7eaa53e84acf6fc9cc747de152450d401489",
 } satisfies Record<ZigPlatform, string>;
 
-// Pinned Porffor identity — must match the `porffor` entry in package.json
-// (`github:CanadaHonk/porffor#alpha-4`, commit a415d19). PORFFOR_VERSION overrides.
+// Pinned Porffor identity comes from porffor-toolchain.ts. PORFFOR_VERSION overrides.
 // When bumping this pin (#55): run the monorepo's `bun run diff` against the
 // frozen reference handlers and update its COMPAT.md for any new mismatch before
 // releasing — the alpha compiler's output can shift between pins. Checked by
 // hand at bump time, not in CI.
-const PORFFOR_CHANNEL = "alpha-4";
-const PORFFOR_COMMIT = "a415d19";
-
-// uWebSockets commit Porffor alpha-4 fetches for the native-fetch server. Read
-// from node_modules/porffor at build time; this is the fallback for the stamp.
+// uWebSockets commit Porffor alpha-4 fetches for the native-fetch server.
 const UWS_COMMIT = "360c276d";
 const UWS_COMMIT_FULL = "360c276d609d59af56ae6932adb95154ace9f15f";
 
@@ -56,51 +54,157 @@ function platformKey(): ZigPlatform {
   return `${arch}-${os}`;
 }
 
+export class ZigToolchainError extends Error {
+  constructor(
+    readonly kind: "download" | "integrity" | "archive" | "cache" | "unsupported",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export type EnsureZigOptions = {
+  cacheRoot?: string;
+  platform?: ZigPlatform;
+  url?: string;
+  expectedSha256?: string;
+  fetcher?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+  timeoutMs?: number;
+};
+
 async function sha256File(path: string): Promise<string> {
   const hash = createHash("sha256");
   hash.update(await readFile(path));
   return hash.digest("hex");
 }
 
