@sproutboat/runtime 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @sproutboat/runtime
 
+## 0.16.0
+
+### Minor Changes
+
+- 14546a0: Add Web Streams globals from web-streams-polyfill 4.3.0, including readable, writable and transform streams, with native regression coverage. Streams run in memory; HTTP request and response bodies remain buffered by the native transport. Together with the compiler fixes, Better Auth 1.7.1 passes email/password and signed-cookie session flows with an explicit memory database adapter. Database-free encrypted sessions still require unsupported AES crypto.
+
+  Expose the existing native timeout and interval functions on globalThis, supporting host-task yields in noble hashes 2.4 without changing timer semantics.
+
 ## 0.15.0
 
 ### Minor Changes

package/README.md

@@ -32,6 +32,12 @@ crypto random values, binding shims, trigger dispatch) and is identical
 for both transports, which is what lets one conformance suite hold them
 honest.
 
+## Web Streams
+
+The prelude includes readable, writable and transform stream globals. These
+operate in memory; HTTP bodies remain buffered. See [native Web Streams](WEB_STREAMS.md)
+for tested APIs, transport limits and Better Auth compatibility.
+
 ## R2 multipart uploads
 
 R2 bindings implement the Cloudflare multipart method shape for objects that

package/WEB_STREAMS.md

@@ -0,0 +1,33 @@
+# Native Web Streams
+
+The runtime installs missing Web Streams globals using the MIT-licensed
+web-streams-polyfill 4.3.0. The generated implementation is embedded in the
+native prelude, so deployed binaries need no JavaScript files or package loader.
+Run `bun run gen:streams` from the repository root to regenerate it.
+
+Native regression tests cover default readers, locking, pending reads,
+cancellation, source errors, array conversion, writable sinks, pipeTo,
+pipeThrough, transforms, tee, pull sources, byte streams and BYOB reads.
+This is API support for streams in memory, not progressive HTTP transport.
+Request and Response bodies and outbound fetch remain buffered. Passing a
+ReadableStream as an HTTP body is not supported. TextEncoderStream,
+TextDecoderStream, CompressionStream and DecompressionStream are not included.
+BYOB buffer detachment requires transfer support from the underlying engine;
+the polyfill cannot supply that engine primitive. Full Web Platform Tests
+conformance has not been established for Porffor.
+
+Porffor Alpha 16 requires controller classes at module scope, rather than inside
+an IIFE. The generator also adapts dynamic array iterator lookup to the working
+native array values iterator. User handler modules retain their separate scope.
+
+Better Auth 1.7.1 now passes native email/password signup, signed-cookie session
+lookup, wrong-password rejection, signin, signout and session revocation with an
+explicit memory database adapter. The compiler also needs the local-function
+return-type and Uint8Array base64 patches shipped with this upgrade. The default
+Better Auth password hashing is retained; credential operations take about
+6 to 8 seconds on the development machine with optimized native compilation.
+This is a verified integration configuration, not a production database benchmark.
+
+Database-free Better Auth selects encrypted JWE sessions and still fails because
+native crypto does not implement AES. Production database adapters, OAuth,
+plugins and asymmetric JWT algorithms have not been validated by this probe.

package/WEB_STREAMS_LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Mattias Buelens
+Copyright (c) 2016 Diwank Singh Tomer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/gen-streams.ts

@@ -0,0 +1,35 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+const marker = "// WEB STREAMS: generated by gen-streams.ts, do not edit.";
+const endMarker = "// END WEB STREAMS";
+const result = await Bun.build({
+  entrypoints: [`${import.meta.dir}/streams-entry.js`],
+  target: "browser",
+  format: "iife",
+  minify: false,
+});
+if (!result.success) throw new Error(result.logs.join("\n"));
+let code = await result.outputs[0].text();
+// Porffor cannot resolve controller class prototypes captured by an IIFE.
+// Keep these classes at module scope. User modules have their own scope.
+if (!code.startsWith("(() => {") || !code.trimEnd().endsWith("})();")) {
+  throw new Error("Unexpected streams bundle format");
+}
+code = code.slice("(() => {".length).trimEnd().slice(0, -"})();".length);
+code = code.replace(/^\s*\/\/ .*streams-entry.js$/m, "// streams-entry.js");
+code = code.replace(/^\s*\/\/ .*web-streams-polyfill\/dist\/ponyfill.mjs$/m,
+  "// web-streams-polyfill 4.3.0, MIT, copyright Mattias Buelens (see WEB_STREAMS_LICENSE)");
+// Alpha 16's direct array iterator works, but dynamic symbol lookup misses it.
+const lookup = "const r = e[t];\n    if (r != null)";
+if (!code.includes(lookup)) throw new Error("Streams iterator adapter target changed");
+code = code.replace(lookup,
+  "let r = e[t];\n    if (r == null && t === Symbol.iterator && Array.isArray(e)) r = () => e.values();\n    if (r != null)");
+const path = `${import.meta.dir}/native-fetch-prelude.js`;
+let prelude = await readFile(path, "utf8");
+const start = prelude.indexOf(marker);
+if (start !== -1) {
+  const end = prelude.indexOf(endMarker, start);
+  if (end === -1) throw new Error("Missing streams block end marker");
+  prelude = prelude.slice(0, start) + prelude.slice(end + endMarker.length).replace(/^\n+/, "");
+}
+await writeFile(path, `${marker}\n/* oxlint-disable -- generated third-party implementation */\n${code}\n/* oxlint-enable */\n${endMarker}\n\n${prelude}`);