@sproutboat/runtime 0.34.0 → 0.34.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @sproutboat/runtime
 
+## 0.34.2
+
+### Patch Changes
+
+- a0ba6a3: Faster requests: about 57% of a request's CPU was Porffor's `globalThis` getter.
+  
+  - **Toolchain, the root cause.** Porffor's `#get_globalThis` re-synced every top-level function and `var` of the module into the global object on every read, one hashed write per binding (about 20 µs with the prelude's ~120 bindings, so every `globalThis.x` in user code paid it too). Every binding is now written when the object is built, and a later read rewrites only the bindings whose value changed (a packed copy of the last value written is kept per binding: an unchanged binding costs one compare). 20,000 reads with 600 top-level functions: 9,300 ms before, a few ms after.
+  - **Runtime and toolchain, the request path.** The runtime's `globalThis.__sbCompat` / `globalThis.env` reads go through accessors over module-level `let`s that the app tail sets once, and `Request`/`Response` cache the class lookups and take the date and WebSocketPair state from statics the runtime sets. Until the tail has run (the shared template, unit tests) everything reads `globalThis` as before.
+  - **Client IP.** `request.cf` no longer reads and splits `SB_TRUSTED_PROXIES` four times a request: it is read once per process, and with no trusted proxy (the usual case) the peer is the client and the forwarded-header lookups are skipped.
+  - **`x-sb-cpu-ms`.** The stamp is appended to the handler's own Response instead of building a second Response with a copy of every header. The same responses are stamped, with the same headers and body.
+  
+  A 404 on one pinned x86 core, CPU per request when saturated, standalone: 319 µs before, 127 µs with the getter patch alone, 113 µs with the request-path change, 81 µs with the client-IP and stamp changes.
+
+## 0.34.1
+
+### Patch Changes
+
+- e62b72d: An unhandled promise rejection no longer ends the process. A D1 call that failed and was never awaited (`db.prepare("INSERT ...").run()` that broke a foreign key) threw its error out of Porffor's promise job loop into the host's "Uncaught ..." exit, taking every in-flight request down even with a try/catch around the call. As on Workers it is now reported: a log line (`Uncaught (in promise) ...`) and an `unhandledrejection` event (`PromiseRejectionEvent` with `promise` and `reason`) on the global scope when `addEventListener("unhandledrejection", ...)` has a listener, and the process and other requests carry on. This applies at every compatibility date, because a crash is a bug rather than a behaviour an app can depend on. The toolchain's `patchUnhandledRejections` calls the runtime's `globalThis.__sbOnUnhandledRejection`; plain Porffor without it keeps the throw. Applies to every binding call that returns a rejecting Promise (D1, KV, R2, Durable Objects, Queues, fetch). An un-awaited `async function` that throws is reported the same way (it used to be dropped silently): the C runtime that rejects it now hands the promise to the same check.
+
 ## 0.34.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/client-ip.test.js

@@ -17,7 +17,7 @@ const load = new Function(
   "__envMap",
   `${src.slice(start, end)}
    const __sbEnv = (k) => __envMap[k];
-   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList, __sbTrustedProxyHeader };`,
+   return { __sbNormalizeIp, __sbIpInCidr, __sbIpTrusted, __sbClientIp, __sbSplitList, __sbTrustedProxyHeader, __sbTrustedProxiesOnce };`,
 );
 const H = load(new Proxy({}, { get: (_, k) => env[k] }));
 
@@ -62,7 +62,9 @@ test("__sbClientIp: a trusted peer resolves the rightmost untrusted XFF hop", ()
 
 test("__sbClientIp: an untrusted peer cannot use XFF even if it sends one", () => {
   env = { SB_TRUSTED_PROXIES: "10.0.0.0/8" };
-  expect(H.__sbClientIp(req({ "x-sb-remote-addr": "198.51.100.9", "x-forwarded-for": "1.1.1.1" }))).toBe("198.51.100.9");
+  expect(H.__sbClientIp(req({ "x-sb-remote-addr": "198.51.100.9", "x-forwarded-for": "1.1.1.1" }))).toBe(
+    "198.51.100.9",
+  );
 });
 
 test("__sbTrustedProxyHeader: no trusted proxies configured means the header is ignored", () => {
@@ -83,3 +85,10 @@ test("__sbTrustedProxyHeader: a trusted peer's value passes through, absent stay
   expect(H.__sbTrustedProxyHeader(r, "x-sb-http-protocol")).toBe("HTTP/2");
   expect(H.__sbTrustedProxyHeader(r, "x-sb-tls-cipher")).toBeUndefined();
 });
+
+test("__sbTrustedProxiesOnce reads SB_TRUSTED_PROXIES once and keeps the list", () => {
+  env = { SB_TRUSTED_PROXIES: "10.0.0.0/8, 192.0.2.1" };
+  expect(H.__sbTrustedProxiesOnce()).toEqual(["10.0.0.0/8", "192.0.2.1"]);
+  env = { SB_TRUSTED_PROXIES: "198.51.100.0/24" };
+  expect(H.__sbTrustedProxiesOnce()).toEqual(["10.0.0.0/8", "192.0.2.1"]); // fixed for the process
+});

package/src/entry-crash.test.js

@@ -18,10 +18,7 @@ const load = new Function(
 // Every Porffor.c`...` block in the prelude only runs inside a function body
 // (never at load time), so a no-op tag covers all of them: __sbCpuMs and
 // __sbEnv just see an empty result, same as "native op returned nothing."
-const H = load(
-  { c: () => "" },
-  new Proxy({}, { get: () => undefined }),
-);
+const H = load({ c: () => "" }, new Proxy({}, { get: () => undefined }));
 