-/** Absolute path to a usable `zig` binary, downloading it on first use. */
-export async function ensureZig(): Promise<string> {
+async function zigComplete(dir: string, key: ZigPlatform, expectedArchive: string): Promise<boolean> {
+  try {
+    // SAFETY: this manifest is private data written below; its values are only
+    // accepted when the immutable identity and binary digest both match.
+    const manifest = JSON.parse(await readFile(resolve(dir, ".sproutboat-complete"), "utf8")) as {
+      version?: string;
+      platform?: string;
+      archiveSha256?: string;
+      binarySha256?: string;
+    };
+    const bin = resolve(dir, "zig");
+    return (
+      manifest.version === ZIG_VERSION &&
+      manifest.platform === key &&
+      manifest.archiveSha256 === expectedArchive &&
+      manifest.binarySha256 !== undefined &&
+      (await sha256File(bin)) === manifest.binarySha256
+    );
+  } catch {
+    return false;
+  }
+}
+
+async function downloadZig(
+  url: string,
+  path: string,
+  fetcher: NonNullable<EnsureZigOptions["fetcher"]>,
+  timeoutMs: number,
+): Promise<void> {
+  let last: unknown;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const response = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs) });
+      if (!response.ok) throw new Error(`HTTP ${response.status}`);
+      await writeFile(path, new Uint8Array(await response.arrayBuffer()));
+      return;
+    } catch (error) {
+      last = error;
+    }
+  }
+  throw new ZigToolchainError("download", `could not download pinned Zig from ${url}: ${String(last)}`);
+}
+
+async function waitForZigPublisher(
+  dir: string,
+  lock: string,
+  key: ZigPlatform,
+  expected: string,
+): Promise<string | null> {
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    if (await zigComplete(dir, key, expected)) return resolve(dir, "zig");
+    if (!existsSync(lock)) return null;
+    if (Date.now() - (await stat(lock)).mtimeMs > 5 * 60_000) {
+      await rm(lock, { recursive: true, force: true });
+      return null;
+    }
+    await Bun.sleep(25);
+  }
+  throw new ZigToolchainError("cache", `timed out waiting for Zig cache lock ${lock}`);
+}
+
+/** Absolute path to a verified Zig binary, downloading it on first use. */
+export async function ensureZig(options: EnsureZigOptions = {}): Promise<string> {
   const override = process.env.SPROUTBOAT_ZIG;
   if (override) {
-    if (!existsSync(override)) throw new Error(`SPROUTBOAT_ZIG=${override} does not exist`);
+    if (!existsSync(override)) throw new ZigToolchainError("unsupported", `SPROUTBOAT_ZIG=${override} does not exist`);
     return override;
   }
-  const key = platformKey();
-  const home = homedir();
-  const dir = resolve(home, ".cache/sproutboat", `zig-${ZIG_VERSION}`);
-  const bin = resolve(dir, "zig");
-  if (existsSync(bin)) return bin;
-
-  const url = `https://ziglang.org/download/${ZIG_VERSION}/zig-${key}-${ZIG_VERSION}.tar.xz`;
-  const expected = ZIG_SHA256[key];
+  const key = options.platform ?? platformKey();
+  const root = resolve(
+    options.cacheRoot ?? process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? resolve(homedir(), ".cache/sproutboat"),
+  );
+  const dir = resolve(root, `zig-${ZIG_VERSION}-${key}`);
+  const expected = options.expectedSha256 ?? ZIG_SHA256[key];
+  if (await zigComplete(dir, key, expected)) return resolve(dir, "zig");
+  await mkdir(root, { recursive: true });
+  const lock = `${dir}.lock`;
+  try {
+    await mkdir(lock);
+  } catch {
+    const published = await waitForZigPublisher(dir, lock, key, expected);
+    if (published) return published;
+    return ensureZig(options);
+  }
+  const stage = resolve(root, `.zig-${ZIG_VERSION}-${key}-${process.pid}-${crypto.randomUUID()}`);
+  const url = options.url ?? `https://ziglang.org/download/${ZIG_VERSION}/zig-${key}-${ZIG_VERSION}.tar.xz`;
   console.log(`Fetching Zig ${ZIG_VERSION} (${key}, one-time)...`);
-  await mkdir(dir, { recursive: true });
-  const archive = resolve(dir, "zig.tar.xz");
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`could not download Zig: ${url} (${response.status})`);
-  await Bun.write(archive, response);
-
-  const actual = await sha256File(archive);
-  if (expected && actual !== expected) {
+  try {
+    if (await zigComplete(dir, key, expected)) return resolve(dir, "zig");
     await rm(dir, { recursive: true, force: true });
-    throw new Error(`Zig download sha256 mismatch\n  expected ${expected}\n  got      ${actual}`);
+    await mkdir(stage);
+    const archive = resolve(stage, "zig.tar.xz");
+    await downloadZig(url, archive, options.fetcher ?? fetch, options.timeoutMs ?? 30_000);
+    const actual = await sha256File(archive);
+    if (actual !== expected)
+      throw new ZigToolchainError(
+        "integrity",
+        `Zig archive sha256 mismatch\n  expected ${expected}\n  got      ${actual}`,
+      );
+    const untar = Bun.spawn(["tar", "-xJf", archive, "-C", stage, "--strip-components=1"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
+    if (code !== 0)
+      throw new ZigToolchainError("archive", `could not extract Zig (needs \`tar\` with xz support): ${err.trim()}`);
+    await rm(archive, { force: true });
+    const bin = resolve(stage, "zig");
+    if (!existsSync(bin)) throw new ZigToolchainError("archive", "Zig archive did not contain a `zig` binary");
+    await chmod(bin, 0o755);
+    await writeFile(
+      resolve(stage, ".sproutboat-complete"),
+      JSON.stringify({
+        version: ZIG_VERSION,
+        platform: key,
+        archiveSha256: actual,
+        binarySha256: await sha256File(bin),
+      }),
+      { mode: 0o444 },
+    );
+    await rename(stage, dir);
+    return resolve(dir, "zig");
+  } finally {
+    await rm(stage, { recursive: true, force: true });
+    await rm(lock, { recursive: true, force: true });
   }
-
-  // `tar -xJ` (xz) works on macOS bsdtar and GNU tar with xz on PATH.
-  const untar = Bun.spawn(["tar", "-xJf", archive, "-C", dir, "--strip-components=1"], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
-  if (code !== 0) throw new Error(`could not extract Zig (needs \`tar\` with xz support): ${err.trim()}`);
-  await rm(archive, { force: true });
-  if (!existsSync(bin)) throw new Error("Zig archive did not contain a `zig` binary");
-  await chmod(bin, 0o755);
-  return bin;
 }
 
 function uwsCommitFull(): string {
@@ -117,7 +221,9 @@ export class UwsUnavailableError extends Error {}
 
