@sproutboat/runtime 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @sproutboat/runtime
 
+## 0.27.1
+
+### Patch Changes
+
+- 0d2d079: Bodies of megabytes no longer take hundreds of megabytes of memory (sproutd #22). Converting bytes to text and text to bytes made one string per character, so reading a 5 MiB R2 object with `text()` peaked at about 400 MiB, and R2 multipart uploads with real (5 MiB) parts ran sproutd's workers out of memory. The conversions now run in one C pass and give exactly the same results. On a standalone build, at 5 MiB:
+  
+  | | before | after |
+  |---|---|---|
+  | `put()` of a string | 82 MiB | 16 MiB |
+  | `put()` then `get()` and `text()` | 400 MiB | 26 MiB |
+  | multipart upload, then `get()` and `text()` | 396 MiB | 21 MiB |
+  | `request.text()` of the request body | 402 MiB | 24 MiB |
+  
+  Also:
+  
+  - At every date, `uploadPart()` stores an `ArrayBuffer` or a typed array as its bytes. It stored the text `[object ArrayBuffer]`.
+  - From `2026-10-26`, `uploadPart()` takes what `put()` takes (a `ReadableStream` or a `Blob` too), and stores text as its UTF-8 bytes, as in workerd. It stored text whose characters all fit in one byte as Latin-1.
+  - From `2026-10-26`, an R2 object body's `body` stream is made when first read, and a whole-object `get()` keeps one copy of the bytes, not two.
+
+## 0.27.0
+
+### Minor Changes
+
+- 9be9c74: R2 matches workerd from compatibility date `2026-10-26`:
+  
+  - `get`, `put`, `head`, `delete`, `list` and `createMultipartUpload` return Promises, and errors reject them.
+  - An object's `etag` is the MD5 of its bytes, with `checksums.md5`. Objects written before keep their old etag.
+  - Objects have `uploaded` as a `Date`, `version`, `storageClass`, `range` and `writeHttpMetadata(headers)`. A body has `body` (a `ReadableStream`), `bodyUsed`, `text()`, `json()`, `arrayBuffer()` and `blob()`.
+  - `get(key, { range, onlyIf })` takes `{ offset, length }`, `{ suffix }` or a `Range` header, and `etagMatches`, `etagDoesNotMatch`, `uploadedBefore`, `uploadedAfter` or `If-*` headers. When the condition fails it returns the object without a body.
+  - `put(key, value, { onlyIf, httpMetadata })` takes a `ReadableStream` or a `Blob`, and `httpMetadata` as `Headers`. When the condition fails it returns `null`.
+  - `delete([keys])` deletes several keys.
+  - `list({ prefix, limit, cursor, delimiter, include })` pages at up to 1,000 entries, groups keys into `delimitedPrefixes`, and returns `httpMetadata` and `customMetadata` only when `include` asks for them.
+  - A value of the wrong type and a key longer than 1,024 bytes fail with R2's errors.
+  
+  Earlier dates keep the synchronous shim. One change applies at every date: **a `list()` prefix now matches exactly.** It used SQL `LIKE`, so it ignored case and read `_` and `%` as wildcards. Both transports store an object's MD5 in a new column, added to existing stores when they open.
+  
+  Against miniflare 4.20260730, `conformance/bindings/r2.js` in sproutd passes 48/48 at `2026-10-26` (16/48 before).
+
 ## 0.26.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/ingress-utf8.test.js

@@ -2,17 +2,15 @@ import { expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
 const src = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
 const decoder = src.slice(src.indexOf("function __sbFromUtf8("), src.indexOf("// sproutboat #181"));
-const ingress = src.slice(
-  src.indexOf("function __sbDecodeIngress("),
-  src.indexOf("globalThis.__sbEntry ="),
-);
+const ingress = src.slice(src.indexOf("function __sbDecodeIngress("), src.indexOf("globalThis.__sbEntry ="));
 const rawBody = src.slice(src.indexOf("function __sbRawBody("), src.indexOf("function __sbHasStreamBody("));
 if (!decoder || !ingress || !rawBody) throw new Error("Ingress decoder source not found");
 // oxlint-disable-next-line no-function-constructor -- Exercise the text-only runtime prelude.
-const load = new Function(`${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`);
+const load = new Function(
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`,
+);
 const decode = load();
-const raw = (text) =>
-  Array.from(new TextEncoder().encode(text), (byte) => String.fromCharCode(byte)).join("");
+const raw = (text) => Array.from(new TextEncoder().encode(text), (byte) => String.fromCharCode(byte)).join("");
 
 test("native ingress text and JSON decode Unicode without changing raw bytes", async () => {
   const body = raw('{"id":"caffè-🚤"}');

package/src/native-fetch-prelude.js

@@ -3034,7 +3034,10 @@ if (globalThis.clearInterval == null) globalThis.clearInterval = clearInterval;
 // these express the same spec-mandated checks and are verified under Porffor
 // alpha-10 by examples/kitchen-sink/harness.ts).
 function __sbIsStr(v) {
-  return Object(v) !== v && v === String(v);
+  // sproutd #22: not `Object(v) !== v`, which wraps (copies) a string in Porffor: two such
+  // checks on a 5 MiB part took 20 MiB.
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- the one check that does not copy its argument
+  return typeof v === "string";
 }
 function __sbIsFn(v) {
   return v instanceof Function;
@@ -3936,6 +3939,9 @@ const __SB_BYTES_WINDOW = 512;
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
+  // sproutd #22: one C pass when the input allows it (see __sbToBytesNative).
+  const native = __sbToBytesNative(input);
+  if (native !== "") return native;
   // Windowed accumulation (#180, then #181). Plain `s +=` in a loop is O(n^2)
   // here, since Porffor's strings have no rope/cons optimization and every
   // append copies the whole accumulated string -- that's #180, a 43KB body
@@ -4015,6 +4021,9 @@ function __sbBufFrom(latin1) {
 // regardless of whether it holds real Latin-1 text or raw bytes, so this
 // decode is only safe where the caller already knows which one it has.
 function __sbFromUtf8(bytes) {
+  // sproutd #22: one C pass for a string of bytes (see __sbFromUtf8Native).
+  const native = __sbFromUtf8Native(bytes);
+  if (native !== "") return native;
   // Collected into an array and joined once at the end, not built with
   // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
   // `+=` in a loop copies the whole accumulated string on every append,
@@ -4672,8 +4681,167 @@ static int sb_os_random(unsigned char* buf, size_t n) {
   return 0;
 }
 
