@sproutboat/runtime 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @sproutboat/runtime
 
+## 0.27.0
+
+### Minor Changes
+
+- 9be9c74: R2 matches workerd from compatibility date `2026-10-26`:
+  
+  - `get`, `put`, `head`, `delete`, `list` and `createMultipartUpload` return Promises, and errors reject them.
+  - An object's `etag` is the MD5 of its bytes, with `checksums.md5`. Objects written before keep their old etag.
+  - Objects have `uploaded` as a `Date`, `version`, `storageClass`, `range` and `writeHttpMetadata(headers)`. A body has `body` (a `ReadableStream`), `bodyUsed`, `text()`, `json()`, `arrayBuffer()` and `blob()`.
+  - `get(key, { range, onlyIf })` takes `{ offset, length }`, `{ suffix }` or a `Range` header, and `etagMatches`, `etagDoesNotMatch`, `uploadedBefore`, `uploadedAfter` or `If-*` headers. When the condition fails it returns the object without a body.
+  - `put(key, value, { onlyIf, httpMetadata })` takes a `ReadableStream` or a `Blob`, and `httpMetadata` as `Headers`. When the condition fails it returns `null`.
+  - `delete([keys])` deletes several keys.
+  - `list({ prefix, limit, cursor, delimiter, include })` pages at up to 1,000 entries, groups keys into `delimitedPrefixes`, and returns `httpMetadata` and `customMetadata` only when `include` asks for them.
+  - A value of the wrong type and a key longer than 1,024 bytes fail with R2's errors.
+  
+  Earlier dates keep the synchronous shim. One change applies at every date: **a `list()` prefix now matches exactly.** It used SQL `LIKE`, so it ignored case and read `_` and `%` as wildcards. Both transports store an object's MD5 in a new column, added to existing stores when they open.
+  
+  Against miniflare 4.20260730, `conformance/bindings/r2.js` in sproutd passes 48/48 at `2026-10-26` (16/48 before).
+
+## 0.26.0
+
+### Minor Changes
+
+- 9b15539: KV matches workerd from compatibility date `2026-10-25`:
+  
+  - `get`, `getWithMetadata`, `put`, `delete` and `list` return Promises, and errors reject them.
+  - `get(key, type)` takes `"text"`, `"json"`, `"arrayBuffer"` and `"stream"`, and `get([keys])` returns a `Map`.
+  - `getWithMetadata(key, type)` returns `{ value, metadata, cacheStatus }`.
+  - `put(key, value, { expiration, expirationTtl, metadata })` takes strings, bytes and `ReadableStream`s, and stores the metadata.
+  - `list({ prefix, limit, cursor })` returns `{ keys: [{ name, expiration?, metadata? }], list_complete, cursor?, cacheStatus }` and pages at up to 1,000 keys.
+  - Keys, values, expirations, metadata and list limits fail with KV's own errors. For example: `Key name cannot be empty.`, `KV PUT failed: 414 UTF-8 encoded length of 513 exceeds key length limit of 512.`, `KV PUT failed: 400 Invalid expiration_ttl of 30. Expiration TTL must be at least 60.`, and `KV PUT failed: 413 Metadata length of 1110 exceeds limit of 1024.`
+  
+  Earlier dates keep the synchronous shim. Two changes apply at every date:
+  
+  - **A `list()` prefix now matches exactly.** It used SQL `LIKE`, so it ignored case and read `_` and `%` as wildcards. For example, the prefix `a_` also listed `ab`, and `a` also listed `AB`.
+  - **Both transports store KV metadata in a new column.** It's added to existing stores when they open.
+
+### Patch Changes
+
+- 1c36119: Create the LTX page-index scratch file inside the database's replication spool
+  instead of libc's global temporary directory, fixing capture initialization when
+  a worker's filesystem sandbox permits writes only beneath its own state directory.
+  The scratch file is private and immediately unlinked. If a kill lands before
+  unlink, the next capture-lock owner removes the stale regular index file before
+  recovery. After unlink, closing the writer or killing the process releases it.
+  Its anonymous transient disk use is not counted by the
+  directory-walk quota. Capture retains its existing explicit opt-in and compatibility
+  date of 2026-10-22; capture-off apps and earlier dates keep their existing behavior.