 const req = (overrides = {}) => ({
   headers: { get: (k) => (overrides.headers && overrides.headers[k.toLowerCase()]) ?? null },
@@ -61,3 +58,55 @@ test("a throwing fetch handler doesn't stop the next request from being served",
   const second = await H.__sbEntry(handlers, req({ boom: false }));
   expect(await second.text()).toBe("ok");
 });
+
+// A promise that rejects with nobody waiting on it (an un-awaited D1 run() that broke a
+// foreign key) must be reported, not end the process: Porffor's promise job loop calls
+// globalThis.__sbOnUnhandledRejection (toolchain patchUnhandledRejections).
+test("an unhandled rejection is logged and fires an unhandledrejection event", () => {
+  const logged = [];
+  const consoleError = console.error;
+  const dispatch = globalThis.dispatchEvent;
+  const Ctor = globalThis.PromiseRejectionEvent;
+  const events = [];
+  console.error = (line) => logged.push(String(line));
+  globalThis.PromiseRejectionEvent = class {
+    constructor(type, init) {
+      this.type = type;
+      this.reason = init.reason;
+      this.promise = init.promise;
+    }
+  };
+  globalThis.dispatchEvent = (event) => events.push(event);
+  try {
+    const promise = Promise.reject(new Error("D1_ERROR: FOREIGN KEY constraint failed"));
+    promise.catch(() => {});
+    globalThis.__sbOnUnhandledRejection(new Error("D1_ERROR: FOREIGN KEY constraint failed"), promise);
+  } finally {
+    console.error = consoleError;
+    globalThis.dispatchEvent = dispatch;
+    globalThis.PromiseRejectionEvent = Ctor;
+  }
+  expect(logged.join("\n")).toContain("Uncaught (in promise)");
+  expect(logged.join("\n")).toContain("FOREIGN KEY");
+  expect(events).toHaveLength(1);
+  expect(events[0].type).toBe("unhandledrejection");
+  expect(events[0].reason.message).toContain("FOREIGN KEY");
+});
+
+test("a throwing unhandledrejection listener does not escape the hook", () => {
+  const consoleError = console.error;
+  const dispatch = globalThis.dispatchEvent;
+  const Ctor = globalThis.PromiseRejectionEvent;
+  console.error = () => {};
+  globalThis.PromiseRejectionEvent = class {};
+  globalThis.dispatchEvent = () => {
+    throw new Error("listener broke");
+  };
+  try {
+    expect(() => globalThis.__sbOnUnhandledRejection(new Error("x"), undefined)).not.toThrow();
+  } finally {
+    console.error = consoleError;
+    globalThis.dispatchEvent = dispatch;
+    globalThis.PromiseRejectionEvent = Ctor;
+  }
+});

package/src/ingress-utf8.test.js

@@ -7,7 +7,7 @@ const rawBody = src.slice(src.indexOf("function __sbRawBody("), src.indexOf("fun
 if (!decoder || !ingress || !rawBody) throw new Error("Ingress decoder source not found");
 // oxlint-disable-next-line no-function-constructor -- Exercise the text-only runtime prelude.
 const load = new Function(
-  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`,
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\nfunction __sbCompatDate() { return undefined; }\n${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`,
 );
 const decode = load();
 const raw = (text) => Array.from(new TextEncoder().encode(text), (byte) => String.fromCharCode(byte)).join("");

package/src/native-fetch-prelude.js

@@ -1,3 +1,24 @@
+// Reads of globalThis are expensive in Porffor (the getter rebuilds the global object on each read);
+// the app tail (wrap.ts) sets these two once. See sproutd/benchmarks/per-request-2026-10-26.
+let __sbCompatNow;
+let __sbEnvNow;
+function __sbCompatDate() {
+  return __sbCompatNow === undefined ? globalThis.__sbCompat : __sbCompatNow;
+}
+function __sbEnvValue() {
+  return __sbEnvNow === undefined ? globalThis.env : __sbEnvNow;
+}
+// Setters, not bare assignments in the tail: the template and every app must compile the prelude identically.
+function __sbSetCompat(date) {
+  __sbCompatNow = date;
+  Request._cd = date;
+}
+function __sbSetEnv(value) {
+  __sbEnvNow = value;
+}
+// Referenced, so the shared template keeps them: an app tail can only call what the template compiled.
+globalThis.__sbSetCompat = __sbSetCompat;
+globalThis.__sbSetEnv = __sbSetEnv;
 // WEB STREAMS: generated by gen-streams.ts, do not edit.
 /* oxlint-disable -- generated third-party implementation */
 // web-streams-polyfill 4.3.0, MIT, copyright Mattias Buelens (see WEB_STREAMS_LICENSE)
@@ -3095,17 +3116,25 @@ function __sbCpuMs() {
 function __sbTagCpu(res, t0) {
   const cpu = __sbCpuMs() - t0;
   try {
-    const body = __sbRawBody(res);
-    if (__sbIsStr(body) && !res.headers.has("set-cookie")) {
-      const headers = {};
-      res.headers.forEach(function (value, name) {
-        headers[name] = value;
-      });
-      headers["x-sb-cpu-ms"] = (cpu >= 0 ? cpu : 0).toFixed(3);
-      return new Response(body, { status: res.status, headers: headers });
+    // A string body and no Set-Cookie, as before. The native writer reads Headers' flat `_entries`,
+    // so the stamp is appended to the handler's own Response instead of building a second one (a
+    // Headers, a body extraction and a status check, plus a copy of every header); an x-sb-cpu-ms
+    // the handler set itself is replaced by the measured one, as before.
+    const headers = res && res.headers;
+    if (headers && __sbIsStr(__sbRawBody(res)) && !headers.has("set-cookie")) {
+      const stamp = (cpu >= 0 ? cpu : 0).toFixed(3);
+      const entries = headers._entries;
+      let set = false;
+      for (let i = 0; i < entries.length; i += 2) {
+        if (entries[i] === "x-sb-cpu-ms") {
+          entries[i + 1] = stamp;
+          set = true;
+        }
+      }
+      if (!set) headers._push("x-sb-cpu-ms", stamp);
     }
   } catch {
-    /* fall through to the original response */
+    /* the handler's Response goes out unstamped */
   }
   return res;
 }
@@ -3323,7 +3352,7 @@ if (Headers.prototype[Symbol.iterator] == null) Headers.prototype[Symbol.iterato
 // and delete with a TypeError. A copy (new Headers(h), new Response(body, res)) is
 // mutable. The runtime's own writes after the handler lift the guard first.
 function __sbFreezeHeaders(message) {
-  if (globalThis.__sbCompat >= "2026-10-23") message.headers._immutable = true;
+  if (__sbCompatDate() >= "2026-10-23") message.headers._immutable = true;
   return message;
 }
 