+// sproutd #22: text and bytes converted in one C pass. The JS loops in
+// __sbFromUtf8 and __sbToBytes made one string per character, so a 5 MiB R2
+// object read with text() took about 400 MiB of heap before the next collection.
+u32 porf_native_fetch_alloc(u32 bytes, u32 type);
+
+// Lenient UTF-8 decode, exactly as __sbFromUtf8's JS: a lead byte whose
+// continuation bytes are not all 10xxxxxx passes through as its own unit.
+// OUT has room for LEN units. Returns the unit count; *WIDE is set when a unit
+// is above 0xff (the result then needs a UTF-16 string).
+static size_t sb_utf8_decode_units(const unsigned char* b, size_t len, uint16_t* out, int* wide) {
+  size_t k = 0;
+  *wide = 0;
+  for (size_t i = 0; i < len; i++) {
+    const unsigned b0 = b[i];
+    if (b0 >= 0x80) {
+      if ((b0 & 0xe0) == 0xc0 && i + 1 < len && (b[i + 1] & 0xc0) == 0x80) {
+        out[k] = (uint16_t)(((b0 & 0x1f) << 6) | (b[i + 1] & 0x3f));
+        if (out[k] > 0xff) *wide = 1;
+        k++; i += 1; continue;
+      }
+      if ((b0 & 0xf0) == 0xe0 && i + 2 < len && (b[i + 1] & 0xc0) == 0x80 && (b[i + 2] & 0xc0) == 0x80) {
+        out[k] = (uint16_t)(((b0 & 0x0f) << 12) | ((b[i + 1] & 0x3f) << 6) | (b[i + 2] & 0x3f));
+        if (out[k] > 0xff) *wide = 1;
+        k++; i += 2; continue;
+      }
+      if ((b0 & 0xf8) == 0xf0 && i + 3 < len && (b[i + 1] & 0xc0) == 0x80 && (b[i + 2] & 0xc0) == 0x80 && (b[i + 3] & 0xc0) == 0x80) {
+        int32_t cp = (int32_t)(((b0 & 0x07) << 18) | ((b[i + 1] & 0x3f) << 12) | ((b[i + 2] & 0x3f) << 6) | (b[i + 3] & 0x3f));
+        cp -= 0x10000;
+        out[k++] = (uint16_t)(0xd800 + (cp >> 10));
+        out[k++] = (uint16_t)(0xdc00 + (cp & 0x3ff));
+        *wide = 1;
+        i += 3; continue;
+      }
+    }
+    out[k++] = (uint16_t)b0;
+  }
+  return k;
+}
+
+// UTF-8 encode, exactly as __sbToBytes's JS: a high surrogate takes the next
+// unit as its pair. OUT has room for 3 bytes per unit. Returns the byte count.
+static size_t sb_utf8_encode_units(const uint16_t* s, size_t len, unsigned char* out) {
+  size_t k = 0;
+  for (size_t i = 0; i < len; i++) {
+    const uint32_t c = s[i];
+    if (c < 0x80) out[k++] = (unsigned char)c;
+    else if (c < 0x800) { out[k++] = (unsigned char)(0xc0 | (c >> 6)); out[k++] = (unsigned char)(0x80 | (c & 0x3f)); }
+    else if (c >= 0xd800 && c < 0xdc00 && i + 1 < len) {
+      const int32_t cp = 0x10000 + (int32_t)((c - 0xd800) << 10) + ((int32_t)s[++i] - 0xdc00);
+      out[k++] = (unsigned char)(0xf0 | ((cp >> 18) & 0xff));
+      out[k++] = (unsigned char)(0x80 | ((cp >> 12) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | ((cp >> 6) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | (cp & 0x3f));
+    } else {
+      out[k++] = (unsigned char)(0xe0 | ((c >> 12) & 0xff));
+      out[k++] = (unsigned char)(0x80 | ((c >> 6) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | (c & 0x3f));
+    }
+  }
+  return k;
+}
+
 `;
 
