@sproutboat/runtime 0.19.2 → 0.21.0

package/src/transport-embedded.js

@@ -2082,6 +2082,10 @@ function __sbHttpAsyncResult(asyncId) {
   return res;
 }
 
+// An async request's caller gave up. The host's request runs to the end; with its
+// placeholder timer cleared, the reply is dropped when it arrives.
+function __sbCancelAsync() {}
+
 // Whether the host runs async requests (sb_async_enable was called).
 function __sbHttpAsyncEnabled() {
   let res = false;

package/src/wrap.ts

@@ -113,7 +113,33 @@ function hasBindings(b: Bindings): boolean {
  * and re-exports at the end (`export { src_default as default, Counter }`) —
  * #89 made the second shape the normal case. Returns null when neither matches.
  */
+/**
+ * `cloudflare:workers` is not a module here: WorkerEntrypoint, DurableObject, RpcTarget
+ * and env are globals the prelude defines. Each import of it becomes a destructuring
+ * of globalThis, `as` renames included, so the handler's names still resolve. The CLI
+ * leaves the specifier external for this.
+ */
+export function inlineWorkersImports(source: string): string {
+  return source.replace(
+    /^import\s*\{([^}]*)\}\s*from\s*["']cloudflare:workers["'];?[ \t]*$/gm,
+    (_match, names: string) => {
+      const pairs = names
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => part.replace(/^(\S+)\s+as\s+(\S+)$/, "$1: $2"));
+      return `const { ${pairs.join(", ")} } = globalThis;`;
+    },
+  );
+}
+
 export function neutraliseExports(source: string): string | null {
+  // `export default class Name extends WorkerEntrypoint {`: the class is the handler.
+  if (/^\s*export\s+default\s+class\b/m.test(source)) {
+    return source
+      .replace(/^(\s*)export\s+default\s+class\b/m, "$1const __sbHandlers = class")
+      .replace(/^export\s+(async\s+function|function|class|const|let|var)\b/gm, "$1");
+  }
   if (/\bexport\s+default\s*\{/.test(source)) {
     return source
       .replace(/^(\s*)export\s+default\s*/m, "$1const __sbHandlers = ")
@@ -182,9 +208,10 @@ export function wrapNativeFetchHandler(
    */
   versionMetadata?: { binding: string; id: string; tag: string; timestamp: string },
 ): string {
-  const neutralised = neutraliseExports(source);
-  if (neutralised === null || !/\bfetch\s*\(/.test(source)) {
-    throw new Error("handler must default-export an object with a fetch(request) method");
+  const neutralised = neutraliseExports(inlineWorkersImports(source));
+  // A WorkerEntrypoint may serve only RPC, with no fetch() at all.
+  if (neutralised === null || (!/\bfetch\s*\(/.test(source) && !/\bextends\s+WorkerEntrypoint\b/.test(source))) {
+    throw new Error("handler must default-export an object with a fetch(request) method, or a WorkerEntrypoint class");
   }
 
   const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;

package/test/native-base64.ts

@@ -18,7 +18,13 @@ const handler = `export default {fetch() {
     const decoded=Array.from(Uint8Array.fromBase64(url,{alphabet:"base64url"}));
     rows.push({padded,url,decoded});
   }
-  return Response.json(rows);
+  // atob/btoa on strings that are not literals (from JSON.parse, from TextDecoder): they
+  // used to read the string's UTF-16 storage and return the wrong bytes.
+  const parsed=JSON.parse('{"latin":"h\\u00e9llo w\\u00f6rld","b64":"AQL/"}');
+  const decodedText=new TextDecoder().decode(new TextEncoder().encode("AQL/"));
+  const codes=(s)=>Array.from(s,(c)=>c.charCodeAt(0));
+  const strings={btoa:btoa(parsed.latin),atob:codes(atob(parsed.b64)),fromDecoder:codes(atob(decodedText))};
+  return Response.json({rows,strings});
 }};`;
 
 function freePort(): number {
@@ -78,7 +84,10 @@ try {
   }
   assert(response, "compiled streams handler did not start");
   assert.equal(response.status, 200);
-  assert.deepEqual(await response.json(), expected);
+  assert.deepEqual(await response.json(), {
+    rows: expected,
+    strings: { btoa: btoa("h\u00e9llo w\u00f6rld"), atob: [1, 2, 255], fromDecoder: [1, 2, 255] },
+  });
   console.log("Native base64 and base64url round-trip zero to nine bytes with correct padding");
 } finally {
   if (server) {