@@ -3752,7 +3781,7 @@ if (typeof globalThis.EventTarget !== "function") {
       if (this.aborted) return;
       this.aborted = true;
       // workerd's default reason reads "The operation was aborted" (from 2026-10-23 here).
-      const message = globalThis.__sbCompat >= "2026-10-23" ? "The operation was aborted" : "This operation was aborted";
+      const message = __sbCompatDate() >= "2026-10-23" ? "The operation was aborted" : "This operation was aborted";
       this.reason = reason === undefined ? namedError("AbortError", message) : reason;
       const event = new Event("abort");
       if (typeof this.onabort === "function") this.onabort.call(this, event);
@@ -3789,6 +3818,22 @@ if (typeof globalThis.EventTarget !== "function") {
   globalThis.EventTarget = EventTarget;
   globalThis.AbortSignal = AbortSignal;
   globalThis.AbortController = AbortController;
+  // Workers' global event target: `addEventListener("unhandledrejection", fn)` hears every
+  // promise that rejected with nobody waiting on it (see __sbOnUnhandledRejection).
+  class PromiseRejectionEvent extends Event {
+    constructor(type, init) {
+      super(type, init);
+      this.promise = init ? init.promise : undefined;
+      this.reason = init ? init.reason : undefined;
+    }
+  }
+  const globalTarget = new EventTarget();
+  globalThis.PromiseRejectionEvent = PromiseRejectionEvent;
+  if (typeof globalThis.addEventListener !== "function") {
+    globalThis.addEventListener = (type, listener, options) => globalTarget.addEventListener(type, listener, options);
+    globalThis.removeEventListener = (type, listener, options) => globalTarget.removeEventListener(type, listener, options);
+    globalThis.dispatchEvent = (event) => globalTarget.dispatchEvent(event);
+  }
 }
 
 // TextEncoderStream and TextDecoderStream over the Web Streams ponyfill (W2 conformance).
@@ -4991,7 +5036,7 @@ function __sbRpc(op, extra) {
 // pages with limit and cursor and returns each key's expiration and metadata. Earlier
 // dates keep the synchronous shim below.
 function __sbKvStrict() {
-  return globalThis.__sbCompat >= "2026-10-25";
+  return __sbCompatDate() >= "2026-10-25";
 }
 function __sbKvKey(key, verb) {
   const name = String(key);
@@ -5115,7 +5160,7 @@ function __sbMakeKv(ns) {
 // are enforced, errors read "D1_ERROR: ...", and a BLOB comes back as an array of
 // byte values. Earlier dates keep the old behaviour.
 function __sbD1Strict() {
-  return globalThis.__sbCompat >= "2026-10-24";
+  return __sbCompatDate() >= "2026-10-24";
 }
 function __sbD1Param(value, strict) {
   if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {
@@ -5433,7 +5478,7 @@ function __sbR2Multipart(bucket, key, uploadId) {
 // cursor, groups by delimiter and returns metadata only when `include` asks for it.
 // Earlier dates keep the synchronous shim below.
 function __sbR2Strict() {
-  return globalThis.__sbCompat >= "2026-10-26";
+  return __sbCompatDate() >= "2026-10-26";
 }
 function __sbR2Key(key, verb) {
   const name = String(key);
@@ -5774,7 +5819,7 @@ function __sbAssetResponse(path, r) {
 // The queue name and consumer settings (bindings.queueConfig, from `queues` in
 // sproutboat.jsonc) apply at every date: they are opt-in.
 function __sbQueuesStrict() {
-  return globalThis.__sbCompat >= "2026-10-31";
+  return __sbCompatDate() >= "2026-10-31";
 }
 