+// sproutd #22: __sbFromUtf8 for a string of bytes (one byte per unit), in C.
+// Returns "" when it cannot (not a string, or out of memory), so the caller
+// falls back to the JS loop. All-ASCII byte strings are already their text.
+// oxlint-disable-next-line no-unused-vars -- `bytes` is read inside the RawC block below, not by JS.
+function __sbFromUtf8Native(bytes) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    if (bytes.type == 195 || bytes.type == 67) {
+      const u32 __p = (u32)bytes.val;
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      int __ascii = bytes.type == 195;
+      if (__ascii) {
+        const unsigned char* __s = (const unsigned char*)(MEM + __p + 4);
+        for (size_t __i = 0; __i < __n; __i++) if (__s[__i] >= 0x80) { __ascii = 0; break; }
+      }
+      if (__ascii) out = bytes;
+      else {
+        unsigned char* __b = (unsigned char*)malloc(__n + 1);
+        uint16_t* __u = (uint16_t*)malloc(__n * 2 + 2);
+        if (__b && __u) {
+          if (bytes.type == 195) memcpy(__b, MEM + __p + 4, __n);
+          else { const uint16_t* __w = (const uint16_t*)(MEM + __p + 4); for (size_t __i = 0; __i < __n; __i++) __b[__i] = (unsigned char)(__w[__i] & 0xff); }
+          int __wide = 0;
+          const size_t __k = sb_utf8_decode_units(__b, __n, __u, &__wide);
+          if (__wide) {
+            const u32 __s = porf_native_fetch_alloc((u32)(4 + __k * 2), 67);
+            *(u32*)(MEM + __s) = (u32)__k;
+            memcpy(MEM + __s + 4, __u, __k * 2);
+            out = porf_box((f64)__s, 67);
+          } else {
+            for (size_t __i = 0; __i < __k; __i++) __b[__i] = (unsigned char)__u[__i];
+            out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__b, __k), 195);
+          }
+        }
+        free(__b); free(__u);
+      }
+    }
+  `;
+  return out;
+}
+
+// sproutd #22: __sbToBytes for a string, a Uint8Array or an ArrayBuffer, in C.
+// Returns "" when it cannot (another type, a length-tracking view, out of
+// memory), so the caller falls back to the JS loop.
+// oxlint-disable-next-line no-unused-vars -- `input` is read inside the RawC block below, not by JS.
+function __sbToBytesNative(input) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const u32 __p = (u32)input.val;
+    if (input.type == 195) {
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      const unsigned char* __s = (const unsigned char*)(MEM + __p + 4);
+      size_t __high = 0;
+      for (size_t __i = 0; __i < __n; __i++) if (__s[__i] >= 0x80) __high++;
+      if (!__high) out = input;
+      else {
+        unsigned char* __o = (unsigned char*)malloc(__n + __high + 1);
+        if (__o) {
+          const unsigned char* __src = (const unsigned char*)(MEM + __p + 4);
+          size_t __k = 0;
+          for (size_t __i = 0; __i < __n; __i++) {
+            const unsigned char __c = __src[__i];
+            if (__c < 0x80) __o[__k++] = __c;
+            else { __o[__k++] = (unsigned char)(0xc0 | (__c >> 6)); __o[__k++] = (unsigned char)(0x80 | (__c & 0x3f)); }
+          }
+          out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, __k), 195);
+          free(__o);
+        }
+      }
+    } else if (input.type == 67) {
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      uint16_t* __w = (uint16_t*)malloc(__n * 2 + 2);
+      unsigned char* __o = (unsigned char*)malloc(__n * 3 + 1);
+      if (__w && __o) {
+        memcpy(__w, MEM + __p + 4, __n * 2);
+        const size_t __k = sb_utf8_encode_units(__w, __n, __o);
+        out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, __k), 195);
+      }
+      free(__w); free(__o);
+    } else if (input.type == 13 || input.type == 81) {
+      const int32_t __len = *(int32_t*)(MEM + __p);
+      if (__len > 0) {
+        const u32 __data = input.type == 13 ? __p + 8 : *(u32*)(MEM + __p + 4) + 4;
+        unsigned char* __o = (unsigned char*)malloc((size_t)__len);
+        if (__o) {
+          memcpy(__o, MEM + __data, (size_t)__len);
+          out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, (size_t)__len), 195);
+          free(__o);
+        }
+      }
+    }
+  `;
+  return out;
+}
+
 // TRANSPORT: wrap.ts splices one of transport-broker.js / transport-embedded.js here.
 
 // `nStr` is the decimal byte count as a string (same string-param pattern as
@@ -5218,6 +5386,15 @@ function __sbR2Object(meta, body) {
   return obj;
 }
 
+// A part's value for the transport: an ArrayBuffer or a view as its bytes (String() of one
+// stored "[object ArrayBuffer]", at every date), anything else as text, as before.
+function __sbR2PartValue(value) {
+  value = __sbUnwrapBody(value);
+  if (value == null) return "";
+  if (!__sbIsStr(value) && value.byteLength !== undefined)
+    return __sbToBytes(value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value));
+  return String(value);
+}
 function __sbR2Multipart(bucket, key, uploadId) {
   return {
     key,
@@ -5226,7 +5403,7 @@ function __sbR2Multipart(bucket, key, uploadId) {
       const number = Number(partNumber);
       if (!Number.isInteger(number) || number < 1 || number > 10000)
         throw new TypeError("partNumber must be an integer between 1 and 10000");
-      return __sbR2MultipartPut(bucket, key, uploadId, number, value == null ? "" : String(value)).part;
+      return __sbR2MultipartPut(bucket, key, uploadId, number, __sbR2PartValue(value)).part;
     },
     complete(parts) {
       const r = __sbRpc("r2.multipart.complete", { bucket, key, uploadId, parts: parts || [] });
@@ -5238,6 +5415,277 @@ function __sbR2Multipart(bucket, key, uploadId) {
   };
 }
 
