@sproutboat/runtime 0.16.0 → 0.17.1

package/src/transport-embedded.js

@@ -25,6 +25,7 @@ Porffor.c`
 #include <string.h>
 #include <strings.h>
 #include <sys/time.h>
+#include <pthread.h>
 #include <bearssl.h>
 
 // sqlite3 is linked in via SB_EXTRA_LINK (see patch-porffor.ts). Declared here
@@ -1112,8 +1113,65 @@ static int sb_egress_refused(const char* host, const struct sockaddr* sa, char*
 }
 // EGRESS:END
 
+// EGRESS-FD:BEGIN
+// SB_EGRESS_FD=N: a sandboxed host (sproutd) opens outbound connections for the
+// sprout, which may not open sockets itself. Ask on unix socket N with
+// "HOST PORT\n"; the host resolves, applies its policy and answers "ok\n" with the
+// connected socket attached (SCM_RIGHTS), or "no MESSAGE\n", which fetch() reports.
+// One question at a time (a lock, for async requests on several threads); any
+// broken exchange closes N for good, so a late answer can never be taken for the
+// next one.
+static int sb_egress_fd_ask(int via, const char* host, int port, char* refused, size_t refused_len);
+static int sb_egress_fd_connect(int via, const char* host, int port, char* refused, size_t refused_len) {
+  static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
+  pthread_mutex_lock(&lock);
+  int fd = sb_egress_fd_ask(via, host, port, refused, refused_len);
+  pthread_mutex_unlock(&lock);
+  return fd;
+}
+static int sb_egress_fd_ask(int via, const char* host, int port, char* refused, size_t refused_len) {
+  static int broken = 0;
+  if (broken) return -1;
+  char line[512];
+  int n = snprintf(line, sizeof(line), "%s %d\n", host, port);
+  if (n <= 0 || (size_t)n >= sizeof(line)) return -1;
+  struct timeval tv; tv.tv_sec = 60; tv.tv_usec = 0;
+  setsockopt(via, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+  if (send(via, line, (size_t)n, 0) != n) { broken = 1; close(via); return -1; }
+  char answer[512];
+  union { struct cmsghdr align; char space[CMSG_SPACE(sizeof(int))]; } control;
+  struct iovec io = { answer, sizeof(answer) - 1 };
+  struct msghdr msg;
+  memset(&msg, 0, sizeof(msg));
+  msg.msg_iov = &io; msg.msg_iovlen = 1;
+  msg.msg_control = control.space; msg.msg_controllen = sizeof(control.space);
+  ssize_t got;
+  do { got = recvmsg(via, &msg, 0); } while (got < 0 && errno == EINTR);
+  int fd = -1;
+  struct cmsghdr* c = got > 0 ? CMSG_FIRSTHDR(&msg) : 0;
+  if (c && c->cmsg_level == SOL_SOCKET && c->cmsg_type == SCM_RIGHTS && c->cmsg_len == CMSG_LEN(sizeof(int)))
+    memcpy(&fd, CMSG_DATA(c), sizeof(fd));
+  if (got <= 0 || answer[got - 1] != '\n' || (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
+    if (fd >= 0) close(fd);
+    broken = 1; close(via);
+    return -1;
+  }
+  answer[got - 1] = 0;
+  if (!strcmp(answer, "ok") && fd >= 0) {
+    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+    return fd;
+  }
+  if (fd >= 0) close(fd);
+  if (!strncmp(answer, "no ", 3) && !refused[0]) snprintf(refused, refused_len, "%s", answer + 3);
+  return -1;
+}
+// EGRESS-FD:END
+
 // refused gets the first refusal; a caller reports it when nothing connected.
 static int sb_tcp_connect(const char* host, int port, char* refused, size_t refused_len) {
+  const char* via = getenv("SB_EGRESS_FD");
+  if (via && *via) return sb_egress_fd_connect(atoi(via), host, port, refused, refused_len);
   struct addrinfo hints, *res = 0, *it;
   memset(&hints, 0, sizeof(hints));
   hints.ai_family = AF_UNSPEC;
@@ -1151,10 +1209,13 @@ static int sb_tcp_connect(const char* host, int port, char* refused, size_t refu
 }
 
