@sproutboat/runtime 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @sproutboat/runtime
 
+## 0.24.0
+
+### Minor Changes
+
+- 9a5363e: D1 matches workerd from compatibility date `2026-10-24`:
+  
+  - `all()`, `run()`, `first()`, `raw()`, `batch()` and `exec()` return Promises, and errors reject them. `bind()` stays synchronous and still throws `D1_TYPE_ERROR` at once.
+  - `meta` has D1's keys: `served_by`, `duration`, `changes`, `last_row_id`, `changed_db`, `size_after` (always 0 here), `rows_read` and `rows_written`.
+  - `raw({ columnNames: true })` puts the column names first, and keeps duplicate names.
+  - `first("name")` throws `D1_COLUMN_NOTFOUND` for a column the result doesn't have.
+  - Empty SQL and an empty `batch([])` throw `D1_ERROR: No SQL statements detected.`
+  - `BEGIN`, `COMMIT`, `ROLLBACK`, `SAVEPOINT` and `RELEASE` are refused, as in D1. A batch is already one transaction.
+  - `exec()` runs line by line, all or nothing, and returns the number of lines. A failing line throws `D1_EXEC_ERROR: Error in line N: ...`.
+  - `withSession()` returns a session with `prepare`, `batch` and `getBookmark()`, which returns `null`. `dump()` rejects; use `backup()` instead.
+  
+  Apps with an earlier `compatibility_date` keep the synchronous API unchanged. To opt in, move the date to `2026-10-24` or later and rebuild. `await` code needs no other change, but code that reads results without `await` does.
+  
+  Not yet like D1: `rows_read` counts the rows returned, not the rows scanned, and pragmas are not limited to D1's allow-list.
+  
+  With LTX capture on (from `2026-10-22`), a capture failure during a D1 call now reports `SQLITE_IOERR` with a message saying the write is not durable in the replication log, instead of SQLite's "not an error". Writes stay refused until restart.
+
+## 0.23.1
+
+### Patch Changes
+
+- 7a7fd34: D1 correctness fixes, in the standalone (embedded) transport and the broker:
+  
+  - **Bytes are no longer lost.** Binding a `Uint8Array`, another typed array, a `DataView` or an `ArrayBuffer` stored NULL in a standalone sprout, along with every parameter after it. It now stores a BLOB, at every compatibility date. On earlier dates a BLOB still reads back as before: as one character per byte.
+  - **`batch()` is one transaction** in a standalone sprout, as it already was through the broker and is in D1: if a statement fails, the ones before it are rolled back. This applies at every compatibility date.
+  - **From compatibility date `2026-10-24`**, D1 follows workerd's rules:
+    - a parameter must be `null`, a number, a string, a boolean or bytes, or the call throws `D1_TYPE_ERROR` (before, `undefined` and objects became NULL);
+    - the number of parameters must match the statement (`D1_ERROR: Wrong number of parameter bindings for SQL query.`);
+    - foreign keys are enforced (`PRAGMA foreign_keys = ON`);
+    - errors read `D1_ERROR: <message>: SQLITE_<CODE>`;
+    - a BLOB reads back as an array of byte values.
+  
+    Apps with an earlier `compatibility_date` keep the old behaviour. To opt in, move the date to `2026-10-24` or later and rebuild.
+  - `meta.changes` is 0 for a statement that only reads. It used to repeat the previous write's count.
+
 ## 0.23.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/d1-shim.test.js

@@ -0,0 +1,154 @@
+// The D1 shim (`env.DB`) over the broker's D1 store (the production platform's path),
+// at a compatibility date before and after 2026-10-24. The embedded transport's half is
+// test/native-d1.ts.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { createD1Store } from "../../wire/src/d1";
+
+const source = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+let store;
+// oxlint-disable-next-line no-function-constructor -- the prelude is prepended as text in production too
+const { makeD1 } = new Function(
+  "Porffor",
+  "__testCall",
+  `${source}\n__sbCall = __testCall; return { makeD1: __sbMakeD1 };`,
+)({ c: () => "" }, (json) => {
+  const msg = JSON.parse(json);
+  try {
+    return JSON.stringify(store.execute({ owner: "app", key: "app/DB", path: ":memory:", name: "DB", msg }));
+  } catch (error) {
+    return JSON.stringify({ ok: false, error: error.message });
+  }
+});
+const fresh = (date) => {
+  globalThis.__sbCompat = date;
+  store?.close();
+  store = createD1Store();
+  return makeD1("DB");
+};
+const caught = (fn) => {
+  try {
+    fn();
+  } catch (error) {
+    return error.message;
+  }
+  return "did not throw";
+};
+// The message a call fails with, synchronously or as a rejected Promise.
+const failure = async (fn) => {
+  try {
+    await fn();
+  } catch (error) {
+    return error.message;
+  }
+  return "did not throw";
+};
+const NO_STATEMENTS = "D1_ERROR: No SQL statements detected.";
+const WRONG_COUNT = "D1_ERROR: Wrong number of parameter bindings for SQL query.";
+
+for (const date of ["2026-09-28", "2026-10-24"]) {
+  test(`${date}: bytes bind as a BLOB, and the parameters after them are kept`, async () => {
+    const DB = fresh(date);
+    await DB.exec("CREATE TABLE t (a TEXT, b BLOB, c TEXT)");
+    const insert = DB.prepare("INSERT INTO t VALUES (?, ?, ?)");
+    await insert.bind("u8", new Uint8Array([0, 255, 7]), "after").run();
+    await insert.bind("ab", new Uint8Array([1, 2]).buffer, "after").run();
+    await insert.bind("view", new DataView(new Uint8Array([9, 8, 7]).buffer, 1, 2), "after").run();
+    expect((await DB.prepare("SELECT a, hex(b) AS h, typeof(b) AS t, c FROM t ORDER BY rowid").all()).results).toEqual([
+      { a: "u8", h: "00FF07", t: "blob", c: "after" },
+      { a: "ab", h: "0102", t: "blob", c: "after" },
+      { a: "view", h: "0807", t: "blob", c: "after" },
+    ]);
+  });
+
+  test(`${date}: batch() is one transaction`, async () => {
+    const DB = fresh(date);
+    await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
+    expect(await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")]))).toMatch(/UNIQUE/);
+    expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
+  });
+}
+
+test("before 2026-10-24: synchronous, lenient, no foreign keys, BLOBs as one char per byte", () => {
+  const DB = fresh("2026-09-28");
+  const result = DB.prepare("SELECT 1 AS a").all();
+  expect(result.then).toBeUndefined();
+  expect(result.results).toEqual([{ a: 1 }]);
+  // (bun:sqlite has always refused a wrong parameter count here; the embedded transport has not.)
+  expect(DB.prepare("SELECT ?1 AS a").bind(undefined).first()).toEqual({ a: null });
+  expect(DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY); CREATE TABLE c (p INTEGER REFERENCES p(id))").count).toBe(1);
+  DB.prepare("INSERT INTO c VALUES (99)").run();
+  expect(DB.prepare("SELECT x'00ff' AS b").first("b")).toBe("\u0000ÿ");
+  expect(DB.prepare("SELECT 1 AS a").first("nope")).toBeUndefined();
+  expect(caught(() => DB.prepare("SELEC 1").all())).toMatch(/^sproutboat d1\.query: /);
+});
+
+test("from 2026-10-24: D1's parameter rules", async () => {
+  const DB = fresh("2026-10-24");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe("D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe("D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe("D1_TYPE_ERROR: Type 'bigint' not supported for value '10'");
+  expect(await failure(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(WRONG_COUNT);
+  expect(await failure(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(WRONG_COUNT);
+  expect(await failure(() => DB.prepare("SELECT ?1").all())).toBe(WRONG_COUNT);
+  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
+});
+
+test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", async () => {
+  const DB = fresh("2026-10-24");
+  await DB.exec("CREATE TABLE p (id INTEGER PRIMARY KEY)\nCREATE TABLE c (p INTEGER REFERENCES p(id))");
+  expect(await failure(() => DB.prepare("INSERT INTO c VALUES (99)").run())).toBe(
+    "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
+  );
+  await DB.prepare("INSERT INTO p VALUES (1)").run();
+  expect(await failure(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
+    "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
+  );
+  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
+  expect(await DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
+});
+
+test("from 2026-10-24: every query method returns a Promise", async () => {
+  const DB = fresh("2026-10-24");
+  const s = DB.prepare("SELECT 41 AS a");
+  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)]) expect(p).toBeInstanceOf(Promise);
+  expect(await s.first("a").then((a) => a + 1)).toBe(42);
+  expect(await Promise.all([s.first("a"), DB.prepare("SELECT 2 AS a").first("a")])).toEqual([41, 2]);
+  // Errors reject rather than throw: .catch() sees them.
+  expect(await DB.prepare("SELEC 1").all().catch((e) => e.message)).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
+});
+
+test("from 2026-10-24: results, meta, raw() and first() as in workerd", async () => {
+  const DB = fresh("2026-10-24");
+  await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, name TEXT)");
+  const inserted = await DB.prepare("INSERT INTO t (name) VALUES (?), (?)").bind("one", "two").run();
+  expect(Object.keys(inserted).sort()).toEqual(["meta", "results", "success"]);
+  expect(Object.keys(inserted.meta).sort()).toEqual(["changed_db", "changes", "duration", "last_row_id", "rows_read", "rows_written", "served_by", "size_after"]);
+  expect([inserted.meta.changes, inserted.meta.last_row_id, inserted.meta.changed_db, inserted.meta.rows_written]).toEqual([2, 2, true, 2]);
+  const read = await DB.prepare("SELECT id, name FROM t ORDER BY id").all();
+  expect([read.meta.changes, read.meta.changed_db, read.meta.rows_written]).toEqual([0, false, 0]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([[1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([["id", "name"], [1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id FROM t WHERE id > 9").raw({ columnNames: true })).toEqual([["id"]]);
+  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([["a", "a"], [1, 2]]);
+  expect((await DB.prepare("SELECT 1 AS a, 2 AS a").all()).results).toEqual([{ a: 2 }]);
+  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe("D1_COLUMN_NOTFOUND: Column not found (nope)");
+  expect(await DB.prepare("SELECT id FROM t WHERE id > 9").first("nope")).toBeNull();
+});
+
+test("from 2026-10-24: empty SQL, transactions, exec() and sessions as in workerd", async () => {
+  const DB = fresh("2026-10-24");
+  expect(await failure(() => DB.prepare("").all())).toBe(NO_STATEMENTS);
+  expect(await failure(() => DB.batch([]))).toBe(NO_STATEMENTS);
+  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(/^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/);
+  expect(await failure(() => DB.prepare("savepoint x").run())).toMatch(/^D1_ERROR: To execute a transaction/);
+  const done = await DB.exec("CREATE TABLE t (id INTEGER)\nINSERT INTO t VALUES (1);\n\nINSERT INTO t VALUES (2);\n");
+  expect([done.count, Number.isFinite(done.duration)]).toEqual([3, true]);
+  expect(await DB.exec("SELECT 1").then((r) => r.count)).toBe(1);
+  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(/^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/);
+  expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
+  const session = DB.withSession("first-unconstrained");
+  expect(await session.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
+  expect(session.getBookmark()).toBeNull();
+  expect(await session.batch([session.prepare("SELECT 1 AS a")]).then((r) => r[0].results)).toEqual([{ a: 1 }]);
+});

