@sproutboat/runtime 0.16.0 → 0.17.1

package/src/native-fetch-prelude.js

@@ -1,37 +1,6 @@
 // WEB STREAMS: generated by gen-streams.ts, do not edit.
 /* oxlint-disable -- generated third-party implementation */
-
-  var __defProp = Object.defineProperty;
-  var __returnValue = (v) => v;
-  function __exportSetter(name, newValue) {
-    this[name] = __returnValue.bind(null, newValue);
-  }
-  var __export = (target, all) => {
-    for (var name in all)
-      __defProp(target, name, {
-        get: all[name],
-        enumerable: true,
-        configurable: true,
-        set: __exportSetter.bind(all, name)
-      });
-  };
 // web-streams-polyfill 4.3.0, MIT, copyright Mattias Buelens (see WEB_STREAMS_LICENSE)
-  var exports_ponyfill = {};
-  __export(exports_ponyfill, {
-    ByteLengthQueuingStrategy: () => ByteLengthQueuingStrategy,
-    CountQueuingStrategy: () => CountQueuingStrategy,
-    ReadableByteStreamController: () => ReadableByteStreamController,
-    ReadableStream: () => ReadableStream,
-    ReadableStreamBYOBReader: () => ReadableStreamBYOBReader,
-    ReadableStreamBYOBRequest: () => ReadableStreamBYOBRequest,
-    ReadableStreamDefaultController: () => ReadableStreamDefaultController,
-    ReadableStreamDefaultReader: () => ReadableStreamDefaultReader,
-    TransformStream: () => TransformStream,
-    TransformStreamDefaultController: () => TransformStreamDefaultController,
-    WritableStream: () => WritableStream,
-    WritableStreamDefaultController: () => WritableStreamDefaultController,
-    WritableStreamDefaultWriter: () => WritableStreamDefaultWriter
-  });
   function e() {}
   function t(e) {
     return typeof e == "object" && e !== null || typeof e == "function";
@@ -332,8 +301,7 @@
     return ue(n, 0, e, t, o), n;
   }
   function he(e, t) {
-    let r = e[t];
-    if (r == null && t === Symbol.iterator && Array.isArray(e)) r = () => e.values();
+    const r = e[t];
     if (r != null) {
       if (typeof r != "function")
         throw new TypeError(`${String(t)} is not a function`);
@@ -2307,10 +2275,32 @@
   }
   Object.defineProperties(TransformStreamDefaultController.prototype, { enqueue: { enumerable: true }, error: { enumerable: true }, terminate: { enumerable: true }, desiredSize: { enumerable: true } }), o(TransformStreamDefaultController.prototype.enqueue, "enqueue"), o(TransformStreamDefaultController.prototype.error, "error"), o(TransformStreamDefaultController.prototype.terminate, "terminate"), typeof Symbol.toStringTag == "symbol" && Object.defineProperty(TransformStreamDefaultController.prototype, Symbol.toStringTag, { value: "TransformStreamDefaultController", configurable: true });
 // streams-entry.js
-  for (const name of Object.keys(exports_ponyfill)) {
-    if (globalThis[name] == null)
-      globalThis[name] = exports_ponyfill[name];
-  }
+  if (globalThis.ByteLengthQueuingStrategy == null)
+    globalThis.ByteLengthQueuingStrategy = ByteLengthQueuingStrategy;
+  if (globalThis.CountQueuingStrategy == null)
+    globalThis.CountQueuingStrategy = CountQueuingStrategy;
+  if (globalThis.ReadableByteStreamController == null)
+    globalThis.ReadableByteStreamController = ReadableByteStreamController;
+  if (globalThis.ReadableStream == null)
+    globalThis.ReadableStream = ReadableStream;
+  if (globalThis.ReadableStreamBYOBReader == null)
+    globalThis.ReadableStreamBYOBReader = ReadableStreamBYOBReader;
+  if (globalThis.ReadableStreamBYOBRequest == null)
+    globalThis.ReadableStreamBYOBRequest = ReadableStreamBYOBRequest;
+  if (globalThis.ReadableStreamDefaultController == null)
+    globalThis.ReadableStreamDefaultController = ReadableStreamDefaultController;
+  if (globalThis.ReadableStreamDefaultReader == null)
+    globalThis.ReadableStreamDefaultReader = ReadableStreamDefaultReader;
+  if (globalThis.TransformStream == null)
+    globalThis.TransformStream = TransformStream;
+  if (globalThis.TransformStreamDefaultController == null)
+    globalThis.TransformStreamDefaultController = TransformStreamDefaultController;
+  if (globalThis.WritableStream == null)
+    globalThis.WritableStream = WritableStream;
+  if (globalThis.WritableStreamDefaultController == null)
+    globalThis.WritableStreamDefaultController = WritableStreamDefaultController;
+  if (globalThis.WritableStreamDefaultWriter == null)
+    globalThis.WritableStreamDefaultWriter = WritableStreamDefaultWriter;
 
 /* oxlint-enable */
 // END WEB STREAMS
@@ -2435,8 +2425,38 @@ function __sbCollectionIterator(owner, kind, formData) {
 
