Platform model

Sprout separates product code from platform control.

App bundle

An application owns:

• static frontend output;
• ordered, append-only SQL migrations;
• optional Deno-compatible Functions;
• optional durable background queues;
• optional UTC cron schedules;
• generated, required-owner, and optional secret declarations; and
• a health path.

The manifest makes those inputs deterministic and reviewable.

Platform-owned boundaries

Sprout owns:

• canonical HTTPS routing and private-app admission;
• brokered Auth sessions and refresh;
• the per-app PostgreSQL schema and restrictive app boundary;
• opaque managed Files isolation and lifecycle;
• private Realtime topic construction;
• Function runtime credentials and secret injection;
• PostgreSQL-backed background-job delivery, retries, dead letters, and bounded history;
• durable deployment, cron, backup, log, and usage records.

Frontend code receives only same-origin runtime interfaces. It never receives service-role, database, object-store, or control-plane credentials.

Client versus operator APIs

The JavaScript SDK is for end-user browser code. Its authority is limited by the current user, RLS, managed Files access, Function manifest access, and the app host. It exposes high-level values rather than raw service clients.

The CLI is for builders and operators. App-scoped agent credentials can deploy, observe, verify, and operate only their assigned app and allowed scopes.

Never put an OPENCLOUD_TOKEN in browser code.