package/src/native-fetch-prelude.js

@@ -4809,56 +4809,236 @@ function __sbRpc(op, extra) {
 
 // D1: a Cloudflare-shaped `env.<DB>` (prepare / bind / all / run / raw / first,
 // plus batch and exec). Every call is one broker roundtrip.
+//
+// Bytes (an ArrayBuffer or a typed array) bind as a BLOB at every compatibility date:
+// before, they were stored as NULL. From compatibility date 2026-10-24 D1 calls are
+// strict, as in workerd: a parameter must be null, a number, a string, a boolean or
+// bytes (D1_TYPE_ERROR otherwise), the count must match the statement, foreign keys
+// are enforced, errors read "D1_ERROR: ...", and a BLOB comes back as an array of
+// byte values. Earlier dates keep the old behaviour.
+function __sbD1Strict() {
+  return globalThis.__sbCompat >= "2026-10-24";
+}
+function __sbD1Param(value, strict) {
+  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
+    const bytes = value instanceof ArrayBuffer ? new Uint8Array(value) : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++) hex += (bytes[i] < 16 ? "0" : "") + bytes[i].toString(16);
+    return { $blob: hex };
+  }
+  if (!strict || value === null || value === true || value === false || Object(value) instanceof Number || __sbIsStr(value)) return value;
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- workerd's D1_TYPE_ERROR names the value's typeof
+  throw new Error("D1_TYPE_ERROR: Type '" + typeof value + "' not supported for value '" + String(value) + "'");
+}
+function __sbD1Rpc(op, extra, strict) {
+  if (!strict) return __sbRpc(op, extra);
+  extra.strict = true;
+  try {
+    return __sbRpc(op, extra);
+  } catch (err) {
+    // "sproutboat d1.query: D1_ERROR: ..." -> "D1_ERROR: ...", as workerd words it.
+    const message = String((err && err.message) || err);
+    const at = message.indexOf("D1_");
+    throw new Error(at > 0 ? message.slice(at) : message);
+  }
+}
+// Strict replies carry columns and rows; build workerd's result objects from them.
+function __sbD1Rows(r) {
+  const rows = r.rows || [];
+  for (let i = 0; i < rows.length; i++)
+    for (let c = 0; c < rows[i].length; c++) {
+      const cell = rows[i][c];
+      if (__sbIsObj(cell) && __sbIsStr(cell.$blob)) {
+        const out = [];
+        for (let k = 0; k + 1 < cell.$blob.length; k += 2) out.push(parseInt(cell.$blob.slice(k, k + 2), 16));
+        rows[i][c] = out;
+      }
+    }
+  return rows;
+}
+function __sbD1Objects(columns, rows) {
+  const out = [];
+  for (let i = 0; i < rows.length; i++) {
+    const row = {};
+    for (let c = 0; c < columns.length; c++) row[columns[c]] = rows[i][c];
+    out.push(row);
+  }
+  return out;
+}
+function __sbD1Result(r, strict) {
+  if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+  return { results: __sbD1Objects(r.columns || [], __sbD1Rows(r)), success: true, meta: r.meta || {} };
+}
+function __sbD1Fail(message) {
+  return new Error(message);
+}
+// From 2026-10-24: workerd's surface. Every query method returns a Promise, meta has D1's
+// keys, raw() takes { columnNames }, first(name) checks the column, empty SQL and
+// transaction statements are refused, exec() runs line by line, and withSession() exists.
+var __sbD1NoTransactions =
+  "D1_ERROR: To execute a transaction, please use the state.storage.transaction() or state.storage.transactionSync() APIs instead of the SQL BEGIN TRANSACTION or SAVEPOINT statements. The JavaScript API is safer because it will automatically roll back on exceptions, and because it interacts correctly with Durable Objects' automatic atomic write coalescing.";
+function __sbD1Check(sql) {
+  const text = String(sql).trim();
+  if (!text) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+  if (/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) throw __sbD1Fail(__sbD1NoTransactions);
+}
+function __sbD1Meta(meta, started) {
+  const changes = Number(meta.changes) || 0;
+  return {
+    served_by: "sproutboat",
+    duration: Date.now() - started,
+    changes,
+    last_row_id: Number(meta.last_row_id) || 0,
+    changed_db: changes > 0,
+    size_after: 0,
+    rows_read: Number(meta.rows_read) || 0,
+    rows_written: changes,
+  };
+}
+// Columns and rows of a strict reply (an older broker answers with objects only).
+function __sbD1Table(r) {
+  if (r.columns) return { columns: r.columns, rows: __sbD1Rows(r) };
+  const objects = r.results || [];
+  const columns = objects.length ? Object.keys(objects[0]) : [];
+  const rows = [];
+  for (let i = 0; i < objects.length; i++) {
+    const row = [];
+    for (let c = 0; c < columns.length; c++) row.push(objects[i][columns[c]]);
+    rows.push(row);
+  }
+  return { columns, rows };
+}
+function __sbD1Promise(run) {
+  try {
+    return Promise.resolve(run());
+  } catch (err) {
+    return Promise.reject(err);
+  }
+}
 function __sbMakeD1(dbName) {
+  // The synchronous core: the answer to one statement as columns, rows and meta.
+  function query(sql, params, strict) {
+    if (strict) __sbD1Check(sql);
+    const started = Date.now();
+    const r = __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
+    if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+    const table = __sbD1Table(r);
+    return { columns: table.columns, rows: table.rows, meta: __sbD1Meta(r.meta || {}, started) };
+  }
   function stmt(sql, params) {
     const s = {
       __sql: sql,
       __params: params,
       bind() {
-        return stmt(sql, Array.prototype.slice.call(arguments));
+        const strict = __sbD1Strict();
+        const list = [];
+        for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
+        return stmt(sql, list);
       },
       all() {
-        const r = __sbRpc("d1.query", { db: dbName, sql, params });
-        return { results: r.results || [], success: true, meta: r.meta || {} };
+        if (!__sbD1Strict()) return query(sql, params, false);
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          return { success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) };
+        });
       },
       run() {
         return s.all();
       },
-      raw() {
-        const rows = s.all().results;
-        const out = [];
-        for (let i = 0; i < rows.length; i++) {
-          const cols = [];
-          for (const k in rows[i]) cols.push(rows[i][k]);
-          out.push(cols);
+      raw(options) {
+        if (!__sbD1Strict()) {
+          const rows = query(sql, params, false).results;
+          const out = [];
+          for (let i = 0; i < rows.length; i++) {
+            const cols = [];
+            for (const k in rows[i]) cols.push(rows[i][k]);
+            out.push(cols);
+          }
+          return out;
         }
-        return out;
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          return options && options.columnNames ? [t.columns].concat(t.rows) : t.rows;
+        });
       },
       first(column) {
-        const rows = s.all().results;
-        if (rows.length === 0) return null;
-        return column == null ? rows[0] : rows[0][column];
+        if (!__sbD1Strict()) {
+          const rows = query(sql, params, false).results;
+          if (rows.length === 0) return null;
+          return column == null ? rows[0] : rows[0][column];
+        }
+        return __sbD1Promise(() => {
+          const t = query(sql, params, true);
+          if (column == null) return t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null;
+          const at = t.columns.indexOf(String(column));
+          if (!t.rows.length) return null;
+          if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
+          return t.rows[0][t.columns.lastIndexOf(String(column))];
+        });
       },
     };
     return s;
   }
-  return {
+  function batch(statements) {
+    const strict = __sbD1Strict();
+    const list = [];
+    for (let i = 0; i < (statements || []).length; i++) {
+      if (strict) __sbD1Check(statements[i].__sql);
+      list.push({ sql: statements[i].__sql, params: statements[i].__params });
+    }
+    if (strict && !list.length) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+    const started = Date.now();
+    const r = __sbD1Rpc("d1.batch", { db: dbName, statements: list }, strict);
+    const out = [];
+    for (let i = 0; i < (r.results || []).length; i++) {
+      if (!strict) {
+        out.push(__sbD1Result(r.results[i], false));
+        continue;
+      }
+      const t = __sbD1Table(r.results[i]);
+      out.push({ success: true, meta: __sbD1Meta(r.results[i].meta || {}, started), results: __sbD1Objects(t.columns, t.rows) });
+    }
+    return out;
+  }
+  function exec(sql) {
+    if (!__sbD1Strict()) {
+      __sbRpc("d1.exec", { db: dbName, sql: String(sql) });
+      return { count: (String(sql).match(/;/g) || []).length, duration: 0 };
+    }
+    // workerd runs exec() line by line and counts the lines.
+    const started = Date.now();
+    const all = String(sql).trim().split("\n");
+    const lines = [];
+    for (let i = 0; i < all.length; i++) if (all[i].trim()) lines.push(all[i]);
+    if (!lines.length) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
+    __sbD1Rpc("d1.exec", { db: dbName, sql: lines.join("\n"), lines }, true);
+    return { count: lines.length, duration: Date.now() - started };
+  }
+  const db = {
     prepare(sql) {
       return stmt(String(sql), []);
     },
     batch(statements) {
-      const list = [];
-      for (let i = 0; i < (statements || []).length; i++)
-        list.push({ sql: statements[i].__sql, params: statements[i].__params });
-      const r = __sbRpc("d1.batch", { db: dbName, statements: list });
-      const out = [];
-      for (let i = 0; i < (r.results || []).length; i++)
-        out.push({ results: r.results[i].results || [], success: true, meta: r.results[i].meta || {} });
-      return out;
+      if (!__sbD1Strict()) return batch(statements);
+      return __sbD1Promise(() => batch(statements));
     },
     exec(sql) {
-      __sbRpc("d1.exec", { db: dbName, sql: String(sql) });
-      return { count: (String(sql).match(/;/g) || []).length, duration: 0 };
+      if (!__sbD1Strict()) return exec(sql);
+      return __sbD1Promise(() => exec(sql));
+    },
+    // workerd's D1 sessions (read replication). One database here, so a session is the
+    // database itself, and there is never a bookmark to return.
+    withSession() {
+      return {
+        prepare: db.prepare,
+        batch: db.batch,
+        getBookmark() {
+          return null;
+        },
+      };
+    },
+    dump() {
+      return Promise.reject(__sbD1Fail("D1_DUMP_ERROR: dump() is not supported; use backup()"));
     },
     // Sproutboat extension (not in CF Workers D1): an online, integrity-checked
     // snapshot of this database. Both transports implement it: standalone writes
@@ -4869,6 +5049,7 @@ function __sbMakeD1(dbName) {
       return { path: r.path, bytes: r.bytes };
     },
   };
+  return db;
 }
 
 // R2: a Cloudflare-shaped object. When `body` is present the sync accessors

package/src/transport-embedded.js

@@ -57,6 +57,10 @@ extern int sqlite3_changes(sqlite3*);
 extern int64_t sqlite3_last_insert_rowid(sqlite3*);
 extern const char* sqlite3_errmsg(sqlite3*);
 extern int sqlite3_close(sqlite3*);
+extern int sqlite3_bind_parameter_count(sqlite3_stmt*);
+extern int sqlite3_stmt_readonly(sqlite3_stmt*);
+extern int sqlite3_extended_errcode(sqlite3*);
+extern int sqlite3_error_offset(sqlite3*);
 