 /** Path to the vendored prebuilt archive for the given short commit. */
 export function uwsVendorArchive(short: string): string {
-  return resolve(import.meta.dir, "..", "vendor", `uwebsockets-${short}-musl.tar.xz`);
+  return short === UWS_COMMIT_FULL.slice(0, 8)
+    ? embeddedUwsArchive
+    : resolve(import.meta.dir, "..", "vendor", `uwebsockets-${short}-musl.tar.xz`);
 }
 
 /**
@@ -162,11 +268,16 @@ export async function ensureUWebSockets(): Promise<void> {
 /** Unpack the vendored source tree into `dir`. */
 async function extractUws(archive: string, dir: string): Promise<void> {
   await mkdir(dir, { recursive: true });
-  const untar = Bun.spawn(["tar", "-xJf", archive, "-C", dir, "--strip-components=1"], {
+  // External programs cannot read Bun's virtual /$bunfs paths. Materialize the
+  // embedded release asset inside the destination before handing it to tar.
+  const readableArchive = archive.includes("/$bunfs/") ? resolve(dir, ".sproutboat-uwebsockets.tar.xz") : archive;
+  if (readableArchive !== archive) await Bun.write(readableArchive, Bun.file(archive));
+  const untar = Bun.spawn(["tar", "-xJf", readableArchive, "-C", dir, "--strip-components=1"], {
     stdout: "pipe",
     stderr: "pipe",
   });
   const [code, err] = await Promise.all([untar.exited, new Response(untar.stderr).text()]);
+  if (readableArchive !== archive) await rm(readableArchive, { force: true });
   if (code !== 0) {
     await rm(dir, { recursive: true, force: true });
     throw new UwsUnavailableError(`could not extract vendored uWebSockets: ${err.trim()}`);
@@ -241,12 +352,14 @@ export async function ensureUWebSocketsHost(): Promise<void> {
 
 /** Directory holding node_modules/porffor (walks up from this file). */
 export function porfforRoot(start = import.meta.dir): string {
+  const managed = cachedPorfforRoot();
+  if (existsSync(resolve(managed, "runtime/index.js"))) return managed;
   let dir = start;
   for (;;) {
     const candidate = resolve(dir, "node_modules/porffor");
     if (existsSync(resolve(candidate, "runtime/index.js"))) return candidate;
     const parent = dirname(dir);
-    if (parent === dir) throw new Error("node_modules/porffor not found — run `bun install`");
+    if (parent === dir) return managed;
     dir = parent;
   }
 }

package/src/types-gen.ts

@@ -49,6 +49,9 @@ function entries(config: SproutboatConfig): Entry[] {
   for (const service of config.services ?? []) {
     out.push({ name: service.binding, type: "Fetcher", note: `service binding: ${service.service}` });
   }
+  for (const rl of config.ratelimiters ?? []) {
+    out.push({ name: rl.binding, type: "RateLimit", note: `rate limit: ${rl.limit} per ${rl.period}s` });
+  }
   if (config.assets?.binding) {
     out.push({ name: config.assets.binding, type: "Fetcher", note: `static assets: ${config.assets.directory}` });
   }