 class __SproutboatURLSearchParams {
   constructor(init) {
+    this._url = null;
+    this._reset(init);
+  }
+  // A URL's searchParams writes back into it (_url), and is re-read when the URL's
+  // search is assigned (_reset).
+  _reset(init) {
     this._keys = [];
     this._vals = [];
+    // The URLSearchParams init forms: another URLSearchParams, a sequence of [name, value]
+    // pairs, a record of own string keys, or a query string. Only strings were read, so
+    // new URLSearchParams({ a: "1" }) serialized as "%5Bobject+Object%5D=" (W2).
+    if (init instanceof __SproutboatURLSearchParams) {
+      this._keys = init._keys.slice();
+      this._vals = init._vals.slice();
+      return;
+    }
+    if (init != null && Object(init) === init) {
+      if (__sbIsFn(init[Symbol.iterator])) {
+        for (const pair of init) {
+          const items = Array.from(pair);
+          if (items.length !== 2) throw new TypeError("URLSearchParams: each pair must have exactly two items");
+          this._keys.push(String(items[0]));
+          this._vals.push(String(items[1]));
+        }
+        return;
+      }
+      for (const key of Object.keys(init)) {
+        this._keys.push(key);
+        this._vals.push(String(init[key]));
+      }
+      return;
+    }
     let raw = init == null ? "" : String(init);
     if (raw.charCodeAt(0) === 63) raw = raw.slice(1); // strip a leading '?'
     if (raw.length === 0) return;
@@ -2451,6 +2471,11 @@ class __SproutboatURLSearchParams {
       this._vals.push(decodeURIComponent(v.split("+").join(" ")));
     }
   }
+  _update() {
+    if (this._url == null) return;
+    const s = this.toString();
+    this._url._query = s === "" ? null : s;
+  }
   get(name) {
     for (let i = 0; i < this._keys.length; i++) if (this._keys[i] === name) return this._vals[i];
     return null;
@@ -2467,12 +2492,10 @@ class __SproutboatURLSearchParams {
   forEach(cb) {
     for (let i = 0; i < this._keys.length; i++) cb(this._vals[i], this._keys[i], this);
   }
-  // Mutators: standalone `new URLSearchParams()` building works. They do NOT
-  // write back into a URL's `search` (Porffor's URL has no setter) — build the
-  // string with toString() and assign it yourself.
   append(name, value) {
     this._keys.push(String(name));
     this._vals.push(String(value));
+    this._update();
   }
   set(name, value) {
     let found = false;
@@ -2487,7 +2510,11 @@ class __SproutboatURLSearchParams {
         found = true;
       }
     }
-    if (!found) this.append(name, value);
+    if (!found) {
+      this._keys.push(String(name));
+      this._vals.push(String(value));
+    }
+    this._update();
   }
   delete(name) {
     for (let i = 0; i < this._keys.length; i++)
@@ -2496,13 +2523,15 @@ class __SproutboatURLSearchParams {
         this._vals.splice(i, 1);
         i--;
       }
+    this._update();
   }
   sort() {
     const idx = this._keys
       .map((_, i) => i)
-      .sort((a, b) => (this._keys[a] < this._keys[b] ? -1 : this._keys[a] > this._keys[b] ? 1 : 0));
+      .sort((a, b) => (this._keys[a] < this._keys[b] ? -1 : this._keys[a] > this._keys[b] ? 1 : a - b));
     this._keys = idx.map((i) => this._keys[i]);
     this._vals = idx.map((i) => this._vals[i]);
+    this._update();
   }
   keys() {
     return __sbCollectionIterator(this, 0, false);
@@ -2517,15 +2546,34 @@ class __SproutboatURLSearchParams {
   get size() {
     return this._keys.length;
   }
+  // application/x-www-form-urlencoded: space is "+", and ! ' ( ) ~ are escaped too.
   toString() {
     let out = "";
     for (let i = 0; i < this._keys.length; i++) {
       if (i > 0) out += "&";
-      out += encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]);
+      out += __sbFormEncode(this._keys[i]) + "=" + __sbFormEncode(this._vals[i]);
     }
     return out;
   }
 }
+// One pass over encodeURIComponent's output (chained split/join doubled compile time).
+function __sbFormEncode(s) {
+  const e = encodeURIComponent(s);
+  let out = "";
+  for (let i = 0; i < e.length; i++) {
+    const c = e.charCodeAt(i);
+    if (c === 33) out += "%21";
+    else if (c === 39) out += "%27";
+    else if (c === 40) out += "%28";
+    else if (c === 41) out += "%29";
+    else if (c === 126) out += "%7E";
+    else if (c === 37 && e.charCodeAt(i + 1) === 50 && e.charCodeAt(i + 2) === 48) {
+      out += "+";
+      i += 2;
+    } else out += e[i];
+  }
+  return out;
+}
 
 // URL and Response are always defined by Porffor's fetch-globals.js banner.
 if (globalThis.URLSearchParams == null) globalThis.URLSearchParams = __SproutboatURLSearchParams;
@@ -2542,19 +2590,39 @@ if (!("searchParams" in URL.prototype)) {
 
 if (Response.json == null) {
   Response.json = function (data, init) {
-    const response = new Response(JSON.stringify(data), init);
-    if (!response.headers.has("content-type")) response.headers.set("content-type", "application/json;charset=utf-8");
-    return response;
+    // Typed before construction: a string body would otherwise default to text/plain.
+    const headers = new Headers(init?.headers);
+    if (!headers.has("content-type")) headers.set("content-type", "application/json");
+    return new Response(JSON.stringify(data), { status: init?.status ?? 200, statusText: init?.statusText, headers });
   };
 }
 
+// Error.stack: Porffor keeps no frames, so give V8's first line, "Name: message", rather
+// than undefined (code logs it or splits it on newlines).
+for (const E of [Error, TypeError, RangeError, ReferenceError, SyntaxError, EvalError, URIError]) {
+  if (!("stack" in E.prototype)) {
+    Object.defineProperty(E.prototype, "stack", {
+      configurable: true,
+      get() {
+        const message = String(this.message);
+        return message === "" ? String(this.name) : String(this.name) + ": " + message;
+      },
+    });
+  }
+}
+
+// Fetch: Headers iterates like entries(), so new Map(headers), [...headers] and
+// Object.fromEntries(headers) work. Porffor's Headers has entries() but no iterator.
+if (Headers.prototype[Symbol.iterator] == null) Headers.prototype[Symbol.iterator] = Headers.prototype.entries;
+
 // Porffor alpha-10 has no static Response.redirect().
 if (Response.redirect == null) {
   Response.redirect = function (url, status = 302) {
     if (status !== 301 && status !== 302 && status !== 303 && status !== 307 && status !== 308) {
       throw new RangeError("invalid redirect status");
     }
-    return new Response("", { status, headers: { location: String(url) } });
+    // Serialized like the URL parser does (a bare origin gains its "/"); invalid URLs throw.
+    return new Response(null, { status, headers: { location: new URL(String(url)).href } });
   };
 }
 
