sproutboat 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -10,6 +10,82 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.10.1] - 2026-09-11
+### Fixed
+- `npm install sproutboat` / `bunx sproutboat` work again. 0.10.0's launcher
+  hard-required per-platform `@sproutboat/cli-*` packages that are not published
+  yet, so it always failed with "optional package … is missing". The launcher
+  now falls back to running `src/main.ts` with Bun when no platform binary is
+  installed (the v0.9.0 model), and `optionalDependencies` are dropped until the
+  binaries actually ship. 0.10.0 is deprecated on npm.
+- `sproutboat --version` and the deploy banner report the real version instead
+  of a hard-coded `0.9.0` when run from the npm package rather than a
+  `bun build --compile` binary.
+- `sproutboat build` / `deploy` locate `esbuild` via the installed dependency,
+  not just `process.execPath`'s directory, so bundling works on the Bun
+  fallback path.
+- The launcher no longer hangs when it receives `SIGINT` / `SIGTERM` while
+  forwarding a signal to a running platform binary.
+
+## [0.10.0] - 2026-09-11
+### Added
+- Per-platform native CLI: `npm install sproutboat` pulls a prebuilt binary for
+  the host (`@sproutboat/cli-{darwin,linux}-{arm64,x64}`) behind a thin launcher
+  that preserves signals and embeds its own version, so the CLI runs without Bun
+  on `PATH`.
+- Porffor is fetched on the first build, not installed as a dependency: the
+  pinned commit is downloaded into `~/.cache/sproutboat`, SHA-256 verified, and
+  patched there. Installation clones nothing and runs no Git, Make or compiler.
+- `request.cf.clientIp` in standalone builds, from a server-set
+  `x-sb-remote-addr`, with `SB_TRUSTED_PROXIES` for `X-Forwarded-For` resolution
+  behind a reverse proxy (baronunread/sproutboat#163).
+- `env.<D1>.backup(name?)` — an online, integrity-checked single-file snapshot
+  of a D1 database via `VACUUM INTO`, on both the embedded and broker transports
+  (baronunread/sproutboat#164).
+- Rate Limiting binding: `ratelimiters: [{ binding, limit, period }]` in
+  `sproutboat.jsonc` gives `env.<NAME>.limit({ key }) -> { success }`, a
+  fixed-window counter on both transports (baronunread/sproutboat#69).
+- `crypto.subtle` subset: `digest` (SHA-256/384/512) and HMAC
+  `importKey` / `sign` / `verify`, backed by reference SHA-2 as inline C so it
+  works on both transports (baronunread/sproutboat#133). No ECDSA or AES yet.
+- `crypto.scryptVerify(password, salt, expected, { N, r, p })` — a verify-only
+  scrypt (RFC 7914) for migrating password hashes made by Node/Bun `scrypt`
+  (baronunread/sproutboat#153). Not a blessed KDF for new credentials.
+- `x-sb-cpu-ms`: per-invocation CPU time, carried on the handler response.
+
+### Fixed
+- `303` (and every other status not in Porffor's table) no longer resets the
+  connection on standalone builds (baronunread/sproutboat#156).
+- Handler `console.log` / `console.error` reach stderr, unbuffered, in
+  standalone builds instead of vanishing (baronunread/sproutboat#165).
+- `sproutboat dev` no longer leaves the previous sprout running across a
+  rebuild, delivers no triggers to a candidate that failed to start, and cleans
+  up every failed setup path on rebuild and on shutdown.
+- The Zig toolchain cache is hardened against a partial or concurrent download.
+
+### Changed
+- Porffor pin bumped alpha-4 → **alpha-5** (`1f4ae4ae`); the same `UWS_COMMIT`,
+  so no uWebSockets re-vendor.
+- Config parsing, the artifact manifest, the binding broker, the wire assets and
+  the whole native-fetch runtime (prelude + transports) now come from published
+  `@sproutboat/*` packages; the CLI keeps thin re-export shims. The Porffor pin
+  and its source patches moved to `@sproutboat/toolchain`.
+- Broker cron / queue / alarm delivery is gated by a local signal, so only a
+  promoted candidate runs timers.
+
+### Performance
+- Embedded transport caches prepared statements per database (FIFO, 32/db)
+  instead of recompiling the SQL on every binding op — the op boundary drops
+  from ~0.6 ms to tens of µs (baronunread/sproutboat#155).
+- The broker's due-queue and due-alarm polls are indexed.
+
+### Docs
+- `docs/standalone.md` documents the single-threaded execution model and the
+  `SO_REUSEPORT` multi-process recipe for scaling past one core
+  (baronunread/sproutboat#154); the embedded transport also sets
+  `PRAGMA busy_timeout` so shared-data-dir writers wait instead of failing.
+  Also: the client-IP behaviour and backing up D1.
+
 ## [0.9.0] - 2026-09-07
 ### Added
 - KV content management: `kv key get`, `put`, `delete`, and `list`; bounded
@@ -282,7 +358,10 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.8.0...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.1...HEAD
+[0.10.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.0...v0.10.1
+[0.10.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.9.0...v0.10.0
+[0.9.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.6.0...v0.6.1