+// R2 from compatibility date 2026-10-26: workerd's surface. Every method returns a
+// Promise; an object's etag is the MD5 of its bytes (sha256 before; objects written
+// earlier keep theirs), with `checksums.md5`, `uploaded` as a Date and `range`; get()
+// takes `range` and `onlyIf`, put() takes `onlyIf`, a ReadableStream or a Blob and
+// httpMetadata as Headers; delete() takes a list of keys; list() pages with limit and
+// cursor, groups by delimiter and returns metadata only when `include` asks for it.
+// Earlier dates keep the synchronous shim below.
+function __sbR2Strict() {
+  return globalThis.__sbCompat >= "2026-10-26";
+}
+function __sbR2Key(key, verb) {
+  const name = String(key);
+  if (new TextEncoder().encode(name).length > 1024) throw new Error(verb + ": The specified object name is not valid. (10020)");
+  return name;
+}
+function __sbR2HexOf(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes.charCodeAt(i) & 0xff;
+    out += (b < 16 ? "0" : "") + b.toString(16);
+  }
+  return out;
+}
+// R2's httpMetadata, in workerd's key order, from an object or a Headers.
+function __sbR2Http(h) {
+  if (h == null) return {};
+  const src = h instanceof Headers
+    ? {
+        contentType: h.get("content-type"),
+        contentLanguage: h.get("content-language"),
+        contentDisposition: h.get("content-disposition"),
+        contentEncoding: h.get("content-encoding"),
+        cacheControl: h.get("cache-control"),
+        cacheExpiry: h.get("expires"),
+      }
+    : h;
+  const out = {};
+  const names = ["contentType", "contentLanguage", "contentDisposition", "contentEncoding", "cacheControl", "cacheExpiry"];
+  for (let i = 0; i < names.length; i++) if (src[names[i]] != null) out[names[i]] = src[names[i]];
+  return out;
+}
+function __sbR2EtagIn(list, etag) {
+  const items = Array.isArray(list) ? list : String(list).split(",");
+  for (let i = 0; i < items.length; i++) {
+    const e = String(items[i]).trim().replace(/^W\//, "").replace(/^"|"$/g, "");
+    if (e === "*" || e === etag) return true;
+  }
+  return false;
+}
+// Whether an object passes onlyIf (an object or a Headers with If-* headers).
+function __sbR2OnlyIf(cond, etag, uploaded) {
+  if (cond == null) return true;
+  const c = cond instanceof Headers
+    ? {
+        etagMatches: cond.get("if-match"),
+        etagDoesNotMatch: cond.get("if-none-match"),
+        uploadedBefore: cond.get("if-unmodified-since"),
+        uploadedAfter: cond.get("if-modified-since"),
+      }
+    : cond;
+  const at = new Date(uploaded).getTime();
+  if (c.etagMatches != null && !__sbR2EtagIn(c.etagMatches, etag)) return false;
+  if (c.etagDoesNotMatch != null && __sbR2EtagIn(c.etagDoesNotMatch, etag)) return false;
+  if (c.uploadedBefore != null && !(at < new Date(c.uploadedBefore).getTime())) return false;
+  if (c.uploadedAfter != null && !(at > new Date(c.uploadedAfter).getTime())) return false;
+  return true;
+}
+// {offset, length} of a range (an object or a Headers with Range) on an object of SIZE.
+function __sbR2Range(range, size) {
+  let offset = 0, length = size;
+  if (range instanceof Headers) {
+    const m = /^bytes=(\d*)-(\d*)$/.exec(String(range.get("range") || "").trim());
+    if (!m) return { offset, length };
+    if (m[1] === "") range = { suffix: Number(m[2]) };
+    else range = m[2] === "" ? { offset: Number(m[1]) } : { offset: Number(m[1]), length: Number(m[2]) - Number(m[1]) + 1 };
+  }
+  if (range.suffix != null) {
+    length = Math.min(Number(range.suffix), size);
+    offset = size - length;
+  } else {
+    offset = Math.min(Number(range.offset || 0), size);
+    length = range.length == null ? size - offset : Math.min(Number(range.length), size - offset);
+  }
+  return { offset, length };
+}
+// An R2Object (or an R2ObjectBody, given BYTES) as workerd returns it.
+function __sbR2StrictObject(meta, bytes, range, include) {
+  const etag = meta.md5 || meta.etag;
+  const md5 = meta.md5;
+  const obj = {
+    key: meta.key,
+    version: meta.etag,
+    size: meta.size,
+    etag,
+    httpEtag: '"' + etag + '"',
+    checksums: {
+      md5: md5 ? __sbBufFrom(__sbR2Bytes(md5)) : undefined,
+      toJSON() {
+        return { md5: md5 || undefined, sha1: undefined, sha256: undefined, sha384: undefined, sha512: undefined };
+      },
+    },
+    uploaded: new Date(meta.uploaded),
+    httpMetadata: include === false ? {} : __sbR2Http(meta.httpMetadata),
+    customMetadata: include === false ? {} : meta.customMetadata || {},
+    storageClass: "",
+    range,
+    writeHttpMetadata(headers) {
+      const h = obj.httpMetadata;
+      if (h.contentType != null) headers.set("content-type", h.contentType);
+      if (h.contentLanguage != null) headers.set("content-language", h.contentLanguage);
+      if (h.contentDisposition != null) headers.set("content-disposition", h.contentDisposition);
+      if (h.contentEncoding != null) headers.set("content-encoding", h.contentEncoding);
+      if (h.cacheControl != null) headers.set("cache-control", h.cacheControl);
+      if (h.cacheExpiry != null) headers.set("expires", new Date(h.cacheExpiry).toUTCString());
+    },
+  };
+  if (bytes == null) return obj;
+  let used = false;
+  const take = () => {
+    if (used) throw new TypeError("Body has already been used. It can only be used once. Use tee() first if you need to read it twice.");
+    used = true;
+    return bytes;
+  };
+  // The stream is made when first asked for: text() and friends read the bytes directly,
+  // so an object read as text never holds a second copy (sproutd #22).
+  let stream = null;
+  Object.defineProperty(obj, "body", {
+    get: () => {
+      if (stream === null) stream = new Response(__sbBufFrom(bytes)).body;
+      return stream;
+    },
+    enumerable: true,
+  });
+  Object.defineProperty(obj, "bodyUsed", { get: () => used, enumerable: true });
+  obj.text = async () => __sbFromUtf8(take());
+  obj.json = async () => JSON.parse(__sbFromUtf8(take()));
+  obj.arrayBuffer = async () => __sbBufFrom(take());
+  obj.blob = async () => new Blob([__sbBufFrom(take())], { type: obj.httpMetadata.contentType || "" });
+  return obj;
+}
+// A hex string's bytes, one char per byte.
