@sproutboat/runtime 0.27.1 → 0.29.0

package/src/native-fetch-prelude.js

@@ -4745,7 +4745,7 @@ static size_t sb_utf8_encode_units(const uint16_t* s, size_t len, unsigned char*
 
 `;
 
-// sproutd #22: __sbFromUtf8 for a string of bytes (one byte per unit), in C.
+// sproutd #22: __sbFromUtf8 for a string of bytes (one byte per unit) or a Uint8Array, in C.
 // Returns "" when it cannot (not a string, or out of memory), so the caller
 // falls back to the JS loop. All-ASCII byte strings are already their text.
 // oxlint-disable-next-line no-unused-vars -- `bytes` is read inside the RawC block below, not by JS.
@@ -4753,9 +4753,10 @@ function __sbFromUtf8Native(bytes) {
   let out = "";
   // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
   Porffor.c`
-    if (bytes.type == 195 || bytes.type == 67) {
-      const u32 __p = (u32)bytes.val;
-      const size_t __n = (size_t)*(u32*)(MEM + __p);
+    const int __view = bytes.type == 81 && *(int32_t*)(MEM + (u32)bytes.val) >= 0;
+    if (bytes.type == 195 || bytes.type == 67 || __view) {
+      const u32 __p = __view ? *(u32*)(MEM + (u32)bytes.val + 4) : (u32)bytes.val;
+      const size_t __n = __view ? (size_t)*(int32_t*)(MEM + (u32)bytes.val) : (size_t)*(u32*)(MEM + __p);
       int __ascii = bytes.type == 195;
       if (__ascii) {
         const unsigned char* __s = (const unsigned char*)(MEM + __p + 4);
@@ -4766,7 +4767,7 @@ function __sbFromUtf8Native(bytes) {
         unsigned char* __b = (unsigned char*)malloc(__n + 1);
         uint16_t* __u = (uint16_t*)malloc(__n * 2 + 2);
         if (__b && __u) {
-          if (bytes.type == 195) memcpy(__b, MEM + __p + 4, __n);
+          if (bytes.type != 67) memcpy(__b, MEM + __p + 4, __n);
           else { const uint16_t* __w = (const uint16_t*)(MEM + __p + 4); for (size_t __i = 0; __i < __n; __i++) __b[__i] = (unsigned char)(__w[__i] & 0xff); }
           int __wide = 0;
           const size_t __k = sb_utf8_decode_units(__b, __n, __u, &__wide);
@@ -5904,11 +5905,18 @@ globalThis.__sbInstallBindings = function (target, bindings) {
           delaySeconds: o.delaySeconds || 0,
         });
       },
-      sendBatch(messages) {
+      sendBatch(messages, options) {
+        // From 2026-10-28 sendBatch(messages, { delaySeconds }) delays every message that
+        // sets none of its own, as on Workers; before, the batch option was ignored.
+        const batchDelay = globalThis.__sbCompat >= "2026-10-28" ? (options && options.delaySeconds) || 0 : 0;
         const list = [];
         for (let j = 0; j < (messages || []).length; j++) {
           const m = messages[j];
-          list.push({ body: __sbIsStr(m.body) ? m.body : JSON.stringify(m.body), delaySeconds: m.delaySeconds || 0 });
+          list.push({
+            body: __sbIsStr(m.body) ? m.body : JSON.stringify(m.body),
+            // A message delay of 0 (or none) takes the batch delay, as miniflare does.
+            delaySeconds: m.delaySeconds || batchDelay,
+          });
         }
         __sbRpc("queue.send_batch", { queue: name, messages: list });
       },
@@ -6010,9 +6018,14 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 async function __sbServiceFetch(binding, input, init) {
   const parts = __sbFetchParts(input, init);
   if (parts.signal) parts.signal.throwIfAborted();
-  // A stream body is read to the end first: the wire carries a whole body.
+  // A stream body goes out as it is read where the transport can (__sbStreamsBody), else it
+  // is read to the end first.
   const body = __sbUnwrapBody(parts.body);
-  const wire = body instanceof ReadableStream ? __sbRequestBody(await __sbCollectBody(body)) : __sbPartsBody({ ...parts, body });
+  const wire = __sbStreamsBody(body)
+    ? { bodyStream: true, __sbBodySource: body }
+    : body instanceof ReadableStream
+      ? __sbRequestBody(await __sbCollectBody(body))
+      : __sbPartsBody({ ...parts, body });
   const msg = { binding, url: parts.url, method: parts.method, headers: parts.headers, ...wire };
   const response = await __sbFetchFollowing("service.fetch", msg, "sproutboat service " + binding, parts.redirect, parts.signal);
   // The callee threw: as in workerd, its error is thrown here.
@@ -6270,7 +6283,52 @@ function __sbUpstreamResponse(r) {
 // whole (a broker from before streaming, or sproutd's embedded transport) is handled
 // as before. Cancelling the body, or the signal, drops the exchange, which stops the
 // upstream request.