 // baronunread/sproutboat#176 — defined in render.js, alongside
 // porf_native_fetch_read_value (which every inline-C block below already
@@ -1293,6 +1297,19 @@ static void sb_putjson_text(sb_buf* b, const char* s, size_t n) {
 // binds as NULL rather than guessing.
 static const char* sb_skip_ws(const char* p) { while (*p == ' ' || *p == '\n' || *p == '\t' || *p == '\r') p++; return p; }
 
+static int sb_hex_nibble(char c) { return c >= 'a' ? c - 'a' + 10 : c >= 'A' ? c - 'A' + 10 : c - '0'; }
+// Past one JSON object (strings and nesting respected), or to the end of the text.
+static const char* sb_json_skip_object(const char* p) {
+  int depth = 0, quoted = 0;
+  for (; *p; p++) {
+    if (quoted) { if (*p == '\\' && p[1]) p++; else if (*p == '"') quoted = 0; continue; }
+    if (*p == '"') quoted = 1;
+    else if (*p == '{' || *p == '[') depth++;
+    else if ((*p == '}' || *p == ']') && --depth == 0) return p + 1;
+  }
+  return p;
+}
+
 static int sb_bind_params(sqlite3_stmt* st, const char* json) {
   const char* p = sb_skip_ws(json);
   if (*p != '[') return 0;
@@ -1338,6 +1355,25 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       free(out);
       continue;
     }
+    // {"$blob":"HEX"}: the bytes of a D1 bind (an ArrayBuffer or a typed array), bound
+    // as a BLOB. Any other object binds NULL. Before this an object stopped the parse,
+    // so a Uint8Array and every parameter after it were silently stored as NULL.
+    if (*p == '{') {
+      const char* end = sb_json_skip_object(p);
+      const char* hex = strstr(p, "\"$blob\":\"");
+      if (hex && hex < end) {
+        hex += 9;
+        size_t n = 0;
+        while (hex + 2 * n < end && hex[2 * n] != '"' && hex[2 * n + 1] != '"') n++;
+        unsigned char* bytes = (unsigned char*)malloc(n ? n : 1);
+        for (size_t i = 0; i < n; i++)
+          bytes[i] = (unsigned char)(sb_hex_nibble(hex[2 * i]) << 4 | sb_hex_nibble(hex[2 * i + 1]));
+        sqlite3_bind_blob(st, index++, bytes, (int)n, SB_SQLITE_TRANSIENT);
+        free(bytes);
+      } else sqlite3_bind_null(st, index++);
+      p = end;
+      continue;
+    }
     // number (or true/false, bound as 1/0)
     if (*p == 't') { sqlite3_bind_double(st, index++, 1); p += 4; continue; }
     if (*p == 'f') { sqlite3_bind_double(st, index++, 0); p += 5; continue; }
@@ -1349,7 +1385,7 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
       p = endp;
     }
   }
-  return 0;
+  return index - 1; // how many were bound
 }
 
 // --- R2 bodies, without the JSON detour or the SQLite detour ----------------
@@ -1909,6 +1945,14 @@ size_t sb_r2_transfer_download_read(sb_r2_transfer_ctx* ctx, size_t offset, char
 }
 void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx->file) fclose(ctx->file); free(ctx); } }
 
+// LTX capture (#141) failed after SQLite committed: the write is in the database but not in
+// the replication log, and the database refuses writes until the process restarts. Said as
+// such (SQLITE_IOERR), never as SQLite's own message, which still reads "not an error".
+#define SB_LTX_FAILED "LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart"
+static int sb_db_capture_failed(const char* path) {
+  for (int i = 0; i < sb_db_count; i++) if (strcmp(sb_db_names[i], path) == 0) return sb_ltx_states[i].failed;
+  return 0;
+}
 // Run a script: one or more statements separated by semicolons. sqlite3_exec
 // handles the whole string, which prepare/step does not — it compiles the first
 // statement and silently ignores the rest, so a schema built from one exec call
@@ -1916,9 +1960,10 @@ void sb_r2_transfer_download_close(sb_r2_transfer_ctx* ctx) { if (ctx) { if (ctx
 static char* sb_sql_script(const char* path, const char* sql) {
   sb_buf b = { 0, 0, 0 };
   int idx = sb_db_for(path);
+  if (idx < 0 && sb_db_capture_failed(path)) { sb_puts(&b, "{\"ok\":false,\"error\":\"" SB_LTX_FAILED "\",\"code\":10}"); return b.p; }
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   char* err = 0;
-  int script_rc = 0;
+  int script_rc = 0, capture_failed = 0;
   if (sb_ltx_states[idx].db) {
     const char *next = sql;
     while (*next && !script_rc) {
@@ -1926,38 +1971,60 @@ static char* sb_sql_script(const char* path, const char* sql) {
       script_rc = sqlite3_prepare_v2(sb_dbs[idx], next, -1, &st, &tail);
       if (!script_rc && st) { do { script_rc = sqlite3_step(st); } while (script_rc == SB_SQLITE_ROW); if (script_rc == SB_SQLITE_DONE) script_rc = 0; }
       if (st) sqlite3_finalize(st);
-      if (sb_ltx_after(idx)) script_rc = 10;
+      if (sb_ltx_after(idx)) { script_rc = 10; capture_failed = 1; }
       if (!tail || tail <= next) break;
       next = tail;
     }
   } else script_rc = sqlite3_exec(sb_dbs[idx], sql, 0, 0, &err);
   if (script_rc != 0) {
+    const char* m = capture_failed ? SB_LTX_FAILED : err ? err : sqlite3_errmsg(sb_dbs[idx]);
     sb_puts(&b, "{\"ok\":false,\"error\":");
-    sb_putjson_text(&b, err ? err : sqlite3_errmsg(sb_dbs[idx]), err ? strlen(err) : strlen(sqlite3_errmsg(sb_dbs[idx])));
-    sb_puts(&b, "}");
+    sb_putjson_text(&b, m, strlen(m));
+    sb_puts(&b, capture_failed ? ",\"code\":10}" : "}");
     return b.p;
   }
   sb_puts(&b, "{\"ok\":true}");
   return b.p;
 }
 
+// An error reply with SQLite's extended result code and, when SQLite knows it, the byte
+// offset of the error in the SQL (D1 reports both). A message of our own comes with its
+// own code (code < 0: take SQLite's).
+static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip) {
+  sb_buf e = { 0, 0, 0 };
+  const char* m = message ? message : sqlite3_errmsg(db);
+  sb_puts(&e, "{\"ok\":false,\"error\":");
+  sb_putjson_text(&e, m, strlen(m));
+  char tail[64];
+  int offset = message ? -1 : sqlite3_error_offset(db);
+  int k = snprintf(tail, sizeof(tail), ",\"code\":%d,\"offset\":%d}", code >= 0 ? code : sqlite3_extended_errcode(db), offset >= skip ? offset - skip : -1);
+  sb_put(&e, tail, (size_t)k);
+  return e.p;
+}
+
+// D1 calls from compatibility date 2026-10-24 put this comment first: the statement must
+// get exactly as many parameters as it has, like D1.
+#define SB_D1_STRICT "/*sb-d1-strict*/"
+
 // Run one statement. Returns malloc'd JSON:
 //   {"ok":true,"cols":[...],"rows":[[...]],"changes":n,"rowid":n}
-// or {"ok":false,"error":"..."}.
+// or {"ok":false,"error":"...","code":n,"offset":n}. In a D1 database (a path under
+// /d1/) a BLOB comes back as {"$blob":"HEX"}; elsewhere as one char per byte.
 static char* sb_sql_run(const char* path, const char* sql, const char* params) {
   sb_buf b = { 0, 0, 0 };
   int idx = sb_db_for(path);
+  if (idx < 0 && sb_db_capture_failed(path)) return sb_sql_error(0, SB_LTX_FAILED, 10, 0);
   if (idx < 0) { sb_puts(&b, "{\"ok\":false,\"error\":\"cannot open database\"}"); return b.p; }
   sqlite3* db = sb_dbs[idx];
+  const int strict = strncmp(sql, SB_D1_STRICT, sizeof(SB_D1_STRICT) - 1) == 0;
+  const int d1 = strstr(path, "/d1/") != 0;
   sqlite3_stmt* st = sb_stmt_get(idx, db, sql);
-  if (!st) {
-    sb_puts(&b, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&b, m, strlen(m));
-    sb_puts(&b, "}");
-    return b.p;
+  if (!st) return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
+  int bound = params && *params ? sb_bind_params(st, params) : 0;
+  if (strict && bound != sqlite3_bind_parameter_count(st)) {
+    sqlite3_reset(st);
+    return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
   }
-  if (params && *params) sb_bind_params(st, params);
 