+- 3cad1f0: The storage quota counts a D1 database's WAL file, which can hold space the app has already freed. While the app is over its quota, the runtime now checkpoints and truncates each D1 database's WAL before measuring again, at most once a second. So `DELETE` then `VACUUM` is enough to get back under the quota, and the app no longer has to run a checkpoint itself. Databases under LTX capture are left alone: capture owns their checkpoints, and they stay frozen until the quota is raised or other data is deleted.
+
 ## 0.25.0
 
 ### Minor Changes

package/LTX_REPLICATION.md

@@ -53,7 +53,18 @@ for this opted-in binding. Use the base LTX file for replication.
 
 Files live under `<database-path>.ltx/epoch-XXXXXX/`. Completed names are
 `<minTXID as 16 hex digits>-<maxTXID as 16 hex digits>.ltx`.
-The encoder streams one page at a time and spools index records with `tmpfile()`.
+The encoder streams one page at a time. It creates its index scratch file with
+`mkstemp()` beneath `<database-path>.ltx/`, immediately unlinks the name, and uses
+the open descriptor until the writer closes. This needs no access to a global
+temporary directory, which a sandboxed worker may not have. The scratch file is
+private (0600). A kill between creation and unlink can leave a named index file.
+On startup, after acquiring the capture lock and before recovery, the owner removes
+only regular root-level files matching the reserved `index-` plus six alphanumeric
+characters. It does not follow symlinks or remove directories or unrelated names.
+After unlink, process death releases the anonymous scratch space automatically.
+Its transient disk usage grows with the index records and is not visible to the
+directory-walk storage quota after unlink. Allow disk headroom for that scratch
+space as well as the LTX output; the quota is not a hard filesystem limit.
 
 For every LTX file:
 
@@ -78,7 +89,10 @@ applications must use idempotent transaction identifiers for retries.
 ## Qualification status
 
 Capture is tested against the exact inline C through `bun run test:native-ltx`,
-including independent BigInt CRC and index verification, a 102-file chain,
+with global `tmpfile()` access deliberately denied in the driver so the capture
+path cannot depend on it. This portable regression does not itself qualify the
+Linux Landlock/seccomp sandbox; sproutd's capture-on lifecycle smoke must do that.
+The tests cover independent BigInt CRC and index verification, a 102-file chain,
 byte-exact restore, integrity checking, oversized transaction rollback, database truncation, explicit rollback and late position-write failure latching.
 The workspace prototype additionally tests the compiled Porffor executable,
 including external writer exclusion and invariant PRAGMA rejection.
@@ -103,8 +117,9 @@ time. It also checks the last LTX file. Five native restarts each at 4.2 MB and
 The 51.1 MB verification took 399 to 446 ms on macOS arm64 (plus about 13 ms to
 health readiness); this is not a 9 ms cold-start claim for large databases.
 
-The regression SIGKILLs at ten durability boundaries, including both sides of
-clean-marker publication, and verifies matching-prefix resume and fallback cases.
+The regression SIGKILLs at eleven durability boundaries, including the interval
+between index creation and unlink and both sides of clean-marker publication,
+and verifies scratch cleanup, matching-prefix resume and fallback cases.
 It also recovers a committed tail beyond the durable cursor. The full Porffor executable passed 200 seeded random SIGKILL iterations on macOS
 arm64: 1,675 acknowledged writes retained, 88 same-generation resumes and 112
 fresh-base recoveries. Every finished chain passed file/database CRC verification,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/kv-shim.test.js

@@ -0,0 +1,124 @@
+// The KV shim (`env.KV`) at compatibility dates before and from 2026-10-25, over an
+// in-memory transport with the kv.* contract both transports implement (broker.test.ts
+// covers the broker's side; sproutd's conformance/bindings/kv.js the whole path).