package/test/native-service-bindings.ts

@@ -0,0 +1,396 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { createBroker, listen } from "../../wire/src/broker";
+import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Service bindings on a standalone sprout. env.PEER.fetch() returns a promise and runs
+// off the event loop (the broker transport's async threads), so the sprout keeps
+// serving while a call is in flight: other requests answer at once, concurrent calls
+// overlap, and a deployment that calls itself through a binding does not deadlock.
+// Requests read like Fetch's: a URL object, a Request plus init, a stream body; every
+// Set-Cookie of the reply survives, and a reply without a content type keeps none.
+// From compatibility date 2026-10-22, redirects are followed as Fetch does. A stand-in
+// edge plays the platform's.
+const handler = `
+import { WorkerEntrypoint } from "cloudflare:workers";
+
+export default class Service extends WorkerEntrypoint {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.pathname === "/ping") return new Response("pong");
+    if (url.pathname === "/requests") {
+      const pending = env.PEER.fetch(new URL("https://peer/echo?u=1"));
+      const isPromise = pending instanceof Promise;
+      const viaUrl = await (await pending).json();
+      const viaRequest = await (await env.PEER.fetch(new Request("https://peer/echo", { method: "PUT", headers: { "x-from": "request" }, body: "req body" }), { method: "PATCH" })).json();
+      const stream = new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode("streamed ")); c.enqueue(new TextEncoder().encode("body")); c.close(); } });
+      const viaStream = await (await env.PEER.fetch("https://peer/echo", { method: "POST", body: stream, duplex: "half" })).json();
+      const cookies = (await env.PEER.fetch("https://peer/cookies")).headers.getSetCookie();
+      const bare = (await env.PEER.fetch("https://peer/bare")).headers.get("content-type");
+      return Response.json({ isPromise, viaUrl, viaRequest, viaStream, cookies, bare });
+    }
+    if (url.pathname === "/redirects") {
+      const followed = await (await env.PEER.fetch("https://peer/redirect?status=302&to=/echo?hop=1")).json();
+      const manual = await env.PEER.fetch("https://peer/redirect?status=302&to=/echo", { redirect: "manual" });
+      const post = (status, body) => env.PEER.fetch("https://peer/redirect?status=" + status + "&to=/typed", { method: "POST", body, headers: { "content-type": "text/plain" } });
+      const seeOther = await (await post(303, "dropped")).json();
+      const temporary = await (await post(307, "kept")).json();
+      let refused = "";
+      try {
+        await env.PEER.fetch("https://peer/redirect?status=302&to=/echo", { redirect: "error" });
+      } catch (e) {
+        refused = e.name;
+      }
+      return Response.json({ followed, manual: [manual.status, manual.headers.get("location")], seeOther, temporary, refused });
+    }
+    if (url.pathname === "/slow") return new Response(await (await env.PEER.fetch("https://peer/slow" + url.search)).text());
+    if (url.pathname === "/abort") {
+      const outcome = async (signal) => {
+        const t0 = Date.now();
+        try {
+          await env.PEER.fetch("https://peer/slow?ms=3000", { signal });
+          return "answered";
+        } catch (e) {
+          return e.name + " " + (Date.now() - t0 < 1000 ? "fast" : "slow");
+        }
+      };
+      const controller = new AbortController();
+      setTimeout(() => controller.abort(), 100);
+      const aborted = await outcome(controller.signal);
+      const timedOut = await outcome(AbortSignal.timeout(100));
+      const already = await outcome(AbortSignal.abort());
+      return Response.json({ aborted, timedOut, already });
+    }
+    if (url.pathname === "/self") {
+      const depth = Number(url.searchParams.get("depth") || 0);
+      if (depth >= 30) return new Response("bottom " + depth);
+      return new Response(await (await env.SELF.fetch("https://self/self?depth=" + (depth + 1))).text());
+    }
+    if (url.pathname === "/streamed") {
+      // Four chunks 300 ms apart upstream: a streamed body gets the first one early.
+      const t0 = Date.now();
+      const res = await env.PEER.fetch("https://peer/drip");
+      const reader = res.body.getReader();
+      let firstMs = -1;
+      let text = "";