package/README.md

@@ -8,6 +8,11 @@ https://sproutboat.com
 The CLI for [Sproutboat](https://github.com/baronunread/sproutboat). Compiles a
 `fetch` handler to a native binary and ships it to any Sproutboat control plane.
 
+## Issues
+
+Tracked centrally in [baronunread/sproutboat](https://github.com/baronunread/sproutboat/issues)
+(label `area:cli`). Please file there.
+
 ## Overview
 
 Wrangler-shaped, MIT licensed. `build` and `deploy` cross-compile your handler
@@ -19,16 +24,23 @@ for agents: [sproutboat.com/llms.txt](https://sproutboat.com/llms.txt)).
 
 ## Using
 
-Sproutboat is a Bun tool. It needs **Bun 1.4+** on the machine you build from,
-and `bunx` rather than `npx`: the CLI runs on Bun's APIs, and `npm install`
-cannot resolve it today ([#134](https://github.com/baronunread/sproutboat/issues/134)).
+The npm package installs a small Node launcher and the matching native
+platform package, so `npm install -g sproutboat` and `npm exec sproutboat` work
+without Bun on `darwin` and `linux` for `arm64` and `x64`. The self-hosted
+runtime exports remain in the root package for Bun-based platform integrations.
 Nothing is needed on the machine that *runs* a sprout: that gets a static
 binary.
 
+The first build downloads the pinned Porffor source into
+`~/.cache/sproutboat`, verifies its SHA-256, applies Sproutboat's compiler
+patches there, and publishes the cache entry atomically. Installation itself
+does not clone Porffor or invoke Git, Make, or a compiler. Warm-cache builds can
+run offline.
+
 ```sh
-bunx sproutboat init hello
+npm exec sproutboat init hello
 cd hello
-bunx sproutboat dev        # runs it right here, no control plane needed
+npm exec sproutboat dev    # runs it right here, no control plane needed
 ```
 
 Happy with it? Ship it:
@@ -38,10 +50,10 @@ bunx sproutboat login --api-url https://control.example.com   # one browser appr
 bunx sproutboat deploy
 ```
 
-Or install it once with Bun and drop the `bunx`:
+Or install it once and drop the `npm exec`:
 