 // body_len, not strlen(body): a binary body can contain NUL bytes (#232).
-static void sb_build_request(sb_buf* req, const char* host, const char* path, const char* method,
+// Host carries the port unless it is the scheme's default (RFC 9110 7.2).
+static void sb_build_request(sb_buf* req, const char* host, int port, int default_port, const char* path, const char* method,
                              const char* headers, const char* body, size_t body_len) {
   sb_puts(req, method); sb_puts(req, " "); sb_puts(req, path); sb_puts(req, " HTTP/1.1\r\n");
-  sb_puts(req, "Host: "); sb_puts(req, host); sb_puts(req, "\r\n");
+  sb_puts(req, "Host: "); sb_puts(req, host);
+  if (port != default_port) { char p[16]; snprintf(p, sizeof(p), ":%d", port); sb_puts(req, p); }
+  sb_puts(req, "\r\n");
   sb_puts(req, "Connection: close\r\n");
   sb_puts(req, "Accept-Encoding: identity\r\n");
   if (headers && *headers) sb_puts(req, headers);
@@ -1268,7 +1329,7 @@ static char* sb_http_plain(const char* host, int port, const char* path, const c
   if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
   sb_buf req = { 0, 0, 0 };
-  sb_build_request(&req, host, path, method, headers, body, body_len);
+  sb_build_request(&req, host, port, 80, path, method, headers, body, body_len);
   size_t sent = 0;
   while (sent < req.len) {
     long n = write(fd, req.p + sent, req.len - sent);
@@ -1473,7 +1534,7 @@ static char* sb_https(const char* host, int port, const char* path, const char*
   br_sslio_init(&ioc, &sc->eng, sb_sock_read, &fd, sb_sock_write, &fd);
 