 // binding -> { binding, queue, maxBatchSize?, maxBatchTimeout?, maxRetries?, retryDelay?, deadLetterQueue? }
@@ -6090,7 +6135,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
       sendBatch(messages, options) {
         // From 2026-10-28 sendBatch(messages, { delaySeconds }) delays every message that
         // sets none of its own, as on Workers; before, the batch option was ignored.
-        const batchDelay = globalThis.__sbCompat >= "2026-10-28" ? (options && options.delaySeconds) || 0 : 0;
+        const batchDelay = __sbCompatDate() >= "2026-10-28" ? (options && options.delaySeconds) || 0 : 0;
         const list = [];
         for (let j = 0; j < (messages || []).length; j++) {
           const m = messages[j];
@@ -6177,7 +6222,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
     const binding = bindings.services[i].binding;
     const fetcher = {
       fetch(input, init) {
-        if (globalThis.__sbCompat >= "2026-10-22") return __sbServiceFetch(binding, input, init);
+        if (__sbCompatDate() >= "2026-10-22") return __sbServiceFetch(binding, input, init);
         const parts = __sbFetchParts(input, init);
         const msg = { binding, url: parts.url, method: parts.method, headers: parts.headers, ...__sbPartsBody(parts) };
         return __sbUpstreamResponse(globalThis.__sbFetchUpstream("service.fetch", msg));
@@ -6367,7 +6412,7 @@ function __sbHandles(handlers, name) {
 // Callee: the receiver of one request. A default export that is a class (a
 // WorkerEntrypoint) is instantiated per request with its ctx and env, as in workerd.
 function __sbReceiver(handlers, ctx) {
-  return __sbIsFn(handlers) ? new handlers(ctx, globalThis.env) : handlers;
+  return __sbIsFn(handlers) ? new handlers(ctx, __sbEnvValue()) : handlers;
 }
 
 // Callee: runs RPC method `method` of `receiver` with the arguments in the request body.
@@ -6396,7 +6441,7 @@ async function __sbRpcDispatch(handlers, receiver, method, request) {
 // throws), a Request given as init brings its body, GET and HEAD refuse a body, and the
 // method and redirect mode are checked. Before it, the parts are read off the input.
 function __sbFetchParts(input, init) {
-  if (globalThis.__sbCompat >= "2026-10-23") {
+  if (__sbCompatDate() >= "2026-10-23") {
     const request = new Request(input, init);
     const headers = [];
     request.headers.forEach((v, k) => headers.push([k, v]));
@@ -6472,7 +6517,7 @@ function __sbUpstreamResponse(r) {
 function __sbStreamsBody(body) {
   return (
     body instanceof ReadableStream &&
-    globalThis.__sbCompat >= "2026-10-27" &&
+    __sbCompatDate() >= "2026-10-27" &&
     globalThis.__sbBodyStreamable != null &&
     globalThis.__sbBodyStreamable()
   );
@@ -6599,7 +6644,7 @@ function __sbFollowHop(op, msg, label, mode, signal, hops) {
   const step = (res) => {
     const location = res.headers.get("location");
     const redirect = res.status === 301 || res.status === 302 || res.status === 303 || res.status === 307 || res.status === 308;
-    if (!(globalThis.__sbCompat >= "2026-10-22") || mode === "manual" || !redirect || location == null) return res;
+    if (!(__sbCompatDate() >= "2026-10-22") || mode === "manual" || !redirect || location == null) return res;
     if (mode === "error") throw new TypeError(label + ": redirect not allowed (redirect: \"error\")");
     if (hops >= 20) throw new TypeError(label + ": too many redirects");
     const dropped = __sbRawBody(res);
@@ -6636,9 +6681,9 @@ function __sbFollowHop(op, msg, label, mode, signal, hops) {
 // (__sbAsyncAtAnyDate). `always` is for RPC, which has no older behaviour to keep.
 function __sbUpstream(op, msg, label, signal, always) {
   if (signal) signal.throwIfAborted();
-  const promised = always || globalThis.__sbCompat >= "2026-10-22" || __sbAsyncAtAnyDate();
+  const promised = always || __sbCompatDate() >= "2026-10-22" || __sbAsyncAtAnyDate();
   if (!__sbHttpAsyncEnabled() || !promised) return __sbUpstreamResponse(globalThis.__sbFetchUpstream(op, msg));
-  if (globalThis.__sbCompat >= "2026-10-22") return __sbUpstreamStreamed(op, msg, label, signal);
+  if (__sbCompatDate() >= "2026-10-22") return __sbUpstreamStreamed(op, msg, label, signal);
   return new Promise((resolve, reject) => {
     let onAbort = null;
     const settled = () => {
@@ -6685,7 +6730,7 @@ globalThis.__sbInstallFetch = function () {
       parts = __sbFetchParts(input, init);
     } catch (error) {
       // From 2026-10-23 an invalid request rejects, as in workerd; before it, it threw.
-      if (globalThis.__sbCompat >= "2026-10-23") return Promise.reject(error);
+      if (__sbCompatDate() >= "2026-10-23") return Promise.reject(error);
       throw error;
     }
     if (__sbWsOutboundOn() && __sbWsIsUpgrade(parts)) return __sbWsFetchUpgrade(parts);
@@ -6746,7 +6791,7 @@ function __sbMakeDONamespace(binding, className) {
           let req;
           // From 2026-10-23 the object gets the Request Fetch makes of input and init, as in
           // workerd: method, headers and body survive, and the input's body is used up.
-          if (globalThis.__sbCompat >= "2026-10-23") {
+          if (__sbCompatDate() >= "2026-10-23") {
             req = new Request(input, init);
           } else if (__sbIsObj(input) && __sbIsStr(input.url) && !init) {
             req = input;
@@ -6798,7 +6843,7 @@ function __sbMakeDONamespace(binding, className) {
 // The object runs in this sprout on every transport (see above), so an RPC call is a
 // direct call; only its storage goes to the broker.
 function __sbDOv2() {
-  return globalThis.__sbCompat >= "2026-10-29";
+  return __sbCompatDate() >= "2026-10-29";
 }
 