@@ -2626,11 +2694,21 @@ if (globalThis.FormData == null) {
     constructor() {
       this._entries = [];
     }
+    // A Blob value is stored as a File named by filename ("blob" by default); anything
+    // else as a string, as the FormData spec's entry list does.
+    static _entryValue(value, filename) {
+      if (value instanceof Blob) {
+        if (filename === undefined && value instanceof File) return value;
+        return new File([value], filename === undefined ? "blob" : String(filename), { type: value.type });
+      }
+      return String(value);
+    }
     append(name, value, filename) {
-      this._entries.push([String(name), value, filename]);
+      this._entries.push([String(name), __SproutboatFormData._entryValue(value, filename), filename]);
     }
     set(name, value, filename) {
       name = String(name);
+      value = __SproutboatFormData._entryValue(value, filename);
       let replaced = false;
       this._entries = this._entries.filter((e) => {
         if (e[0] !== name) return true;
@@ -2786,7 +2864,12 @@ if (globalThis.crypto.getRandomValues == null) {
   globalThis.crypto.getRandomValues = function (view) {
     const n = view.length >>> 0;
     // WebCrypto caps a single call at 65536 bytes.
-    if (n > 65536) throw new RangeError("crypto.getRandomValues: byte length exceeds 65536");
+    if (n > 65536) {
+      // WebCrypto's error for an oversized request (a DOMException named QuotaExceededError).
+      const e = new Error("crypto.getRandomValues: byte length exceeds 65536");
+      e.name = "QuotaExceededError";
+      throw e;
+    }
     if (n === 0) return view;
     // One CSPRNG byte per element. Correct for Uint8Array (and randomUUID); a
     // wider view gets its low byte filled, matching the previous polyfill's shape.
@@ -2796,17 +2879,282 @@ if (globalThis.crypto.getRandomValues == null) {
     return view;
   };
 }
-// structuredClone: JSON round-trip. Lossy (no Map/Set/Date/typed arrays), but
-// covers the common "deep-copy a plain object" case Worker code relies on.
+// queueMicrotask, and atob/btoa input checks as the HTML spec has them: atob drops ASCII
+// whitespace and rejects anything that is not base64, btoa rejects characters above
+// U+00FF. Both threw nothing and returned garbage before (W2 conformance).
+{
+  const invalidCharacter = (message) => {
+    const e = new Error(message);
+    e.name = "InvalidCharacterError";
+    return e;
+  };
+  if (globalThis.queueMicrotask == null) {
+    globalThis.queueMicrotask = function (callback) {
+      if (!__sbIsFn(callback)) throw new TypeError("queueMicrotask needs a function");
+      Promise.resolve().then(() => callback());
+    };
+  }
+  const nativeAtob = globalThis.atob, nativeBtoa = globalThis.btoa;
+  globalThis.atob = function (data) {
+    let text = String(data).replace(/[\t\n\f\r ]/g, "");
+    if (text.length % 4 === 0) text = text.replace(/==?$/, "");
+    if (text.length % 4 === 1 || !/^[A-Za-z0-9+/]*$/.test(text)) throw invalidCharacter("atob: the string is not valid base64");
+    while (text.length % 4 !== 0) text += "=";
+    return nativeAtob(text);
+  };
+  globalThis.btoa = function (data) {
+    const text = String(data);
+    for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) > 0xff) throw invalidCharacter("btoa: the string has characters outside Latin-1");
+    return nativeBtoa(text);
+  };
+}
+
+/* oxlint-disable anti-slop/no-runtime-typeof -- these Web API polyfills branch on JavaScript types
+   exactly where their specs do (listener: function or { handleEvent }; structured clone: by value type). */
+// Event, CustomEvent, EventTarget, AbortSignal and AbortController, as workerd has
+// them (no DOM tree, so no bubbling or capture phases). Found missing by the W2
+// conformance suite; libraries use AbortController for fetch timeouts and EventTarget
+// for their own events.
+if (typeof globalThis.EventTarget !== "function") {
+  const namedError = (name, message) => {
+    const e = new Error(message);
+    e.name = name;
+    return e;
+  };
+  class Event {
+    constructor(type, init) {
+      if (arguments.length === 0) throw new TypeError("Event requires a type");
+      const options = init || {};
+      this.type = String(type);
+      this.bubbles = !!options.bubbles;
+      this.cancelable = !!options.cancelable;
+      this.composed = !!options.composed;
+      this.defaultPrevented = false;
+      this.target = null;
+      this.currentTarget = null;
+      this.eventPhase = 0;
+      this.isTrusted = false;
+      this.timeStamp = Date.now();
+      this.__sbStopped = false;
+    }
+    preventDefault() { if (this.cancelable) this.defaultPrevented = true; }
+    stopPropagation() {}
+    stopImmediatePropagation() { this.__sbStopped = true; }
+    composedPath() { return this.currentTarget ? [this.currentTarget] : []; }
+  }
+  class CustomEvent extends Event {
+    constructor(type, init) {
+      super(type, init);
+      this.detail = init && init.detail !== undefined ? init.detail : null;
+    }
+  }
+  class EventTarget {
+    constructor() { this.__sbListeners = {}; }
+    addEventListener(type, listener, options) {
+      if (listener == null) return;
+      const capture = typeof options === "boolean" ? options : !!(options && options.capture);
+      const once = !!(options && typeof options === "object" && options.once);
+      const signal = options && typeof options === "object" ? options.signal : undefined;
+      if (signal && signal.aborted) return;
+      const list = this.__sbListeners[type] || (this.__sbListeners[type] = []);
+      for (const entry of list) if (entry.listener === listener && entry.capture === capture) return;
+      const entry = { listener, capture, once, removed: false };
+      list.push(entry);
+      if (signal) signal.addEventListener("abort", () => this.removeEventListener(type, listener, capture));
+    }
+    removeEventListener(type, listener, options) {
+      const capture = typeof options === "boolean" ? options : !!(options && options.capture);
+      const list = this.__sbListeners[type];
+      if (!list) return;
+      for (let i = 0; i < list.length; i++) {
+        if (list[i].listener === listener && list[i].capture === capture) {
+          list[i].removed = true;
+          list.splice(i, 1);
+          return;
+        }
+      }
+    }
+    dispatchEvent(event) {
+      if (!(event instanceof Event)) throw new TypeError("dispatchEvent needs an Event");
+      event.target = this;
+      event.currentTarget = this;
+      event.eventPhase = 2;
+      const list = (this.__sbListeners[event.type] || []).slice();
+      for (const entry of list) {
+        if (entry.removed) continue;