   sb_buf req = { 0, 0, 0 };
-  sb_build_request(&req, host, path, method, headers, body, body_len);
+  sb_build_request(&req, host, port, 443, path, method, headers, body, body_len);
   int wrote = br_sslio_write_all(&ioc, req.p, req.len);
   free(req.p);
   if (wrote != 0) {
@@ -1527,6 +1588,129 @@ static char* sb_http_request(const char* host, int port, const char* path, const
   return tls ? sb_https(host, port, path, method, headers, body, body_len)
              : sb_http_plain(host, port, path, method, headers, body, body_len);
 }
+
+// ASYNC:BEGIN
+// Async outbound HTTP for a host with an event loop (sproutd, B18). The host calls
+// sb_async_enable() and watches the fd it returns. fetch() then queues each request
+// for a small pool of threads that run the blocking client above, and returns at
+// once. A finished request is queued and signalled on the fd; the host calls
+// sb_async_drain(), which fires the JS callback registered under the request's
+// timer id. Threads touch only their own malloc'd job, never the JS heap. Without
+// sb_async_enable() (standalone sprouts) nothing here runs.
+void porf_native_fetch_fire_timer(u32 id);
+void porf_native_fetch_timer_clear(u32 id);
+typedef struct sb_async_job {
+  struct sb_async_job* next;
+  u32 id;
+  int port, tls;
+  char *host, *path, *method, *headers, *body, *out;
+  size_t body_len;
+} sb_async_job;
+#define SB_ASYNC_THREADS 8
+static pthread_mutex_t sb_async_lock = PTHREAD_MUTEX_INITIALIZER;
+static sb_async_job *sb_async_queue = 0, *sb_async_queue_tail = 0, *sb_async_done = 0, *sb_async_current = 0;
+static int sb_async_pipe[2] = { -1, -1 };
+static int sb_async_threads = 0;
+
+int sb_async_enable(void) {
+  if (sb_async_pipe[0] >= 0) return sb_async_pipe[0];
+  if (pipe(sb_async_pipe) != 0) return -1;
+  for (int i = 0; i < 2; i++) {
+    fcntl(sb_async_pipe[i], F_SETFD, FD_CLOEXEC);
+    fcntl(sb_async_pipe[i], F_SETFL, fcntl(sb_async_pipe[i], F_GETFL) | O_NONBLOCK);
+  }
+  return sb_async_pipe[0];
+}
+int sb_async_enabled(void) { return sb_async_pipe[0] >= 0; }
+static void sb_async_free(sb_async_job* j) {
+  free(j->host); free(j->path); free(j->method); free(j->headers); free(j->body); free(j->out); free(j);
+}
+// Called with sb_async_lock held.
+static void sb_async_finish_locked(sb_async_job* j) {
+  j->next = sb_async_done;
+  sb_async_done = j;
+  char one = 1;
+  while (write(sb_async_pipe[1], &one, 1) < 0 && errno == EINTR) {}
+}
+static void* sb_async_thread(void* unused) {
+  (void)unused;
+  for (;;) {
+    pthread_mutex_lock(&sb_async_lock);
+    sb_async_job* j = sb_async_queue;
+    if (!j) { sb_async_threads--; pthread_mutex_unlock(&sb_async_lock); return 0; }
+    sb_async_queue = j->next;
+    if (!sb_async_queue) sb_async_queue_tail = 0;
+    pthread_mutex_unlock(&sb_async_lock);
+    j->out = sb_http_request(j->host, j->port, j->path, j->method, j->headers, j->body, j->body_len, j->tls);
+    pthread_mutex_lock(&sb_async_lock);
+    sb_async_finish_locked(j);
+    pthread_mutex_unlock(&sb_async_lock);
+  }
+}
+static void sb_async_start(sb_async_job* j) {
+  sb_init_anchors();  // built once, before any thread reads them
+  pthread_mutex_lock(&sb_async_lock);
+  j->next = 0;
+  if (sb_async_queue_tail) sb_async_queue_tail->next = j; else sb_async_queue = j;
+  sb_async_queue_tail = j;
+  int spawn = sb_async_threads < SB_ASYNC_THREADS;
+  if (spawn) sb_async_threads++;
+  pthread_mutex_unlock(&sb_async_lock);
+  if (!spawn) return;
+  pthread_attr_t attr;
+  pthread_attr_init(&attr);
+  pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+  pthread_attr_setstacksize(&attr, 256 * 1024);
+  pthread_t thread;
+  int failed = pthread_create(&thread, &attr, sb_async_thread, 0);
+  pthread_attr_destroy(&attr);
+  if (!failed) return;
+  // No thread (a pids limit): a running thread takes the queue; with none, fail it.
+  pthread_mutex_lock(&sb_async_lock);
+  if (--sb_async_threads == 0) {
+    while (sb_async_queue) {
+      sb_async_job* q = sb_async_queue;
+      sb_async_queue = q->next;
+      q->out = sb_error_json("could not start a request: ", strerror(failed));
+      sb_async_finish_locked(q);
+    }
+    sb_async_queue_tail = 0;
+  }
+  pthread_mutex_unlock(&sb_async_lock);
+}
+// The inline C of __sbHttpRaw and __sbHttpAsyncResult calls these by prototype: Porffor
+// may emit a function's body before this block.
+void sb_async_submit(u32 id, int port, int tls, char* host, char* path, char* method, char* headers,
+                     char* body, size_t body_len) {
+  sb_async_job* j = (sb_async_job*)calloc(1, sizeof(sb_async_job));
+  if (!j) abort();
+  j->id = id; j->port = port; j->tls = tls;
+  j->host = host; j->path = path; j->method = method; j->headers = headers;
+  j->body = body; j->body_len = body_len;
+  sb_async_start(j);
+}
+const char* sb_async_reply(u32 id) {
+  return sb_async_current && sb_async_current->id == id ? sb_async_current->out : 0;
+}
+// Host: the fd became readable. Fires each finished request's callback.
+void sb_async_drain(void) {
+  char buf[64];
+  while (read(sb_async_pipe[0], buf, sizeof(buf)) > 0) {}
+  pthread_mutex_lock(&sb_async_lock);
+  sb_async_job* done = sb_async_done;
+  sb_async_done = 0;
+  pthread_mutex_unlock(&sb_async_lock);
+  while (done) {
+    sb_async_job* j = done;
+    done = j->next;
+    porf_native_fetch_timer_clear(j->id);  // the host's placeholder timer
+    sb_async_current = j;                  // read by __sbHttpAsyncResult in the callback
+    porf_native_fetch_fire_timer(j->id);
+    sb_async_current = 0;
+    sb_async_free(j);
+  }
+}
+// ASYNC:END
 `;
 
