@sproutboat/runtime 0.22.0 → 0.23.1

package/src/transport-embedded.js

@@ -57,6 +57,10 @@ extern int sqlite3_changes(sqlite3*);
 extern int64_t sqlite3_last_insert_rowid(sqlite3*);
 extern const char* sqlite3_errmsg(sqlite3*);
 extern int sqlite3_close(sqlite3*);
+extern int sqlite3_bind_parameter_count(sqlite3_stmt*);
+extern int sqlite3_stmt_readonly(sqlite3_stmt*);
+extern int sqlite3_extended_errcode(sqlite3*);
+extern int sqlite3_error_offset(sqlite3*);
 
 // baronunread/sproutboat#176 — defined in render.js, alongside
 // porf_native_fetch_read_value (which every inline-C block below already
@@ -1293,6 +1297,19 @@ static void sb_putjson_text(sb_buf* b, const char* s, size_t n) {
 // binds as NULL rather than guessing.
 static const char* sb_skip_ws(const char* p) { while (*p == ' ' || *p == '\n' || *p == '\t' || *p == '\r') p++; return p; }
 
+static int sb_hex_nibble(char c) { return c >= 'a' ? c - 'a' + 10 : c >= 'A' ? c - 'A' + 10 : c - '0'; }
+// Past one JSON object (strings and nesting respected), or to the end of the text.
+static const char* sb_json_skip_object(const char* p) {
+  int depth = 0, quoted = 0;
+  for (; *p; p++) {
+    if (quoted) { if (*p == '\\' && p[1]) p++; else if (*p == '"') quoted = 0; continue; }
+    if (*p == '"') quoted = 1;
+    else if (*p == '{' || *p == '[') depth++;
+    else if ((*p == '}' || *p == ']') && --depth == 0) return p + 1;
+  }
+  return p;
+}
+
 static int sb_bind_params(sqlite3_stmt* st, const char* json) {
   const char* p = sb_skip_ws(json);
   if (*p != '[') return 0;
@@ -1338,6 +1355,25 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       free(out);
       continue;
     }
+    // {"$blob":"HEX"}: the bytes of a D1 bind (an ArrayBuffer or a typed array), bound
+    // as a BLOB. Any other object binds NULL. Before this an object stopped the parse,
+    // so a Uint8Array and every parameter after it were silently stored as NULL.
+    if (*p == '{') {
+      const char* end = sb_json_skip_object(p);
+      const char* hex = strstr(p, "\"$blob\":\"");
+      if (hex && hex < end) {
+        hex += 9;
+        size_t n = 0;
+        while (hex + 2 * n < end && hex[2 * n] != '"' && hex[2 * n + 1] != '"') n++;
+        unsigned char* bytes = (unsigned char*)malloc(n ? n : 1);
+        for (size_t i = 0; i < n; i++)
+          bytes[i] = (unsigned char)(sb_hex_nibble(hex[2 * i]) << 4 | sb_hex_nibble(hex[2 * i + 1]));
+        sqlite3_bind_blob(st, index++, bytes, (int)n, SB_SQLITE_TRANSIENT);
+        free(bytes);
+      } else sqlite3_bind_null(st, index++);
+      p = end;
+      continue;
+    }
     // number (or true/false, bound as 1/0)
     if (*p == 't') { sqlite3_bind_double(st, index++, 1); p += 4; continue; }
     if (*p == 'f') { sqlite3_bind_double(st, index++, 0); p += 5; continue; }
@@ -1349,7 +1385,7 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       p = endp;
     }
   }
-  return 0;
+  return index - 1; // how many were bound
 }
 
 // --- R2 bodies, without the JSON detour or the SQLite detour ----------------
@@ -1941,23 +1977,52 @@ static char* sb_sql_script(const char* path, const char* sql) {
   return b.p;
 }
 
+// An error reply with SQLite's extended result code and, when SQLite knows it, the byte
+// offset of the error in the SQL (D1 reports both). A message of our own comes with its
+// own code (code < 0: take SQLite's).