+function __sbR2Bytes(hex) {
+  let out = "";
+  for (let i = 0; i + 1 < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+function __sbMakeR2(name) {
+  const attempt = (run) => {
+    try {
+      return Promise.resolve(run());
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  };
+  const head = (key) => {
+    const r = __sbRpc("r2.head", { bucket: name, key });
+    return r.found ? r.object : null;
+  };
+  const upload = (key, uploadId) => {
+    const inner = __sbR2Multipart(name, key, uploadId);
+    return {
+      key,
+      uploadId,
+      // A part is any value put() takes; text is stored as its UTF-8 bytes, as in workerd.
+      uploadPart: async (partNumber, value) => {
+        value = __sbUnwrapBody(value);
+        if (value instanceof Blob) value = await value.arrayBuffer();
+        else if (value != null && __sbIsFn(value.getReader)) value = await new Response(value).arrayBuffer();
+        return inner.uploadPart(partNumber, __sbIsStr(value) ? __sbToBytes(value) : value);
+      },
+      // ponytail: a multipart object's etag stays the transport's sha256; workerd's is
+      // MD5-of-part-MD5s-N. Add when an app compares multipart etags.
+      complete: (parts) => attempt(() => __sbR2StrictObject(__sbRpc("r2.multipart.complete", { bucket: name, key, uploadId, parts: parts || [] }).object, null)),
+      abort: () => attempt(() => inner.abort()),
+    };
+  };
+  return {
+    head(key) {
+      return attempt(() => {
+        const meta = head(__sbR2Key(key, "head"));
+        return meta ? __sbR2StrictObject(meta, null, { offset: 0, length: meta.size }) : null;
+      });
+    },
+    get(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbR2Get(name, __sbR2Key(key, "get"));
+        if (!r.found) return null;
+        const meta = r.object;
+        if (!__sbR2OnlyIf(o.onlyIf, meta.md5 || meta.etag, meta.uploaded)) return __sbR2StrictObject(meta, null, { offset: 0, length: meta.size });
+        const bytes = r.body == null ? "" : r.body;
+        const range = o.range == null ? { offset: 0, length: meta.size } : __sbR2Range(o.range, meta.size);
+        const whole = range.offset === 0 && range.length >= bytes.length;
+        return __sbR2StrictObject(meta, whole ? bytes : bytes.slice(range.offset, range.offset + range.length), range);
+      });
+    },
+    async put(key, value, options) {
+      const objectKey = __sbR2Key(key, "put");
+      const o = options || {};
+      value = __sbUnwrapBody(value);
+      if (value instanceof Blob) value = await value.arrayBuffer();
+      else if (value != null && __sbIsFn(value.getReader)) value = await new Response(value).arrayBuffer();
+      let bytes;
+      if (value == null) bytes = "";
+      else if (__sbIsStr(value)) bytes = __sbToBytes(value);
+      else if (value.byteLength !== undefined)
+        bytes = __sbToBytes(value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value));
+      else
+        throw new TypeError("Failed to execute 'put' on 'R2Bucket': parameter 2 is not of type 'ReadableStream or ArrayBuffer or ArrayBufferView or string or Blob'.");
+      if (o.onlyIf != null) {
+        // ponytail: check, then write; one worker per app, so nothing writes in between.
+        const current = head(objectKey);
+        if (current && !__sbR2OnlyIf(o.onlyIf, current.md5 || current.etag, current.uploaded)) return null;
+        if (!current && o.onlyIf.etagMatches != null) return null;
+      }
+      const http = __sbR2Http(o.httpMetadata);
+      const custom = o.customMetadata || {};
+      const meta = __sbR2Put(name, objectKey, bytes, http, custom).object;
+      meta.md5 = __sbR2HexOf(__sbDigestRaw("5", bytes));
+      __sbRpc("r2.md5", { bucket: name, key: objectKey, etag: meta.etag, md5: meta.md5 });
+      meta.httpMetadata = http;
+      meta.customMetadata = custom;
+      return __sbR2StrictObject(meta, null, undefined);
+    },
+    delete(keys) {
+      return attempt(() => {
+        const list = Array.isArray(keys) ? keys : [keys];
+        for (let i = 0; i < list.length; i++) __sbRpc("r2.delete", { bucket: name, key: __sbR2Key(list[i], "delete") });
+      });
+    },
+    list(options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.list", {
+          bucket: name,
+          page: true,
+          prefix: o.prefix == null ? "" : String(o.prefix),
+          cursor: o.cursor == null ? "" : String(o.cursor),
+          limit: o.limit == null ? 1000 : Number(o.limit),
+          delimiter: o.delimiter == null ? "" : String(o.delimiter),
+        });
+        const include = o.include || [];
+        const objects = [];
+        for (let j = 0; j < (r.objects || []).length; j++) {
+          const obj = __sbR2StrictObject(r.objects[j], null, undefined);
+          if (include.indexOf("httpMetadata") < 0) obj.httpMetadata = {};
+          if (include.indexOf("customMetadata") < 0) obj.customMetadata = {};
+          objects.push(obj);
+        }
+        return { objects, truncated: !!r.truncated, cursor: r.truncated ? r.cursor : undefined, delimitedPrefixes: r.delimitedPrefixes || [] };
+      });
+    },
+    createMultipartUpload(key, options) {
+      return attempt(() => {
+        const objectKey = __sbR2Key(key, "createMultipartUpload");
+        const o = options || {};
+        const r = __sbRpc("r2.multipart.create", {
+          bucket: name,
+          key: objectKey,
+          httpMetadata: __sbR2Http(o.httpMetadata),
+          customMetadata: o.customMetadata || {},
+        });
+        return upload(objectKey, r.uploadId);
+      });
+    },
+    resumeMultipartUpload(key, uploadId) {
+      return upload(String(key), String(uploadId));
+    },
+  };
+}
+
 // Asset rules use the same parsed manifest in both transports. Matching mirrors
 // @sproutboat/assets; parity tests cover the portable native implementation.
 function __sbAssetRedirect(rule, path) {
@@ -5364,7 +5812,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   for (let i = 0; i < (bindings.r2 || []).length; i++) {
     const name = bindings.r2[i];
-    target[name] = {
+    target[name] = __sbR2Strict() ? __sbMakeR2(name) : {
       put(key, value, options) {
         value = __sbUnwrapBody(value);
         const o = options || {};