 // R2 put: the body is its own parameter, so it never gets escaped.
@@ -1810,8 +1994,10 @@ function __sbD1BackupRaw(src, dest) {
 // Outbound HTTP. String params so C can read each directly; the JS side has
 // already split the URL; the connect refuses private addresses. `tlsFlag` is "1" or "0" —
 // a string like the rest, so the marshalling stays uniform.
+// asyncId > 0 (B18): queue the request under that timer id and return "" at once;
+// its callback reads the reply with __sbHttpAsyncResult.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
-function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag) {
+function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag, asyncId) {
   let res = "";
   // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
   Porffor.c`
@@ -1867,16 +2053,59 @@ function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag) {
     char* __body = (char*)malloc(__bl + 1); memcpy(__body, __b, __bl); __body[__bl] = 0;
     if (__bo) free(__bo);
 
-    char* __out = sb_http_request(__host, atoi(__portbuf), __path, __method, __hdrs, __body, __bl, __tls);
-    free(__host); free(__path); free(__method); free(__hdrs); free(__body);
-    if (__out) {
-      res = porf_box((f64)porf_native_fetch_alloc_bytestring(__out, strlen(__out)), 195);
-      free(__out);
+    const u32 __async = asyncId.type == 1 && asyncId.val > 0 ? (u32)asyncId.val : 0;
+    if (__async) {
+      void sb_async_submit(u32, int, int, char*, char*, char*, char*, char*, size_t);
+      sb_async_submit(__async, atoi(__portbuf), __tls, __host, __path, __method, __hdrs, __body, __bl);
+    } else {
+      char* __out = sb_http_request(__host, atoi(__portbuf), __path, __method, __hdrs, __body, __bl, __tls);
+      free(__host); free(__path); free(__method); free(__hdrs); free(__body);
+      if (__out) {
+        res = porf_box((f64)porf_native_fetch_alloc_bytestring(__out, strlen(__out)), 195);
+        free(__out);
+      }
     }
   `;
   return res;
 }
 
+// The reply of the async request now firing its callback (B18), or "".
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbHttpAsyncResult(asyncId) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* sb_async_reply(u32);
+    const char* __r = asyncId.type == 1 ? sb_async_reply((u32)asyncId.val) : 0;
+    if (__r) res = porf_box((f64)porf_native_fetch_alloc_bytestring(__r, strlen(__r)), 195);
+  `;
+  return res;
+}
+
+// Whether the host runs async requests (sb_async_enable was called).
+function __sbHttpAsyncEnabled() {
+  let res = false;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    int sb_async_enabled(void);
+    if (sb_async_enabled()) res = porf_box(1, 2);
+  `;
+  return res;
+}
+
+// The outbound client's JSON reply -> the fetch op's result.
+function __sbFetchReply(raw) {
+  const reply = JSON.parse(raw);
+  if (reply.ok === false) throw new Error(reply.error);
+  // A TLS peer that closed without close_notify is normal on Connection:
+  // close, and also what a truncation attack looks like. Accept it only when
+  // Content-Length says the body arrived whole.
+  if (reply.unclean && !reply.complete) {
+    throw new Error("connection closed before the response was complete");
+  }
+  return { ok: true, status: reply.status, headers: reply.headers, body: reply.body };
+}
+
 // One statement in, one JSON reply out. `path`, `sql` and `paramsJson` are
 // parameters so the generated C names them directly.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
@@ -1954,7 +2183,8 @@ function __sbEnsureSchema() {
   );
   const kvColumns = __sbSql(s, "PRAGMA table_info(kv)", []).rows;
   let hasKvExpiresAt = false;
-  for (let i = 0; i < kvColumns.length; i++) if (kvColumns[i][1] === "expires_at") hasKvExpiresAt = true;
+  for (let i = 0; i < kvColumns.length; i++)
+    if (kvColumns[i][1] === "expires_at") hasKvExpiresAt = true;
   if (!hasKvExpiresAt) __sbSql(s, "ALTER TABLE kv ADD COLUMN expires_at INTEGER", []);
   // #233 — 1 when the value was put as bytes, same column as the broker's.
   let hasKvBinary = false;
@@ -2011,6 +2241,10 @@ function __sbEnsureSchema() {
   );
   // Additive: old standalone store.sqlite files gain the poll index on open.
   __sbSql(s, "CREATE INDEX IF NOT EXISTS mq_due ON mq (queue, dead, visible_at)", []);
+  const mqColumns = __sbSql(s, "PRAGMA table_info(mq)", []).rows;
+  let mqClaim = false;
+  for (let i = 0; i < mqColumns.length; i++) if (mqColumns[i][1] === "claim_token") mqClaim = true;
+  if (!mqClaim) __sbSql(s, "ALTER TABLE mq ADD COLUMN claim_token TEXT NOT NULL DEFAULT ''", []);
   __sbSql(
     s,
     "CREATE TABLE IF NOT EXISTS do_storage (cls TEXT NOT NULL, id TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (cls, id, key))",
@@ -2020,6 +2254,11 @@ function __sbEnsureSchema() {
     "CREATE TABLE IF NOT EXISTS do_alarm (cls TEXT NOT NULL, id TEXT NOT NULL, at INTEGER NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (cls, id))",
   );
   __sbSql(s, "CREATE INDEX IF NOT EXISTS do_alarm_due ON do_alarm (at)", []);
+  __sbSql(
+    s,
+    "CREATE TABLE IF NOT EXISTS do_alarm_delivery (cls TEXT NOT NULL, id TEXT NOT NULL, at INTEGER NOT NULL, attempts INTEGER NOT NULL, token TEXT NOT NULL, expires INTEGER NOT NULL, PRIMARY KEY(cls,id))",
+    [],
+  );
   __sbSql(
     s,
     "CREATE TABLE IF NOT EXISTS ae (dataset TEXT NOT NULL, ts INTEGER NOT NULL, indexes_json TEXT NOT NULL, blobs_json TEXT NOT NULL, doubles_json TEXT NOT NULL)",
@@ -2053,7 +2292,10 @@ function __sbEmbeddedDispatch(msg) {
   if (op === "ping") return { ok: true, op: "pong", echo: msg.msg };
 