+// Streamed request bodies, from compatibility date 2026-10-27, on a transport that sends
+// them in frames (the broker's, on an async host, against a broker that takes them):
+// fetch() and service bindings send a ReadableStream body as it is read, instead of
+// reading it to the end first. As in workerd, a streamed body can't follow a 307 or 308.
+function __sbStreamsBody(body) {
+  return (
+    body instanceof ReadableStream &&
+    globalThis.__sbCompat >= "2026-10-27" &&
+    globalThis.__sbBodyStreamable != null &&
+    globalThis.__sbBodyStreamable()
+  );
+}
+// Reads source into the exchange under timer id `id`, a frame per chunk, while ended()
+// is false. Above 4 MiB not yet written it waits for the socket to catch up.
+async function __sbPumpRequestBody(id, source, ended) {
+  const reader = source.getReader();
+  try {
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      if (ended()) {
+        reader.cancel();
+        return;
+      }
+      let bytes = null;
+      if (value instanceof Uint8Array) bytes = value;
+      else if (value instanceof ArrayBuffer) bytes = new Uint8Array(value);
+      else if (ArrayBuffer.isView(value)) bytes = new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+      else throw new TypeError("This ReadableStream did not return bytes.");
+      if (bytes.length === 0) continue;
+      let backlog = Number(globalThis.__sbAsyncBody(id, "c", __sbToBytes(bytes)));
+      while (backlog > 4 * 1024 * 1024 && !ended()) {
+        await new Promise((resolve) => setTimeout(resolve, 2));
+        backlog = Number(globalThis.__sbAsyncBody(id, "q", ""));
+      }
+    }
+    globalThis.__sbAsyncBody(id, "e", "");
+  } catch (error) {
+    globalThis.__sbAsyncBody(id, "x", "");
+    __sbLogUncaught("fetch", error);
+  }
+}
+
 function __sbUpstreamStreamed(op, msg, label, signal) {
+  const source = msg.__sbBodySource;
+  if (source !== undefined) delete msg.__sbBodySource;
   return new Promise((resolve, reject) => {
     let controller = null;
     let onAbort = null;
@@ -6338,6 +6396,7 @@ function __sbUpstreamStreamed(op, msg, label, signal) {
       msg.asyncId = id;
       msg.stream = true;
       globalThis.__sbFetchUpstream(op, msg);
+      if (source !== undefined) __sbPumpRequestBody(id, source, () => done);
     } catch (e) {
       finish();
       reject(e);
@@ -6375,7 +6434,8 @@ function __sbFollowHop(op, msg, label, mode, signal, hops) {
       next.method = "GET";
       next.body = null;
       delete next.bodyBinary;
-    }
+      delete next.bodyStream;
+    } else if (msg.bodyStream === true) throw new TypeError(label + ": a streamed request body can't follow a " + res.status + " redirect");
     return __sbFollowHop(op, next, label, mode, signal, hops + 1);
   };
   const out = __sbUpstream(op, msg, label, signal);
@@ -6435,6 +6495,7 @@ function __sbUpstream(op, msg, label, signal, always) {
 // Worker's fetch. Installed by the generated module (wrap.ts), not here: the
 // prelude must not replace fetch just by being evaluated.
 globalThis.__sbInstallFetch = function () {
+  __sbIngressStreamingSetup();
   globalThis.fetch = function (input, init) {
     let parts;
     try {
@@ -6448,9 +6509,11 @@ globalThis.__sbInstallFetch = function () {
       const msg = { url: parts.url, method: parts.method, headers: parts.headers, ...body };
       return __sbFetchFollowing("fetch", msg, "sproutboat fetch", parts.redirect, parts.signal);
     };
-    // A stream body is read to the end first, as for a service binding: the wire carries a
-    // whole body. It was sent as the text "[object ReadableStream]".
+    // A stream body goes out as it is read, from 2026-10-27 where the transport can
+    // (__sbStreamsBody); else it is read to the end first. It was sent as the text
+    // "[object ReadableStream]".
     const stream = __sbUnwrapBody(parts.body);
+    if (__sbStreamsBody(stream)) return send({ bodyStream: true, __sbBodySource: stream });
     if (stream instanceof ReadableStream) return __sbCollectBody(stream).then((bytes) => send(__sbRequestBody(bytes)));
     return send(__sbPartsBody(parts));
   };
@@ -6458,14 +6521,14 @@ globalThis.__sbInstallFetch = function () {
 
 // ---------------------------------------------------------------------------
 // Durable Objects. The class runs here in the sandboxed sprout. There is exactly
-// one sprout process per deployment (the supervisor model) and the native-fetch
-// runtime processes one turn at a time, so calls to a given object id are
-// already serialized — `env.<NS>.get(id).fetch()` invokes the instance directly,
-// no round-trip. Only `state.storage.*` goes to the broker (so object state
-// outlives a sprout restart), scoped to (class, id).