+        if (entry.once) this.removeEventListener(event.type, entry.listener, entry.capture);
+        const fn = entry.listener;
+        if (typeof fn === "function") fn.call(this, event);
+        else if (fn && typeof fn.handleEvent === "function") fn.handleEvent(event);
+        if (event.__sbStopped) break;
+      }
+      event.currentTarget = null;
+      event.eventPhase = 0;
+      return !event.defaultPrevented;
+    }
+  }
+  class AbortSignal extends EventTarget {
+    constructor() {
+      super();
+      this.aborted = false;
+      this.reason = undefined;
+      this.onabort = null;
+    }
+    throwIfAborted() { if (this.aborted) throw this.reason; }
+    __sbAbort(reason) {
+      if (this.aborted) return;
+      this.aborted = true;
+      this.reason = reason === undefined ? namedError("AbortError", "This operation was aborted") : reason;
+      const event = new Event("abort");
+      if (typeof this.onabort === "function") this.onabort.call(this, event);
+      this.dispatchEvent(event);
+    }
+    static abort(reason) {
+      const signal = new AbortSignal();
+      signal.__sbAbort(reason);
+      return signal;
+    }
+    static timeout(ms) {
+      const signal = new AbortSignal();
+      setTimeout(() => signal.__sbAbort(namedError("TimeoutError", "The operation timed out")), ms);
+      return signal;
+    }
+    static any(signals) {
+      const signal = new AbortSignal();
+      for (const s of signals) {
+        if (s.aborted) {
+          signal.__sbAbort(s.reason);
+          return signal;
+        }
+      }
+      for (const s of signals) s.addEventListener("abort", () => signal.__sbAbort(s.reason));
+      return signal;
+    }
+  }
+  class AbortController {
+    constructor() { this.signal = new AbortSignal(); }
+    abort(reason) { this.signal.__sbAbort(reason); }
+  }
+  globalThis.Event = Event;
+  globalThis.CustomEvent = CustomEvent;
+  globalThis.EventTarget = EventTarget;
+  globalThis.AbortSignal = AbortSignal;
+  globalThis.AbortController = AbortController;
+}
+
+// TextEncoderStream and TextDecoderStream over the Web Streams ponyfill (W2 conformance).
+// The encoder holds back a lone high surrogate at the end of a chunk until the next one;
+// the decoder is TextDecoder in streaming mode, so a character split across chunks decodes.
+if (globalThis.TextEncoderStream == null) {
+  class TextEncoderStream {
+    constructor() {
+      const encoder = new TextEncoder();
+      let pending = "";
+      const transform = new TransformStream({
+        transform(chunk, controller) {
+          let text = pending + String(chunk);
+          pending = "";
+          const last = text.charCodeAt(text.length - 1);
+          if (last >= 0xd800 && last <= 0xdbff) {
+            pending = text.slice(-1);
+            text = text.slice(0, -1);
+          }
+          if (text.length > 0) controller.enqueue(encoder.encode(text));
+        },
+        flush(controller) {
+          if (pending.length > 0) controller.enqueue(encoder.encode(pending));
+        },
+      });
+      this.readable = transform.readable;
+      this.writable = transform.writable;
+    }
+    get encoding() {
+      return "utf-8";
+    }
+  }
+  class TextDecoderStream {
+    constructor(label = "utf-8", options = undefined) {
+      const decoder = new TextDecoder(label, options);
+      this.encoding = decoder.encoding;
+      this.fatal = decoder.fatal;
+      this.ignoreBOM = decoder.ignoreBOM;
+      const transform = new TransformStream({
+        transform(chunk, controller) {
+          const text = decoder.decode(chunk, { stream: true });
+          if (text.length > 0) controller.enqueue(text);
+        },
+        flush(controller) {
+          const text = decoder.decode();
+          if (text.length > 0) controller.enqueue(text);
+        },
+      });
+      this.readable = transform.readable;
+      this.writable = transform.writable;
+    }
+  }
+  globalThis.TextEncoderStream = TextEncoderStream;
+  globalThis.TextDecoderStream = TextDecoderStream;
+}
+
+// structuredClone: the HTML structured-clone algorithm for the types Worker code
+// passes around. Keeps cycles and shared references (a memo per call), Date, RegExp,
+// Map, Set, ArrayBuffer, typed arrays, DataView, errors, arrays and plain objects;
+// functions and symbols throw DataCloneError. It replaced a JSON round-trip that lost
+// every non-JSON type and crashed on cycles (W2 conformance).
 if (globalThis.structuredClone == null) {
-  // The suggested fix (use structuredClone) is circular — this IS the polyfill,
-  // and Porffor exposes no other deep-clone primitive.
-  // react-doctor-disable-next-line react-doctor/no-json-parse-stringify-clone
+  const dataCloneError = (what) => {
+    const e = new Error(what + " could not be cloned");
+    e.name = "DataCloneError";
+    return e;
+  };
+  const errorTypes = { Error, EvalError, RangeError, ReferenceError, SyntaxError, TypeError, URIError };
+  const clone = (value, memo) => {
+    const type = typeof value;
+    if (type === "function") throw dataCloneError("function");
+    if (type === "symbol") throw dataCloneError("Symbol");
+    if (value === null || type !== "object") return value;
+    if (memo.has(value)) return memo.get(value);
+    let out;
+    if (value instanceof Date) out = new Date(value.getTime());
+    else if (value instanceof RegExp) out = new RegExp(value.source, value.flags);
+    else if (value instanceof ArrayBuffer) out = value.slice(0);
+    else if (ArrayBuffer.isView(value)) {
+      const buffer = clone(value.buffer, memo);
+      out = value instanceof DataView ? new DataView(buffer, value.byteOffset, value.byteLength) : new value.constructor(buffer, value.byteOffset, value.length);
+    } else if (value instanceof Map) {
+      out = new Map();
+      memo.set(value, out);
+      for (const [k, v] of value) out.set(clone(k, memo), clone(v, memo));
+      return out;
+    } else if (value instanceof Set) {
+      out = new Set();
+      memo.set(value, out);
+      for (const v of value) out.add(clone(v, memo));
+      return out;
+    } else if (value instanceof Error) {
+      const Ctor = errorTypes[value.name] || Error;
+      out = new Ctor(value.message);
+    } else if (Array.isArray(value)) {
+      out = new Array(value.length);
+      memo.set(value, out);
+      for (const k of Object.keys(value)) out[k] = clone(value[k], memo);
+      return out;
+    } else {
+      out = {};
+      memo.set(value, out);
+      for (const k of Object.keys(value)) out[k] = clone(value[k], memo);
+      return out;
+    }
+    memo.set(value, out);
+    return out;
+  };
   globalThis.structuredClone = function (value) {
-    return JSON.parse(JSON.stringify(value));
+    return clone(value, new Map());
   };
 }
 