   if (op === "kv.get") {
-    const r = __sbSql(store, "SELECT value, expires_at, binary FROM kv WHERE ns = ? AND key = ?", [msg.ns, msg.key]);
+    const r = __sbSql(store, "SELECT value, expires_at, binary FROM kv WHERE ns = ? AND key = ?", [
+      msg.ns,
+      msg.key,
+    ]);
     if (!r.rows.length) return { ok: true, found: false, value: null };
     const expiresAt = r.rows[0][1];
     if (expiresAt != null && expiresAt <= Date.now()) {
@@ -2104,6 +2346,11 @@ function __sbEmbeddedDispatch(msg) {
     const meta = (bundle.manifest && bundle.manifest.files) || {};
     let path = String(msg.path || "/");
     if (path.charAt(0) !== "/") path = "/" + path;
+    const redirects = (bundle.manifest && bundle.manifest.redirects) || [];
+    for (let i = 0; i < redirects.length; i++) {
+      const location = __sbAssetRedirect(redirects[i], path);
+      if (location !== null) return { ok: true, found: false, status: redirects[i].status, location };
+    }
 
     let key = null;
     if (path.charAt(path.length - 1) === "/") {
@@ -2161,25 +2408,20 @@ function __sbEmbeddedDispatch(msg) {
       headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
     }
     const port = url.port ? url.port : tls ? "443" : "80";
-    const reply = JSON.parse(
-      __sbHttpRaw(
-        url.hostname,
-        port,
-        url.pathname + url.search,
-        String(msg.method || "GET").toUpperCase(),
-        headerText,
-        msg.body == null ? "" : String(msg.body),
-        (tls ? "1" : "0") + (msg.bodyBinary === true ? "b" : ""),
-      ),
+    const asyncId = msg.asyncId > 0 ? msg.asyncId : 0;
+    const raw = __sbHttpRaw(
+      url.hostname,
+      port,
+      url.pathname + url.search,
+      String(msg.method || "GET").toUpperCase(),
+      headerText,
+      msg.body == null ? "" : String(msg.body),
+      (tls ? "1" : "0") + (msg.bodyBinary === true ? "b" : ""),
+      asyncId,
     );
-    if (reply.ok === false) throw new Error(reply.error);
-    // A TLS peer that closed without close_notify is normal on Connection:
-    // close, and also what a truncation attack looks like. Accept it only when
-    // Content-Length says the body arrived whole.
-    if (reply.unclean && !reply.complete) {
-      throw new Error("connection closed before the response was complete");
-    }
-    return { ok: true, status: reply.status, headers: reply.headers, body: reply.body };
+    // B18: queued; the reply reaches the callback registered under asyncId.
+    if (asyncId) return { ok: true, pending: true };
+    return __sbFetchReply(raw);
   }
 