   sb_puts(&b, "{\"ok\":true,\"cols\":[");
   int ncol = sqlite3_column_count(st);
@@ -1984,27 +2051,32 @@ static char* sb_sql_run(const char* path, const char* sql, const char* params) {
       }
       const unsigned char* txt = sqlite3_column_text(st, i);
       int n = sqlite3_column_bytes(st, i);
-      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte.
-      if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
+      // TEXT is UTF-8 and decodes (#189); a BLOB stays one char per byte, or is hex in D1.
+      if (t == 4 && d1) {
+        static const char* digits = "0123456789abcdef";
+        const unsigned char* bytes = (const unsigned char*)sqlite3_column_blob(st, i);
+        sb_puts(&b, "{\"$blob\":\"");
+        for (int j = 0; j < n; j++) { char pair[2] = { digits[bytes[j] >> 4], digits[bytes[j] & 15] }; sb_put(&b, pair, 2); }
+        sb_puts(&b, "\"}");
+      }
+      else if (t == 4) sb_putjson(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
       else sb_putjson_text(&b, txt ? (const char*)txt : "", txt ? (size_t)n : 0);
     }
     sb_puts(&b, "]");
   }
   char tail[96];
-  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
+  // A read-only statement changed nothing: sqlite3_changes still holds the last write's count.
+  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
   sb_put(&b, tail, (size_t)k);
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
-  if (sb_ltx_after(idx)) rc = 10;
+  const int capture_failed = sb_ltx_after(idx) != 0;
+  if (capture_failed) rc = 10;
   if (rc != SB_SQLITE_DONE && rc != SB_SQLITE_ROW) {
     free(b.p);
-    sb_buf e = { 0, 0, 0 };
-    sb_puts(&e, "{\"ok\":false,\"error\":");
-    const char* m = sqlite3_errmsg(db);
-    sb_putjson_text(&e, m, strlen(m));
-    sb_puts(&e, "}");
-    return e.p;
+    if (capture_failed) return sb_sql_error(db, SB_LTX_FAILED, 10, 0);
+    return sb_sql_error(db, 0, -1, strict ? (int)sizeof(SB_D1_STRICT) - 1 : 0);
   }
   return b.p;
 }
@@ -3513,19 +3585,20 @@ function __sbEmbeddedDispatch(msg) {
     if (op === "d1.exec") {
       // exec() takes a script; a single prepare would run only its first
       // statement and quietly drop the rest.
+      __sbD1Open(path, msg.strict === true);
+      if (msg.strict === true && Array.isArray(msg.lines)) {
+        __sbD1ExecLines(path, msg.lines);
+        return { ok: true };
+      }
       const reply = JSON.parse(__sbSqlScriptRaw(path, String(msg.sql)));
       if (reply.ok === false) throw new Error("sqlite: " + reply.error);
       return { ok: true };
     }
-    if (op === "d1.batch") {
-      const results = [];
-      const list = msg.statements || [];
-      for (let i = 0; i < list.length; i++)
-        results.push(__sbD1Run(path, list[i].sql, list[i].params));
-      return { ok: true, results };
-    }
-    const one = __sbD1Run(path, msg.sql, msg.params);
-    return { ok: true, results: one.results, meta: one.meta, success: true };
+    const strict = msg.strict === true;
+    __sbD1Open(path, strict);
+    if (op === "d1.batch") return { ok: true, results: __sbD1Batch(path, msg.statements || [], strict) };
+    const one = __sbD1Run(path, msg.sql, msg.params, strict);
+    return { ok: true, results: one.results, columns: one.columns, rows: one.rows, meta: one.meta, success: true };
   }
 
   if (op === "d1.backup") {
@@ -3979,16 +4052,111 @@ function __sbEmbeddedDispatch(msg) {
 }
 