package/src/wrap.ts

@@ -1,267 +1,5 @@
-/**
- * The build-independent half of sprout compilation: the binding/trigger wrapper
- * that turns a user's `export default { fetch }` into a native-fetch module, plus
- * the `Bindings` shape and the `SPROUTBOAT_*_JSON` env readers.
- *
- * This module has no imports on purpose — the monorepo consumes it via the
- * `sproutboat/runtime/wrap` export to drive its own (host-native, non-musl)
- * compile path without pulling in `toolchain.ts` / `patch-porffor.ts`.
- */
-
-/** The prelude file (Web API shims + broker binding shim + trigger dispatcher).
- *  It is read as text and string-prepended before Porffor sees it, never
- *  imported — callers do `readFile(preludePath, "utf8")`. */
-export const preludePath = new URL("./native-fetch-prelude.js", import.meta.url);
-
-/**
- * #15 — the two transports the prelude can be built with.
- *
- * Both define `__sbCall(reqJson) -> replyJson` and nothing else; every binding
- * shim above that line is identical, which is what lets one conformance suite
- * hold both honest. `broker` talks to the per-deployment broker over loopback
- * (deployed, dev, phase-0 standalone); `embedded` compiles SQLite into the
- * sprout and needs no second process at all.
- */
-export type Transport = "broker" | "embedded";
-export const transportPath = (transport: Transport): URL =>
-  new URL(transport === "embedded" ? "./transport-embedded.js" : "./transport-broker.js", import.meta.url);
-
-/** Where the prelude expects its transport spliced in. */
-export const TRANSPORT_MARKER =
-  "// TRANSPORT: wrap.ts splices one of transport-broker.js / transport-embedded.js here.";
-
-// The server honours $PORT at runtime (patches/porffor-render.patch); this baked
-// value is only a fallback for a directly-run binary.
-const DEFAULT_PORT = 8080;
-
-/**
- * What an artifact with no `compatibilityDate` means. Artifacts built before
- * the field existed keep the semantics of that day forever, because the binary
- * is immutable and `rollback` can reactivate it at any time.
- *
- * How to use it: when a runtime behaviour has to change in a way that would
- * break a deployed handler, don't change it unconditionally — gate it in the
- * prelude on `__sbCompat >= "YYYY-MM-DD"` (ISO dates compare correctly as
- * strings) and document the flip date. Old binaries carry their old date and
- * keep the old behaviour; a project opts in by moving `compatibility_date` in
- * its `sproutboat.jsonc` and rebuilding.
- */
-export const BASELINE_COMPATIBILITY_DATE = "2026-08-26";
-
-/**
- * Binding names a project declares. `do` maps a binding name to a Durable Object
- * class name; `crons` are schedule expressions with no name.
- */
-export type Bindings = {
-  kv: string[];
-  secrets: string[];
-  outbound: string[];
-  d1: string[];
-  r2: string[];
-  queues: string[];
-  analytics: string[];
-  do: Array<{ binding: string; className: string }>;
-  /** #48 — worker-to-worker: binding name -> the project it calls. The hostname
-   *  it resolves to is a runtime input, not part of the artifact. */
-  services: Array<{ binding: string; service: string }>;
-  crons: string[];
-  /** Static-asset binding name for `env.<NAME>.fetch(request)`; `""` when assets are edge-only. */
-  assets: string;
-};
-
-export const EMPTY_BINDINGS: Bindings = {
-  kv: [],
-  secrets: [],
-  outbound: [],
-  d1: [],
-  r2: [],
-  queues: [],
-  analytics: [],
-  do: [],
-  services: [],
-  crons: [],
-  assets: "",
-};
-
-function hasBindings(b: Bindings): boolean {
-  return (
-    b.kv.length > 0 ||
-    b.secrets.length > 0 ||
-    b.outbound.length > 0 ||
-    b.d1.length > 0 ||
-    b.r2.length > 0 ||
-    b.queues.length > 0 ||
-    b.analytics.length > 0 ||
-    b.do.length > 0 ||
-    b.services.length > 0 ||
-    b.assets !== ""
-  );
-}
-
-/**
- * Turn the module's exports into plain top-level declarations, so the handler
- * object is reachable as `__sbHandlers` and Durable Object classes stay
- * addressable by name.
- *
- * Two shapes reach us. A hand-written file exports inline
- * (`export default { fetch }`), while a bundled one declares everything first
- * and re-exports at the end (`export { src_default as default, Counter }`) —
- * #89 made the second shape the normal case. Returns null when neither matches.
- */
-export function neutraliseExports(source: string): string | null {
-  if (/\bexport\s+default\s*\{/.test(source)) {
-    return source
-      .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
-      .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
-  }
-  // Not anchored to a line: a minified bundle puts the whole module on one
-  // line. Bundlers emit exactly one such block, at the end.
-  const blocks = [...source.matchAll(/export\s*\{([^}]*)\}\s*;?/g)];
-  const block = blocks[blocks.length - 1];
-  if (block === undefined) return null;
-  let handler: string | null = null;
-  const aliases: string[] = [];
-  for (const entry of block[1]
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean)) {
-    const parts = entry.match(/^(\S+)(?:\s+as\s+(\S+))?$/);
-    if (parts === null) continue;
-    const local = parts[1];
-    const exported = parts[2] ?? local;
-    if (exported === "default") handler = local;
-    // `export { Counter as Counter }` needs no alias; a renamed one does, so
-    // `durable_objects` in the config can still name the class it expects.
-    else if (exported !== local) aliases.push(`const ${exported} = ${local};`);
-  }
-  if (handler === null) return null;
-  return source.replace(block[0], [`const __sbHandlers = ${handler};`, ...aliases].join("\n"));
-}
-
-/**
- * Build the final native-fetch module: the prelude (Web API shims + the broker
- * binding shim + the trigger dispatcher), then `const env = {…}` with the baked
- * `vars`, then — if any binding is declared — one `__sbInstallBindings(env, …)`
- * line, then the user's source with its `export` keywords neutralised (so its