   if (op === "secret.get") {
@@ -2531,20 +2773,26 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, entries };
   }
   if (op === "do.alarm.set") {
-    __sbSql(
-      store,
-      "INSERT INTO do_alarm (cls, id, at, attempts) VALUES (?1,?2,?3,0) ON CONFLICT (cls, id) DO UPDATE SET at = ?3, attempts = 0",
-      [msg.cls, msg.id, Math.trunc(Number(msg.at) || 0)],
-    );
-    return { ok: true };
+    __sbSql(store,"BEGIN IMMEDIATE",[]);
+    try {
+      __sbSql(store,"DELETE FROM do_alarm_delivery WHERE cls=? AND id=? AND expires<=?",[msg.cls,msg.id,Date.now()]);
+      __sbSql(store,"INSERT INTO do_alarm (cls,id,at,attempts) VALUES (?1,?2,?3,0) ON CONFLICT (cls,id) DO UPDATE SET at=?3,attempts=0",[msg.cls,msg.id,Math.trunc(Number(msg.at)||0)]);
+      __sbSql(store,"COMMIT",[]);
+    } catch (error) {__sbSql(store,"ROLLBACK",[]);throw error;}
+    return {ok:true};
   }
   if (op === "do.alarm.get") {
-    const r = __sbSql(store, "SELECT at FROM do_alarm WHERE cls = ? AND id = ?", [msg.cls, msg.id]);
+    const r = __sbSql(store, "SELECT at FROM do_alarm WHERE cls=?1 AND id=?2 UNION ALL SELECT at FROM do_alarm_delivery WHERE cls=?1 AND id=?2 AND expires<=?3 AND attempts<5 LIMIT 1", [msg.cls,msg.id,Date.now()+5000]);
     return { ok: true, at: r.rows.length ? Number(r.rows[0][0]) : null };
   }
   if (op === "do.alarm.delete") {
-    const r = __sbSql(store, "DELETE FROM do_alarm WHERE cls = ? AND id = ?", [msg.cls, msg.id]);
-    return { ok: true, deleted: r.changes > 0 };
+    __sbSql(store,"BEGIN IMMEDIATE",[]);
+    try {
+      const retry=__sbSql(store,"DELETE FROM do_alarm_delivery WHERE cls=? AND id=?",[msg.cls,msg.id]);
+      const pending=__sbSql(store,"DELETE FROM do_alarm WHERE cls=? AND id=?",[msg.cls,msg.id]);
+      __sbSql(store,"COMMIT",[]);
+      return {ok:true,deleted:Number(retry.changes)+Number(pending.changes)>0};
+    } catch (error) {__sbSql(store,"ROLLBACK",[]);throw error;}
   }
 
   if (op === "ae.write") {
@@ -2604,10 +2852,11 @@ function __sbEmbeddedDispatch(msg) {
 
   if (op === "cache.match") {
     const name = msg.name || "default";
-    const r = __sbSql(store, "SELECT status, headers_json, body, expires_at FROM cache WHERE name = ? AND cache_key = ?", [
-      name,
-      msg.key,
-    ]);
+    const r = __sbSql(
+      store,
+      "SELECT status, headers_json, body, expires_at FROM cache WHERE name = ? AND cache_key = ?",
+      [name, msg.key],
+    );
     if (!r.rows.length) return { ok: true, found: false };
     const [status, headersJson, body, expiresAt] = r.rows[0];
     if (expiresAt != null && expiresAt <= Date.now()) {
@@ -2620,10 +2869,16 @@ function __sbEmbeddedDispatch(msg) {
     const name = msg.name || "default";
     const status = Number(msg.status) || 200;
     const headers = msg.headers || {};
-    const cacheControl = String(headers["cache-control"] || headers["Cache-Control"] || "").toLowerCase();
+    const cacheControl = String(
+      headers["cache-control"] || headers["Cache-Control"] || "",
+    ).toLowerCase();
     // Mirrors Workers' own caches.default.put(): a 206 or an explicit
     // no-store/private is a silent no-op, not an error.
-    if (status === 206 || cacheControl.indexOf("no-store") !== -1 || cacheControl.indexOf("private") !== -1) {
+    if (
+      status === 206 ||
+      cacheControl.indexOf("no-store") !== -1 ||
+      cacheControl.indexOf("private") !== -1
+    ) {
       return { ok: true, stored: false };
     }
     const sMaxAge = /s-maxage=(\d+)/.exec(cacheControl);
@@ -2731,7 +2986,10 @@ globalThis.__sbFetchUpstream = function (op, msg) {
 };
 