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        if (firstMs < 0) firstMs = Date.now() - t0;
+        text += new TextDecoder().decode(value);
+      }
+      const whole = await (await env.PEER.fetch("https://peer/drip")).text();
+      const big = new Uint8Array(await (await env.PEER.fetch("https://peer/big")).arrayBuffer());
+      let bigOk = big.length === 12 * 1048576;
+      for (let i = 0; bigOk && i < big.length; i += 4093) bigOk = big[i] === (i & 255);
+      return Response.json({ firstEarly: firstMs >= 0 && firstMs < 250, text, whole, bigOk });
+    }
+    if (url.pathname === "/rpc") {
+      // RPC to this deployment's own WorkerEntrypoint, through the vouched SELF binding.
+      const sum = await env.SELF.add(2, 3);
+      const trip = await env.SELF.roundTrip({ d: new Date(5), b: new Uint8Array([7, 255]), m: new Map([["k", -0]]), u: undefined, n: NaN });
+      const kept = {
+        d: trip.d instanceof Date && trip.d.getTime() === 5,
+        b: trip.b instanceof Uint8Array && trip.b.length === 2 && trip.b[1] === 255,
+        m: trip.m instanceof Map && Object.is(trip.m.get("k"), -0),
+        u: "u" in trip && trip.u === undefined,
+        n: Number.isNaN(trip.n),
+      };
+      const thrown = await env.SELF.fail("nope").then(() => null, (e) => [e.name, e.message, e instanceof RangeError]);
+      const unknown = await env.SELF.noSuchMethod().then(() => null, (e) => [e.name, e.message]);
+      const context = await env.SELF.whoAmI();
+      return Response.json({ sum, kept, thrown, unknown, context });
+    }
+    if (url.pathname === "/whoami") {
+      return Response.json({ url: request.url, internal: [...request.headers.keys()].filter((k) => k.startsWith("x-sb-")) });
+    }
+    if (url.pathname === "/boom") throw new RangeError("kaboom");
+    if (url.pathname === "/callself") {
+      const who = await (await env.SELF.fetch("https://self.example/whoami?q=1")).json();
+      let thrown = null;
+      try {
+        await env.SELF.fetch("https://self.example/boom");
+      } catch (e) {
+        thrown = [e.name, e.message, e instanceof RangeError];
+      }
+      return Response.json({ who, thrown });
+    }
+    return new Response("no route", { status: 404 });
+  }
+
+  add(a, b) {
+    return a + b;
+  }
+
+  roundTrip(value) {
+    return value;
+  }
+
+  fail(message) {
+    throw new RangeError(message);
+  }
+
+  whoAmI() {
+    return { env: this.env !== undefined && this.env.SELF !== undefined, waitUntil: this.ctx.waitUntil instanceof Function };
+  }
+}
+`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const port = freePort();
+const EDGE_SECRET = "native-services-edge-secret";
+const EDGE_TOKEN = "native-services-edge-token";
+// Upstream requests whose client went away before the answer: a cancelled call must
+// stop here, not only be ignored by the caller.
+let slowAbandoned = 0;
+// The platform's edge, reduced to what the broker forwards to it: routing by Host.
+const edge = Bun.serve({
+  hostname: "127.0.0.1",
+  port: 0,
+  async fetch(request) {
+    const url = new URL(request.url);
+    const host = request.headers.get("host");
+    if (host === "self.test") {
+      // Vouch for the call as the platform's edge does: the broker's secret in, the
+      // sprout's own token out, and the caller's URL passed along.
+      const headers = new Headers(request.headers);
+      for (const name of ["x-sb-edge-secret", "x-sb-edge-token", "x-sb-binding-call", "x-sb-url"]) headers.delete(name);
+      if (request.headers.get("x-sb-edge-secret") === EDGE_SECRET) {
+        headers.set("x-sb-binding-call", "1");
+        headers.set("x-sb-edge-token", EDGE_TOKEN);
+        const callerUrl = request.headers.get("x-sb-url");
+        if (callerUrl) headers.set("x-sb-url", callerUrl);
+      }
+      const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.arrayBuffer();
+      return fetch(`http://127.0.0.1:${port}${url.pathname}${url.search}`, { method: request.method, headers, body });
+    }
+    if (url.pathname === "/echo") {
+      return Response.json({
+        method: request.method,
+        path: url.pathname + url.search,
+        from: request.headers.get("x-from"),
+        body: await request.text(),
+      });
+    }
+    if (url.pathname === "/typed") {
+      return Response.json({ method: request.method, type: request.headers.get("content-type"), body: await request.text() });