+static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip) {
+  sb_buf e = { 0, 0, 0 };
+  const char* m = message ? message : sqlite3_errmsg(db);
+  sb_puts(&e, "{\"ok\":false,\"error\":");
+  sb_putjson_text(&e, m, strlen(m));
+  char tail[64];
+  int offset = message ? -1 : sqlite3_error_offset(db);
+  int k = snprintf(tail, sizeof(tail), ",\"code\":%d,\"offset\":%d}", code >= 0 ? code : sqlite3_extended_errcode(db), offset >= skip ? offset - skip : -1);
+  sb_put(&e, tail, (size_t)k);
+  return e.p;
+}
+
+// D1 calls from compatibility date 2026-10-24 put this comment first: the statement must
+// get exactly as many parameters as it has, like D1.
+#define SB_D1_STRICT "/*sb-d1-strict*/"
+// LTX capture (#141) failed after SQLite committed: the write is in the database but not in
+// the replication log, and the database refuses writes until the process restarts. Said as
+// such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
+#define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+static int sb_db_capture_failed(const char* path) {
+  for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
+  return 0;
+}
+
 // Run one statement. Returns malloc'd JSON:
 //   {"ok":true,"cols":[...],"rows":[[...]],"changes":n,"rowid":n}
-// or {"ok":false,"error":"..."}.
+// or {"ok":false,"error":"...","code":n,"offset":n}. In a D1 database (a path under
+// /d1/) a BLOB comes back as {"$blob":"HEX"}; elsewhere as one char per byte.
 static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sb_buf b = { 0, 0, 0 };
   int idx = sb_db_for(path);
+  if (idx < 0 && sb_db_capture_failed(path)) return sb_sql_error(0, SB_LTX_FAILED, 10, 0);
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   sqlite3* db = sb_dbs[idx];
+  const int strict = strncmp(sql, SB_D1_STRICT, sizeof(SB_D1_STRICT) - 1) == 0;
+  const int d1 = strstr(path, "/d1/") != 0;
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
-  if (!st) {
-    sb_puts(&b, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&b, m, strlen(m));
-    sb_puts(&b, "}");
-    return b.p;
+  if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+  int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (strict && bound != sqlite3_bind_parameter_count(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
   }
-  if (params && *params) sb_bind_params(st, params);
 
   sb_puts(&b, "{\"ok\":true,\"cols\":[");
   int ncol = sqlite3_column_count(st);
@@ -1984,27 +2049,32 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
       }
       const unsigned char* txt = sqlite3_column_text(st, i);
       int n = sqlite3_column_bytes(st, i);
-      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte.
-      if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
+      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte, or is hex in D1.
+      if (t == 4 && d1) {
+        static const char* digits = "0123456789abcdef";
+        const unsigned char* bytes = (const unsigned char*)sqlite3_column_blob(st, i);
+        sb_puts(&b, "{\"$blob\":\"");
+        for (int j = 0; j < n; j++) { char pair[2] = { digits[bytes[j] >> 4], digits[bytes[j] & 15] }; sb_put(&b, pair, 2); }
+        sb_puts(&b, "\"}");
+      }
+      else if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
       else sb_putjson_text(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
     }
     sb_puts(&b, "]");
   }
   char tail[96];
-  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
+  // A read-only statement changed nothing: sqlite3_changes still holds the last write's count.