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const source = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+let rows;
+const call = (json) => {
+  const msg = JSON.parse(json);
+  const reply = (() => {
+    if (msg.op === "kv.get") {
+      const r = rows.get(msg.key);
+      return r ? { ok: true, found: true, value: r.value, binary: r.binary, metadata: r.metadata ?? null, expiration: r.expiration ?? null } : { ok: true, found: false, value: null };
+    }
+    if (msg.op === "kv.put") {
+      rows.set(msg.key, { value: msg.value, binary: msg.binary === true, metadata: msg.metadata, expiration: msg.expiration ?? (msg.expirationTtl ? Math.floor(Date.now() / 1000) + msg.expirationTtl : undefined) });
+      return { ok: true };
+    }
+    if (msg.op === "kv.delete") {
+      rows.delete(msg.key);
+      return { ok: true };
+    }
+    if (msg.op === "kv.list") {
+      const keys = [...rows.keys()].filter((k) => k.startsWith(msg.prefix) && (!msg.cursor || k > msg.cursor)).sort();
+      const limit = msg.limit ?? keys.length;
+      const page = keys.slice(0, limit);
+      const complete = keys.length <= limit;
+      return {
+        ok: true,
+        keys: page,
+        entries: page.map((k) => ({ name: k, expiration: rows.get(k).expiration ?? null, metadata: rows.get(k).metadata ?? null })),
+        list_complete: complete,
+        cursor: complete ? "" : page[page.length - 1],
+      };
+    }
+    return { ok: false, error: "unknown op" };
+  })();
+  return JSON.stringify(reply);
+};
+// oxlint-disable-next-line no-function-constructor -- the prelude is prepended as text in production too
+const { makeEnv } = new Function(
+  "Porffor",
+  "__testCall",
+  `${source}\n__sbCall = __testCall; return { makeEnv: (target) => { __sbInstallBindings(target, { kv: ["KV"] }); return target; } };`,
+)({ c: () => "" }, call);
+const fresh = (date) => {
+  globalThis.__sbCompat = date;
+  rows = new Map();
+  return makeEnv({}).KV;
+};
+const failure = async (fn) => {
+  try {
+    await fn();
+  } catch (error) {
+    return `${error.name}: ${error.message}`;
+  }
+  return "did not throw";
+};
+
+test("before 2026-10-25: the synchronous shim, unchanged", () => {
+  const KV = fresh("2026-10-24");
+  expect(KV.put("a", "v")).toBeUndefined();
+  expect(KV.get("a")).toBe("v");
+  expect(KV.list("a")).toEqual(["a"]);
+  expect(KV.getWithMetadata).toBeUndefined();
+});
+
+test("from 2026-10-25: Promises, metadata, typed gets and get(keys)", async () => {
+  const KV = fresh("2026-10-25");
+  expect(KV.put("a", "v", { metadata: { n: 1 } })).toBeInstanceOf(Promise);
+  await KV.put("a", '{"x":1}', { metadata: { n: 1 } });
+  expect(await KV.get("a", "json")).toEqual({ x: 1 });
+  expect(await KV.get("a", { type: "text" })).toBe('{"x":1}');
+  expect(await KV.getWithMetadata("a", "json")).toEqual({ value: { x: 1 }, metadata: { n: 1 }, cacheStatus: null });
+  expect(await KV.getWithMetadata("missing")).toEqual({ value: null, metadata: null, cacheStatus: null });
+  await KV.put("b", new Uint8Array([0, 255]));
+  expect(Array.from(new Uint8Array(await KV.get("b", "arrayBuffer")))).toEqual([0, 255]);
+  // (ReadableStream values and the "stream" type use the prelude's own streams: checked end to
+  // end by sproutd's conformance/bindings/kv.js, not here against Bun's.)
+  const many = await KV.get(["a", "missing"]);
+  expect(many).toBeInstanceOf(Map);
+  expect([...many.entries()]).toEqual([["a", '{"x":1}'], ["missing", null]]);
+  expect(await KV.delete("a")).toBeUndefined();
+  expect(await KV.get("a")).toBeNull();
+});
+
+test("from 2026-10-25: KV's errors for keys, values, expiration and metadata", async () => {
+  const KV = fresh("2026-10-25");
+  expect(await failure(() => KV.put("", "v"))).toBe("TypeError: Key name cannot be empty.");
+  expect(await failure(() => KV.put("..", "v"))).toBe('TypeError: ".." is not allowed as a key name.');
+  expect(await failure(() => KV.put("k".repeat(513), "v"))).toBe("Error: KV PUT failed: 414 UTF-8 encoded length of 513 exceeds key length limit of 512.");
+  expect(await failure(() => KV.get("k".repeat(513)))).toBe("Error: KV GET failed: 414 UTF-8 encoded length of 513 exceeds key length limit of 512.");
+  expect(await failure(() => KV.put("a", { a: 1 }))).toBe("TypeError: KV put() accepts only strings, ArrayBuffers, ArrayBufferViews, and ReadableStreams as values.");
+  expect(await failure(() => KV.put("a", "v", { expirationTtl: 30 }))).toBe("Error: KV PUT failed: 400 Invalid expiration_ttl of 30. Expiration TTL must be at least 60.");
+  expect(await failure(() => KV.put("a", "v", { expirationTtl: "soon" }))).toBe("Error: KV PUT failed: 400 Invalid expiration_ttl of 0. Please specify integer greater than 0.");
+  expect(await failure(() => KV.put("a", "v", { expiration: 1000 }))).toBe(
+    "Error: KV PUT failed: 400 Invalid expiration of 1000. Please specify integer greater than the current number of seconds since the UNIX epoch.",
+  );
+  expect(await failure(() => KV.put("a", "v", { metadata: { big: "x".repeat(1100) } }))).toBe("Error: KV PUT failed: 413 Metadata length of 1110 exceeds limit of 1024.");
+  expect(await KV.get("missing", "nope")).toBeNull();
+  await KV.put("there", "v");
+  expect(await failure(() => KV.get("there", "nope"))).toBe('TypeError: Unknown response type. Possible types are "text", "arrayBuffer", "json", and "stream".');
+  expect(await failure(() => KV.list({ limit: 1001 }))).toBe("Error: KV GET failed: 400 Invalid key_count_limit of 1001. Please specify an integer less than 1000.");
+  // A failing get rejects rather than throws.