 /** One D1 statement, shaped like the broker's d1Run. */
-function __sbD1Run(path, sql, params) {
-  const r = __sbSql(path, String(sql), params || []);
+// BEGIN D1 OPS (lifted by test/native-d1.ts)
+// D1 calls from compatibility date 2026-10-24 come with msg.strict (the shim sets it):
+// exact parameter counts, foreign keys enforced, D1's error text, and rows as arrays with
+// their column names (the shim builds the objects, so duplicate names survive in raw()).
+// A BLOB comes from C as {"$blob":"HEX"}; strict calls get it so, older ones get the one
+// char per byte string they always had.
+var __sbD1Opened = {};
+function __sbD1Open(path, strict) {
+  if (__sbD1Opened[path] === strict) return;
+  __sbD1Opened[path] = strict;
+  __sbSql(path, strict ? "PRAGMA foreign_keys = ON" : "PRAGMA foreign_keys = OFF", []);
+}
+var __sbSqliteCodes = ["", "SQLITE_ERROR", "SQLITE_INTERNAL", "SQLITE_PERM", "SQLITE_ABORT", "SQLITE_BUSY",
+  "SQLITE_LOCKED", "SQLITE_NOMEM", "SQLITE_READONLY", "SQLITE_INTERRUPT", "SQLITE_IOERR", "SQLITE_CORRUPT",
+  "SQLITE_NOTFOUND", "SQLITE_FULL", "SQLITE_CANTOPEN", "SQLITE_PROTOCOL", "SQLITE_EMPTY", "SQLITE_SCHEMA",
+  "SQLITE_TOOBIG", "SQLITE_CONSTRAINT", "SQLITE_MISMATCH", "SQLITE_MISUSE", "SQLITE_NOLFS", "SQLITE_AUTH",
+  "SQLITE_FORMAT", "SQLITE_RANGE", "SQLITE_NOTADB"];
+var __sbSqliteConstraints = { 275: "CHECK", 531: "COMMITHOOK", 787: "FOREIGNKEY", 1043: "FUNCTION",
+  1299: "NOTNULL", 1555: "PRIMARYKEY", 1811: "TRIGGER", 2067: "UNIQUE", 2323: "VTAB", 2579: "ROWID",
+  2835: "PINNED", 3091: "DATATYPE" };
+function __sbD1Error(reply) {
+  const code = Number(reply.code) || 0;
+  const base = __sbSqliteCodes[code & 255] || "";
+  let text = "D1_ERROR: " + reply.error;
+  if (reply.offset >= 0) text += " at offset " + reply.offset;
+  if (base) {
+    text += ": " + base;
+    if (__sbSqliteConstraints[code]) text += " (extended: SQLITE_CONSTRAINT_" + __sbSqliteConstraints[code] + ")";
+  }
+  return new Error(text);
+}
+function __sbD1Bytes(cell) {
+  let out = "";
+  const hex = String(cell.$blob);
+  for (let i = 0; i + 1 < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+function __sbD1Run(path, sql, params, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, (strict ? "/*sb-d1-strict*/" : "") + String(sql), JSON.stringify(params || [])));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+  const meta = { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length };
+  if (strict) return { columns: r.cols, rows: r.rows, meta };
   const results = [];
   for (let i = 0; i < r.rows.length; i++) {
     const row = {};
-    for (let c = 0; c < r.cols.length; c++) row[r.cols[c]] = r.rows[i][c];
+    for (let c = 0; c < r.cols.length; c++) {
+      const cell = r.rows[i][c];
+      row[r.cols[c]] = cell !== null && Object(cell) === cell ? __sbD1Bytes(cell) : cell;
+    }
     results.push(row);
   }
-  return { results, meta: { changes: r.changes, last_row_id: r.rowid, rows_read: r.rows.length } };
+  return { results, meta };
+}
+// One statement of our own (SAVEPOINT, RELEASE, ...), failing in the caller's terms.
+function __sbD1Control(path, sql, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, sql, "[]"));
+  if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// Undo after a failure, best effort: the error the caller sees is the first one. If LTX
+// capture failed, SQLite may already have committed; that error says so, and the database
+// stays closed to writes (the capture latch), so a cleanup failure must not replace it.
+function __sbD1Undo(path, savepoint) {
+  try {
+    __sbD1Control(path, "ROLLBACK TO " + savepoint, false);
+    __sbD1Control(path, "RELEASE " + savepoint, false);
+  } catch (ignored) {
+    return ignored;
+  }
+  return null;
+}
+// One transaction, like D1: a statement that fails undoes the ones before it.
+function __sbD1Batch(path, list, strict) {
+  const results = [];
+  __sbD1Control(path, "SAVEPOINT sb_d1_batch", strict);
+  try {
+    for (let i = 0; i < list.length; i++) results.push(__sbD1Run(path, list[i].sql, list[i].params, strict));
+  } catch (err) {
+    __sbD1Undo(path, "sb_d1_batch");
+    throw err;
+  }
+  __sbD1Release(path, "sb_d1_batch", strict);
+  return results;
+}
+// RELEASE of our outermost savepoint is the commit. A deferred constraint can fail it and
+// leave the transaction open: undo it. A capture failure (code 10) comes after SQLite has
+// committed: nothing to undo, and that error is the one to report.
+function __sbD1Release(path, savepoint, strict) {
+  const r = JSON.parse(__sbSqlRaw(path, "RELEASE " + savepoint, "[]"));
+  if (r.ok !== false) return;
+  if (Number(r.code) !== 10) __sbD1Undo(path, savepoint);
+  throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
+}
+// exec() from 2026-10-24: line by line as workerd runs it, all or nothing.
+function __sbD1ExecLines(path, lines) {
+  __sbD1Control(path, "SAVEPOINT sb_d1_exec", true);
+  for (let i = 0; i < lines.length; i++) {
+    const reply = JSON.parse(__sbSqlScriptRaw(path, String(lines[i])));
+    if (reply.ok === false) {
+      if (Number(reply.code) !== 10) __sbD1Undo(path, "sb_d1_exec");
+      throw new Error("D1_EXEC_ERROR: Error in line " + (i + 1) + ": " + lines[i] + ": " + reply.error);
+    }
+  }
+  __sbD1Release(path, "sb_d1_exec", true);
 }
+// END D1 OPS
 
 /**
  * R2 object bodies, out of band (#56).