+  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
   sb_put(&b, tail, (size_t)k);
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
-  if (sb_ltx_after(idx)) rc = 10;
+  const int capture_failed = sb_ltx_after(idx) != 0;
+  if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
-    sb_buf e = { 0, 0, 0 };
-    sb_puts(&e, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&e, m, strlen(m));
-    sb_puts(&e, "}");
-    return e.p;
+    if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
+    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   }
   return b.p;
 }
@@ -3513,19 +3583,16 @@ function __sbEmbeddedDispatch(msg) {
     if (op === "d1.exec") {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
+      __sbD1Open(path, msg.strict === true);
       const reply = JSON.parse(__sbSqlScriptRaw(path, String(msg.sql)));
       if (reply.ok === false) throw new Error("sqlite: " + reply.error);
       return { ok: true };
     }
-    if (op === "d1.batch") {
-      const results = [];
-      const list = msg.statements || [];
-      for (let i = 0; i < list.length; i++)
-        results.push(__sbD1Run(path, list[i].sql, list[i].params));
-      return { ok: true, results };
-    }
-    const one = __sbD1Run(path, msg.sql, msg.params);
-    return { ok: true, results: one.results, meta: one.meta, success: true };
+    const strict = msg.strict === true;
+    __sbD1Open(path, strict);
+    if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
+    const one = __sbD1Run(path, msg.sql, msg.params, strict);
+    return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
   }
 
   if (op === "d1.backup") {
@@ -3979,16 +4046,99 @@ function __sbEmbeddedDispatch(msg) {
 }
 
 /** One D1 statement, shaped like the broker's d1Run. */
-function __sbD1Run(path, sql, params) {
-  const r = __sbSql(path, String(sql), params || []);
+// BEGIN D1 OPS (lifted by test/native-d1.ts)
+// D1 calls from compatibility date 2026-10-24 come with msg.strict (the shim sets it):
+// exact parameter counts, foreign keys enforced, D1's error text, and rows as arrays with
+// their column names (the shim builds the objects, so duplicate names survive in raw()).
+// A BLOB comes from C as {"$blob":"HEX"}; strict calls get it so, older ones get the one
+// char per byte string they always had.
+var __sbD1Opened = {};
+function __sbD1Open(path, strict) {
+  if (__sbD1Opened[path] === strict) return;
+  __sbD1Opened[path] = strict;
+  __sbSql(path, strict ? "PRAGMA foreign_keys = ON" : "PRAGMA foreign_keys = OFF", []);
+}
+var __sbSqliteCodes = ["", "SQLITE_ERROR", "SQLITE_INTERNAL", "SQLITE_PERM", "SQLITE_ABORT", "SQLITE_BUSY",
+  "SQLITE_LOCKED", "SQLITE_NOMEM", "SQLITE_READONLY", "SQLITE_INTERRUPT", "SQLITE_IOERR", "SQLITE_CORRUPT",
+  "SQLITE_NOTFOUND", "SQLITE_FULL", "SQLITE_CANTOPEN", "SQLITE_PROTOCOL", "SQLITE_EMPTY", "SQLITE_SCHEMA",
+  "SQLITE_TOOBIG", "SQLITE_CONSTRAINT", "SQLITE_MISMATCH", "SQLITE_MISUSE", "SQLITE_NOLFS", "SQLITE_AUTH",
+  "SQLITE_FORMAT", "SQLITE_RANGE", "SQLITE_NOTADB"];
+var __sbSqliteConstraints = { 275: "CHECK", 531: "COMMITHOOK", 787: "FOREIGNKEY", 1043: "FUNCTION",
+  1299: "NOTNULL", 1555: "PRIMARYKEY", 1811: "TRIGGER", 2067: "UNIQUE", 2323: "VTAB", 2579: "ROWID",
+  2835: "PINNED", 3091: "DATATYPE" };
+function __sbD1Error(reply) {
+  const code = Number(reply.code) || 0;
+  const base = __sbSqliteCodes[code & 255] || "";
+  let text = "D1_ERROR: " + reply.error;
+  if (reply.offset >= 0) text += " at offset " + reply.offset;
+  if (base) {
+    text += ": " + base;
+    if (__sbSqliteConstraints[code]) text += " (extended: SQLITE_CONSTRAINT_" + __sbSqliteConstraints[code] + ")";
+  }
+  return new Error(text);
+}
+function __sbD1Bytes(cell) {
+  let out = "";
+  const hex = String(cell.$blob);
+  for (let i = 0; i + 1 < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+function __sbD1Run(path, sql, params, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, (strict ? "/*sb-d1-strict*/" : "") + String(sql), JSON.stringify(params || [])));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+  const meta = { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length };
+  if (strict) return { columns: r.cols, rows: r.rows, meta };
   const results = [];
   for (let i = 0; i < r.rows.length; i++) {
     const row = {};
-    for (let c = 0; c < r.cols.length; c++) row[r.cols[c]] = r.rows[i][c];
+    for (let c = 0; c < r.cols.length; c++) {
+      const cell = r.rows[i][c];
+      row[r.cols[c]] = cell !== null && Object(cell) === cell ? __sbD1Bytes(cell) : cell;
+    }
     results.push(row);
   }
-  return { results, meta: { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length } };
+  return { results, meta };
 }
+// One statement of our own (SAVEPOINT, RELEASE, ...), failing in the caller's terms.