 function __sbDOSha(text) {
@@ -7044,7 +7089,7 @@ function __sbGetDOInstance(cls, idText, idObj) {
     // The hibernation API, from 2026-10-30 (where WebSocketPair exists).
     const holder = { inst: null, auto: null, cls, id, restored: [] };
     if (__sbWsEnabled()) __sbDOWebSocketState(state, holder);
-    inst = new Ctor(state, globalThis.env);
+    inst = new Ctor(state, __sbEnvValue());
     holder.inst = inst;
     inst.__sbTasks = __sbTasks;
     inst.__sbGate = gate;
@@ -7138,7 +7183,7 @@ function __sbDOStorage(cls, id) {
 // Values written in the new format start with __sbDOTag (no JSON text starts with "#"),
 // so either side reads both.
 function __sbDOGated() {
-  return globalThis.__sbCompat >= "2026-10-28";
+  return __sbCompatDate() >= "2026-10-28";
 }
 
 function __sbDOMakeGate() {
@@ -8420,7 +8465,7 @@ function __sbWsHostResponse(r) {
   }
   // The compatibility date goes along: a standalone or platform server carries client sockets
   // from 2026-11-01 only (sproutd, whose bridge ignores it, from 2026-10-30).
-  const id = Number(__sbWsOp("o", 0, globalThis.__sbCompat, 0));
+  const id = Number(__sbWsOp("o", 0, __sbCompatDate(), 0));
   if (!(id > 0)) return new Response("WebSockets are not supported by this host yet", { status: 501 });
   ws._host = id;
   if (ws._peer !== null && ws._peer._hib !== null && __sbWsHibOn()) __sbWsHibRegister(ws._peer, id);
@@ -8480,7 +8525,7 @@ function __sbWsPump(ws) {
 // described at __sbWsOp, ids with the top bit set. Returning that Response from a handler
 // relays the socket to the client through a pair.
 function __sbWsOutboundOn() {
-  return globalThis.__sbCompat >= "2026-11-01";
+  return __sbCompatDate() >= "2026-11-01";
 }
 let __sbWsWakeable = -1;
 function __sbWsCanWake() {
@@ -8767,7 +8812,7 @@ function __sbWsProxy(r, upstream) {
 // their tags and attachments) and the event is dispatched as webSocketMessage/webSocketClose.
 let __sbWsHibHost = -1;
 function __sbWsHibOn() {
-  if (globalThis.__sbCompat < "2026-11-01" || !__sbDOGated()) return false;
+  if (__sbCompatDate() < "2026-11-01" || !__sbDOGated()) return false;
   if (__sbWsHibHost < 0 && __sbWsOp("H", 0, "", 0) === "1") __sbWsHibHost = 1;
   return __sbWsHibHost === 1;
 }
@@ -8899,7 +8944,9 @@ function __sbWsRestoreSocket(id) {
 }
 
 function __sbInstallWebSockets() {
-  if (globalThis.__sbCompat < "2026-10-30") return;
+  Request._hasWsp = false;
+  if (__sbCompatDate() < "2026-10-30") return;
+  Request._hasWsp = true;
   globalThis.WebSocketPair = __SbWebSocketPair;
   globalThis.WebSocket = __SbWebSocket;
   globalThis.WebSocketRequestResponsePair = __SbWebSocketRequestResponsePair;
@@ -8962,7 +9009,7 @@ function __sbBindingCallIngress(request) {
   if (vouched) {
     const url = headers.get("x-sb-url");
     // The callee sees its caller's URL from compatibility date 2026-10-22, as in workerd.
-    if (url && URL.canParse(url) && globalThis.__sbCompat >= "2026-10-22") request.url = url;
+    if (url && URL.canParse(url) && __sbCompatDate() >= "2026-10-22") request.url = url;
     headers.delete("x-sb-remote-addr");
   }
   for (const name of ["x-sb-binding-call", "x-sb-url", "x-sb-edge-token"]) {
@@ -8983,6 +9030,21 @@ function __sbLogUncaught(where, error) {
   }
 }
 
+// A promise rejected and nothing was waiting on it (an un-awaited `db.prepare(...).run()`
+// that failed, say). As on Workers the request, the process and every other request go on:
+// the rejection is logged, and an "unhandledrejection" event fires on the global scope when
+// something listens. Porffor's promise job loop calls this hook (patchUnhandledRejections);
+// without it, it throws the reason out of the event loop and the process exits.
+globalThis.__sbOnUnhandledRejection = function (reason, promise) {
+  __sbLogUncaught("promise", reason);
+  try {
+    if (__sbIsFn(globalThis.PromiseRejectionEvent) && __sbIsFn(globalThis.dispatchEvent))
+      globalThis.dispatchEvent(new globalThis.PromiseRejectionEvent("unhandledrejection", { promise, reason, cancelable: true }));
+  } catch (error) {
+    __sbLogUncaught("unhandledrejection listener", error);
+  }
+};
+
 // Shared by alarm and scheduled: both reply with an empty 204 once their
 // handler (and anything it queued via `waitUntil`) has settled.
 async function __sb204WithDrain(res, tasks) {
@@ -9047,7 +9109,7 @@ function __sbReqBodyOp(op, id, data) {
 // Turns streaming on in the native server, from 2026-10-27. Called once at startup, after
 // the compatibility date is set (__sbInstallFetch).
 function __sbIngressStreamingSetup() {
-  if (globalThis.__sbCompat >= "2026-10-27") __sbReqBodyOp("e", 0, "");
+  if (__sbCompatDate() >= "2026-10-27") __sbReqBodyOp("e", 0, "");
 }
 