package/test/native-d1.ts

@@ -0,0 +1,300 @@
+import assert from "node:assert/strict";
+import { closeSync, openSync, readFileSync, readdirSync, readSync, writeSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// The embedded transport's SQL runner (sb_sql_run and sb_bind_params), compiled from the
+// transport's own inline C against the system SQLite, the way native-ltx.ts does. Only
+// the C up to the D1 backup code is needed; the few runtime symbols it names are stubbed.
+const transport = await readFile(new URL("../src/transport-embedded.js", import.meta.url), "utf8");
+const start = transport.indexOf("Porffor.c`\n") + "Porffor.c`\n".length;
+const end = transport.indexOf("// #164 — an online");
+assert(start > 20 && end > start, "transport C block markers moved");
+const work = await mkdtemp(join(tmpdir(), "sb-native-d1-"));
+try {
+  await writeFile(
+    join(work, "bearssl.h"),
+    `typedef struct { int x; } br_sha256_context;
+static void br_sha256_init(br_sha256_context* c) { (void)c; }
+static void br_sha256_update(br_sha256_context* c, const void* d, unsigned long n) { (void)c; (void)d; (void)n; }
+static void br_sha256_out(const br_sha256_context* c, void* o) { (void)c; (void)o; }
+`,
+  );
+  await writeFile(join(work, "block.c"), transport.slice(start, end));
+  await writeFile(
+    join(work, "driver.c"),
+    `#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <time.h>
+#include <sys/stat.h>
+typedef struct { double val; int type; } jsval;
+typedef uint32_t u32;
+static uint32_t porf_native_fetch_alloc_bytestring(const char* d, size_t n) { (void)d; (void)n; return 0; }
+#include "block.c"
+const char* sb_standalone_app_name(void) { return "test"; }
+// One call per line: PATH \\t SQL \\t PARAMS_JSON; one reply line each. ":break PATH" makes
+// PATH's next LTX capture fail (native-ltx.ts's :break-position).
+int main(void) {
+  sb_ltx_compat = 1;  // __sbLtxConfigure at compatibility date 2026-10-22 or later
+  char* line = 0; size_t cap = 0;
+  while (getline(&line, &cap, stdin) > 0) {
+    line[strcspn(line, "\\n")] = 0;
+    if (!strncmp(line, ":break ", 7)) { line[strcspn(line, "\\t")] = 0; char p[1024]; snprintf(p, sizeof(p), "%s.ltx/position.tmp", line + 7); mkdir(p, 0700); puts("{}"); fflush(stdout); continue; }
+    char* sql = strchr(line, '\\t'); if (!sql) return 2; *sql++ = 0;
+    char* params = strchr(sql, '\\t'); if (!params) return 2; *params++ = 0;
+    // ":script PATH" runs SQL as a script (sb_sql_script, what exec() uses).
+    char* out = !strncmp(line, ":script ", 8) ? sb_sql_script(line + 8, sql) : sb_sql_run(line, sql, params); puts(out); fflush(stdout); free(out);
+  }
+  return 0;
+}
+`,
+  );
+  const binary = join(work, "driver");
+  const compile = Bun.spawnSync(["cc", "-O1", "-w", "-I", work, join(work, "driver.c"), "-lsqlite3", "-o", binary]);
+  assert.equal(compile.exitCode, 0, compile.stderr.toString());
+
+  const d1 = join(work, "data/d1/DB.sqlite");
+  const store = join(work, "data/store.sqlite");
+  const run = (calls: [string, string, unknown[]][]) => {
+    const input = calls.map(([path, sql, params]) => `${path}\t${sql}\t${JSON.stringify(params)}\n`).join("");
+    const p = Bun.spawnSync([binary], { stdin: Buffer.from(input) });
+    assert.equal(p.exitCode, 0, p.stderr.toString());
+    return p.stdout
+      .toString()
+      .trim()
+      .split("\n")
+      .map((l) => JSON.parse(l));
+  };
+  const blob = (bytes: number[]) => ({ $blob: Buffer.from(bytes).toString("hex") });
+
+  // A Uint8Array bind used to stop the parameter parse: it, and every parameter after it,
+  // were stored as NULL (data loss).
+  const [, , stored, other] = run([
+    [d1, "CREATE TABLE t (a TEXT, b BLOB, c TEXT)", []],
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", ["k", blob([0, 255, 127, 0x22]), "after"]],
+    [d1, "SELECT a, b, typeof(b) AS bt, length(b) AS bl, c FROM t", []],
+    [store, "SELECT x'00ff' AS b", []],
+  ]);
+  assert.deepEqual(
+    stored.rows,
+    [["k", { $blob: "00ff7f22" }, "blob", 4, "after"]],
+    "blob stored as a BLOB, later parameters kept",
+  );
+  assert.equal(other.rows[0][0], String(other.rows[0][0]), "outside D1 a BLOB is still one char per byte, not hex");
+
+  // An object that is not a blob binds NULL and the parse carries on (a "}" in a string included).
+  const [, kept] = run([
+    [d1, "INSERT INTO t VALUES (?1, ?2, ?3)", [{ a: "}{" }, 5, "x"]],
+    [d1, "SELECT a, b, c FROM t WHERE c = 'x'", []],
+  ]);
+  assert.deepEqual(kept.rows, [[null, 5, "x"]]);
+
+  // Strict D1 calls (compatibility date 2026-10-24) check the parameter count.
+  const [few, many, right, reuse] = run([
+    [d1, "/*sb-d1-strict*/SELECT ?1, ?2", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1", [1, 2]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a", [1]],
+    [d1, "/*sb-d1-strict*/SELECT ?1 AS a, ?1 AS b, ?2 AS c", ["x", "y"]],
+  ]);
+  assert.equal(few.ok, false);
+  assert.equal(few.error, "Wrong number of parameter bindings for SQL query.");
+  assert.equal(many.ok, false);
+  assert.deepEqual(right.rows, [[1]]);
+  assert.deepEqual(reuse.rows, [["x", "x", "y"]]);
+  const [loose] = run([[d1, "SELECT ?1 AS a, ?2 AS b", [1]]]);
+  assert.deepEqual(loose.rows, [[1, null]], "without the marker a missing parameter is NULL, as before");
+
+  // Errors carry SQLite's extended code and the offset in the caller's SQL.
+  const [syntax, unique] = run([
+    [d1, "/*sb-d1-strict*/SELEC 1", []],
+    [d1, "CREATE TABLE u (id INTEGER PRIMARY KEY); INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(syntax.ok, false);
+  assert.equal(syntax.code, 1);
+  assert.equal(syntax.offset, 0);
+  assert.equal(unique.ok, true);
+  const [, dup] = run([
+    [d1, "INSERT INTO u VALUES (1)", []],
+    [d1, "INSERT INTO u VALUES (1)", []],
+  ]);
+  assert.equal(dup.ok, false);
+  assert.equal(dup.code, 1555, "SQLITE_CONSTRAINT_PRIMARYKEY");
+
+  // A read reports no changes, not the last write's.
+  const [write, read] = run([
+    [d1, "INSERT INTO t (a) VALUES ('z')", []],
+    [d1, "SELECT count(*) FROM t", []],
+  ]);
+  assert.equal(write.changes, 1);
+  assert.equal(read.changes, 0);
+  // The transport's D1 ops (JS), on the same C: lifted from BEGIN/END D1 OPS.
+  const opsStart = transport.indexOf("// BEGIN D1 OPS");
+  const opsEnd = transport.indexOf("// END D1 OPS");
+  assert(opsStart > 0 && opsEnd > opsStart, "D1 ops markers moved");
+  // One long-lived driver, so a SAVEPOINT spans calls as it does in a worker: FIFOs give
+  // the lifted (synchronous) ops a synchronous line protocol.
+  const fifoIn = join(work, "in"),
+    fifoOut = join(work, "out");
+  assert.equal(Bun.spawnSync(["mkfifo", fifoIn, fifoOut]).exitCode, 0);
+  const driver = Bun.spawn(["sh", "-c", `exec "${binary}" < "${fifoIn}" > "${fifoOut}"`], {