+/* oxlint-enable anti-slop/no-runtime-typeof */
+
 if (globalThis.crypto.randomUUID == null) {
   globalThis.crypto.randomUUID = function () {
     const b = new Uint8Array(16);
@@ -2827,6 +3175,8 @@ if (globalThis.crypto.randomUUID == null) {
 // dependency, so it works on the broker transport too.
 function __sbHashBits(algo) {
   const n = String((algo && algo.name) || algo || "").toUpperCase();
+  if (n === "SHA-1" || n === "SHA1") return "1";
+  if (n === "MD5") return "5";
   if (n === "SHA-256" || n === "SHA256") return "256";
   if (n === "SHA-384" || n === "SHA384") return "384";
   if (n === "SHA-512" || n === "SHA512") return "512";
@@ -3053,42 +3403,77 @@ function __sbHexOrBytes(value) {
   return __sbToBytes(value);
 }
 
+// Errors as WebCrypto names them (DOMException names; plain Errors here).
+function __sbCryptoError(name, message) {
+  const e = new Error(message);
+  e.name = name;
+  return e;
+}
+// An HMAC key as importKey and generateKey return it. MD5 is digest-only, as in workerd.
+function __sbHmacKey(bytes, bits, extractable, usages) {
+  const hash = bits === "1" ? "SHA-1" : "SHA-" + bits;
+  return {
+    type: "secret",
+    extractable: !!extractable,
+    algorithm: { name: "HMAC", hash: { name: hash }, length: bytes.length * 8 },
+    usages: usages || [],
+    __sbKey: bytes,
+    __sbBits: bits,
+  };
+}
+function __sbHmacBits(algo) {
+  const bits = __sbHashBits((algo && algo.hash) || "SHA-256");
+  if (!bits || bits === "5") throw __sbCryptoError("NotSupportedError", "HMAC needs SHA-1, SHA-256, SHA-384 or SHA-512");
+  return bits;
+}
 if (globalThis.crypto.subtle == null) {
   globalThis.crypto.subtle = {
     async digest(algo, data) {
       const bits = __sbHashBits(algo);
-      if (!bits) throw new Error("crypto.subtle.digest: unsupported algorithm");
+      if (!bits) throw __sbCryptoError("NotSupportedError", "crypto.subtle.digest: unsupported algorithm");
       const out = __sbDigestRaw(bits, __sbToBytes(data));
       if (!out) throw new Error("crypto.subtle.digest failed");
       return __sbBufFrom(out);
     },
     async importKey(format, keyData, algo, extractable, usages) {
-      if (format !== "raw") throw new Error("crypto.subtle.importKey: only format 'raw' is supported");
+      if (format !== "raw") throw __sbCryptoError("NotSupportedError", "crypto.subtle.importKey: only format 'raw' is supported");
       const name = String((algo && algo.name) || algo || "").toUpperCase();
-      if (name !== "HMAC") throw new Error("crypto.subtle.importKey: only HMAC keys are supported");
-      const bits = __sbHashBits((algo && algo.hash) || "SHA-256");
-      if (!bits) throw new Error("crypto.subtle.importKey: unsupported hash");
-      return {
-        type: "secret",
-        extractable: !!extractable,
-        algorithm: { name: "HMAC", hash: { name: "SHA-" + bits } },
-        usages: usages || [],
-        __sbKey: __sbToBytes(keyData),
-        __sbBits: bits,
-      };
+      if (name !== "HMAC") throw __sbCryptoError("NotSupportedError", "crypto.subtle.importKey: only HMAC keys are supported");
+      return __sbHmacKey(__sbToBytes(keyData), __sbHmacBits(algo), extractable, usages);
+    },
+    async exportKey(format, key) {
+      if (!key || key.__sbKey == null) throw new TypeError("crypto.subtle.exportKey: not a key from this runtime");
+      if (format !== "raw") throw __sbCryptoError("NotSupportedError", "crypto.subtle.exportKey: only format 'raw' is supported");
+      if (!key.extractable) throw __sbCryptoError("InvalidAccessError", "crypto.subtle.exportKey: the key is not extractable");
+      return __sbBufFrom(key.__sbKey);
+    },
+    async generateKey(algo, extractable, usages) {
+      const name = String((algo && algo.name) || algo || "").toUpperCase();
+      if (name !== "HMAC") throw __sbCryptoError("NotSupportedError", "crypto.subtle.generateKey: only HMAC keys are supported");
+      const bits = __sbHmacBits(algo);
+      // The default length is the hash's block size: 512 bits, or 1024 for SHA-384/512.
+      const length = (algo && algo.length) || (bits === "384" || bits === "512" ? 1024 : 512);
+      const bytes = __sbRandomBytes(String(Math.ceil(length / 8)));
+      return __sbHmacKey(bytes, bits, extractable, usages);
     },
     async sign(algo, key, data) {
-      if (!key || key.__sbKey == null) throw new Error("crypto.subtle.sign: only HMAC keys from importKey are supported");
+      if (!key || key.__sbKey == null) throw __sbCryptoError("InvalidAccessError", "crypto.subtle.sign: only HMAC keys are supported");
       const out = __sbHmacRaw(key.__sbBits, key.__sbKey, __sbToBytes(data));
       if (!out) throw new Error("crypto.subtle.sign failed");
       return __sbBufFrom(out);
     },
     async verify(algo, key, signature, data) {
-      if (!key || key.__sbKey == null) throw new Error("crypto.subtle.verify: only HMAC keys are supported");
+      if (!key || key.__sbKey == null) throw __sbCryptoError("InvalidAccessError", "crypto.subtle.verify: only HMAC keys are supported");
       const mac = __sbHmacRaw(key.__sbBits, key.__sbKey, __sbToBytes(data));
       if (!mac) return false;
       return __sbEqCt(mac, __sbToBytes(signature));
     },
+    // workerd's extension: constant-time comparison of two equal-length buffers.
+    timingSafeEqual(a, b) {
+      const x = __sbToBytes(a), y = __sbToBytes(b);
+      if (x.length !== y.length) throw new TypeError("crypto.subtle.timingSafeEqual: the buffers differ in length");
+      return __sbEqCt(x, y);
+    },
   };
 }
 
@@ -3291,9 +3676,82 @@ static void sb_sha512_final(sb_sha512_ctx* c, unsigned char* out, int is384) {
     for (int j = 0; j < 8; j++) out[i*8+j] = (unsigned char)(c->h[i] >> (56 - j*8));
 }
 