 // request.body for a streamed request: chunks as the server receives them.
@@ -9124,7 +9186,7 @@ function __sbIngressStream(request, id) {
 // handing the request to user code. Request.text() in Porffor otherwise treats
 // the raw bytes as already-decoded characters and corrupts Unicode/HMAC input.
 function __sbDecodeIngress(request) {
-  const streamed = globalThis.__sbCompat >= "2026-10-27" ? Number(__sbReqBodyOp("t", 0, "")) : 0;
+  const streamed = __sbCompatDate() >= "2026-10-27" ? Number(__sbReqBodyOp("t", 0, "")) : 0;
   if (streamed > 0) {
     __sbIngressStream(request, streamed);
     return;
@@ -9133,7 +9195,7 @@ function __sbDecodeIngress(request) {
   if (raw == null) return;
   // A GET or HEAD has no body, as in workerd (from 2026-10-23): request.body is null, and
   // new Request(request) copies none. Before it, the body is the empty string.
-  if (raw === "" && (request.method === "GET" || request.method === "HEAD") && globalThis.__sbCompat >= "2026-10-23") {
+  if (raw === "" && (request.method === "GET" || request.method === "HEAD") && __sbCompatDate() >= "2026-10-23") {
     request.body = null;
     return;
   }
@@ -9150,6 +9212,14 @@ function __sbDecodeIngress(request) {
   };
 }
 
+// SB_TRUSTED_PROXIES is fixed for the life of a process (a sproutd worker gets its own after the fork,
+// and this runs per request, never before it), so it is read and split once, not four times a request.
+let __sbTrustedCache;
+function __sbTrustedProxiesOnce() {
+  if (__sbTrustedCache === undefined) __sbTrustedCache = __sbSplitList(__sbEnv("SB_TRUSTED_PROXIES"));
+  return __sbTrustedCache;
+}
+
 globalThis.__sbEntry = function (handlers, request) {
   __sbDecodeIngress(request);
   const trigger = request.headers.get("x-sb-trigger");
@@ -9160,13 +9230,18 @@ globalThis.__sbEntry = function (handlers, request) {
     // are only set when a trusted front proxy forwarded them; colo, ASN and
     // geo fields stay absent everywhere (#128 explicitly rejects faking them).
     const __cf = request.cf || {};
-    __cf.clientIp = __sbClientIp(request);
-    const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");
-    if (__httpProtocol) __cf.httpProtocol = __httpProtocol;
-    const __tlsVersion = __sbTrustedProxyHeader(request, "x-sb-tls-version");
-    if (__tlsVersion) __cf.tlsVersion = __tlsVersion;
-    const __tlsCipher = __sbTrustedProxyHeader(request, "x-sb-tls-cipher");
-    if (__tlsCipher) __cf.tlsCipher = __tlsCipher;
+    if (__sbTrustedProxiesOnce().length === 0) {
+      // No trusted proxy (the usual case): the peer is the client and no forwarded header counts.
+      __cf.clientIp = __sbNormalizeIp(request.headers.get("x-sb-remote-addr") || "");
+    } else {
+      __cf.clientIp = __sbClientIp(request);
+      const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");
+      if (__httpProtocol) __cf.httpProtocol = __httpProtocol;
+      const __tlsVersion = __sbTrustedProxyHeader(request, "x-sb-tls-version");
+      if (__tlsVersion) __cf.tlsVersion = __tlsVersion;
+      const __tlsCipher = __sbTrustedProxyHeader(request, "x-sb-tls-cipher");
+      if (__tlsCipher) __cf.tlsCipher = __tlsCipher;
+    }
     request.cf = __cf;
     // The edge's headers are gone: from 2026-10-23 the handler cannot change the rest.
     __sbFreezeHeaders(request);
@@ -9196,8 +9271,8 @@ globalThis.__sbEntry = function (handlers, request) {
       if (rpc == null && !__sbHandles(handlers, "fetch")) throw new Error("Handler does not export a fetch() function.");
       __res = rpc != null
         ? __sbRpcDispatch(handlers, receiver, rpc, request)
-        : globalThis.__sbCompat >= "2026-09-28"
-          ? receiver.fetch(request, globalThis.env, ctx)
+        : __sbCompatDate() >= "2026-09-28"
+          ? receiver.fetch(request, __sbEnvValue(), ctx)
           : receiver.fetch(request, ctx);
     } catch (error) {
       // #179 — a synchronous throw anywhere in the handler must not take the
@@ -9229,8 +9304,8 @@ globalThis.__sbEntry = function (handlers, request) {
     try {
       const event = { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} };
       const receiver = __sbReceiver(handlers, ctx);
-      __sres = globalThis.__sbCompat >= "2026-09-28"
-        ? receiver.scheduled(event, globalThis.env, ctx)
+      __sres = __sbCompatDate() >= "2026-09-28"
+        ? receiver.scheduled(event, __sbEnvValue(), ctx)
         : receiver.scheduled(event, ctx);
     } catch (error) {
       // #179 — same rule as fetch: don't let a throw here crash the process.
@@ -9358,8 +9433,8 @@ async function __sbRunQueueBatch(handlers, body, ctx) {
     };
   }
   try {
-    const __qres = globalThis.__sbCompat >= "2026-09-28"
-      ? handlers.queue(batch, globalThis.env, ctx)
+    const __qres = __sbCompatDate() >= "2026-09-28"
+      ? handlers.queue(batch, __sbEnvValue(), ctx)
       : handlers.queue(batch, ctx);
     // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
     // the response go out) before its own `await`s did, so any ack()/retry()