+  const rejected = KV.get("");
+  expect(rejected).toBeInstanceOf(Promise);
+  expect(await rejected.catch((e) => e.message)).toBe("Key name cannot be empty.");
+});
+
+test("from 2026-10-25: list() pages with limit and cursor, with expiration and metadata", async () => {
+  const KV = fresh("2026-10-25");
+  for (const k of ["b", "a", "c"]) await KV.put(k, "v", k === "a" ? { metadata: { t: 1 }, expirationTtl: 3600 } : undefined);
+  const first = await KV.list({ limit: 2 });
+  expect(first.keys.map((k) => k.name)).toEqual(["a", "b"]);
+  expect(first.keys[0].metadata).toEqual({ t: 1 });
+  expect(Number.isInteger(first.keys[0].expiration)).toBe(true);
+  expect("expiration" in first.keys[1]).toBe(false);
+  expect(first.list_complete).toBe(false);
+  const rest = await KV.list({ limit: 2, cursor: first.cursor });
+  expect(rest.keys.map((k) => k.name)).toEqual(["c"]);
+  expect(Object.keys(rest).sort()).toEqual(["cacheStatus", "keys", "list_complete"]);
+  expect(await KV.list({ limit: 0 })).toEqual({ keys: [], list_complete: true, cacheStatus: null });
+});

package/src/native-fetch-prelude.js

@@ -4807,6 +4807,126 @@ function __sbRpc(op, extra) {
   return reply;
 }
 
+// KV from compatibility date 2026-10-25: workerd's surface. Every method returns a
+// Promise; keys and options are checked with KV's errors; get() takes a list of keys and
+// the "stream" type; getWithMetadata(); put() takes a ReadableStream and metadata; list()
+// pages with limit and cursor and returns each key's expiration and metadata. Earlier
+// dates keep the synchronous shim below.
+function __sbKvStrict() {
+  return globalThis.__sbCompat >= "2026-10-25";
+}
+function __sbKvKey(key, verb) {
+  const name = String(key);
+  if (name === "") throw new TypeError("Key name cannot be empty.");
+  if (name === "." || name === "..") throw new TypeError('"' + name + '" is not allowed as a key name.');
+  const length = new TextEncoder().encode(name).length;
+  if (length > 512) throw new Error("KV " + verb + " failed: 414 UTF-8 encoded length of " + length + " exceeds key length limit of 512.");
+  return name;
+}
+function __sbKvType(typeOrOptions) {
+  return typeOrOptions == null ? "text" : __sbIsStr(typeOrOptions) ? typeOrOptions : typeOrOptions.type || "text";
+}
+// An unknown type fails only when there is a value to decode: a missing key is null
+// whatever the type, as in workerd.