 globalThis.__sbAssetsGet = function (path) {
-  return __sbEmbeddedDispatch({ op: "assets.get", path });
+  const reply = __sbEmbeddedDispatch({ op: "assets.get", path });
+  const manifest = globalThis.__sbAssets.manifest || {};
+  reply.rules = { headers: manifest.headers || [], redirects: manifest.redirects || [] };
+  return reply;
 };
 
 /** The transport contract: one request string in, one reply string out. */
@@ -2852,17 +3110,36 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
       const now = Date.now();
       for (let q = 0; q < queues.length; q++) {
         const name = queues[q];
-        const due = __sbSql(
-          store,
-          "SELECT id, body, attempts FROM mq WHERE queue = ? AND dead = 0 AND visible_at <= ? ORDER BY visible_at LIMIT 10",
-          [name, now],
-        );
+        const claim = String(now) + ":" + String(Math.random());
+        __sbSql(store, "BEGIN IMMEDIATE", []);
+        let due;
+        try {
+          __sbSql(store, "UPDATE mq SET dead=1 WHERE queue=? AND visible_at<=? AND attempts>=5", [
+            name,
+            now,
+          ]);
+          due = __sbSql(
+            store,
+            "SELECT id,body,attempts FROM mq WHERE queue=? AND dead=0 AND visible_at<=? ORDER BY visible_at LIMIT 10",
+            [name, now],
+          );
+          for (let i = 0; i < due.rows.length; i++)
+            __sbSql(
+              store,
+              "UPDATE mq SET visible_at=?,claim_token=?,attempts=attempts+1 WHERE queue=? AND id=?",
+              [now + 30000, claim, name, due.rows[i][0]],
+            );
+          __sbSql(store, "COMMIT", []);
+        } catch (error) {
+          __sbSql(store, "ROLLBACK", []);
+          throw error;
+        }
         if (due.rows.length === 0) continue;
         // Hide the batch first, so a slow handler cannot have it delivered twice.
         const messages = [];
         for (let i = 0; i < due.rows.length; i++) {
           const row = due.rows[i];
-          __sbSql(store, "UPDATE mq SET visible_at = ? WHERE id = ?", [now + 30000, row[0]]);
+
           messages.push({ id: row[0], body: row[1], timestamp: now, attempts: Number(row[2]) + 1 });
         }
         // #171 — same ctx.waitUntil as the broker-delivered path, and the same
@@ -2879,13 +3156,17 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
         if (result && __sbIsFn(result.then)) result = await result;
         if (__sbTasks.length) await __sbDrainWaitUntil(__sbTasks);
         for (let i = 0; i < result.ack.length; i++) {
-          __sbSql(store, "DELETE FROM mq WHERE id = ?", [result.ack[i]]);
+          __sbSql(
+            store,
+            "DELETE FROM mq WHERE queue=? AND id=? AND claim_token=? AND visible_at>?",
+            [name, result.ack[i], claim, Date.now()],
+          );
         }
         for (let i = 0; i < result.retry.length; i++) {
           __sbSql(
             store,
-            "UPDATE mq SET attempts = attempts + 1, visible_at = ?, dead = CASE WHEN attempts + 1 >= 5 THEN 1 ELSE 0 END WHERE id = ?",
-            [Date.now() + 5000, result.retry[i]],
+            "UPDATE mq SET visible_at=?,claim_token='',dead=CASE WHEN attempts>=5 THEN 1 ELSE 0 END WHERE queue=? AND id=? AND claim_token=? AND visible_at>?",
+            [Date.now() + 5000, name, result.retry[i], claim, Date.now()],
           );
         }
       }
@@ -2896,25 +3177,76 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
     setInterval(async function () {
       __sbEnsureSchema();
       const now = Date.now();
-      const due = __sbSql(
-        store,
-        "SELECT cls, id, at, attempts FROM do_alarm WHERE at <= ? ORDER BY at LIMIT 10",