package/src/transport-embedded.js

@@ -5323,7 +5323,7 @@ function __sbLtxConfigure() {
 }
 
 function __sbCall(reqJson) {
-  if (globalThis.__sbCompat >= "2026-10-22") __sbLtxConfigure();
+  if (__sbCompatDate() >= "2026-10-22") __sbLtxConfigure();
   try {
     return JSON.stringify(__sbEmbeddedDispatch(JSON.parse(reqJson)));
   } catch (err) {
@@ -5710,8 +5710,8 @@ globalThis.__sbStartLocalTriggers = function (handlers, bindings) {
           try {
             const receiver = __sbReceiver(handlers, ctx);
             const event = { cron: crons[i], scheduledTime: now.getTime(), noRetry() {} };
-            const res = globalThis.__sbCompat >= "2026-09-28"
-              ? receiver.scheduled(event, globalThis.env, ctx)
+            const res = __sbCompatDate() >= "2026-09-28"
+              ? receiver.scheduled(event, __sbEnvValue(), ctx)
               : receiver.scheduled(event, ctx);
             if (res && __sbIsFn(res.then)) await res;
           } catch (error) {

package/src/wrap.ts

@@ -234,7 +234,7 @@ export function wrapNativeFetchHandler(
     );
   }
 
-  const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n`;
+  const env = `const env = ${JSON.stringify(vars)};\nglobalThis.env = env;\n__sbSetEnv(env);\n`;
   const versionMetadataLine = versionMetadata
     ? `env[${JSON.stringify(versionMetadata.binding)}] = ${JSON.stringify({
         id: versionMetadata.id,
@@ -246,6 +246,7 @@ export function wrapNativeFetchHandler(
   // not be able to change the semantics it was compiled against at runtime.
   const compat =
     `globalThis.__sbCompat = ${JSON.stringify(compatibilityDate)};\n` +
+    `__sbSetCompat(${JSON.stringify(compatibilityDate)});\n` +
     // #15 — the embedded transport derives its default data directory from this.
     `globalThis.__sbAppName = ${JSON.stringify(appName)};\n` +
     (assets ? `globalThis.__sbAssets = ${JSON.stringify(assets)};\n` : "");

package/test/native-cpu-stamp.ts

@@ -0,0 +1,129 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// The x-sb-cpu-ms stamp is added to the handler's own Response (it used to build a second one),
+// and request.cf's client IP skips the trusted-proxy work when no proxy is configured. What goes on
+// the wire must not change: which responses are stamped, the headers and the body, the client IP.
+const handler = `export default {fetch(request) {
+  const path = new URL(request.url).pathname;
+  if (path === "/text") return new Response("hello");
+  if (path === "/json") return new Response('{"a":1}', { status: 201, headers: { "content-type": "application/json", "x-a": "1" } });
+  if (path === "/bytes") return new Response(new Uint8Array([1, 2, 3]));
+  if (path === "/cookies") {
+    const h = new Headers(); h.append("set-cookie", "a=1"); h.append("set-cookie", "b=2");
+    return new Response("c", { headers: h });
+  }
+  if (path === "/own") return new Response("own", { headers: { "x-sb-cpu-ms": "mine" } });
+  if (path === "/ip") return new Response(JSON.stringify({ ip: request.cf.clientIp, proto: request.cf.httpProtocol ?? null }));
+  return new Response("not found", { status: 404 });
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-cpu-stamp-"));
+const servers: ReturnType<typeof Bun.spawn>[] = [];
+async function start(binary: string, env: Record<string, string>): Promise<number> {
+  const port = freePort();
+  const server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, ...env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  servers.push(server);
+  for (let attempt = 0; attempt < 50; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/text`, { signal: AbortSignal.timeout(500) });
+      return port;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  throw new Error("compiled handler did not start");
+}
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native cpu stamp test needs node on PATH");
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "stamp.generated.js");
+  const binary = join(workdir, "stamp-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker)));
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = await start(binary, {});
+  const get = (path: string, headers: Record<string, string> = {}, p = port) =>
+    fetch(`http://127.0.0.1:${p}${path}`, { headers });
+
+  const text = await get("/text");
+  assert.equal(await text.text(), "hello");
+  assert.match(text.headers.get("x-sb-cpu-ms") ?? "", /^\d+\.\d{3}$/, "a string body is stamped");
+  assert.equal(text.headers.get("content-type"), "text/plain;charset=UTF-8");
+
+  const json = await get("/json");
+  assert.equal(json.status, 201);
+  assert.equal(await json.text(), '{"a":1}');
+  assert.equal(json.headers.get("x-a"), "1");
+  assert.equal(json.headers.get("content-type"), "application/json");
+  assert.match(json.headers.get("x-sb-cpu-ms") ?? "", /^\d+\.\d{3}$/);
+
+  const notFound = await get("/missing");
+  assert.equal(notFound.status, 404);
+  assert.match(notFound.headers.get("x-sb-cpu-ms") ?? "", /^\d+\.\d{3}$/);
+
+  const bytes = await get("/bytes");
+  assert.deepEqual([...new Uint8Array(await bytes.arrayBuffer())], [1, 2, 3]);
+  assert.equal(bytes.headers.get("x-sb-cpu-ms"), null, "a binary body is not stamped");
+
+  const cookies = await get("/cookies");
+  assert.equal(await cookies.text(), "c");
+  assert.deepEqual(cookies.headers.getSetCookie(), ["a=1", "b=2"]);
+  assert.equal(cookies.headers.get("x-sb-cpu-ms"), null, "a Set-Cookie response is not stamped");
+
+  const own = await get("/own");
+  assert.match(own.headers.get("x-sb-cpu-ms") ?? "", /^\d+\.\d{3}$/, "the measured value replaces a handler-set one");
+
+  for (let i = 0; i < 5; i++) assert.equal(await (await get("/text")).text(), "hello");
+
+  // No trusted proxy: the peer is the client, forwarded headers do not count.
+  const plain = await (await get("/ip", { "x-forwarded-for": "203.0.113.9", "x-sb-http-protocol": "h2" })).json();
+  assert.deepEqual(plain, { ip: "127.0.0.1", proto: null });
+  // The peer is a trusted proxy: the forwarded client and protocol count.
+  const proxied = await start(binary, { SB_TRUSTED_PROXIES: "127.0.0.1" });
+  const forwarded = await (
+    await get("/ip", { "x-forwarded-for": "203.0.113.9", "x-sb-http-protocol": "h2" }, proxied)
+  ).json();
+  assert.deepEqual(forwarded, { ip: "203.0.113.9", proto: "h2" });
+  console.log("Native x-sb-cpu-ms stamp and client IP: same responses on the wire, no second Response");
+} finally {
+  for (const server of servers) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-unhandled-rejection.ts