-// One-shot digest. algo: 256 | 384 | 512. out must hold 32/48/64 bytes.
+// SHA-1 and MD5 (W2: workerd's digest has both; HMAC also takes SHA-1). One-shot over a
+// padded copy: inputs are request-sized, not streams.
+static uint32_t sb_rol32(uint32_t x, int n) { return (x << n) | (x >> (32 - n)); }
+static unsigned char* sb_md_pad(const unsigned char* msg, size_t len, size_t* total, int big_endian) {
+  *total = ((len + 8) / 64 + 1) * 64;
+  unsigned char* m = (unsigned char*)calloc(*total, 1);
+  if (!m) return 0;
+  memcpy(m, msg, len); m[len] = 0x80;
+  uint64_t bits = (uint64_t)len * 8;
+  for (int i = 0; i < 8; i++) m[big_endian ? *total - 1 - i : *total - 8 + i] = (unsigned char)(bits >> (8 * i));
+  return m;
+}
+static size_t sb_sha1(const unsigned char* msg, size_t len, unsigned char out[20]) {
+  size_t total; unsigned char* m = sb_md_pad(msg, len, &total, 1);
+  if (!m) return 0;
+  uint32_t h[5] = { 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0 };
+  for (size_t off = 0; off < total; off += 64) {
+    uint32_t w[80];
+    for (int i = 0; i < 16; i++) w[i] = ((uint32_t)m[off + 4*i] << 24) | ((uint32_t)m[off + 4*i + 1] << 16) | ((uint32_t)m[off + 4*i + 2] << 8) | m[off + 4*i + 3];
+    for (int i = 16; i < 80; i++) w[i] = sb_rol32(w[i-3] ^ w[i-8] ^ w[i-14] ^ w[i-16], 1);
+    uint32_t a = h[0], b = h[1], c = h[2], d = h[3], e = h[4];
+    for (int i = 0; i < 80; i++) {
+      uint32_t f, k;
+      if (i < 20) { f = (b & c) | (~b & d); k = 0x5A827999; }
+      else if (i < 40) { f = b ^ c ^ d; k = 0x6ED9EBA1; }
+      else if (i < 60) { f = (b & c) | (b & d) | (c & d); k = 0x8F1BBCDC; }
+      else { f = b ^ c ^ d; k = 0xCA62C1D6; }
+      uint32_t t = sb_rol32(a, 5) + f + e + k + w[i];
+      e = d; d = c; c = sb_rol32(b, 30); b = a; a = t;
+    }
+    h[0] += a; h[1] += b; h[2] += c; h[3] += d; h[4] += e;
+  }
+  free(m);
+  for (int i = 0; i < 5; i++) { out[4*i] = h[i] >> 24; out[4*i+1] = h[i] >> 16; out[4*i+2] = h[i] >> 8; out[4*i+3] = h[i]; }
+  return 20;
+}
+static size_t sb_md5(const unsigned char* msg, size_t len, unsigned char out[16]) {
+  static const uint32_t K[64] = {
+    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
+    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
+    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
+    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
+    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
+    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
+    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
+    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391 };
+  static const int S[16] = { 7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21 };
+  size_t total; unsigned char* m = sb_md_pad(msg, len, &total, 0);
+  if (!m) return 0;
+  uint32_t h[4] = { 0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476 };
+  for (size_t off = 0; off < total; off += 64) {
+    uint32_t w[16];
+    for (int i = 0; i < 16; i++) w[i] = (uint32_t)m[off + 4*i] | ((uint32_t)m[off + 4*i + 1] << 8) | ((uint32_t)m[off + 4*i + 2] << 16) | ((uint32_t)m[off + 4*i + 3] << 24);
+    uint32_t a = h[0], b = h[1], c = h[2], d = h[3];
+    for (int i = 0; i < 64; i++) {
+      uint32_t f; int g;
+      if (i < 16) { f = (b & c) | (~b & d); g = i; }
+      else if (i < 32) { f = (d & b) | (~d & c); g = (5*i + 1) % 16; }
+      else if (i < 48) { f = b ^ c ^ d; g = (3*i + 5) % 16; }
+      else { f = c ^ (b | ~d); g = (7*i) % 16; }
+      f = f + a + K[i] + w[g];
+      a = d; d = c; c = b;
+      b = b + sb_rol32(f, S[(i / 16) * 4 + i % 4]);
+    }
+    h[0] += a; h[1] += b; h[2] += c; h[3] += d;
+  }
+  free(m);
+  for (int i = 0; i < 4; i++) { out[4*i] = h[i]; out[4*i+1] = h[i] >> 8; out[4*i+2] = h[i] >> 16; out[4*i+3] = h[i] >> 24; }
+  return 16;
+}
+
+// One-shot digest. algo: 1 (SHA-1) | 5 (MD5) | 256 | 384 | 512. out must hold up to 64 bytes.
 // Returns the digest length, or 0 for an unknown algo.
 static size_t sb_digest(int algo, const unsigned char* msg, size_t mlen, unsigned char* out) {
+  if (algo == 1) return sb_sha1(msg, mlen, out);
+  if (algo == 5) return sb_md5(msg, mlen, out);
   if (algo == 256) { sb_sha256_ctx c; sb_sha256_init(&c); sb_sha256_update(&c, msg, mlen); sb_sha256_final(&c, out); return 32; }
   if (algo == 384) { sb_sha512_ctx c; sb_sha512_init(&c, 1); sb_sha512_update(&c, msg, mlen); sb_sha512_final(&c, out, 1); return 48; }
   if (algo == 512) { sb_sha512_ctx c; sb_sha512_init(&c, 0); sb_sha512_update(&c, msg, mlen); sb_sha512_final(&c, out, 0); return 64; }
@@ -3303,6 +3761,20 @@ static size_t sb_digest(int algo, const unsigned char* msg, size_t mlen, unsigne
 // HMAC(algo) per RFC 2104. Block size is 64 for SHA-256, 128 for SHA-384/512.
 static size_t sb_hmac(int algo, const unsigned char* key, size_t klen,
                       const unsigned char* msg, size_t mlen, unsigned char* out) {
+  if (algo == 1) {
+    // HMAC-SHA-1: block 64, over padded copies like the one-shot digest.
+    unsigned char k1[64], inner1[20];
+    memset(k1, 0, sizeof(k1));
+    if (klen > 64) sb_sha1(key, klen, k1); else memcpy(k1, key, klen);
+    unsigned char* buf = (unsigned char*)malloc(64 + (mlen > 20 ? mlen : 20));
+    if (!buf) return 0;
+    for (int i = 0; i < 64; i++) buf[i] = k1[i] ^ 0x36;
+    memcpy(buf + 64, msg, mlen); sb_sha1(buf, 64 + mlen, inner1);
+    for (int i = 0; i < 64; i++) buf[i] = k1[i] ^ 0x5c;
+    memcpy(buf + 64, inner1, 20); sb_sha1(buf, 84, out);
+    free(buf);
+    return 20;
+  }
   size_t bs = algo == 256 ? 64 : 128;
   unsigned char k[128], ipad[128], opad[128], inner[64];
   memset(k, 0, sizeof(k));
@@ -3712,6 +4184,64 @@ function __sbR2Multipart(bucket, key, uploadId) {
   };
 }
 