+function __sbD1Control(path, sql, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, sql, "[]"));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// Undo after a failure, best effort: the error the caller sees is the first one. If LTX
+// capture failed, SQLite may already have committed; that error says so, and the database
+// stays closed to writes (the capture latch), so a cleanup failure must not replace it.
+function __sbD1Undo(path, savepoint) {
+  try {
+    __sbD1Control(path, "ROLLBACK TO " + savepoint, false);
+    __sbD1Control(path, "RELEASE " + savepoint, false);
+  } catch (ignored) {
+    return ignored;
+  }
+  return null;
+}
+// One transaction, like D1: a statement that fails undoes the ones before it.
+function __sbD1Batch(path, list, strict) {
+  const results = [];
+  __sbD1Control(path, "SAVEPOINT sb_d1_batch", strict);
+  try {
+    for (let i = 0; i < list.length; i++) results.push(__sbD1Run(path, list[i].sql, list[i].params, strict));
+  } catch (err) {
+    __sbD1Undo(path, "sb_d1_batch");
+    throw err;
+  }
+  __sbD1Release(path, "sb_d1_batch", strict);
+  return results;
+}
+// RELEASE of our outermost savepoint is the commit. A deferred constraint can fail it and
+// leave the transaction open: undo it. A capture failure (code 10) comes after SQLite has
+// committed: nothing to undo, and that error is the one to report.
+function __sbD1Release(path, savepoint, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, "RELEASE " + savepoint, "[]"));
+  if (r.ok !== false) return;
+  if (Number(r.code) !== 10) __sbD1Undo(path, savepoint);
+  throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// END D1 OPS
 
 /**
  * R2 object bodies, out of band (#56).

package/test/native-d1.ts

@@ -0,0 +1,283 @@
+import assert from "node:assert/strict";
+import { closeSync, openSync, readFileSync, readdirSync, readSync, writeSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// The embedded transport's SQL runner (sb_sql_run and sb_bind_params), compiled from the
+// transport's own inline C against the system SQLite, the way native-ltx.ts does. Only
+// the C up to the D1 backup code is needed; the few runtime symbols it names are stubbed.
+const transport = await readFile(new URL("../src/transport-embedded.js", import.meta.url), "utf8");
+const start = transport.indexOf("Porffor.c`\n") + "Porffor.c`\n".length;
+const end = transport.indexOf("// #164 — an online");
+assert(start > 20 && end > start, "transport C block markers moved");
+const work = await mkdtemp(join(tmpdir(), "sb-native-d1-"));
+try {
+  await writeFile(
+    join(work, "bearssl.h"),
+    `typedef struct { int x; } br_sha256_context;
+static void br_sha256_init(br_sha256_context* c) { (void)c; }
+static void br_sha256_update(br_sha256_context* c, const void* d, unsigned long n) { (void)c; (void)d; (void)n; }
+static void br_sha256_out(const br_sha256_context* c, void* o) { (void)c; (void)o; }
+`,
+  );
+  await writeFile(join(work, "block.c"), transport.slice(start, end));
+  await writeFile(
+    join(work, "driver.c"),
+    `#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <time.h>
+#include <sys/stat.h>
+typedef struct { double val; int type; } jsval;
+typedef uint32_t u32;
+static uint32_t porf_native_fetch_alloc_bytestring(const char* d, size_t n) { (void)d; (void)n; return 0; }
+#include "block.c"
+const char* sb_standalone_app_name(void) { return "test"; }
+// One call per line: PATH \\t SQL \\t PARAMS_JSON; one reply line each. ":break PATH" makes
+// PATH's next LTX capture fail (native-ltx.ts's :break-position).