package/src/r2-object.test.js

@@ -18,6 +18,9 @@ const rawStart = src.indexOf("function __sbRawBodyResponse(");
 const utf8End = rawStart;
 const rawEnd = src.indexOf("function __sbEqCt(");
 const r2Start = src.indexOf("function __sbR2Object(");
+const isStrStart = src.indexOf("function __sbIsStr(");
+const isStrEnd = src.indexOf("function __sbIsFn(");
+const bytesStart = src.indexOf("const __SB_BYTES_WINDOW");
 const r2End = src.indexOf("// Installed only when the project declares bindings.");
 if (utf8Start === -1 || utf8End === -1) throw new Error("__sbFromUtf8 block not found in prelude");
 if (rawStart === -1 || rawEnd === -1) throw new Error("__sbRawBodyResponse block not found in prelude");
@@ -27,7 +30,8 @@ if (r2Start === -1 || r2End === -1 || r2End < r2Start) throw new Error("__sbR2Ob
 const load = new Function(
   "__sbRpc",
   "__sbR2MultipartPut",
-  `${src.slice(utf8Start, utf8End)}\n${src.slice(rawStart, rawEnd)}\n${src.slice(r2Start, r2End)}\nreturn { __sbR2Object, __sbR2Multipart };`,
+  // __sbIsStr and __sbToBytes (for uploadPart's values), with the C fast paths stubbed out.
+  `function __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(isStrStart, isStrEnd)}\n${src.slice(bytesStart, utf8Start)}\n${src.slice(utf8Start, utf8End)}\n${src.slice(rawStart, rawEnd)}\n${src.slice(r2Start, r2End)}\nreturn { __sbR2Object, __sbR2Multipart };`,
 );
 const calls = [];
 const rpc = (op, value) => {
@@ -70,7 +74,7 @@ test("toResponse() lets caller-supplied headers/status override the defaults", (
   expect(resp.headers.get("content-type")).toBe("application/octet-stream");
 });
 
-test("toResponse() on an empty body still returns bytes, not the string \"\"", async () => {
+test('toResponse() on an empty body still returns bytes, not the string ""', async () => {
   const obj = __sbR2Object(meta, "");
   const resp = obj.toResponse();
   const buf = new Uint8Array(await resp.arrayBuffer());
@@ -84,9 +88,14 @@ test("multipart uploads expose the Cloudflare-shaped uploadPart, complete, and a
   expect(upload.uploadPart(1, "first")).toEqual({ partNumber: 1, etag: "part-1" });
   expect(upload.complete([{ partNumber: 1, etag: "part-1" }])).toMatchObject(meta);
   upload.abort();
-  expect(calls.map((call) => call.op)).toEqual([
-    "r2.multipart.put",
-    "r2.multipart.complete",
-    "r2.multipart.abort",
-  ]);
+  expect(calls.map((call) => call.op)).toEqual(["r2.multipart.put", "r2.multipart.complete", "r2.multipart.abort"]);
+});
+
+test("uploadPart stores an ArrayBuffer or a view as its bytes, not as [object ArrayBuffer]", () => {
+  calls.length = 0;
+  const upload = __sbR2Multipart("FILES", "archive.bin", "upload-1");
+  upload.uploadPart(1, new Uint8Array([0, 255, 65]).buffer);
+  upload.uploadPart(2, new Uint8Array([9, 8, 7, 6]).subarray(1, 3));
+  upload.uploadPart(3, "text");
+  expect(calls.map((call) => call.value.body)).toEqual(["\u0000ÿA", "\u0008\u0007", "text"]);
 });

package/src/to-bytes.test.js

@@ -22,7 +22,7 @@ if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sb
 
 // oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
 const load = new Function(
-  `${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
 );
 const { __sbToBytes, __sbHexOrBytes } = load();
 

package/src/transport-embedded.js

@@ -3590,6 +3590,10 @@ function __sbEnsureSchema() {
   let hasBlobId = false;
   for (let i = 0; i < r2Columns.length; i++) if (r2Columns[i][1] === "blob_id") hasBlobId = true;
   if (!hasBlobId) __sbSql(s, "ALTER TABLE r2 ADD COLUMN blob_id TEXT", []);
+  // The MD5 of an object's bytes, its etag from compatibility date 2026-10-26 (r2.md5).
+  let hasR2Md5 = false;
+  for (let i = 0; i < r2Columns.length; i++) if (r2Columns[i][1] === "md5") hasR2Md5 = true;
+  if (!hasR2Md5) __sbSql(s, "ALTER TABLE r2 ADD COLUMN md5 TEXT", []);
   __sbSql(
     s,
     "CREATE TABLE IF NOT EXISTS r2_upload (bucket TEXT NOT NULL, key TEXT NOT NULL, upload_id TEXT NOT NULL, " +
@@ -3661,6 +3665,51 @@ function __sbEnsureSchema() {
   );
 }
 