-        [now],
-      );
+      __sbSql(store, "BEGIN IMMEDIATE", []);
+      let due;
+      const claim = String(now) + ":" + String(Math.random());
+      try {
+        __sbSql(store,"DELETE FROM do_alarm_delivery WHERE expires<=? AND attempts>=5 AND EXISTS (SELECT 1 FROM do_alarm a WHERE a.cls=do_alarm_delivery.cls AND a.id=do_alarm_delivery.id)",[now]);
+        const pending = __sbSql(
+          store,
+          "SELECT cls,id,at,attempts FROM do_alarm WHERE at<=? AND NOT EXISTS (SELECT 1 FROM do_alarm_delivery d WHERE d.cls=do_alarm.cls AND d.id=do_alarm.id) ORDER BY at LIMIT 10",
+          [now],
+        );
+        for (let i = 0; i < pending.rows.length; i++) {
+          const r = pending.rows[i];
+          __sbSql(store, "INSERT INTO do_alarm_delivery VALUES (?,?,?,?,?,?)", [
+            r[0],
+            r[1],
+            r[2],
+            r[3],
+            "",
+            0,
+          ]);
+          __sbSql(store, "DELETE FROM do_alarm WHERE cls=? AND id=? AND at=?", [r[0], r[1], r[2]]);
+        }
+        due = __sbSql(
+          store,
+          "SELECT cls,id,at,attempts FROM do_alarm_delivery WHERE expires<=? AND attempts<5 LIMIT 10",
+          [now],
+        );
+        for (let i = 0; i < due.rows.length; i++)
+          __sbSql(
+            store,
+            "UPDATE do_alarm_delivery SET token=?,expires=?,attempts=attempts+1 WHERE cls=? AND id=?",
+            [claim, now + 30000, due.rows[i][0], due.rows[i][1]],
+          );
+        __sbSql(store, "COMMIT", []);
+      } catch (error) {
+        __sbSql(store, "ROLLBACK", []);
+        throw error;
+      }
       for (let i = 0; i < due.rows.length; i++) {
         const cls = due.rows[i][0];
         const id = due.rows[i][1];
-        // Claim before running: alarm() may schedule the next one, and deleting
-        // afterwards would erase it. Same rule as the broker (#125).
-        __sbSql(store, "DELETE FROM do_alarm WHERE cls = ? AND id = ?", [cls, id]);
-        const instance = __sbGetDOInstance(cls, id);
-        if (__sbIsFn(instance.alarm)) {
-          // #57 gap: this local path bypasses `__sbEntry`'s alarm dispatch
-          // entirely, so it kept the old fire-and-forget behaviour after that
-          // fix landed. Same treatment: await alarm() and drain its waitUntil.
-          const res = instance.alarm();
-          if (res && __sbIsFn(res.then)) await res;
-          if (instance.__sbTasks.length) await __sbDrainWaitUntil(instance.__sbTasks);
+        try {
+          const instance = __sbGetDOInstance(cls, id);
+          if (__sbIsFn(instance.alarm)) {
+            const res = instance.alarm();
+            if (res && __sbIsFn(res.then)) await res;
+            if (instance.__sbTasks.length) await __sbDrainWaitUntil(instance.__sbTasks);
+          }
+          __sbSql(
+            store,
+            "DELETE FROM do_alarm_delivery WHERE cls=? AND id=? AND token=? AND expires>?",
+            [cls, id, claim, Date.now()],
+          );
+        } catch {
+          const scheduled = __sbSql(store, "SELECT 1 FROM do_alarm WHERE cls=? AND id=?", [
+            cls,
+            id,
+          ]);
+          if (scheduled.rows.length)
+            __sbSql(
+              store,
+              "DELETE FROM do_alarm_delivery WHERE cls=? AND id=? AND token=? AND expires>?",
+              [cls, id, claim, Date.now()],
+            );
+          else
+            __sbSql(
+              store,
+              "UPDATE do_alarm_delivery SET expires=? WHERE cls=? AND id=? AND token=? AND expires>?",
+              [Date.now() + 5000, cls, id, claim, Date.now()],
+            );
         }
       }
     }, 500);