- * `export default {…}` becomes a plain object we can hand to the dispatcher),
- * then our single `export default { fetch }` that routes every request through
- * `__sbEntry` (HTTP → `handlers.fetch`; `x-sb-trigger` → scheduled / queue / DO).
- *
- * With no bindings and no `scheduled`/`queue`/DO the output behaves exactly like
- * a plain `export default { fetch }` sprout.
- *
- * `port` is only the baked fallback in `export default { port }`; the runtime
- * reads `$PORT` first. The monorepo's bench path overrides it.
- *
- * ponytail: the sprout process is long-lived, so a handler that mutates `env`
- * leaks that change to later requests. Freeze upstream once Porffor supports
- * Object.freeze in native mode.
- */
-export function wrapNativeFetchHandler(
-  source: string,
-  prelude: string,
-  vars: Record<string, string> = {},
-  bindings: Bindings = EMPTY_BINDINGS,
-  port: number = DEFAULT_PORT,
-  compatibilityDate: string = BASELINE_COMPATIBILITY_DATE,
-  appName: string = "app",
-  /** #15 — assets baked into the module for a binary that has no files beside it. */
-  assets?: { manifest: unknown; files: Record<string, string> },
-): string {
-  const neutralised = neutraliseExports(source);
-  if (neutralised === null || !/\bfetch\s*\(/.test(source)) {
-    throw new Error("handler must default-export an object with a fetch(request) method");
-  }
-
-  const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
-  // Baked, not a binding: the date belongs to the artifact, and a handler must
-  // not be able to change the semantics it was compiled against at runtime.
-  const compat =
-    `globalThis.__sbCompat = ${JSON.stringify(compatibilityDate)};\n` +
-    // #15 — the embedded transport derives its default data directory from this.
-    `globalThis.__sbAppName = ${JSON.stringify(appName)};\n` +
-    // #15 — and enforces the outbound allowlist itself, with no broker to do it.
-    `globalThis.__sbOutbound = ${JSON.stringify(bindings.outbound)};\n` +
-    (assets ? `globalThis.__sbAssets = ${JSON.stringify(assets)};\n` : "");
-  const wire = hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "";
-  const registerDO = bindings.do.length
-    ? `__sbRegisterDO({ ${bindings.do.map((d) => `${d.className}: ${d.className}`).join(", ")} });\n`
-    : "";
-  // Cron / queue / alarm timers, for a transport that has no broker to deliver
-  // them. The broker transport defines this as a no-op, so the emitted module
-  // is the same either way.
-  const triggers = hasBindings(bindings) ? `__sbStartLocalTriggers(__sbHandlers, ${JSON.stringify(bindings)});\n` : "";
-
-  return (
-    `${prelude}\n${compat}${env}${wire}` +
-    `${neutralised}\n` +
-    `${registerDO}${triggers}` +
-    `export default {\n  port: ${port},\n  fetch(request) { return __sbEntry(__sbHandlers, request); }\n};\n`
-  );
-}
-
-type VarsJson = string | number | boolean | null | { readonly [key: string]: VarsJson } | VarsJson[];
-function isVarsObject(value: VarsJson): value is { readonly [key: string]: VarsJson } {
-  return value !== null && Object(value) === value && !Array.isArray(value);
-}
-function isVarsString(value: VarsJson): value is string {
-  return Object(value) !== value && value === String(value);
-}
-
-/** `SPROUTBOAT_VARS_JSON` (set by the build) → a validated flat string map. */
-export function readVarsFromEnv(): Record<string, string> {
-  const raw = process.env.SPROUTBOAT_VARS_JSON;
-  if (!raw) return {};
-  const parsed: VarsJson = JSON.parse(raw);
-  if (!isVarsObject(parsed)) throw new Error("SPROUTBOAT_VARS_JSON must be a JSON object");
-  return Object.fromEntries(
-    Object.entries(parsed).map(([key, value]): [string, string] => {
-      if (!/^[A-Z][A-Z0-9_]*$/.test(key) || !isVarsString(value))
-        throw new Error(`SPROUTBOAT_VARS_JSON.${key} must map an UPPER_SNAKE name to a string`);
-      return [key, value];
-    }),
-  );
-}
-
-/**
- * `SPROUTBOAT_BINDINGS_JSON` (the artifact's `bindings.json`, passed by the
- * build) → a `Bindings` shape. Every field is re-validated here; unknown keys
- * are dropped and a missing / empty payload is `EMPTY_BINDINGS`, so an old build
- * with no bindings still compiles.
- */
-export function readBindingsFromEnv(): Bindings {
-  const raw = process.env.SPROUTBOAT_BINDINGS_JSON;
-  if (!raw) return EMPTY_BINDINGS;
-  const parsed: VarsJson = JSON.parse(raw);
-  if (!isVarsObject(parsed)) throw new Error("SPROUTBOAT_BINDINGS_JSON must be a JSON object");
-  const strings = (v: VarsJson): string[] => (Array.isArray(v) ? v.filter(isVarsString) : []);
-  const services: Array<{ binding: string; service: string }> = [];
-  if (Array.isArray(parsed.services)) {
-    for (const entry of parsed.services) {
-      if (isVarsObject(entry) && isVarsString(entry.binding) && isVarsString(entry.service)) {
-        services.push({ binding: entry.binding, service: entry.service });
-      }
-    }
-  }
-  const dos: Array<{ binding: string; className: string }> = [];
-  if (Array.isArray(parsed.do)) {
-    for (const entry of parsed.do) {
-      if (isVarsObject(entry) && isVarsString(entry.binding) && isVarsString(entry.className)) {
-        dos.push({ binding: entry.binding, className: entry.className });
-      }
-    }
-  }
-  return {
-    kv: strings(parsed.kv),
-    secrets: strings(parsed.secrets),
-    outbound: strings(parsed.outbound),
-    d1: strings(parsed.d1),
-    r2: strings(parsed.r2),
-    queues: strings(parsed.queues),
-    analytics: strings(parsed.analytics),
-    do: dos,
-    services,
-    crons: strings(parsed.crons),
-    assets: isVarsString(parsed.assets) ? parsed.assets : "",
-  };
-}
+// Re-exported from @sproutboat/runtime (moved verbatim with its file-URL
+// siblings: transports and prelude travel together because wrap.ts locates
+// them by file URL next to itself). This shim keeps every `./wrap` importer
+// and the `sproutboat/runtime/wrap` export path working.
+export * from "@sproutboat/runtime";