+int main(void) {
+  sb_ltx_compat = 1;  // __sbLtxConfigure at compatibility date 2026-10-22 or later
+  char* line = 0; size_t cap = 0;
+  while (getline(&line, &cap, stdin) > 0) {
+    line[strcspn(line, "\\n")] = 0;
+    if (!strncmp(line, ":break ", 7)) { line[strcspn(line, "\\t")] = 0; char p[1024]; snprintf(p, sizeof(p), "%s.ltx/position.tmp", line + 7); mkdir(p, 0700); puts("{}"); fflush(stdout); continue; }
+    char* sql = strchr(line, '\\t'); if (!sql) return 2; *sql++ = 0;
+    char* params = strchr(sql, '\\t'); if (!params) return 2; *params++ = 0;
+    char* out = sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
+  }
+  return 0;
+}
+`,
+  );
+  const binary = join(work, "driver");
+  const compile = Bun.spawnSync(["cc", "-O1", "-w", "-I", work, join(work, "driver.c"), "-lsqlite3", "-o", binary]);
+  assert.equal(compile.exitCode, 0, compile.stderr.toString());
+
+  const d1 = join(work, "data/d1/DB.sqlite");
+  const store = join(work, "data/store.sqlite");
+  const run = (calls: [string, string, unknown[]][]) => {
+    const input = calls.map(([path, sql, params]) => `${path}\t${sql}\t${JSON.stringify(params)}\n`).join("");
+    const p = Bun.spawnSync([binary], { stdin: Buffer.from(input) });
+    assert.equal(p.exitCode, 0, p.stderr.toString());
+    return p.stdout
+      .toString()
+      .trim()
+      .split("\n")
+      .map((l) => JSON.parse(l));
+  };
+  const blob = (bytes: number[]) => ({ $blob: Buffer.from(bytes).toString("hex") });
+
+  // A Uint8Array bind used to stop the parameter parse: it, and every parameter after it,
+  // were stored as NULL (data loss).
+  const [, , stored, other] = run([
+    [d1, "CREATE TABLE t (a TEXT, b BLOB, c TEXT)", []],
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", ["k", blob([0, 255, 127, 0x22]), "after"]],
+    [d1, "SELECT a, b, typeof(b) AS bt, length(b) AS bl, c FROM t", []],
+    [store, "SELECT x'00ff' AS b", []],
+  ]);
+  assert.deepEqual(
+    stored.rows,
+    [["k", { $blob: "00ff7f22" }, "blob", 4, "after"]],
+    "blob stored as a BLOB, later parameters kept",
+  );
+  assert.equal(other.rows[0][0], String(other.rows[0][0]), "outside D1 a BLOB is still one char per byte, not hex");
+
+  // An object that is not a blob binds NULL and the parse carries on (a "}" in a string included).
+  const [, kept] = run([
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", [{ a: "}{" }, 5, "x"]],
+    [d1, "SELECT a, b, c FROM t WHERE c = 'x'", []],
+  ]);
+  assert.deepEqual(kept.rows, [[null, 5, "x"]]);
+
+  // Strict D1 calls (compatibility date 2026-10-24) check the parameter count.
+  const [few, many, right, reuse] = run([
+    [d1, "/*sb-d1-strict*/SELECT ?1, ?2", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1", [1, 2]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a, ?1 AS b, ?2 AS c", ["x", "y"]],
+  ]);
+  assert.equal(few.ok, false);
+  assert.equal(few.error, "Wrong number of parameter bindings for SQL query.");
+  assert.equal(many.ok, false);
+  assert.deepEqual(right.rows, [[1]]);
+  assert.deepEqual(reuse.rows, [["x", "x", "y"]]);
+  const [loose] = run([[d1, "SELECT ?1 AS a, ?2 AS b", [1]]]);
+  assert.deepEqual(loose.rows, [[1, null]], "without the marker a missing parameter is NULL, as before");
+
+  // Errors carry SQLite's extended code and the offset in the caller's SQL.