+    }
+    if (url.pathname === "/redirect") {
+      const status = Number(url.searchParams.get("status"));
+      return new Response(null, { status, headers: { location: url.searchParams.get("to") ?? "/" } });
+    }
+    if (url.pathname === "/drip") {
+      const encoder = new TextEncoder();
+      return new Response(
+        new ReadableStream({
+          async start(controller) {
+            for (let i = 0; i < 4; i++) {
+              if (i) await Bun.sleep(300);
+              controller.enqueue(encoder.encode(i + " "));
+            }
+            controller.close();
+          },
+        }),
+      );
+    }
+    if (url.pathname === "/big") {
+      const bytes = new Uint8Array(12 * 1048576);
+      for (let i = 0; i < bytes.length; i++) bytes[i] = i & 255;
+      return new Response(bytes);
+    }
+    if (url.pathname === "/bare") return new Response(null, { headers: { "x-bare": "1" } });
+    if (url.pathname === "/slow") {
+      request.signal.addEventListener("abort", () => slowAbandoned++);
+      await Bun.sleep(Number(url.searchParams.get("ms") || 500));
+      return new Response("slow done");
+    }
+    if (url.pathname === "/cookies") {
+      const headers = new Headers();
+      headers.append("set-cookie", "a=1; Path=/");
+      headers.append("set-cookie", "b=2; Path=/");
+      return new Response("cookies", { headers });
+    }
+    return new Response("edge: no route", { status: 404 });
+  },
+});
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-services-"));
+const services = [
+  { binding: "PEER", service: "peer" },
+  { binding: "SELF", service: "self" },
+];
+const bindings = { ...EMPTY_BINDINGS, services };
+const broker = createBroker({
+  db: ":memory:",
+  token: "native-services",
+  bindings: { ...bindings, resources: {} },
+  edgeUrl: `http://127.0.0.1:${edge.port}/`,
+  edgeSecret: EDGE_SECRET,
+  services: { PEER: "peer.test", SELF: "self.test" },
+});
+const brokerServer = listen(broker, "127.0.0.1", 0);
+let server: ReturnType<typeof Bun.spawn> | undefined;
+const get = async (path: string) => {
+  const t0 = performance.now();
+  const res = await fetch(`http://127.0.0.1:${port}${path}`, { signal: AbortSignal.timeout(20_000) });
+  return { status: res.status, text: await res.text(), ms: performance.now() - t0 };
+};
+try {
+  const porffor = await ensurePorffor({ cacheRoot: workdir });
+  const node = Bun.which("node");
+  if (!node) throw new Error("native service-binding test needs node on PATH");
+  const [core, transport] = await Promise.all([
+    readFile(preludePath, "utf8"),
+    readFile(transportPath("broker"), "utf8"),
+  ]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "services.generated.js");
+  const binary = join(workdir, "services-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-22"));
+
+  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
+    cwd: workdir,
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: {
+      ...process.env,
+      PORT: String(port),
+      SB_BROKER_PORT: String(brokerServer.port),
+      SB_BROKER_TOKEN: "native-services",
+      SB_EDGE_TOKEN: EDGE_TOKEN,
+    },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let started = false;
+  for (let attempt = 0; attempt < 50 && !started; attempt++) {
+    try {
+      started = (await get("/ping")).text === "pong";
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(started, "compiled service-binding handler did not start");
+
+  const requests = await get("/requests");
+  assert.equal(requests.status, 200, requests.text);
+  assert.deepEqual(JSON.parse(requests.text), {
+    isPromise: true,
+    viaUrl: { method: "GET", path: "/echo?u=1", from: null, body: "" },
+    viaRequest: { method: "PATCH", path: "/echo", from: "request", body: "req body" },
+    viaStream: { method: "POST", path: "/echo", from: null, body: "streamed body" },
+    cookies: ["a=1; Path=/", "b=2; Path=/"],
+    bare: null,
+  });
+
+  // Redirects (compatibility date 2026-10-22): followed through the binding by default,
+  // returned under "manual", refused under "error"; a 303 turns a POST into a bodiless GET.
+  const redirects = await get("/redirects");
+  assert.equal(redirects.status, 200, redirects.text);
+  assert.deepEqual(JSON.parse(redirects.text), {
+    followed: { method: "GET", path: "/echo?hop=1", from: null, body: "" },
+    manual: [302, "/echo"],