-// ponytail: serialization relies on the single sprout process; a multi-sprout
-// deployment needs the broker to hold a per-id lock (cloud). Storage ops are one
-// key at a time; blockConcurrencyWhile just runs the fn.
+// one sprout process per deployment (the supervisor model), so one instance per
+// id: `env.<NS>.get(id).fetch()` invokes the instance directly, no round-trip.
+// Events still interleave at every await; from 2026-10-28 an input gate (below,
+// __sbDOEnter) keeps them out while a storage read is in flight, as in workerd.
+// Only `state.storage.*` goes to the broker (so object state outlives a sprout
+// restart), scoped to (class, id).
+// ponytail: one instance per id relies on the single sprout process; a
+// multi-sprout deployment needs the broker to hold a per-id lock (cloud).
 
 function __sbMakeDONamespace(binding, className) {
   return {
@@ -6514,9 +6577,14 @@ function __sbMakeDONamespace(binding, className) {
             if (opts.body != null) req.body = String(opts.body);
           }
           const inst = __sbGetDOInstance(className, idStr);
-          const res = inst.fetch(req);
-          if (inst.__sbTasks.length || (res && __sbIsFn(res.then)) || __sbHasStreamBody(res)) return __sbFetchWithDrain(res, inst.__sbTasks);
-          return res;
+          const deliver = () => {
+            const res = inst.fetch(req);
+            if (inst.__sbTasks.length || (res && __sbIsFn(res.then)) || __sbHasStreamBody(res)) return __sbFetchWithDrain(res, inst.__sbTasks);
+            return res;
+          };
+          // From 2026-10-28 the call waits at the object's input gate, as in workerd.
+          if (__sbDOGated()) return __sbDOEnter(inst.__sbGate, deliver);
+          return deliver();
         },
       };
     },
@@ -6540,15 +6608,39 @@ function __sbGetDOInstance(cls, id) {
     // `__sbDOInstances`), so the queue lives on `state` too and is drained by
     // whichever call site invoked `fetch`/`alarm` this turn.
     const __sbTasks = [];
+    const gate = __sbDOMakeGate();
     const state = {
       id: {
         toString() {
           return id;
         },
       },
-      storage: __sbDOStorage(cls, id),
+      storage: __sbDOGated() ? __sbDOAsyncStorage(cls, id, gate) : __sbDOStorage(cls, id),
       blockConcurrencyWhile(fn) {
-        return fn();
+        if (!__sbDOGated()) return fn();
+        // No event enters until fn settles (2026-10-28).
+        gate.locks++;
+        const done = () => {
+          gate.locks--;
+          __sbDOPump(gate);
+        };
+        let r;
+        try {
+          r = fn();
+        } catch (error) {
+          done();
+          return Promise.reject(error);
+        }
+        return Promise.resolve(r).then(
+          (v) => {
+            done();
+            return v;
+          },
+          (error) => {
+            done();
+            throw error;
+          },
+        );
       },
       waitUntil(p) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
@@ -6556,6 +6648,7 @@ function __sbGetDOInstance(cls, id) {
     };
     inst = new Ctor(state, globalThis.env);
     inst.__sbTasks = __sbTasks;
+    inst.__sbGate = gate;
     __sbDOInstances[cacheKey] = inst;
   }
   return inst;
@@ -6568,12 +6661,12 @@ function __sbDOStorage(cls, id) {
         const out = new Map();
         for (let i = 0; i < key.length; i++) {
           const r = __sbRpc("do.storage.get", { cls, id, key: String(key[i]) });
-          if (r.found) out.set(key[i], JSON.parse(r.value));
+          if (r.found) out.set(key[i], __sbDODecode(r.value));
         }
         return out;
       }
       const r = __sbRpc("do.storage.get", { cls, id, key: String(key) });
-      return r.found ? JSON.parse(r.value) : undefined;
+      return r.found ? __sbDODecode(r.value) : undefined;
     },
     put(key, value) {
       if (key != null && __sbIsObj(key)) {
@@ -6616,12 +6709,435 @@ function __sbDOStorage(cls, id) {
         limit: o.limit == null ? 1000 : o.limit,
       });
       const out = new Map();
-      for (let i = 0; i < (r.entries || []).length; i++) out.set(r.entries[i][0], JSON.parse(r.entries[i][1]));
+      for (let i = 0; i < (r.entries || []).length; i++) out.set(r.entries[i][0], __sbDODecode(r.entries[i][1]));
+      return out;
+    },
+  };
+}
+
+
+// From compatibility date 2026-10-28 Durable Objects behave like workerd's in three ways:
+//
+// - Input gate. While a storage read is in flight, no other event (stub.fetch(), an alarm)
+//   enters the object; the reader's continuation runs first. Reads here are synchronous, so
+//   the gate stays shut until the next timer turn, by which point every microtask the read
+//   woke (the reader's code up to its next real await) has run. So
+//   `const v = await storage.get("n"); await storage.put("n", v + 1)` is safe under
+//   concurrent calls; it used to lose updates (10 concurrent increments ended at 1). An
+//   event that awaits anything else (fetch, a timer) lets the next one in, as in workerd.