+// Asset rules use the same parsed manifest in both transports. Matching mirrors
+// @sproutboat/assets; parity tests cover the portable native implementation.
+function __sbAssetRedirect(rule, path) {
+  const star = rule.from.indexOf("*");
+  if (star !== -1) {
+    const prefix = rule.from.slice(0, star);
+    if (!path.startsWith(prefix)) return null;
+    return rule.to.split(":splat").join(path.slice(prefix.length));
+  }
+  const from = rule.from.split("/").filter(Boolean);
+  const parts = path.split("/").filter(Boolean);
+  if (from.length !== parts.length) return null;
+  const params = {};
+  for (let i = 0; i < from.length; i++) {
+    if (from[i].startsWith(":")) params[from[i].slice(1)] = parts[i];
+    else if (from[i] !== parts[i]) return null;
+  }
+  let to = rule.to;
+  for (const name in params) to = to.split(":" + name).join(params[name]);
+  return to;
+}
+
+function __sbAssetHeaderMatches(pattern, path) {
+  const from = pattern.split("/").filter(Boolean);
+  const parts = path.split("/").filter(Boolean);
+  for (let i = 0; i < from.length; i++) {
+    if (from[i] === "*") return true;
+    if (from[i] !== parts[i]) return false;
+  }
+  return from.length === parts.length;
+}
+
+function __sbAssetResponse(path, r) {
+  if (r.location != null) return new Response(null, { status: r.status, headers: { location: r.location } });
+  const rules = r.rules || {};
+  const redirects = rules.redirects || [];
+  for (let i = 0; i < redirects.length; i++) {
+    const to = __sbAssetRedirect(redirects[i], path);
+    if (to !== null) return new Response(null, { status: redirects[i].status, headers: { location: to } });
+  }
+  const headers = new Headers();
+  if (r.type) headers.set("content-type", r.type);
+  if (r.found) headers.set("etag", '"' + r.hash + '"');
+  // A custom 404 page is also an asset; a generated Not Found is not.
+  if (r.type) {
+    const list = rules.headers || [];
+    for (let i = 0; i < list.length; i++) {
+      const rule = list[i];
+      if (!__sbAssetHeaderMatches(rule.pattern, path)) continue;
+      for (let j = 0; j < rule.unset.length; j++) headers.delete(rule.unset[j]);
+      for (let j = 0; j < rule.set.length; j++) headers.set(rule.set[j][0], rule.set[j][1]);
+    }
+  }
+  // Apply the internal byte marker after user rules so they cannot remove it.
+  if (r.body != null) headers.set("x-sb-raw-body", "1");
+  return __sbRawBodyResponse(r.body, { status: r.status || (r.found ? 200 : 404), headers });
+}
+
 // Installed only when the project declares bindings. `env` is the module-scoped
 // object from compile.ts (a `const`, but mutable); we add the binding accessors
 // to it in place. compile.ts emits `__sbInstallBindings(env, {...})` right after
@@ -3935,16 +4465,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         } catch {
           /* use as-is */
         }
-        const r = globalThis.__sbAssetsGet(path);
-        const headers = {};
-        if (r.type) headers["content-type"] = r.type;
-        if (r.found) headers["etag"] = '"' + r.hash + '"';
-        // #176: these bytes came off disk already-finished (UTF-8 text or
-        // binary, doesn't matter which) -- the reserved x-sb-raw-body header
-        // tells the C write path to pass them through untouched instead of
-        // re-encoding as if this were a JS string a handler built.
-        if (r.body != null) headers["x-sb-raw-body"] = "1";
-        return __sbRawBodyResponse(r.body, { status: r.status || (r.found ? 200 : 404), headers });
+        return __sbAssetResponse(path, globalThis.__sbAssetsGet(path));
       },
     };
   }
@@ -3989,26 +4510,48 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 // prelude must not replace fetch just by being evaluated.
 globalThis.__sbInstallFetch = function () {
   globalThis.fetch = function (input, init) {
-    const url = __sbIsStr(input) ? input : String(input.url);
+    // A Request's method, headers and body apply unless init overrides them; a URL
+    // object stands for its href.
+    const req = input != null && !__sbIsStr(input) && input.url != null ? input : null;
+    const url = req ? String(req.url) : input != null && input.href != null ? String(input.href) : String(input);
     const opts = init || {};
+    const source = opts.headers != null ? opts.headers : req ? req.headers : null;
     const headers = [];
-    if (opts.headers) {
-      if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
-      else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
-    }
-    const r = globalThis.__sbFetchUpstream("fetch", {
-      url,
-      method: opts.method || "GET",
-      headers,
-      ...__sbRequestBody(opts.body),
+    if (source) {
+      if (__sbIsFn(source.forEach)) source.forEach((v, k) => headers.push([k, v]));
+      else for (const k in source) headers.push([k, source[k]]);
+    }
+    const body = opts.body !== undefined ? opts.body : req && req.body !== "" ? req.body : null;
+    const method = opts.method || (req && req.method) || "GET";
+    const msg = { url, method, headers, ...__sbRequestBody(body) };
+    const respond = (r) => {
+      const respHeaders = new Headers();
+      for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
+      // #176: bytes from an outbound HTTP response, not a string this handler
+      // built -- must not be re-encoded if the handler proxies it straight
+      // through (see the assets binding for the same reasoning).
+      if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
+      return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
+    };
+    if (!__sbHttpAsyncEnabled()) return respond(globalThis.__sbFetchUpstream("fetch", msg));
+    // B18: the host runs the request off the event loop. Its reply fires a timer
+    // that never fires on its own; the timer table keeps the callback alive.
+    return new Promise((resolve, reject) => {
+      const id = setTimeout(() => {
+        try {
+          resolve(respond(__sbFetchReply(__sbHttpAsyncResult(id))));
+        } catch (e) {
+          reject(new Error("sproutboat fetch: " + ((e && e.message) || e)));
+        }
+      }, 2147483647);
+      try {
+        msg.asyncId = id;
+        globalThis.__sbFetchUpstream("fetch", msg);
+      } catch (e) {
+        clearTimeout(id);
+        reject(e);
+      }
     });
-    const respHeaders = new Headers();
-    for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
-    // #176: bytes from an outbound HTTP response, not a string this handler
-    // built -- must not be re-encoded if the handler proxies it straight
-    // through (see the assets binding for the same reasoning).
-    if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
-    return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
   };
 };
 
@@ -4067,7 +4610,7 @@ function __sbMakeDONamespace(binding, className) {
           }
           const inst = __sbGetDOInstance(className, idStr);
           const res = inst.fetch(req);
-          if (inst.__sbTasks.length || (res && __sbIsFn(res.then))) return __sbFetchWithDrain(res, inst.__sbTasks);
+          if (inst.__sbTasks.length || (res && __sbIsFn(res.then)) || __sbHasStreamBody(res)) return __sbFetchWithDrain(res, inst.__sbTasks);
           return res;
         },
       };
@@ -4350,14 +4893,17 @@ function __sbTrustedProxyHeader(request, name) {
 // own.
 const __SB_WAITUNTIL_TIMEOUT_MS = 25000;
 
-function __sbTimeout(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 async function __sbDrainWaitUntil(tasks) {
   if (!tasks.length) return;
   const pending = tasks.splice(0, tasks.length);
-  await Promise.race([__sbDrainAll(pending), __sbTimeout(__SB_WAITUNTIL_TIMEOUT_MS)]);
+  // Clear the cap's timer once the tasks finish: a pending timer kept the process
+  // busy for the full 25 s (sproutd will not reap a worker with timers left, B22).
+  let timer;
+  const cap = new Promise((resolve) => {
+    timer = setTimeout(resolve, __SB_WAITUNTIL_TIMEOUT_MS);
+  });
+  await Promise.race([__sbDrainAll(pending), cap]);
+  clearTimeout(timer);
 }
 