+    seeOther: { method: "GET", type: null, body: "" },
+    temporary: { method: "POST", type: "text/plain", body: "kept" },
+    refused: "TypeError",
+  });
+
+  // A call in flight does not hold up other requests.
+  const slow = get("/slow?ms=1500");
+  await Bun.sleep(200);
+  const ping = await get("/ping");
+  assert.equal(ping.text, "pong");
+  assert(ping.ms < 500, `/ping took ${Math.round(ping.ms)} ms behind a 1.5 s call`);
+  assert.equal((await slow).text, "slow done");
+
+  // Calls overlap.
+  const t0 = performance.now();
+  const all = await Promise.all(Array.from({ length: 8 }, () => get("/slow?ms=500")));
+  const total = performance.now() - t0;
+  assert(all.every((r) => r.text === "slow done"), JSON.stringify(all));
+  assert(total < 1500, `8 concurrent 500 ms calls took ${Math.round(total)} ms`);
+
+  // Cancellation: an aborted signal rejects at once, and the abort reaches the upstream
+  // request (the broker drops it when the sprout closes the exchange's connection).
+  const abandonedBefore = slowAbandoned;
+  const aborts = await get("/abort");
+  assert.equal(aborts.status, 200, aborts.text);
+  assert.deepEqual(JSON.parse(aborts.text), { aborted: "AbortError fast", timedOut: "TimeoutError fast", already: "AbortError fast" });
+  await Bun.sleep(300);
+  assert.equal(slowAbandoned - abandonedBefore, 2, "both in-flight calls were stopped upstream");
+
+  // A call the edge vouched for sees the caller's URL and none of the edge's headers,
+  // and the callee's error is thrown in the caller, class and message intact.
+  const callself = await get("/callself");
+  assert.equal(callself.status, 200, callself.text);
+  assert.deepEqual(JSON.parse(callself.text), {
+    who: { url: "https://self.example/whoami?q=1", internal: [] },
+    thrown: ["RangeError", "kaboom", true],
+  });
+  // A client cannot claim to be a binding call: no caller URL, no error marker.
+  const forged = { "x-sb-binding-call": "1", "x-sb-edge-token": "guess", "x-sb-url": "https://forged.example/" };
+  const spoofed = await fetch(`http://127.0.0.1:${port}/whoami`, { headers: forged });
+  assert.equal((await spoofed.json()).url, `http://127.0.0.1:${port}/whoami`);
+  const publicBoom = await fetch(`http://127.0.0.1:${port}/boom`, { headers: forged });
+  assert.equal(publicBoom.status, 500);
+  assert.equal(publicBoom.headers.get("x-sb-uncaught"), null);
+
+  // Streamed responses (compatibility date 2026-10-21 on): the call resolves on the
+  // head, the first chunk arrives before the rest, and a 12 MiB body arrives intact.
+  const streamed = await get("/streamed");
+  assert.equal(streamed.status, 200, streamed.text);
+  assert.deepEqual(JSON.parse(streamed.text), { firstEarly: true, text: "0 1 2 3 ", whole: "0 1 2 3 ", bigOk: true });
+
+  // RPC: methods of the WorkerEntrypoint, called on the binding, with values copied as
+  // structured clone does and errors thrown as in workerd.
+  const rpc = await get("/rpc");
+  assert.equal(rpc.status, 200, rpc.text);
+  assert.deepEqual(JSON.parse(rpc.text), {
+    sum: 5,
+    kept: { d: true, b: true, m: true, u: true, n: true },
+    thrown: ["RangeError", "nope", true],
+    unknown: ["TypeError", 'The RPC receiver does not implement the method "noSuchMethod".'],
+    context: { env: true, waitUntil: true },
+  });
+  // A client cannot call a method: without the edge's vouching, x-sb-rpc is just a header.
+  const forgedRpc = await fetch(`http://127.0.0.1:${port}/ping`, { method: "POST", headers: { "x-sb-rpc": "fail" }, body: "[\"x\"]" });
+  assert.equal(await forgedRpc.text(), "pong");
+
+  // A deployment calling itself, 30 levels deep: every level waits on the next at once.
+  const self = await get("/self");
+  assert.equal(self.text, "bottom 30");
+  console.log(
+    `Service bindings return promises and run off the loop: /ping ${Math.round(ping.ms)} ms during a call, ` +
+      `8x500 ms in ${Math.round(total)} ms, self-recursion ok; URL, Request+init, stream bodies, Set-Cookie and missing content types preserved; redirects follow Fetch; aborted calls stop upstream; vouched calls see the caller's URL and rethrow the callee's errors; responses stream; RPC calls WorkerEntrypoint methods`,
+  );
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  brokerServer.stop();
+  broker.close();
+  edge.stop(true);
+  await rm(workdir, { recursive: true, force: true });
+}