+//   blockConcurrencyWhile() and transaction() shut it until they settle.
+// - Storage methods return Promises.
+// - Values are structured-cloned (Date, Map, Set, RegExp, ArrayBuffer and views, BigInt,
+//   undefined inside containers, NaN and the infinities), not JSON: put(k, undefined) and
+//   functions throw, and list() takes start, startAfter, end and reverse.
+//
+// Before that date storage is synchronous JSON and events interleave at every await.
+// Values written in the new format start with __sbDOTag (no JSON text starts with "#"),
+// so either side reads both.
+function __sbDOGated() {
+  return globalThis.__sbCompat >= "2026-10-28";
+}
+
+function __sbDOMakeGate() {
+  return { locks: 0, waiting: [] };
+}
+
+// Deliver queued events while the gate is open. A delivered event that reads storage shuts
+// the gate again, which stops the loop.
+function __sbDOPump(gate) {
+  while (gate.locks === 0 && gate.waiting.length > 0) gate.waiting.shift()();
+}
+
+// Shut the gate until the next timer turn (see above).
+function __sbDOHold(gate) {
+  gate.locks++;
+  setTimeout(function () {
+    gate.locks--;
+    __sbDOPump(gate);
+  }, 0);
+}
+
+// Run an event now if the gate is open and nothing is queued ahead of it, else queue it.
+// Always a Promise, like workerd's stub.fetch().
+function __sbDOEnter(gate, run) {
+  if (gate.locks === 0 && gate.waiting.length === 0) {
+    try {
+      return Promise.resolve(run());
+    } catch (error) {
+      return Promise.reject(error);
+    }
+  }
+  return new Promise(function (resolve, reject) {
+    gate.waiting.push(function () {
+      try {
+        resolve(run());
+      } catch (error) {
+        reject(error);
+      }
+    });
+  });
+}
+
+const __sbDOTag = "#sb1:";
+
+function __sbDOCloneError(value) {
+  let text = "value";
+  try {
+    text = String(value);
+  } catch {
+    /* a value whose String() throws still gets the error below */
+  }
+  const error = new Error(text + " could not be cloned.");
+  error.name = "DataCloneError";
+  return error;
+}
+
+function __sbDOHex(bytes) {
+  const digits = "0123456789abcdef";
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) out += digits[bytes[i] >> 4] + digits[bytes[i] & 15];
+  return out;
+}
+
+function __sbDOUnhex(text) {
+  const out = new Uint8Array(text.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(text.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+
+function __sbDOView(name, bytes) {
+  const buf = bytes.buffer;
+  if (name === "Uint8Array") return bytes;
+  if (name === "Int8Array") return new Int8Array(buf);
+  if (name === "Uint8ClampedArray") return new Uint8ClampedArray(buf);
+  if (name === "Uint16Array") return new Uint16Array(buf);
+  if (name === "Int16Array") return new Int16Array(buf);
+  if (name === "Uint32Array") return new Uint32Array(buf);
+  if (name === "Int32Array") return new Int32Array(buf);
+  if (name === "Float32Array") return new Float32Array(buf);
+  if (name === "Float64Array") return new Float64Array(buf);
+  if (name === "DataView") return new DataView(buf);
+  return bytes;
+}
+
+// A value as JSON: null, booleans, strings and finite numbers are themselves; everything
+// else is an array whose first element names its type, so no plain value is ambiguous.