+function __sbKvDecode(r, type) {
+  if (type !== "text" && type !== "json" && type !== "arrayBuffer" && type !== "stream")
+    throw new TypeError('Unknown response type. Possible types are "text", "arrayBuffer", "json", and "stream".');
+  if (type === "arrayBuffer") return __sbBufFrom(r.binary ? r.value : __sbToBytes(r.value));
+  if (type === "stream") return new Response(__sbBufFrom(r.binary ? r.value : __sbToBytes(r.value))).body;
+  const text = r.binary ? __sbFromUtf8(r.value) : r.value;
+  return type === "json" ? JSON.parse(text) : text;
+}
+function __sbKvMetadata(text) {
+  return text == null ? null : JSON.parse(text);
+}
+function __sbMakeKv(ns) {
+  const one = (key, type) => {
+    const r = __sbRpc("kv.get", { ns, key: __sbKvKey(key, "GET") });
+    return r.found ? { value: __sbKvDecode(r, type), metadata: __sbKvMetadata(r.metadata) } : { value: null, metadata: null };
+  };
+  const attempt = (run) => {
+    try {
+      return Promise.resolve(run());
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  };
+  return {
+    get(key, typeOrOptions) {
+      return attempt(() => {
+        const type = __sbKvType(typeOrOptions);
+        if (!Array.isArray(key)) return one(key, type).value;
+        const out = new Map();
+        for (let i = 0; i < key.length; i++) out.set(String(key[i]), one(key[i], type).value);
+        return out;
+      });
+    },
+    getWithMetadata(key, typeOrOptions) {
+      return attempt(() => {
+        const r = one(key, __sbKvType(typeOrOptions));
+        return { value: r.value, metadata: r.metadata, cacheStatus: null };
+      });
+    },
+    async put(key, value, options) {
+      const msg = { ns, key: __sbKvKey(key, "PUT"), value: "" };
+      value = __sbUnwrapBody(value);
+      if (value != null && __sbIsFn(value.getReader)) value = new Uint8Array(await new Response(value).arrayBuffer());
+      if (value != null && !__sbIsStr(value) && value.byteLength !== undefined) {
+        const bytes = value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value);
+        msg.value = __sbToBytes(bytes);
+        msg.binary = true;
+      } else if (__sbIsStr(value) || value === Number(value) || value === true || value === false) msg.value = String(value);
+      else throw new TypeError("KV put() accepts only strings, ArrayBuffers, ArrayBufferViews, and ReadableStreams as values.");
+      const o = options || {};
+      if (o.expirationTtl != null) {
+        const ttl = Math.floor(Number(o.expirationTtl)) || 0;
+        if (ttl <= 0) throw new Error("KV PUT failed: 400 Invalid expiration_ttl of " + ttl + ". Please specify integer greater than 0.");
+        if (ttl < 60) throw new Error("KV PUT failed: 400 Invalid expiration_ttl of " + ttl + ". Expiration TTL must be at least 60.");
+        msg.expirationTtl = ttl;
+      } else if (o.expiration != null) {
+        const at = Math.floor(Number(o.expiration)) || 0;
+        if (at <= Math.floor(Date.now() / 1000))
+          throw new Error("KV PUT failed: 400 Invalid expiration of " + at + ". Please specify integer greater than the current number of seconds since the UNIX epoch.");
+        msg.expiration = at;
+      }
+      if (o.metadata !== undefined) {
+        const json = JSON.stringify(o.metadata);
+        const length = new TextEncoder().encode(json).length;
+        if (length > 1024) throw new Error("KV PUT failed: 413 Metadata length of " + length + " exceeds limit of 1024.");
+        msg.metadata = json;
+      }
+      __sbRpc("kv.put", msg);
+    },
+    delete(key) {
+      return attempt(() => {
+        __sbRpc("kv.delete", { ns, key: __sbKvKey(key, "DELETE") });
+      });
+    },
+    list(options) {
+      return attempt(() => {
+        const o = options || {};
+        const limit = o.limit == null ? 1000 : Math.floor(Number(o.limit));
+        if (!(limit >= 0) || limit > 1000)
+          throw new Error("KV GET failed: 400 Invalid key_count_limit of " + o.limit + ". Please specify an integer less than 1000.");
+        if (limit === 0) return { keys: [], list_complete: true, cacheStatus: null };
+        const r = __sbRpc("kv.list", { ns, prefix: o.prefix == null ? "" : String(o.prefix), limit, cursor: o.cursor == null ? "" : String(o.cursor) });
+        const keys = [];
+        const entries = r.entries || [];
+        for (let i = 0; i < entries.length; i++) {
+          const k = { name: entries[i].name };
+          if (entries[i].expiration != null) k.expiration = entries[i].expiration;
+          if (entries[i].metadata != null) k.metadata = __sbKvMetadata(entries[i].metadata);
+          keys.push(k);
+        }
+        const out = { keys, list_complete: r.list_complete !== false };
+        if (!out.list_complete) out.cursor = r.cursor;
+        out.cacheStatus = null;
+        return out;
+      });
+    },
+  };
+}
+
 // D1: a Cloudflare-shaped `env.<DB>` (prepare / bind / all / run / raw / first,
 // plus batch and exec). Every call is one broker roundtrip.