 ```sh
-bun add -g sproutboat     # then: sproutboat deploy, sproutboat tail, ...
+npm install -g sproutboat # then: sproutboat deploy, sproutboat tail, ...
 ```
 
 `login` is one-time. It writes a long-lived token to
@@ -113,6 +125,7 @@ complete export. Existing output files require `--force`.
   "queues": ["JOBS"],
   "analytics_engine_datasets": ["METRICS"],   // bare name only, no id
   "durable_objects": { "COUNTER": "Counter" },
+  "ratelimiters": [{ "binding": "API", "limit": 100, "period": 60 }], // env.API.limit({ key })
   "outbound": ["api.example.com"],
   "triggers": { "crons": ["*/5 * * * *"] },
   "assets": { "directory": "public", "binding": "ASSETS", "run_sprout_first": ["/api/*"] }

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.9.0 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.10.1 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 
@@ -44,6 +44,10 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | `CC` | C compiler used to build uSockets for a host build (default `cc`). A host build needs one regardless: it is what Porffor compiles its own generated C with. |
 | `AR` | Archiver used to assemble uSockets.a for a host build (default `ar`). |
 | `SPROUTBOAT_COMPILE_TIMEOUT_MS` | Porffor compile timeout in ms (default 600000). |
+| `SPROUTBOAT_TOOLCHAIN_CACHE` | Managed Porffor and compiler cache root (default ~/.cache/sproutboat). |
+| `SPROUTBOAT_PORFFOR_DIR` | Contributor override for an existing Porffor source checkout. Required files are validated before use. |
+| `SPROUTBOAT_BUILD_UWS_FROM_SOURCE` | Set to 1 to explicitly allow the contributor-only Git and Make uWebSockets fallback. |
+| `SPROUTBOAT_CLI_VERSION` | CLI version embedded by the release executable build. Not normally set by users. |
 | `SPROUTBOAT_VARS_JSON` | JSON object of baked `vars` (UPPER_SNAKE -> string), read by the wrapper when generating the sprout module. |
 | `SPROUTBOAT_BINDINGS_JSON` | The artifact's bindings.json, read by the wrapper to emit the `__sbInstallBindings` line. |
 | `SPROUTBOAT_CONFIG_DIR` | Directory for credentials.json (default ~/.config/sproutboat). |
@@ -67,7 +71,7 @@ usage: sproutboat <init [name] | check [project-dir] | types [project-dir] | dev
 | | |
 | --- | --- |
 | Zig | `0.16.0` (`zig cc -target x86_64-linux-musl`, static) |
-| Provenance stamp | `zig-musl/0.16.0+porffor/a415d19+uws/360c276d` |
+| Provenance stamp | `zig-musl/0.16.0+porffor/1f4ae4a+uws/360c276d` |
 | Artifact schema | `2` |
 | Runtime | `native-fetch` |
 | Capability profile | `http-sync-v0` |

package/bin/sproutboat.cjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// npm selects the packaged executable for this host when it is installed; that
+// is a native single-file binary that needs no Bun. When it is absent (it is
+// not published yet — see issue #134), fall back to running the TypeScript
+// entry point with Bun, which is how the CLI shipped through v0.9.0.
+const { spawn } = require("node:child_process");
+const { join } = require("node:path");
+
+const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
+const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
+
+let command;
+let args;
+let viaBun = false;
+try {
+  if (!platform || !arch) throw new Error(`unsupported host ${process.platform}/${process.arch}`);
+  command = require.resolve(`@sproutboat/cli-${platform}-${arch}/bin/sproutboat`);
+  args = process.argv.slice(2);
+} catch {
+  viaBun = true;
+  // SPROUTBOAT_BUN is an escape hatch for an unusual install; otherwise PATH.
+  command = process.env.SPROUTBOAT_BUN || "bun";
+  args = [join(__dirname, "..", "src", "main.ts"), ...process.argv.slice(2)];
+}
+
+const child = spawn(command, args, { stdio: "inherit", windowsHide: true });
+
+child.once("error", (error) => {
+  if (viaBun && error.code === "ENOENT") {
+    console.error("sproutboat: this build needs Bun on PATH. Install it: https://bun.sh");
+  } else {
+    console.error(`sproutboat: could not start: ${error.message}`);
+  }
+  process.exit(1);
+});
+
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => child.kill(signal));
+}
+
+child.once("exit", (code, signal) => {
+  if (signal) {
+    // Re-raise so the parent's exit reflects the signal — but drop our own
+    // handler first, or the re-raise re-enters it and the process hangs.