 async function __sbDrainAll(pending) {
@@ -4373,15 +4919,130 @@ async function __sbDrainAll(pending) {
 // Tail-called from `__sbEntry`/DO dispatch so the promise this returns is the
 // one *this* async function creates, not a `.then()` derived from someone
 // else's — see the note below on why that distinction matters here.
+// B19 (first step): a ReadableStream response body is read to the end and sent buffered;
+// the native writer had sent "[object ReadableStream]". Chunks must be bytes, as in workerd
+// (a string chunk is a TypeError), and the whole body is capped like a fetched one.
+const __SB_STREAM_BODY_MAX = 32 * 1024 * 1024;
+async function __sbCollectBody(stream) {
+  const reader = stream.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    let bytes;
+    if (value instanceof Uint8Array) bytes = value;
+    else if (value instanceof ArrayBuffer) bytes = new Uint8Array(value);
+    else if (ArrayBuffer.isView(value)) bytes = new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    else throw new TypeError("This ReadableStream did not return bytes.");
+    size += bytes.length;
+    if (size > __SB_STREAM_BODY_MAX) throw new RangeError("Response body stream exceeds 32 MiB");
+    chunks.push(bytes);
+  }
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, at);
+    at += chunk.length;
+  }
+  return out;
+}
+function __sbHasStreamBody(res) {
+  return res != null && res.body instanceof ReadableStream;
+}
+
+// B19: on a host that streams (a standalone sprout's native server defines sb_stream_*), a
+// stream body goes out as it is produced: the response is marked with the internal
+// x-sb-stream header, the native writer sends the status and headers and holds the
+// connection open, and each chunk is written as it arrives. Hosts that do not stream
+// (sproutd's workers, for now) link the weak fallbacks, report unsupported and keep buffering.
+// op: "s" supported, "o" open, "w" write data, "e" end. Returns a short string.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block, not by JS.
+function __sbStreamOp(op, id, data) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    extern int sb_stream_supported(void);
+    extern unsigned int sb_stream_open(void);
+    extern int sb_stream_write(unsigned int, const char*, size_t);
+    extern void sb_stream_end(unsigned int);
+    const char* __o; size_t __ol; char* __oo = 0;
+    porf_native_fetch_read_value(op, &__o, &__ol, &__oo);
+    char __op = __ol ? __o[0] : 0;
+    if (__oo) free(__oo);
+    const char* __i; size_t __il; char* __io = 0;
+    porf_native_fetch_read_value(id, &__i, &__il, &__io);
+    char __ib[16]; size_t __ik = __il < 15 ? __il : 15;
+    memcpy(__ib, __i, __ik); __ib[__ik] = 0;
+    if (__io) free(__io);
+    unsigned int __id = (unsigned int)strtoul(__ib, 0, 10);
+    char __r[24]; __r[0] = 0;
+    if (sb_stream_supported()) {
+      if (__op == 's') snprintf(__r, sizeof(__r), "1");
+      else if (__op == 'o') snprintf(__r, sizeof(__r), "%u", sb_stream_open());
+      else if (__op == 'w') {
+        const char* __d = 0; size_t __dl = 0;
+        int __w = -1;
+        if (porf_native_fetch_read_raw_bytes(data, &__d, &__dl) == 0) __w = sb_stream_write(__id, __d, __dl);
+        snprintf(__r, sizeof(__r), "%d", __w);
+      } else if (__op == 'e') { sb_stream_end(__id); snprintf(__r, sizeof(__r), "0"); }
+    }
+    out = porf_box((f64)porf_native_fetch_alloc_bytestring(__r, strlen(__r)), 195);
+  `;
+  return out;
+}
+let __sbStreaming = -1;
+function __sbStreamingSupported() {
+  if (__sbStreaming < 0) __sbStreaming = __sbStreamOp("s", "0", "") === "1" ? 1 : 0;
+  return __sbStreaming === 1;
+}
+function __sbStreamResponse(response) {
+  const stream = response.body;
+  const id = __sbStreamOp("o", "0", "");
+  response.headers.set("x-sb-stream", id);
+  response.body = "";
+  (async () => {
+    const reader = stream.getReader();
+    try {
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        let bytes;
+        if (value instanceof Uint8Array) bytes = value;
+        else if (value instanceof ArrayBuffer) bytes = new Uint8Array(value);
+        else if (ArrayBuffer.isView(value)) bytes = new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+        else throw new TypeError("This ReadableStream did not return bytes.");
+        if (bytes.length > 0 && __sbStreamOp("w", id, __sbToBytes(bytes)) !== "0") {
+          // The client went away: stop the source.
+          reader.cancel();
+          break;
+        }
+      }
+    } catch (error) {
+      // The status line is already out; log and end what was sent.
+      __sbLogUncaught("fetch", error);
+    }
+    __sbStreamOp("e", id, "");
+  })();
+  return response;
+}
+
 async function __sbFetchWithDrain(res, tasks) {
   let r;
   try {
     r = res && __sbIsFn(res.then) ? await res : res;
+    if (__sbHasStreamBody(r)) {
+      if (__sbStreamingSupported()) __sbStreamResponse(r);
+      else r.body = await __sbCollectBody(r.body);
+    }
   } catch (error) {
     // #179 — a rejected handler promise must not take the process down with it.
     r = __sbErrorResponse(error);
   }
-  await __sbDrainWaitUntil(tasks);
+  // The response goes out now and ctx.waitUntil work keeps running after it, as in
+  // workerd; it was awaited first, so a 1.5 s background task delayed the response by
+  // 1.5 s. The 25 s cap still bounds it.
+  __sbDrainWaitUntil(tasks);
   return r;
 }
 
@@ -4391,7 +5052,10 @@ async function __sbFetchWithDrain(res, tasks) {
 // nothing on stderr, which hid #168 entirely.
 function __sbErrorResponse(error) {
   __sbLogUncaught("fetch", error);
-  return new Response("Internal Server Error", { status: 500 });
+  // Untyped, as workerd sends it: the text/plain default is for handlers' bodies.
+  const response = new Response("Internal Server Error", { status: 500 });
+  response.headers.delete("content-type");
+  return response;
 }
 
 function __sbLogUncaught(where, error) {
@@ -4416,7 +5080,7 @@ async function __sb204WithDrain(res, tasks) {
     __sbLogUncaught("scheduled/alarm", error);
   }
   await __sbDrainWaitUntil(tasks);
-  return new Response("", { status: 204 });
+  return new Response(null, { status: 204 });
 }
 
 async function __sbQueueWithDrain(result, tasks) {
@@ -4489,7 +5153,7 @@ globalThis.__sbEntry = function (handlers, request) {
     }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
-    if (__sbTasks.length || (__res && __sbIsFn(__res.then))) return __sbFetchWithDrain(__res, __sbTasks);
+    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks);
     return __sbTagCpu(__res, __t0);
   }
   if (!__sbTriggerAuthed(request)) return new Response("forbidden", { status: 403 });
@@ -4515,10 +5179,10 @@ globalThis.__sbEntry = function (handlers, request) {
     } catch (error) {
       // #179 — same rule as fetch: don't let a throw here crash the process.
       __sbLogUncaught("scheduled", error);
-      return new Response("", { status: 204 });
+      return new Response(null, { status: 204 });
     }
     if (__sbTasks.length || (__sres && __sbIsFn(__sres.then))) return __sb204WithDrain(__sres, __sbTasks);
-    return new Response("", { status: 204 });
+    return new Response(null, { status: 204 });
   }
 
   if (trigger === "queue") {
@@ -4550,12 +5214,12 @@ globalThis.__sbEntry = function (handlers, request) {
     } catch (error) {
       // #179 — same rule as fetch: don't let a throw here crash the process.
       __sbLogUncaught("alarm", error);
-      return new Response("", { status: 204 });
+      return new Response(null, { status: 204 });
     }
     // Was fire-and-forget before: an async `alarm()` and any `state.waitUntil()`
     // it queued were both dropped the moment 204 went out. Await both.
     if (inst.__sbTasks.length || (__ares && __sbIsFn(__ares.then))) return __sb204WithDrain(__ares, inst.__sbTasks);
-    return new Response("", { status: 204 });
+    return new Response(null, { status: 204 });
   }
 
   return new Response("unknown trigger", { status: 400 });