package/types/sproutboat.d.ts

@@ -176,6 +176,37 @@ declare global {
     query<T = unknown>(options?: { limit?: number }): { count: number; rows: T[] };
   }
 
+  // ------------------------------------ Rate limiting
+
+  /**
+   * A rate-limiter binding (#69). `limit` and `period` are fixed in
+   * sproutboat.jsonc; `limit({ key })` counts one call against a fixed window
+   * and reports whether the key is still under the cap.
+   */
+  interface RateLimit {
+    limit(options: { key: string }): { success: boolean };
+  }
+
+  // ------------------------------------ Crypto
+
+  /**
+   * `crypto.subtle` covers `digest` (SHA-256/384/512) and HMAC
+   * `importKey` / `sign` / `verify`; other algorithms throw.
+   *
+   * `crypto.scryptVerify` is a Sproutboat extension (#153), not WebCrypto: it
+   * re-derives a scrypt hash and compares it in constant time, for migrating
+   * password hashes made by Node/Bun `scrypt`. Verify-only on purpose; new
+   * credentials should use HMAC/PBKDF2 via `crypto.subtle`.
+   */
+  interface Crypto {
+    scryptVerify(
+      password: string | ArrayBuffer | ArrayBufferView,
+      salt: string | ArrayBuffer | ArrayBufferView,
+      expected: string | ArrayBuffer | ArrayBufferView,
+      params?: { N?: number; r?: number; p?: number },
+    ): boolean;
+  }
+
   // ------------------------------------ Fetchers: services and assets
 
   /** A service binding, and the shape of the static-asset binding. */