+/* oxlint-disable anti-slop/no-runtime-typeof -- structured clone branches on the value's type, as the HTML spec's StructuredSerialize does. */
+function __sbDOPack(v, seen) {
+  if (v === null || v === true || v === false || __sbIsStr(v)) return v;
+  const t = typeof v;
+  if (t === "number") {
+    if (v === 0 && 1 / v < 0) return ["N", "-0"];
+    return Number.isFinite(v) ? v : ["N", String(v)];
+  }
+  if (t === "bigint") return ["B", String(v)];
+  if (t === "undefined") return ["U"];
+  if (t !== "object") throw __sbDOCloneError(v);
+  if (seen.indexOf(v) !== -1) throw __sbDOCloneError("a circular value");
+  seen.push(v);
+  let out;
+  if (v instanceof Date) out = ["D", v.getTime()];
+  else if (v instanceof Map) {
+    out = ["M"];
+    v.forEach((x, k) => {
+      out.push(__sbDOPack(k, seen), __sbDOPack(x, seen));
+    });
+  } else if (v instanceof Set) {
+    out = ["S"];
+    v.forEach((x) => {
+      out.push(__sbDOPack(x, seen));
+    });
+  } else if (v instanceof ArrayBuffer) out = ["AB", __sbDOHex(new Uint8Array(v))];
+  else if (ArrayBuffer.isView(v))
+    out = ["V", Object.prototype.toString.call(v).slice(8, -1), __sbDOHex(new Uint8Array(v.buffer, v.byteOffset, v.byteLength))];
+  else if (v instanceof RegExp) out = ["R", v.source, v.flags];
+  else if (Array.isArray(v)) {
+    out = ["A"];
+    for (let i = 0; i < v.length; i++) out.push(__sbDOPack(v[i], seen));
+  } else if (v instanceof Error) out = ["E", String(v.name), String(v.message)];
+  else {
+    out = ["O"];
+    const keys = Object.keys(v);
+    for (let i = 0; i < keys.length; i++) out.push(keys[i], __sbDOPack(v[keys[i]], seen));
+  }
+  seen.pop();
+  return out;
+}
+/* oxlint-enable anti-slop/no-runtime-typeof */
+
+function __sbDOUnpack(p) {
+  if (!Array.isArray(p)) return p;
+  const tag = p[0];
+  if (tag === "U") return undefined;
+  if (tag === "N") return p[1] === "-0" ? -0 : Number(p[1]);
+  if (tag === "B") return BigInt(p[1]);
+  if (tag === "D") return new Date(p[1]);
+  if (tag === "AB") return __sbDOUnhex(p[1]).buffer;
+  if (tag === "V") return __sbDOView(p[1], __sbDOUnhex(p[2]));
+  if (tag === "R") return new RegExp(p[1], p[2]);
+  if (tag === "E") {
+    const e = new Error(p[2]);
+    e.name = p[1];
+    return e;
+  }
+  if (tag === "M") {
+    const m = new Map();
+    for (let i = 1; i + 1 < p.length; i += 2) m.set(__sbDOUnpack(p[i]), __sbDOUnpack(p[i + 1]));
+    return m;
+  }
+  if (tag === "S") {
+    const s = new Set();
+    for (let i = 1; i < p.length; i++) s.add(__sbDOUnpack(p[i]));
+    return s;
+  }
+  if (tag === "A") {
+    const a = [];
+    for (let i = 1; i < p.length; i++) a.push(__sbDOUnpack(p[i]));
+    return a;
+  }
+  const o = {};
+  for (let i = 1; i + 1 < p.length; i += 2) o[p[i]] = __sbDOUnpack(p[i + 1]);
+  return o;
+}
+
+function __sbDOEncode(value) {
+  if (value === undefined) throw new TypeError("put() called with undefined value.");
+  return __sbDOTag + JSON.stringify(__sbDOPack(value, []));
+}
+
+// Reads both formats at every date: tagged (2026-10-28 writes) and plain JSON (earlier ones).
+function __sbDODecode(text) {
+  if (__sbIsStr(text) && text.indexOf(__sbDOTag) === 0) return __sbDOUnpack(JSON.parse(text.slice(__sbDOTag.length)));
+  return JSON.parse(text);
+}
+
+function __sbDOListLimit(options) {
+  const o = options || {};
+  if (o.limit != null && !(Number(o.limit) > 0)) throw new TypeError("List limit must be positive.");
+  return o;
+}
+
+function __sbDOInRange(key, o) {
+  if (o.prefix != null && key.indexOf(String(o.prefix)) !== 0) return false;
+  if (o.start != null && key < String(o.start)) return false;
+  if (o.startAfter != null && key <= String(o.startAfter)) return false;
+  if (o.end != null && key >= String(o.end)) return false;
+  return true;
+}
+
+// The synchronous core of the 2026-10-28 storage: structured values, list() ranges.
+function __sbDOStrictStorage(cls, id) {
+  const get = (key) => {
+    const r = __sbRpc("do.storage.get", { cls, id, key: String(key) });
+    return r.found ? __sbDODecode(r.value) : undefined;
+  };
+  const put = (key, value) => {
+    __sbRpc("do.storage.put", { cls, id, key: String(key), value: __sbDOEncode(value) });
+  };
+  const del = (key) => !!__sbRpc("do.storage.delete", { cls, id, key: String(key) }).deleted;
+  return {
+    get(key) {
+      if (!Array.isArray(key)) return get(key);
+      const out = new Map();
+      for (let i = 0; i < key.length; i++) {
+        const v = get(key[i]);
+        if (v !== undefined) out.set(key[i], v);
+      }
+      return out;
+    },
+    put(key, value) {
+      if (key != null && __sbIsObj(key)) {
+        // Encode every value before writing any, so one bad value writes nothing.
+        const keys = Object.keys(key);
+        const encoded = [];
+        for (let i = 0; i < keys.length; i++) encoded.push(__sbDOEncode(key[keys[i]]));
+        for (let i = 0; i < keys.length; i++) __sbRpc("do.storage.put", { cls, id, key: keys[i], value: encoded[i] });
+        return;
+      }
+      put(key, value);
+    },
+    delete(key) {
+      if (!Array.isArray(key)) return del(key);
+      let n = 0;
+      for (let i = 0; i < key.length; i++) n += del(key[i]) ? 1 : 0;
+      return n;
+    },
+    deleteAll() {
+      // workerd's deleteAll() also drops the alarm.