 //
@@ -5118,6 +5238,261 @@ function __sbR2Multipart(bucket, key, uploadId) {
   };
 }
 
+// R2 from compatibility date 2026-10-26: workerd's surface. Every method returns a
+// Promise; an object's etag is the MD5 of its bytes (sha256 before; objects written
+// earlier keep theirs), with `checksums.md5`, `uploaded` as a Date and `range`; get()
+// takes `range` and `onlyIf`, put() takes `onlyIf`, a ReadableStream or a Blob and
+// httpMetadata as Headers; delete() takes a list of keys; list() pages with limit and
+// cursor, groups by delimiter and returns metadata only when `include` asks for it.
+// Earlier dates keep the synchronous shim below.
+function __sbR2Strict() {
+  return globalThis.__sbCompat >= "2026-10-26";
+}
+function __sbR2Key(key, verb) {
+  const name = String(key);
+  if (new TextEncoder().encode(name).length > 1024) throw new Error(verb + ": The specified object name is not valid. (10020)");
+  return name;
+}
+function __sbR2HexOf(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes.charCodeAt(i) & 0xff;
+    out += (b < 16 ? "0" : "") + b.toString(16);
+  }
+  return out;
+}
+// R2's httpMetadata, in workerd's key order, from an object or a Headers.
+function __sbR2Http(h) {
+  if (h == null) return {};
+  const src = h instanceof Headers
+    ? {
+        contentType: h.get("content-type"),
+        contentLanguage: h.get("content-language"),
+        contentDisposition: h.get("content-disposition"),
+        contentEncoding: h.get("content-encoding"),
+        cacheControl: h.get("cache-control"),
+        cacheExpiry: h.get("expires"),
+      }
+    : h;
+  const out = {};
+  const names = ["contentType", "contentLanguage", "contentDisposition", "contentEncoding", "cacheControl", "cacheExpiry"];
+  for (let i = 0; i < names.length; i++) if (src[names[i]] != null) out[names[i]] = src[names[i]];
+  return out;
+}
+function __sbR2EtagIn(list, etag) {
+  const items = Array.isArray(list) ? list : String(list).split(",");
+  for (let i = 0; i < items.length; i++) {
+    const e = String(items[i]).trim().replace(/^W\//, "").replace(/^"|"$/g, "");
+    if (e === "*" || e === etag) return true;
+  }
+  return false;
+}
+// Whether an object passes onlyIf (an object or a Headers with If-* headers).
+function __sbR2OnlyIf(cond, etag, uploaded) {
+  if (cond == null) return true;
+  const c = cond instanceof Headers
+    ? {
+        etagMatches: cond.get("if-match"),
+        etagDoesNotMatch: cond.get("if-none-match"),
+        uploadedBefore: cond.get("if-unmodified-since"),
+        uploadedAfter: cond.get("if-modified-since"),
+      }
+    : cond;
+  const at = new Date(uploaded).getTime();
+  if (c.etagMatches != null && !__sbR2EtagIn(c.etagMatches, etag)) return false;
+  if (c.etagDoesNotMatch != null && __sbR2EtagIn(c.etagDoesNotMatch, etag)) return false;
+  if (c.uploadedBefore != null && !(at < new Date(c.uploadedBefore).getTime())) return false;
+  if (c.uploadedAfter != null && !(at > new Date(c.uploadedAfter).getTime())) return false;
+  return true;
+}
+// {offset, length} of a range (an object or a Headers with Range) on an object of SIZE.
+function __sbR2Range(range, size) {
+  let offset = 0, length = size;
+  if (range instanceof Headers) {
+    const m = /^bytes=(\d*)-(\d*)$/.exec(String(range.get("range") || "").trim());
+    if (!m) return { offset, length };
+    if (m[1] === "") range = { suffix: Number(m[2]) };
+    else range = m[2] === "" ? { offset: Number(m[1]) } : { offset: Number(m[1]), length: Number(m[2]) - Number(m[1]) + 1 };
+  }
+  if (range.suffix != null) {
+    length = Math.min(Number(range.suffix), size);
+    offset = size - length;
+  } else {
+    offset = Math.min(Number(range.offset || 0), size);
+    length = range.length == null ? size - offset : Math.min(Number(range.length), size - offset);
+  }
+  return { offset, length };
+}
+// An R2Object (or an R2ObjectBody, given BYTES) as workerd returns it.