+// One page of r2.list for the shim from 2026-10-26: at most LIMIT entries after CURSOR,
+// keys under PREFIX, those holding DELIMITER after it grouped into delimitedPrefixes (a
+// group counts as one entry). Same rules as the broker's r2ListPage.
+// ponytail: with a delimiter every key after the cursor is read; an index on the
+// delimited prefix if buckets grow past ~100k keys.
+function __sbR2ListPage(store, msg) {
+  const prefix = String(msg.prefix || "");
+  const delimiter = String(msg.delimiter || "");
+  const limit = Math.min(Math.max(Math.floor(Number(msg.limit)) || 1000, 1), 1000);
+  const r = __sbSql(
+    store,
+    "SELECT key, size, etag, uploaded, http_json, custom_json, md5 FROM r2 WHERE bucket = ?1 AND substr(key, 1, length(?2)) = ?2 " +
+      "AND key > ?3 ORDER BY key" + (delimiter ? "" : " LIMIT " + (limit + 1)),
+    [msg.bucket, prefix, String(msg.cursor || "")],
+  );
+  const objects = [];
+  const delimitedPrefixes = [];
+  let last = "";
+  let truncated = false;
+  for (let i = 0; i < r.rows.length; i++) {
+    const row = r.rows[i];
+    const at = delimiter ? row[0].indexOf(delimiter, prefix.length) : -1;
+    const group = at < 0 ? "" : row[0].slice(0, at + delimiter.length);
+    if (!group || delimitedPrefixes[delimitedPrefixes.length - 1] !== group) {
+      if (objects.length + delimitedPrefixes.length >= limit) {
+        truncated = true;
+        break;
+      }
+      if (group) delimitedPrefixes.push(group);
+      else
+        objects.push({
+          key: row[0],
+          size: Number(row[1]),
+          etag: row[2],
+          uploaded: row[3],
+          httpMetadata: JSON.parse(row[4] || "{}"),
+          customMetadata: JSON.parse(row[5] || "{}"),
+          md5: row[6],
+        });
+    }
+    last = row[0];
+  }
+  return { ok: true, objects, delimitedPrefixes, truncated, cursor: truncated ? last : "" };
+}
+
 function __sbHex(n) {
   let out = "";
   const bytes = __sbRandomBytes(String(n));
@@ -4072,7 +4121,7 @@ function __sbEmbeddedDispatch(msg) {
     const wantsBody = op === "r2.get";
     const r = __sbSql(
       store,
-      "SELECT size, etag, uploaded, http_json, custom_json, blob_id FROM r2 WHERE bucket = ? AND key = ?",
+      "SELECT size, etag, uploaded, http_json, custom_json, blob_id, md5 FROM r2 WHERE bucket = ? AND key = ?",
       [msg.bucket, msg.key],
     );
     if (!r.rows.length) return { ok: true, found: false };
@@ -4088,6 +4137,7 @@ function __sbEmbeddedDispatch(msg) {
         uploaded: row[2],
         httpMetadata: JSON.parse(row[3] || "{}"),
         customMetadata: JSON.parse(row[4] || "{}"),
+        md5: row[6],
       },
       blobId: row[5] || "",
       body: wantsBody
@@ -4110,10 +4160,23 @@ function __sbEmbeddedDispatch(msg) {
       );
     return { ok: true };
   }
+  if (op === "r2.md5") {
+    // Recorded after the put that wrote these bytes (etag): the shim from 2026-10-26 hashes them.
+    __sbSql(store, "UPDATE r2 SET md5 = ?1 WHERE bucket = ?2 AND key = ?3 AND etag = ?4", [
+      String(msg.md5),
+      msg.bucket,
+      msg.key,
+      String(msg.etag),
+    ]);
+    return { ok: true };
+  }
   if (op === "r2.list") {
+    // The prefix matches exactly at every date: LIKE ignored case and read "_" and "%" as
+    // wildcards. With `page` (the shim from 2026-10-26), a page after the cursor.
+    if (msg.page) return __sbR2ListPage(store, msg);
     const r = __sbSql(
       store,
-      "SELECT key, size, etag, uploaded FROM r2 WHERE bucket = ? AND key LIKE ? || '%' ORDER BY key",
+      "SELECT key, size, etag, uploaded FROM r2 WHERE bucket = ?1 AND substr(key, 1, length(?2)) = ?2 ORDER BY key",
       [msg.bucket, msg.prefix || ""],
     );
     const objects = [];

package/src/utf8-decode.test.js

@@ -12,7 +12,9 @@ const end = src.indexOf("// sproutboat #181 — wrap a Response");
 if (start === -1 || end === -1 || end < start) throw new Error("__sbFromUtf8 block not found in prelude");
 
 // oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
-const load = new Function(`${src.slice(start, end)}\nreturn { __sbFromUtf8 };`);
+const load = new Function(
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(start, end)}\nreturn { __sbFromUtf8 };`,
+);
 const { __sbFromUtf8 } = load();
 
 /** Build a bytestring (one char per raw byte) the way __sbToBytes/porf_native_fetch_alloc_bytestring would, from real UTF-8 bytes. */
@@ -78,7 +80,7 @@ if (rbrStart === -1 || rbrEnd === -1 || rbrEnd < rbrStart) {
 // oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
 const loadRbr = new Function(
   "Response",
-  `${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
 );
 // A minimal Response stand-in: only what __sbRawBodyResponse touches (the
 // constructor call and setting .text/.json on the instance), no Porffor