+    process.removeAllListeners(signal);
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 1);
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -19,12 +19,14 @@
     "url": "git+https://github.com/baronunread/sproutboat-cli.git"
   },
   "bin": {
-    "sproutboat": "src/main.ts"
+    "sproutboat": "bin/sproutboat.cjs"
   },
   "files": [
     "CHANGELOG.md",
     "SURFACE.md",
     "src",
+    "bin/sproutboat.cjs",
+    "scripts",
     "types",
     "vendor"
   ],
@@ -37,7 +39,6 @@
     "./runtime/assets": "./src/assets.ts",
     "./runtime/broker": "./src/broker.ts",
     "./runtime/wrap": "./src/wrap.ts",
-    "./runtime/prelude": "./src/native-fetch-prelude.js",
     "./package.json": "./package.json",
     "./types": "./types/sproutboat.d.ts"
   },
@@ -46,6 +47,7 @@
     "typecheck": "tsc --noEmit",
     "lint": "oxlint .",
     "examples": "bun examples/smoke.ts",
+    "build:cli": "bun scripts/build-cli.ts",
     "fmt": "oxfmt .",
     "fmt:check": "oxfmt --check .",
     "test": "bun test",
@@ -58,8 +60,13 @@
     "kitchen-sink:standalone": "bun examples/kitchen-sink/harness-standalone.ts"
   },
   "dependencies": {
-    "esbuild": "^0.28.2",
-    "porffor": "github:CanadaHonk/porffor#alpha-4"
+    "@sproutboat/artifact": "^0.2.0",
+    "@sproutboat/assets": "^0.2.0",
+    "@sproutboat/config": "^0.3.0",
+    "@sproutboat/runtime": "^0.4.0",
+    "@sproutboat/toolchain": "^0.3.0",
+    "@sproutboat/wire": "^0.4.0",
+    "esbuild": "^0.28.2"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.81.0",
@@ -70,6 +77,6 @@
     "typescript": "7.0.2"
   },
   "engines": {
-    "bun": ">=1.4.0"
+    "node": ">=18"
   }
 }

package/scripts/build-cli.ts

@@ -0,0 +1,44 @@
+/** Build one platform package executable. npm's tiny root launcher resolves it. */
+import { chmod, copyFile, mkdir } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const platform = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
+const arch = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;
+if (!platform || !arch) throw new Error(`unsupported release host ${process.platform}/${process.arch}`);
+const packageDir = resolve(import.meta.dir, "..", "platform-packages", `${platform}-${arch}`);
+const out = resolve(packageDir, "bin", "sproutboat");
+await mkdir(resolve(out, ".."), { recursive: true });
+// SAFETY: package.json is this release's manifest and npm requires its version.
+const version = ((await Bun.file(resolve(import.meta.dir, "..", "package.json")).json()) as { version: string })
+  .version;
+// SAFETY: every checked-in platform package manifest owns a required string version.
+const platformVersion = ((await Bun.file(resolve(packageDir, "package.json")).json()) as { version: string }).version;
+if (platformVersion !== version)
+  throw new Error(`platform package version ${platformVersion} does not match root ${version}`);
+const child = Bun.spawn(
+  [
+    process.execPath,
+    "build",
+    "--compile",
+    "--target=bun",
+    `--define:process.env.SPROUTBOAT_CLI_VERSION=${JSON.stringify(version)}`,
+    "--outfile",
+    out,
+    "src/main.ts",
+  ],
+  {
+    cwd: resolve(import.meta.dir, ".."),
+    stdout: "inherit",
+    stderr: "inherit",
+  },
+);
+if ((await child.exited) !== 0) process.exit(1);
+let esbuild: string;
+try {
+  esbuild = Bun.resolveSync(`@esbuild/${platform}-${arch}/bin/esbuild`, import.meta.dir);
+} catch {
+  throw new Error("matching esbuild binary is missing; run bun install before building a platform package");
+}
+const packagedEsbuild = resolve(packageDir, "bin", "esbuild");
+await copyFile(esbuild, packagedEsbuild);
+await chmod(packagedEsbuild, 0o755);

package/src/assets.ts

@@ -1,121 +1,4 @@
-/**
- * Static-asset manifest. `sproutboat build` copies the project's `assets`
- * directory next to the artifact and writes `assets.json` (this manifest); the
- * edge serves matching files directly (assets-first, like Cloudflare), and the
- * broker's `assets.get` op backs `env.<ASSETS>.fetch(request)` for the paths
- * the sprout chooses to serve itself.
- */
-import { createHash } from "node:crypto";
-import { readdirSync, readFileSync } from "node:fs";
-import { join, posix } from "node:path";
-
-export type AssetEntry = { hash: string; size: number; type: string };