+    env: { ...process.env, SB_LTX_ENABLE: "1", SB_LTX_DATABASE: "LTX" },
+  });
+  const toDriver = openSync(fifoIn, "w"),
+    fromDriver = openSync(fifoOut, "r");
+  let pending = "";
+  const sqlRaw = (path: string, sql: string, params: string) => {
+    writeSync(toDriver, `${path}\t${sql}\t${params}\n`);
+    const chunk = Buffer.alloc(65536);
+    while (!pending.includes("\n")) {
+      const n = readSync(fromDriver, chunk, 0, chunk.length, null);
+      if (n <= 0) throw new Error("driver exited");
+      pending += chunk.toString("utf8", 0, n);
+    }
+    const line = pending.slice(0, pending.indexOf("\n"));
+    pending = pending.slice(line.length + 1);
+    return line;
+  };
+  const sql = (path: string, text: string, params: unknown[]) => {
+    const r = JSON.parse(sqlRaw(path, text, JSON.stringify(params)));
+    if (r.ok === false) throw new Error("sqlite: " + r.error);
+    return r;
+  };
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const scriptRaw = (path: string, text: string) => sqlRaw(":script " + path, text, "[]");
+  const ops = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    "__sbSqlScriptRaw",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch, __sbD1Open, __sbD1ExecLines };`,
+  )(sqlRaw, sql, scriptRaw);
+  // exec() from 2026-10-24: line by line, all or nothing, the failing line named.
+  const ex = join(work, "data/d1/EXEC.sqlite");
+  ops.__sbD1ExecLines(ex, ["CREATE TABLE x (id INTEGER)", "INSERT INTO x VALUES (1); INSERT INTO x VALUES (2);"]);
+  assert.throws(
+    () => ops.__sbD1ExecLines(ex, ["INSERT INTO x VALUES (3);", "SELEC 2"]),
+    (e: Error) => e.message === 'D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error',
+  );
+  assert.equal(ops.__sbD1Run(ex, "SELECT count(*) AS n FROM x", [], false).results[0].n, 2, "exec rolled back");
+  const db2 = join(work, "data/d1/OPS.sqlite");
+  ops.__sbD1Run(db2, "CREATE TABLE p (id INTEGER PRIMARY KEY)", [], false);
+  ops.__sbD1Run(db2, "CREATE TABLE c (id INTEGER PRIMARY KEY, p INTEGER REFERENCES p(id))", [], false);
+  // batch() is one transaction: the failing second insert undoes the first.
+  assert.throws(
+    () =>
+      ops.__sbD1Batch(
+        db2,
+        [
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+          { sql: "INSERT INTO p VALUES (5)", params: [] },
+        ],
+        false,
+      ),
+    /UNIQUE/,
+  );
+  assert.equal(ops.__sbD1Run(db2, "SELECT count(*) AS n FROM p", [], false).results[0].n, 0, "batch rolled back");
+  assert.equal(
+    ops.__sbD1Batch(
+      db2,
+      [
+        { sql: "INSERT INTO p VALUES (1)", params: [] },
+        { sql: "INSERT INTO p VALUES (2)", params: [] },
+      ],
+      false,
+    ).length,
+    2,
+  );
+  // Old dates: no foreign keys, a BLOB read as one char per byte, errors as before.
+  ops.__sbD1Open(db2, false);
+  ops.__sbD1Run(db2, "INSERT INTO c VALUES (1, 99)", [], false);
+  const oldBlob = ops.__sbD1Run(db2, "SELECT ?1 AS b", [{ $blob: "00ff" }], false).results[0].b;
+  assert.equal(oldBlob, "\u0000ÿ");
+  assert.throws(() => ops.__sbD1Run(db2, "SELEC 1", [], false), /^Error: sqlite: near "SELEC": syntax error$/);
+  // Strict (2026-10-24): foreign keys on, rows with columns, D1's error text.
+  ops.__sbD1Open(db2, true);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO c VALUES (2, 98)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: FOREIGN KEY constraint failed: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_FOREIGNKEY)",
+  );
+  const strictRow = ops.__sbD1Run(db2, "SELECT 1 AS a, ?1 AS a", [{ $blob: "0a" }], true);
+  assert.deepEqual([strictRow.columns, strictRow.rows], [["a", "a"], [[1, { $blob: "0a" }]]]);
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELEC 1", [], true),
+    (e: Error) => e.message === 'D1_ERROR: near "SELEC": syntax error at offset 0: SQLITE_ERROR',
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "INSERT INTO p VALUES (1)", [], true),
+    (e: Error) =>
+      e.message ===
+      "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(db2, "SELECT ?1", [], true),
+    (e: Error) => e.message === "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  // LTX capture on (SB_LTX_ENABLE, database LTX): a batch is one commit, and a capture
+  // that fails at RELEASE (after SQLite committed) surfaces as itself: SQLITE_IOERR with a
+  // message that says so, never "no such savepoint" from the cleanup, and the database then
+  // refuses writes until restart.
+  const ltx = join(work, "data/d1/LTX.sqlite");
+  const generation = () => join(ltx + ".ltx", readFileSync(ltx + ".ltx/position", "utf8").split("\n")[1]);
+  const ltxFiles = () => readdirSync(generation()).filter((n) => n.endsWith(".ltx")).length;
+  ops.__sbD1Open(ltx, true);
+  ops.__sbD1Run(ltx, "CREATE TABLE e (id INTEGER PRIMARY KEY, v TEXT)", [], true);
+  const beforeBatch = ltxFiles();
+  ops.__sbD1Batch(
+    ltx,
+    [
+      { sql: "INSERT INTO e VALUES (1, 'a')", params: [] },
+      { sql: "INSERT INTO e VALUES (2, 'b')", params: [] },
+    ],
+    true,
+  );
+  assert.equal(ltxFiles(), beforeBatch + 1, "a batch is one LTX commit");
+  // Break capture just before the batch's RELEASE.
+  // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
+  const breaking = new Function(
+    "__sbSqlRaw",
+    "__sbSql",
+    "__sbSqlScriptRaw",
+    `${transport.slice(opsStart, opsEnd)}\nreturn { __sbD1Run, __sbD1Batch };`,
+  )((path: string, text: string, params: string) => {
+    if (text === "RELEASE sb_d1_batch") sqlRaw(":break " + path, "", "");
+    return sqlRaw(path, text, params);
+  }, sql, scriptRaw);
+  const LTX_FAILED =
+    "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR";
+  assert.throws(
+    () => breaking.__sbD1Batch(ltx, [{ sql: "INSERT INTO e VALUES (3, 'c')", params: [] }], true),
+    (e: Error) => e.message === LTX_FAILED,
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "INSERT INTO e VALUES (4, 'd')", [], true),
+    (e: Error) => e.message === LTX_FAILED,
+    "writes refused after a capture failure",
+  );
+  assert.throws(
+    () => ops.__sbD1Run(ltx, "SELECT 1", [], false),
+    /^Error: sqlite: LTX capture failed/,
+    "old dates see the same failure",
+  );
+  assert.throws(
+    () => ops.__sbD1ExecLines(ltx, ["INSERT INTO e VALUES (5, 'e')"]),
+    (e: Error) => e.message === "D1_ERROR: LTX capture failed: the transaction may be committed locally but is not durable in the replication log; writes are refused until restart: SQLITE_IOERR",
+    "exec() after a capture failure",
+  );
+  closeSync(toDriver);
+  closeSync(fromDriver);
+  await driver.exited;
+  console.log(
+    "native d1: sb_sql_run and the D1 ops pass (blob binds, atomic batch, strict counts, foreign keys, error text)",
+  );
+} finally {
+  await rm(work, { recursive: true, force: true });
+}