@@ -0,0 +1,133 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// A promise that rejects with nobody waiting on it (a binding call that failed and was never
+// awaited, say a D1 run() that broke a foreign key) must not take the process down, whatever
+// the compatibility date. As on Workers it is logged, an "unhandledrejection" listener hears
+// it, and the next request is served.
+const handler = `addEventListener("unhandledrejection", (event) => {
+  globalThis.__heard = (globalThis.__heard || []).concat(String(event.reason && event.reason.message));
+});
+export default {async fetch(request) {
+  const path = new URL(request.url).pathname;
+  if (path === "/reject") {
+    try {
+      Promise.reject(new Error("D1_ERROR: FOREIGN KEY constraint failed"));
+    } catch (error) {
+      return new Response("caught", { status: 500 });
+    }
+    return new Response("fired");
+  }
+  if (path === "/promise") {
+    try {
+      new Promise(function (resolve, reject) { reject(new Error("kv failed")); });
+    } catch (error) {
+      return new Response("caught", { status: 500 });
+    }
+    return new Response("fired");
+  }
+  if (path === "/async") {
+    async function failNow() { throw new Error("async function failed"); }
+    failNow();
+    return new Response("fired");
+  }
+  if (path === "/heard") return new Response(JSON.stringify(globalThis.__heard || []));
+  return new Response("pong");
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+for (const date of ["2026-09-28", "2026-10-24"]) {
+  const workdir = await mkdtemp(join(tmpdir(), "sb-native-unhandled-"));
+  let server: ReturnType<typeof Bun.spawn> | undefined;
+  try {
+    const porffor = await ensurePorffor();
+    const node = Bun.which("node");
+    if (!node) throw new Error("native unhandled rejection test needs node on PATH");
+    const [core, broker] = await Promise.all([
+      readFile(preludePath, "utf8"),
+      readFile(transportPath("broker"), "utf8"),
+    ]);
+    assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+    const generated = join(workdir, "unhandled.generated.js");
+    const binary = join(workdir, "unhandled-native");
+    await writeFile(
+      generated,
+      wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker), undefined, undefined, undefined, date),
+    );
+    const compile = Bun.spawn(
+      [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+      {
+        cwd: workdir,
+        env: process.env,
+        stdout: "pipe",
+        stderr: "pipe",
+      },
+    );
+    const [exitCode, stdout, stderr] = await Promise.all([
+      compile.exited,
+      new Response(compile.stdout).text(),
+      new Response(compile.stderr).text(),
+    ]);
+    assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+    const port = freePort();
+    server = Bun.spawn([binary], {
+      cwd: workdir,
+      env: { ...process.env, PORT: String(port), SB_BROKER_TOKEN: "native-test-token" },
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    let ready = false;
+    for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+      try {
+        await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+        ready = true;
+      } catch {
+        if (server.exitCode !== null) break;
+        await Bun.sleep(100);
+      }
+    }
+    assert(ready, `compiled handler did not start (${date})`);
+    const get = async (path: string) => (await fetch(`http://127.0.0.1:${port}${path}`)).text();
+
+    assert.equal(await get("/reject"), "fired");
+    assert.equal(await get("/pong"), "pong", `the request after an unhandled rejection failed (${date})`);
+    assert.equal(await get("/promise"), "fired");
+    assert.equal(await get("/async"), "fired");
+    await Bun.sleep(300);
+    assert.equal(await get("/pong"), "pong", `the request after a rejected promise failed (${date})`);
+    assert.equal(server.exitCode, null, `the server exited on an unhandled rejection (${date})`);
+    assert.equal(await get("/pong"), "pong", `the request after an unawaited async function threw failed (${date})`);
+    const heard = JSON.parse(await get("/heard"));
+    assert(
+      heard.some((message: string) => message.includes("FOREIGN KEY")),
+      `no unhandledrejection event for the rejected promise (${date}): ${JSON.stringify(heard)}`,
+    );
+    assert(
+      heard.some((message: string) => message.includes("async function failed")),
+      `no unhandledrejection event for the async function (${date}): ${JSON.stringify(heard)}`,
+    );
+    server.kill(9);
+    await server.exited;
+    const log = await new Response(server.stderr).text();
+    assert(log.includes("Uncaught (in promise)"), `the rejection was not logged (${date}): ${log}`);
+    server = undefined;
+    console.log(`Native unhandled rejections are reported, not fatal (${date})`);
+  } finally {
+    if (server) {
+      server.kill(9);
+      await server.exited;
+    }
+    await rm(workdir, { recursive: true, force: true });
+  }
+}