-/** `/absolute/posix/path` -> entry. Serialised into `assets.json`. */
-export type AssetFiles = { [path: string]: AssetEntry };
-export type AssetManifest = {
-  /** Fallback for requests that match no file, applied by the broker. */
-  notFound: "none" | "single-page-application" | "404-page";
-  /** `true` = every path to the sprout first; string[] = selective (leading `!` negates). */
-  runSproutFirst: boolean | string[];
-  files: AssetFiles;
-};
-
-const TYPES = new Map<string, string>([
-  ["html", "text/html; charset=utf-8"],
-  ["css", "text/css; charset=utf-8"],
-  ["js", "text/javascript; charset=utf-8"],
-  ["mjs", "text/javascript; charset=utf-8"],
-  ["json", "application/json; charset=utf-8"],
-  ["map", "application/json; charset=utf-8"],
-  ["txt", "text/plain; charset=utf-8"],
-  ["xml", "application/xml; charset=utf-8"],
-  ["svg", "image/svg+xml"],
-  ["png", "image/png"],
-  ["jpg", "image/jpeg"],
-  ["jpeg", "image/jpeg"],
-  ["gif", "image/gif"],
-  ["webp", "image/webp"],
-  ["avif", "image/avif"],
-  ["ico", "image/x-icon"],
-  ["woff2", "font/woff2"],
-  ["woff", "font/woff"],
-  ["ttf", "font/ttf"],
-  ["wasm", "application/wasm"],
-  ["webmanifest", "application/manifest+json"],
-]);
-
-export function contentType(name: string): string {
-  const dot = name.lastIndexOf(".");
-  return (dot >= 0 ? TYPES.get(name.slice(dot + 1).toLowerCase()) : undefined) ?? "application/octet-stream";
-}
-
-/**
- * Resolve a request path to a manifest key the way a static host does:
- *   - an exact hit wins;
- *   - a directory path (`/docs/`) tries `/docs/index.html`;
- *   - an extensionless path (`/docs`) tries `/docs.html`, then `/docs/index.html`.
- * Returns the matched key, or `null`. This only picks which file to serve — no
- * canonical redirects, and the caller still owns not-found handling. Mirrors
- * Cloudflare's `html_handling: "auto-trailing-slash"` minus the 3xx responses.
- */
-export function resolveAssetKey(path: string, has: (key: string) => boolean): string | null {
-  if (!path.startsWith("/")) path = `/${path}`;
-  if (path.endsWith("/")) {
-    const index = `${path}index.html`;
-    return has(index) ? index : null;
-  }
-  if (has(path)) return path;
-  const base = path.slice(path.lastIndexOf("/") + 1);
-  if (!base.includes(".")) {
-    if (has(`${path}.html`)) return `${path}.html`;
-    if (has(`${path}/index.html`)) return `${path}/index.html`;
-  }
-  return null;
-}
-
-/** Walk `dir` recursively, returning `{ "/path": {hash,size,type} }`. */
-export function walkAssets(dir: string) {
-  const out: AssetFiles = {};
-  const recurse = (abs: string, rel: string): void => {
-    for (const ent of readdirSync(abs, { withFileTypes: true })) {
-      if (ent.name.startsWith(".")) continue;
-      const childAbs = join(abs, ent.name);
-      const childRel = posix.join(rel, ent.name);
-      if (ent.isDirectory()) {
-        recurse(childAbs, childRel);
-        continue;
-      }
-      if (!ent.isFile()) continue;
-      const body = readFileSync(childAbs);
-      out[`/${childRel}`] = {
-        hash: createHash("sha256").update(body).digest("hex"),
-        size: body.byteLength,
-        type: contentType(ent.name),
-      };
-    }
-  };
-  recurse(dir, "");
-  return out;
-}
-
-/** Does `pathname` hit the sprout before assets, given a `runSproutFirst` spec? */
-export function isSproutFirst(spec: boolean | string[], pathname: string): boolean {
-  if (!Array.isArray(spec)) return spec;
-  let matched = false;
-  for (const raw of spec) {
-    const negate = raw.startsWith("!");
-    const pattern = negate ? raw.slice(1) : raw;
-    if (globMatch(pattern, pathname)) matched = !negate;
-  }
-  return matched;
-}
-
-/** `*` matches within a segment, `**` across segments. Anchored both ends. */
-function globMatch(pattern: string, path: string): boolean {
-  const rx = pattern
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-    .replace(/\*\*/g, " ")
-    .replace(/\*/g, "[^/]*")
-    .replace(/ /g, ".*");
-  return new RegExp(`^${rx}$`).test(path);
-}
+// Re-exported from @sproutboat/assets (moved verbatim). This shim keeps
+// every `./assets` importer and the `sproutboat/runtime/assets` export path
+// working; the implementation lives in the shared package.
+export * from "@sproutboat/assets";