+      __sbRpc("do.storage.delete_all", { cls, id });
+      __sbRpc("do.alarm.delete", { cls, id });
+    },
+    setAlarm(when) {
+      const at = when instanceof Date ? when.getTime() : when;
+      if (!Number.isFinite(at))
+        throw new TypeError("Failed to execute 'setAlarm' on 'DurableObjectStorage': parameter 1 is not of type 'date'.");
+      __sbRpc("do.alarm.set", { cls, id, at: Number(at) });
+    },
+    getAlarm() {
+      const r = __sbRpc("do.alarm.get", { cls, id });
+      return r.at == null ? null : r.at;
+    },
+    deleteAlarm() {
+      __sbRpc("do.alarm.delete", { cls, id });
+    },
+    list(options) {
+      const o = __sbDOListLimit(options);
+      const r = __sbRpc("do.storage.list", {
+        cls,
+        id,
+        prefix: o.prefix == null ? "" : String(o.prefix),
+        start: o.start == null ? null : String(o.start),
+        startAfter: o.startAfter == null ? null : String(o.startAfter),
+        end: o.end == null ? null : String(o.end),
+        reverse: !!o.reverse,
+        limit: o.limit == null ? 10000 : Number(o.limit),
+      });
+      const out = new Map();
+      const entries = r.entries || [];
+      // A transport that predates the range fields returns a superset: filter it here.
+      for (let i = 0; i < entries.length; i++)
+        if (__sbDOInRange(entries[i][0], o)) out.set(entries[i][0], __sbDODecode(entries[i][1]));
       return out;
     },
   };
 }
 
+// The 2026-10-28 storage: every method returns a Promise; reads shut the input gate.
+function __sbDOAsyncStorage(cls, id, gate) {
+  const s = __sbDOStrictStorage(cls, id);
+  const settle = (f) => {
+    try {
+      return Promise.resolve(f());
+    } catch (error) {
+      return Promise.reject(error);
+    }
+  };
+  const read = (f) => {
+    __sbDOHold(gate);
+    return settle(f);
+  };
+  return {
+    get: (key) => read(() => s.get(key)),
+    list: (options) => read(() => s.list(options)),
+    getAlarm: () => read(() => s.getAlarm()),
+    put: (key, value) => settle(() => s.put(key, value)),
+    delete: (key) => settle(() => s.delete(key)),
+    deleteAll: () => settle(() => s.deleteAll()),
+    setAlarm: (when) => settle(() => s.setAlarm(when)),
+    deleteAlarm: () => settle(() => s.deleteAlarm()),
+    sync: () => Promise.resolve(),
+    transaction: (fn) => __sbDOTransaction(cls, id, s, gate, fn),
+  };
+}
+
+// storage.transaction(fn): fn gets a txn with the storage methods; its writes stay in
+// memory (read back by its own get and list) and are written when fn resolves, unless it
+// threw or called txn.rollback(). The input gate stays shut meanwhile, so no other event
+// sees a half-written transaction.
+function __sbDOTransaction(cls, id, s, gate, fn) {
+  const writes = new Map(); // key -> encoded value, or null for a delete
+  let rolledBack = false;
+  const getOne = (key) => {
+    const k = String(key);
+    if (!writes.has(k)) return s.get(k);
+    const v = writes.get(k);
+    return v === null ? undefined : __sbDODecode(v);
+  };
+  const putOne = (key, value) => {
+    writes.set(String(key), __sbDOEncode(value));
+  };
+  const delOne = (key) => {
+    const existed = getOne(key) !== undefined;
+    writes.set(String(key), null);
+    return existed;
+  };
+  const txn = {
+    get(key) {
+      if (!Array.isArray(key)) return Promise.resolve(getOne(key));
+      const out = new Map();
+      for (let i = 0; i < key.length; i++) {
+        const v = getOne(key[i]);
+        if (v !== undefined) out.set(key[i], v);
+      }
+      return Promise.resolve(out);
+    },
+    put(key, value) {
+      try {
+        if (key != null && __sbIsObj(key)) {
+          const keys = Object.keys(key);
+          for (let i = 0; i < keys.length; i++) putOne(keys[i], key[keys[i]]);
+        } else putOne(key, value);
+        return Promise.resolve();
+      } catch (error) {
+        return Promise.reject(error);
+      }
+    },
+    delete(key) {
+      if (!Array.isArray(key)) return Promise.resolve(delOne(key));
+      let n = 0;
+      for (let i = 0; i < key.length; i++) n += delOne(key[i]) ? 1 : 0;
+      return Promise.resolve(n);
+    },
+    list(options) {
+      try {
+        const o = __sbDOListLimit(options);
+        const merged = s.list({ prefix: o.prefix, start: o.start, startAfter: o.startAfter, end: o.end });
+        writes.forEach((v, k) => {
+          if (!__sbDOInRange(k, o)) return;