package/test/native-byte-text.ts

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// sproutd #22: __sbFromUtf8 and __sbToBytes run in C (__sbFromUtf8Native, __sbToBytesNative).
+// They must give exactly what the JS loops gave, and a body of megabytes must not take
+// hundreds of megabytes of heap (the JS made one string per character: a 5 MiB R2 object
+// read with text() took about 400 MiB).
+const handler = `const bytes = (list) => { let s = ""; for (const b of list) s += String.fromCharCode(b); return s; };
+const codes = (s) => { const out = []; for (let i = 0; i < s.length; i++) out.push(s.charCodeAt(i)); return out; };
+export default {fetch(request) {
+  if (new URL(request.url).pathname === "/big") {
+    const text = __sbFromUtf8("\\u00c3\\u00a9".repeat(4 * 1024 * 1024));
+    const utf8 = __sbToBytes("\\u2713".repeat(1024 * 1024));
+    const ascii = __sbToBytes("a".repeat(8 * 1024 * 1024));
+    return new Response(JSON.stringify([text.length, text.charCodeAt(0), utf8.length, utf8.charCodeAt(2), ascii.length]));
+  }
+  const decode = [
+    "hello", bytes([0x63, 0x61, 0x66, 0xc3, 0xa9, 0x20, 0xf0, 0x9f, 0x8c, 0xb1, 0x20, 0xe2, 0x9c, 0x93]),
+    bytes([0xc2]), bytes([0xe9, 0x41]), bytes([0xf0, 0x9f, 0x8c]), bytes([0xe2, 0x28, 0xa1]), bytes([0xc0, 0x80]),
+    bytes([0xf8, 0x88, 0x80, 0x80, 0x80]), bytes([0xed, 0xa0, 0x80]), bytes([0xf4, 0x90, 0x80, 0x80]), bytes([0xff, 0xfe, 0x00]),
+    JSON.parse('"caf\\\\u00c3\\\\u00a9 \\\\u0100"'), JSON.parse('"\\\\u00e2\\\\u009c\\\\u0093"'), "",
+  ];
+  const encode = [
+    "hello", "caf\\u00e9", "\\u2713 \\ud83c\\udf31", "\\ud800x", "\\udc00", "a\\ud800", "\\u0100\\u07ff\\u0800\\uffff", "",
+    new Uint8Array([0, 255, 128]), new Uint8Array([1, 2, 3]).buffer, new Uint8Array(new Uint8Array([9, 8, 7, 6]).buffer, 1, 2), new Uint8Array(0),
+  ];
+  return new Response(JSON.stringify({ decode: decode.map((s) => codes(__sbFromUtf8(s))), encode: encode.map((v) => codes(__sbToBytes(v))) }));
+}};`;
+
+// The JS the C replaces, lifted from the prelude with the C stubbed out, as the reference.
+const core = await readFile(preludePath, "utf8");
+const lift = (from: string, to: string) => {
+  const start = core.indexOf(from);
+  const end = core.indexOf(to, start);
+  assert(start >= 0 && end > start, `${from} block not found in prelude`);
+  return core.slice(start, end);
+};
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for the reference
+const reference = new Function(
+  `function __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n` +
+    lift("function __sbIsStr(", "function __sbIsFn(") +
+    lift("const __SB_BYTES_WINDOW", "function __sbBufFrom(") +
+    lift("function __sbFromUtf8(", "// sproutboat #181") +
+    "return { __sbFromUtf8, __sbToBytes };",
+)();
+const bytes = (list: number[]) => String.fromCharCode(...list);
+const codes = (s: string) => [...s].flatMap((c) => [...Array(c.length).keys()].map((i) => c.charCodeAt(i)));
+const want = {
+  decode: [
+    "hello",
+    bytes([0x63, 0x61, 0x66, 0xc3, 0xa9, 0x20, 0xf0, 0x9f, 0x8c, 0xb1, 0x20, 0xe2, 0x9c, 0x93]),
+    bytes([0xc2]),
+    bytes([0xe9, 0x41]),
+    bytes([0xf0, 0x9f, 0x8c]),
+    bytes([0xe2, 0x28, 0xa1]),
+    bytes([0xc0, 0x80]),
+    bytes([0xf8, 0x88, 0x80, 0x80, 0x80]),
+    bytes([0xed, 0xa0, 0x80]),
+    bytes([0xf4, 0x90, 0x80, 0x80]),
+    bytes([0xff, 0xfe, 0x00]),
+    "café Ā",
+    "â\u009c\u0093",
+    "",
+  ].map((s) => codes(reference.__sbFromUtf8(s))),
+  encode: [
+    "hello",
+    "café",
+    "✓ 🌱",
+    "\ud800x",
+    "\udc00",
+    "a\ud800",
+    "Ā߿ࠀ￿",
+    "",
+    new Uint8Array([0, 255, 128]),
+    new Uint8Array([1, 2, 3]).buffer,
+    new Uint8Array(new Uint8Array([9, 8, 7, 6]).buffer, 1, 2),
+    new Uint8Array(0),
+  ].map((v) => codes(reference.__sbToBytes(v))),
+};
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-byte-text-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native byte-text test needs node on PATH");
+  const broker = await readFile(transportPath("broker"), "utf8");
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "bytes.generated.js");
+  const binary = join(workdir, "bytes-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker)));
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  // Peak RSS: /proc's high-water mark on Linux, time(1) on macOS.
+  const linux = process.platform === "linux";
+  server = Bun.spawn(linux ? [binary] : ["/usr/bin/time", "-l", binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  const got = await (await fetch(`http://127.0.0.1:${port}/`)).json();
+  assert.deepEqual(got.decode, want.decode, "__sbFromUtf8 in C decodes as the JS did");
+  assert.deepEqual(got.encode, want.encode, "__sbToBytes in C encodes as the JS did");
+  console.log("C byte/text conversions match the JS ones");
+
+  const big = await (await fetch(`http://127.0.0.1:${port}/big`)).json();
+  assert.deepEqual(big, [4 * 1024 * 1024, 0xe9, 3 * 1024 * 1024, 0x93, 8 * 1024 * 1024]);
+  let peak = 0;
+  if (linux) {
+    const status = await readFile(`/proc/${server.pid}/status`, "utf8");
+    peak = Number(/VmHWM:\s+(\d+) kB/.exec(status)?.[1] ?? 0) * 1024;
+  }
+  server.kill("SIGINT");
+  const timing = linux ? "" : await new Response(server.stderr).text();
+  await server.exited;
+  server = undefined;
+  if (!linux) peak = Number(/(\d+)\s+maximum resident set size/.exec(timing)?.[1] ?? 0);
+  assert(peak > 0, "peak RSS was measured");
+  // The JS took over 600 MiB for these; the C needs the strings plus one scratch copy.
+  assert(peak < 96 * 1024 * 1024, `8 MiB conversions peaked at ${(peak / 1048576).toFixed(1)} MiB`);
+  console.log(`8 MiB conversions peak at ${(peak / 1048576).toFixed(1)} MiB RSS`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}