+function __sbR2StrictObject(meta, bytes, range, include) {
+  const etag = meta.md5 || meta.etag;
+  const md5 = meta.md5;
+  const obj = {
+    key: meta.key,
+    version: meta.etag,
+    size: meta.size,
+    etag,
+    httpEtag: '"' + etag + '"',
+    checksums: {
+      md5: md5 ? __sbBufFrom(__sbR2Bytes(md5)) : undefined,
+      toJSON() {
+        return { md5: md5 || undefined, sha1: undefined, sha256: undefined, sha384: undefined, sha512: undefined };
+      },
+    },
+    uploaded: new Date(meta.uploaded),
+    httpMetadata: include === false ? {} : __sbR2Http(meta.httpMetadata),
+    customMetadata: include === false ? {} : meta.customMetadata || {},
+    storageClass: "",
+    range,
+    writeHttpMetadata(headers) {
+      const h = obj.httpMetadata;
+      if (h.contentType != null) headers.set("content-type", h.contentType);
+      if (h.contentLanguage != null) headers.set("content-language", h.contentLanguage);
+      if (h.contentDisposition != null) headers.set("content-disposition", h.contentDisposition);
+      if (h.contentEncoding != null) headers.set("content-encoding", h.contentEncoding);
+      if (h.cacheControl != null) headers.set("cache-control", h.cacheControl);
+      if (h.cacheExpiry != null) headers.set("expires", new Date(h.cacheExpiry).toUTCString());
+    },
+  };
+  if (bytes == null) return obj;
+  let used = false;
+  const take = () => {
+    if (used) throw new TypeError("Body has already been used. It can only be used once. Use tee() first if you need to read it twice.");
+    used = true;
+    return bytes;
+  };
+  obj.body = new Response(__sbBufFrom(bytes)).body;
+  Object.defineProperty(obj, "bodyUsed", { get: () => used, enumerable: true });
+  obj.text = async () => __sbFromUtf8(take());
+  obj.json = async () => JSON.parse(__sbFromUtf8(take()));
+  obj.arrayBuffer = async () => __sbBufFrom(take());
+  obj.blob = async () => new Blob([__sbBufFrom(take())], { type: obj.httpMetadata.contentType || "" });
+  return obj;
+}
+// A hex string's bytes, one char per byte.
+function __sbR2Bytes(hex) {
+  let out = "";
+  for (let i = 0; i + 1 < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+function __sbMakeR2(name) {
+  const attempt = (run) => {
+    try {
+      return Promise.resolve(run());
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  };
+  const head = (key) => {
+    const r = __sbRpc("r2.head", { bucket: name, key });
+    return r.found ? r.object : null;
+  };
+  const upload = (key, uploadId) => {
+    const inner = __sbR2Multipart(name, key, uploadId);
+    return {
+      key,
+      uploadId,
+      uploadPart: (partNumber, value) => attempt(() => inner.uploadPart(partNumber, value)),
+      // ponytail: a multipart object's etag stays the transport's sha256; workerd's is
+      // MD5-of-part-MD5s-N. Add when an app compares multipart etags.
+      complete: (parts) => attempt(() => __sbR2StrictObject(__sbRpc("r2.multipart.complete", { bucket: name, key, uploadId, parts: parts || [] }).object, null)),
+      abort: () => attempt(() => inner.abort()),
+    };
+  };
+  return {
+    head(key) {
+      return attempt(() => {
+        const meta = head(__sbR2Key(key, "head"));
+        return meta ? __sbR2StrictObject(meta, null, { offset: 0, length: meta.size }) : null;
+      });
+    },
+    get(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbR2Get(name, __sbR2Key(key, "get"));
+        if (!r.found) return null;
+        const meta = r.object;
+        if (!__sbR2OnlyIf(o.onlyIf, meta.md5 || meta.etag, meta.uploaded)) return __sbR2StrictObject(meta, null, { offset: 0, length: meta.size });
+        const bytes = r.body == null ? "" : r.body;
+        const range = o.range == null ? { offset: 0, length: meta.size } : __sbR2Range(o.range, meta.size);
+        return __sbR2StrictObject(meta, bytes.slice(range.offset, range.offset + range.length), range);
+      });
+    },
+    async put(key, value, options) {
+      const objectKey = __sbR2Key(key, "put");
+      const o = options || {};
+      value = __sbUnwrapBody(value);
+      if (value instanceof Blob) value = await value.arrayBuffer();
+      else if (value != null && __sbIsFn(value.getReader)) value = await new Response(value).arrayBuffer();
+      let bytes;
+      if (value == null) bytes = "";
+      else if (__sbIsStr(value)) bytes = __sbToBytes(value);
+      else if (value.byteLength !== undefined)
+        bytes = __sbToBytes(value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value));
+      else
+        throw new TypeError("Failed to execute 'put' on 'R2Bucket': parameter 2 is not of type 'ReadableStream or ArrayBuffer or ArrayBufferView or string or Blob'.");
+      if (o.onlyIf != null) {
+        // ponytail: check, then write; one worker per app, so nothing writes in between.