+          if (v === null) merged.delete(k);
+          else merged.set(k, __sbDODecode(v));
+        });
+        const keys = [];
+        merged.forEach((v, k) => keys.push(k));
+        keys.sort();
+        if (o.reverse) keys.reverse();
+        const out = new Map();
+        const limit = o.limit == null ? keys.length : Number(o.limit);
+        for (let i = 0; i < keys.length && i < limit; i++) out.set(keys[i], merged.get(keys[i]));
+        return Promise.resolve(out);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+    },
+    rollback() {
+      rolledBack = true;
+    },
+    getAlarm: () => Promise.resolve(s.getAlarm()),
+    setAlarm: (when) => Promise.resolve(s.setAlarm(when)),
+    deleteAlarm: () => Promise.resolve(s.deleteAlarm()),
+  };
+  gate.locks++;
+  const done = () => {
+    gate.locks--;
+    __sbDOPump(gate);
+  };
+  let r;
+  try {
+    r = fn(txn);
+  } catch (error) {
+    done();
+    return Promise.reject(error);
+  }
+  return Promise.resolve(r).then(
+    (v) => {
+      try {
+        if (!rolledBack)
+          writes.forEach((value, key) => {
+            if (value === null) __sbRpc("do.storage.delete", { cls, id, key });
+            else __sbRpc("do.storage.put", { cls, id, key, value });
+          });
+      } finally {
+        done();
+      }
+      return v;
+    },
+    (error) => {
+      done();
+      throw error;
+    },
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Trigger dispatch. The compiled server only ever calls `fetch(request)`; this
 // routes the internal `x-sb-trigger` requests (sent by the broker, authenticated
@@ -7031,11 +7547,133 @@ async function __sbQueueWithDrain(result, tasks) {
   return new Response(JSON.stringify(r), { headers: { "content-type": "application/json" } });
 }
 
+// Streamed request bodies, from compatibility date 2026-10-27, on a native server that
+// streams them (a standalone or platform sprout; request-streaming.ts in the toolchain).
+// The handler runs once the headers are in, and request.body hands out the bytes as they
+// arrive: the server pauses the socket while more than 1 MiB waits unread. Before that
+// date the server buffers the whole body and the handler gets it at once, as before.
+// op: "e" enable (at startup), "t" take the current request's body id, "p" poll (a byte
+// count, "0" nothing yet, "-1" ended, "-2" failed), "i" copy into the Uint8Array in data,
+// "w" wait on the timer id in data, "c" close. Returns a short string.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block, not by JS.
+function __sbReqBodyOp(op, id, data) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    extern int sb_reqbody_enable(void);
+    extern unsigned int sb_reqbody_take_current(void);
+    extern long long sb_reqbody_poll(unsigned int);
+    extern size_t sb_reqbody_take(unsigned int, char*, size_t);
+    extern void sb_reqbody_wait(unsigned int, unsigned int);
+    extern void sb_reqbody_close(unsigned int);
+    const char* __o; size_t __ol; char* __oo = 0;
+    porf_native_fetch_read_value(op, &__o, &__ol, &__oo);
+    char __op = __ol ? __o[0] : 0;
+    if (__oo) free(__oo);
+    const unsigned int __id = id.type == 1 && id.val > 0 ? (unsigned int)id.val : 0;
+    char __r[32]; __r[0] = 0;
+    if (__op == 'e') snprintf(__r, sizeof(__r), "%d", sb_reqbody_enable());
+    else if (__op == 't') snprintf(__r, sizeof(__r), "%u", sb_reqbody_take_current());
+    else if (__op == 'p') snprintf(__r, sizeof(__r), "%lld", sb_reqbody_poll(__id));
+    else if (__op == 'i' && data.type == 81) {
+      const u32 __ta = (u32)data.val;
+      const int32_t __len = *(int32_t*)(MEM + __ta);
+      if (__len > 0) {
+        const u32 __at = *(u32*)(MEM + __ta + 4) + 4;
+        snprintf(__r, sizeof(__r), "%zu", sb_reqbody_take(__id, (char*)(MEM + __at), (size_t)__len));
+      }
+    } else if (__op == 'w' && data.type == 1 && data.val > 0) sb_reqbody_wait(__id, (unsigned int)data.val);
+    else if (__op == 'c') sb_reqbody_close(__id);
+    out = porf_box((f64)porf_native_fetch_alloc_bytestring(__r, strlen(__r)), 195);
+  `;
+  return out;
+}
+
+// Turns streaming on in the native server, from 2026-10-27. Called once at startup, after
+// the compatibility date is set (__sbInstallFetch).
+function __sbIngressStreamingSetup() {
+  if (globalThis.__sbCompat >= "2026-10-27") __sbReqBodyOp("e", 0, "");
+}
+
+// request.body for a streamed request: chunks as the server receives them.