+  const [syntax, unique] = run([
+    [d1, "/*sb-d1-strict*/SELEC 1", []],
+    [d1, "CREATE TABLE u (id INTEGER PRIMARY KEY); INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(syntax.ok, false);
+  assert.equal(syntax.code, 1);
+  assert.equal(syntax.offset, 0);
+  assert.equal(unique.ok, true);
+  const [, dup] = run([
+    [d1, "INSERT INTO u VALUES (1)", []],
+    [d1, "INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(dup.ok, false);
+  assert.equal(dup.code, 1555, "SQLITE_CONSTRAINT_PRIMARYKEY");
+
+  // A read reports no changes, not the last write's.
+  const [write, read] = run([
+    [d1, "INSERT INTO t (a) VALUES ('z')", []],
+    [d1, "SELECT count(*) FROM t", []],
+  ]);
+  assert.equal(write.changes, 1);
+  assert.equal(read.changes, 0);
+  // The transport's D1 ops (JS), on the same C: lifted from BEGIN/END D1 OPS.
+  const opsStart = transport.indexOf("// BEGIN D1 OPS");
+  const opsEnd = transport.indexOf("// END D1 OPS");
+  assert(opsStart > 0 && opsEnd > opsStart, "D1 ops markers moved");
+  // One long-lived driver, so a SAVEPOINT spans calls as it does in a worker: FIFOs give
+  // the lifted (synchronous) ops a synchronous line protocol.
+  const fifoIn = join(work, "in"),
+    fifoOut = join(work, "out");
+  assert.equal(Bun.spawnSync(["mkfifo", fifoIn, fifoOut]).exitCode, 0);
+  const driver = Bun.spawn(["sh", "-c", `exec "${binary}" < "${fifoIn}" > "${fifoOut}"`], {
+    env: { ...process.env, SB_LTX_ENABLE: "1", SB_LTX_DATABASE: "LTX" },
+  });
+  const toDriver = openSync(fifoIn, "w"),
+    fromDriver = openSync(fifoOut, "r");
+  let pending = "";
+  const sqlRaw = (path: string, sql: string, params: string) => {
+    writeSync(toDriver, `${path}\t${sql}\t${params}\n`);
+    const chunk = Buffer.alloc(65536);
+    while (!pending.includes("\n")) {
+      const n = readSync(fromDriver, chunk, 0, chunk.length, null);
+      if (n <= 0) throw new Error("driver exited");
+      pending += chunk.toString("utf8", 0, n);
+    }
+    const line = pending.slice(0, pending.indexOf("\n"));
+    pending = pending.slice(line.length + 1);
+    return line;
+  };
+  const sql = (path: string, text: string, params: unknown[]) => {
+    const r = JSON.parse(sqlRaw(path, text, JSON.stringify(params)));
+    if (r.ok === false) throw new Error("sqlite: " + r.error);
+    return r;
+  };
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const ops = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open };`,
+  )(sqlRaw, sql);
+  const db2 = join(work, "data/d1/OPS.sqlite");
+  ops.__sbD1Run(db2, "CREATE TABLE p (id INTEGER PRIMARY KEY)", [], false);
+  ops.__sbD1Run(db2, "CREATE TABLE c (id INTEGER PRIMARY KEY, p INTEGER REFERENCES p(id))", [], false);
+  // batch() is one transaction: the failing second insert undoes the first.