package/test/native-ltx.ts

@@ -247,6 +247,65 @@ try {
     assert.deepEqual(await readdir(join(root, epoch)), finishedBefore, "idle restart must not rewrite a base");
     assert.equal((await readdir(root)).filter((n) => n.startsWith("epoch-")).length, 1);
   }
+  // A D1 batch() (__sbD1Batch) is a SAVEPOINT around its statements, each its own call,
+  // then RELEASE: one transaction, so one LTX file with the next TXID. A rolled-back batch
+  // (ROLLBACK TO, then RELEASE) commits the pages it touched back unchanged: at most one
+  // more LTX file, and the restored database has none of its rows.
+  {
+    const batchPath = join(work, "batch.sqlite");
+    await run(batchPath, "CREATE TABLE b(id INTEGER PRIMARY KEY,value TEXT);\n");
+    const batchRoot = batchPath + ".ltx";
+    const batchEpoch = (await readdir(batchRoot)).find((n) => n.startsWith("epoch-"));
+    assert(batchEpoch);
+    const ltxFiles = async () => (await readdir(join(batchRoot, batchEpoch))).filter((n) => n.endsWith(".ltx")).sort();
+    const before = await ltxFiles();
+    const lastTxid = BigInt("0x" + before[before.length - 1].split("-")[0]);
+    const replies = await run(
+      batchPath,
+      "SAVEPOINT sb_d1_batch;\nINSERT INTO b VALUES(1,'one');\nINSERT INTO b VALUES(2,'two');\nRELEASE sb_d1_batch;\n",
+    );
+    assert(
+      replies.every((n) => n.startsWith("0 ")),
+      replies.join("\n"),
+    );
+    const after = await ltxFiles();
+    const added = after.filter((n) => !before.includes(n));
+    assert.equal(added.length, 1, "a batch is one LTX file: " + added.join(", "));
+    const [minTxid, maxTxid] = added[0]
+      .replace(".ltx", "")
+      .split("-")
+      .map((h) => BigInt("0x" + h));
+    assert.equal(minTxid, lastTxid + 1n);
+    assert.equal(maxTxid, lastTxid + 1n);
+    const rolledBack = await run(
+      batchPath,
+      "SAVEPOINT sb_d1_batch;\nINSERT INTO b VALUES(3,'three');\nROLLBACK TO sb_d1_batch;\nRELEASE sb_d1_batch;\n",
+    );
+    assert(
+      rolledBack.every((n) => n.startsWith("0 ")),
+      rolledBack.join("\n"),
+    );
+    const afterRollback = await ltxFiles();
+    assert(afterRollback.length <= after.length + 1, "a rolled-back batch writes at most one LTX file");
+    // If it writes one, it holds page 1 only (SQLite bumps the header of the page it had
+    // dirtied: the file change counter and version-valid-for number, bytes 24-27 and 92-95,
+    // so the pre- and post-apply checksums differ); the rows are checked below.
+    for (const name of afterRollback.filter((n) => !after.includes(n))) {
+      const b = new Uint8Array(await readFile(join(batchRoot, batchEpoch, name)));
+      const v = new DataView(b.buffer, b.byteOffset, b.byteLength);
+      assert.equal(v.getUint32(100), 1, "first page of the rolled-back batch's LTX file");
+      assert.equal(v.getUint32(106 + 4 + v.getUint32(106)), 0, "the rolled-back batch's LTX file holds one page");
+    }
+    const batchRestore = join(work, "batch-restored.sqlite");
+    await restore(join(batchRoot, batchEpoch), batchRestore);
+    assert.deepEqual(await readFile(batchRestore), await readFile(batchPath));
+    const check = new Database(batchRestore);
+    assert.deepEqual(check.query("SELECT id, value FROM b ORDER BY id").all(), [
+      { id: 1, value: "one" },
+      { id: 2, value: "two" },
+    ]);
+    check.close();
+  }
   // Size alone is not enough: an offline committed change must invalidate a clean marker.
   const offline = new Database(path);
   offline.exec("UPDATE t SET value='changed-offline' WHERE id=1");