+        const current = head(objectKey);
+        if (current && !__sbR2OnlyIf(o.onlyIf, current.md5 || current.etag, current.uploaded)) return null;
+        if (!current && o.onlyIf.etagMatches != null) return null;
+      }
+      const http = __sbR2Http(o.httpMetadata);
+      const custom = o.customMetadata || {};
+      const meta = __sbR2Put(name, objectKey, bytes, http, custom).object;
+      meta.md5 = __sbR2HexOf(__sbDigestRaw("5", bytes));
+      __sbRpc("r2.md5", { bucket: name, key: objectKey, etag: meta.etag, md5: meta.md5 });
+      meta.httpMetadata = http;
+      meta.customMetadata = custom;
+      return __sbR2StrictObject(meta, null, undefined);
+    },
+    delete(keys) {
+      return attempt(() => {
+        const list = Array.isArray(keys) ? keys : [keys];
+        for (let i = 0; i < list.length; i++) __sbRpc("r2.delete", { bucket: name, key: __sbR2Key(list[i], "delete") });
+      });
+    },
+    list(options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.list", {
+          bucket: name,
+          page: true,
+          prefix: o.prefix == null ? "" : String(o.prefix),
+          cursor: o.cursor == null ? "" : String(o.cursor),
+          limit: o.limit == null ? 1000 : Number(o.limit),
+          delimiter: o.delimiter == null ? "" : String(o.delimiter),
+        });
+        const include = o.include || [];
+        const objects = [];
+        for (let j = 0; j < (r.objects || []).length; j++) {
+          const obj = __sbR2StrictObject(r.objects[j], null, undefined);
+          if (include.indexOf("httpMetadata") < 0) obj.httpMetadata = {};
+          if (include.indexOf("customMetadata") < 0) obj.customMetadata = {};
+          objects.push(obj);
+        }
+        return { objects, truncated: !!r.truncated, cursor: r.truncated ? r.cursor : undefined, delimitedPrefixes: r.delimitedPrefixes || [] };
+      });
+    },
+    createMultipartUpload(key, options) {
+      return attempt(() => {
+        const objectKey = __sbR2Key(key, "createMultipartUpload");
+        const o = options || {};
+        const r = __sbRpc("r2.multipart.create", {
+          bucket: name,
+          key: objectKey,
+          httpMetadata: __sbR2Http(o.httpMetadata),
+          customMetadata: o.customMetadata || {},
+        });
+        return upload(objectKey, r.uploadId);
+      });
+    },
+    resumeMultipartUpload(key, uploadId) {
+      return upload(String(key), String(uploadId));
+    },
+  };
+}
+
 // Asset rules use the same parsed manifest in both transports. Matching mirrors
 // @sproutboat/assets; parity tests cover the portable native implementation.
 function __sbAssetRedirect(rule, path) {
@@ -5185,7 +5560,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   for (let i = 0; i < (bindings.kv || []).length; i++) {
     const ns = bindings.kv[i];
-    target[ns] = {
+    target[ns] = __sbKvStrict() ? __sbMakeKv(ns) : {
       // #233 — Workers' get(key, type | { type }): "text" (default), "json",
       // "arrayBuffer". A value put as bytes is stored one char per byte and
       // flagged, so text decodes it as UTF-8 and arrayBuffer returns it
@@ -5244,7 +5619,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   for (let i = 0; i < (bindings.r2 || []).length; i++) {
     const name = bindings.r2[i];
-    target[name] = {
+    target[name] = __sbR2Strict() ? __sbMakeR2(name) : {
       put(key, value, options) {
         value = __sbUnwrapBody(value);
         const o = options || {};