+  assert.throws(
+    () =>
+      ops.__sbD1Batch(
+        db2,
+        [
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+        ],
+        false,
+      ),
+    /UNIQUE/,
+  );
+  assert.equal(ops.__sbD1Run(db2, "SELECT count(*) AS n FROM p", [], false).results[0].n, 0, "batch rolled back");
+  assert.equal(
+    ops.__sbD1Batch(
+      db2,
+      [
+        { sql: "INSERT INTO p VALUES (1)", params: [] },
+        { sql: "INSERT INTO p VALUES (2)", params: [] },
+      ],
+      false,
+    ).length,
+    2,
+  );
+  // Old dates: no foreign keys, a BLOB read as one char per byte, errors as before.
+  ops.__sbD1Open(db2, false);
+  ops.__sbD1Run(db2, "INSERT INTO c VALUES (1, 99)", [], false);
+  const oldBlob = ops.__sbD1Run(db2, "SELECT ?1 AS b", [{ $blob: "00ff" }], false).results[0].b;
+  assert.equal(oldBlob, "\u0000ÿ");
+  assert.throws(() => ops.__sbD1Run(db2, "SELEC 1", [], false), /^Error: sqlite: near "SELEC": syntax error$/);
+  // Strict (2026-10-24): foreign keys on, rows with columns, D1's error text.
+  ops.__sbD1Open(db2, true);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO c VALUES (2, 98)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
+  );
+  const strictRow = ops.__sbD1Run(db2, "SELECT 1 AS a, ?1 AS a", [{ $blob: "0a" }], true);
+  assert.deepEqual([strictRow.columns, strictRow.rows], [["a", "a"], [[1, { $blob: "0a" }]]]);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELEC 1", [], true),
+    (e: Error) => e.message === 'D1_ERROR: near "SELEC": syntax error at offset 0: SQLITE_ERROR',
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO p VALUES (1)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELECT ?1", [], true),
+    (e: Error) => e.message === "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  // LTX capture on (SB_LTX_ENABLE, database LTX): a batch is one commit, and a capture
+  // that fails at RELEASE (after SQLite committed) surfaces as itself: SQLITE_IOERR with a
+  // message that says so, never "no such savepoint" from the cleanup, and the database then
+  // refuses writes until restart.
+  const ltx = join(work, "data/d1/LTX.sqlite");
+  const generation = () => join(ltx + ".ltx", readFileSync(ltx + ".ltx/position", "utf8").split("\n")[1]);
+  const ltxFiles = () => readdirSync(generation()).filter((n) => n.endsWith(".ltx")).length;
+  ops.__sbD1Open(ltx, true);
+  ops.__sbD1Run(ltx, "CREATE TABLE e (id INTEGER PRIMARY KEY, v TEXT)", [], true);
+  const beforeBatch = ltxFiles();
+  ops.__sbD1Batch(
+    ltx,
+    [
+      { sql: "INSERT INTO e VALUES (1, 'a')", params: [] },
+      { sql: "INSERT INTO e VALUES (2, 'b')", params: [] },
+    ],
+    true,
+  );
+  assert.equal(ltxFiles(), beforeBatch + 1, "a batch is one LTX commit");
+  // Break capture just before the batch's RELEASE.
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const breaking = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch };`,
+  )((path: string, text: string, params: string) => {
+    if (text === "RELEASE sb_d1_batch") sqlRaw(":break " + path, "", "");
+    return sqlRaw(path, text, params);
+  }, sql);
+  const LTX_FAILED =
+    "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR";
+  assert.throws(
+    () => breaking.__sbD1Batch(ltx, [{ sql: "INSERT INTO e VALUES (3, 'c')", params: [] }], true),
+    (e: Error) => e.message === LTX_FAILED,
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "INSERT INTO e VALUES (4, 'd')", [], true),
+    (e: Error) => e.message === LTX_FAILED,
+    "writes refused after a capture failure",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "SELECT 1", [], false),
+    /^Error: sqlite: LTX capture failed/,
+    "old dates see the same failure",
+  );
+  closeSync(toDriver);
+  closeSync(fromDriver);
+  await driver.exited;
+  console.log(
+    "native d1: sb_sql_run and the D1 ops pass (blob binds, atomic batch, strict counts, foreign keys, error text)",
+  );
+} finally {
+  await rm(work, { recursive: true, force: true });
+}