+function __sbIngressStream(request, id) {
+  let closed = false;
+  const close = () => {
+    if (!closed) {
+      closed = true;
+      __sbReqBodyOp("c", id, "");
+    }
+  };
+  const step = (controller, resolve) => {
+    const state = Number(__sbReqBodyOp("p", id, ""));
+    if (state === 0) {
+      // Nothing yet: the server fires this timer when bytes, the end or an error arrive.
+      const timer = setTimeout(() => step(controller, resolve), 2147483647);
+      __sbReqBodyOp("w", id, timer);
+      return;
+    }
+    if (state > 0) {
+      const chunk = new Uint8Array(state);
+      __sbReqBodyOp("i", id, chunk);
+      controller.enqueue(chunk);
+    } else {
+      close();
+      if (state === -1) controller.close();
+      else controller.error(new TypeError("Network connection lost."));
+    }
+    resolve();
+  };
+  const stream = new ReadableStream({
+    pull(controller) {
+      return new Promise((resolve) => step(controller, resolve));
+    },
+    cancel() {
+      close();
+    },
+  });
+  request.body = stream;
+  // The bytes of the whole body, read through the stream (so bodyUsed and locking hold).
+  const all = async () => {
+    const body = request.body;
+    if (request.bodyUsed) throw new TypeError("Body has already been used. It can only be used once. Use tee() first if you need to read it twice.");
+    request._bodyUsed = true;
+    const reader = body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      chunks.push(value);
+      size += value.length;
+    }
+    if (chunks.length === 1) return chunks[0];
+    const out = new Uint8Array(size);
+    let at = 0;
+    for (const chunk of chunks) {
+      out.set(chunk, at);
+      at += chunk.length;
+    }
+    return out;
+  };
+  request.text = async () => __sbFromUtf8(await all());
+  request.json = async () => JSON.parse(__sbFromUtf8(await all()));
+  request.arrayBuffer = async () => {
+    const bytes = await all();
+    return bytes.byteLength === bytes.buffer.byteLength ? bytes.buffer : bytes.slice().buffer;
+  };
+  request.bytes = async () => await all();
+}
+
 // Native HTTP ingress stores the body as one character per raw byte. Keep
 // that representation for binary consumers, but decode text lazily before
 // handing the request to user code. Request.text() in Porffor otherwise treats
 // the raw bytes as already-decoded characters and corrupts Unicode/HMAC input.
 function __sbDecodeIngress(request) {
+  const streamed = globalThis.__sbCompat >= "2026-10-27" ? Number(__sbReqBodyOp("t", 0, "")) : 0;
+  if (streamed > 0) {
+    __sbIngressStream(request, streamed);
+    return;
+  }
   const raw = __sbRawBody(request);
   if (raw == null) return;
   // A GET or HEAD has no body, as in workerd (from 2026-10-23): request.body is null, and
@@ -7169,7 +7807,7 @@ globalThis.__sbEntry = function (handlers, request) {
     if (!__sbIsFn(inst.alarm)) return new Response("no alarm handler", { status: 404 });
     let __ares;
     try {
-      __ares = inst.alarm();
+      __ares = __sbDOGated() ? __sbDOEnter(inst.__sbGate, () => inst.alarm()) : inst.alarm();
     } catch (error) {
       // #179 — same rule as fetch: don't let a throw here crash the process.
       __sbLogUncaught("alarm", error);
@@ -7194,6 +7832,7 @@ globalThis.__sbEntry = function (handlers, request) {
 async function __sbRunQueueBatch(handlers, body, ctx) {
   const acked = [];
   const retried = [];
+  let threw = false;
   const raw = body.messages || [];
   const messages = [];
   for (let i = 0; i < raw.length; i++) {
@@ -7230,15 +7869,18 @@ async function __sbRunQueueBatch(handlers, body, ctx) {
     // the response go out) before its own `await`s did, so any ack()/retry()
     // past the first one never counted.
     if (__qres && __sbIsFn(__qres.then)) await __qres;
-  } catch {
+  } catch (error) {
     // #179 — a throw here must not crash the process. Whatever ack()/retry()
-    // calls the handler made before throwing still count; anything it never
-    // touched falls through to the default-ack pass below, same as a handler
-    // that returns without calling ack()/retry() on every message.
+    // calls the handler made before throwing still count.
+    threw = true;
+    __sbLogUncaught("queue", error);
   }
-  // default: any message neither acked nor retried is treated as acked
+  // A message neither acked nor retried is acked when the handler returns, and retried
+  // when it throws, as on Workers. A throw used to ack the whole batch on the embedded
+  // transport (standalone, sproutd), so a failing consumer lost its messages.
   for (let i = 0; i < messages.length; i++) {
-    if (acked.indexOf(messages[i].id) === -1 && retried.indexOf(messages[i].id) === -1) acked.push(messages[i].id);
+    if (acked.indexOf(messages[i].id) === -1 && retried.indexOf(messages[i].id) === -1)
+      (threw ? retried : acked).push(messages[i].id);
   }
   return { ack: acked, retry: retried };
 }