@sproutboat/runtime 0.34.4 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @sproutboat/runtime
 
+## 0.35.0
+
+### Minor Changes
+
+- 7f5e87b: A standalone binary now opens its SQLite databases in `PRAGMA locking_mode=EXCLUSIVE` by default, with the page cache at 2 MB (`cache_size=-2000`, unchanged). The lock is taken once and held, so a transaction no longer takes and releases file locks around itself, and the WAL index lives in heap memory instead of a shared `-shm` file. The cost: no other process can open the database while the binary runs, so the `sqlite3` shell, `sproutboat kv/d1 --local --data-dir` against a running binary, and the several-copies-behind-`SO_REUSEPORT` recipe do not work on a live binary. Set `SB_SQLITE_EXCLUSIVE=0` to opt out and keep shared locking. A database under LTX replication is never opened exclusive.
+  
+  The default belongs to the standalone binary only: the toolchain's native server shim sets `SB_SQLITE_EXCLUSIVE=1` at startup unless the variable is already set. The embedded transport itself reads only `SB_SQLITE_EXCLUSIVE` (`1` is exclusive, anything else is shared), so sproutd and the broker keep shared locking unless an operator sets it.
+  
+  `SB_SQLITE_CACHE_MB=<n>` (1 to 4096) sets each database's page cache in MiB; unset it stays at 2 MB.
+
+### Patch Changes
+
+- 2c9d885: A strict D1 query in a standalone binary does less around SQLite. It skips the generic dispatch (a request object, a walk down the op list, a result object), a statement is a class instead of an object with five closures, `raw()` and `first()` no longer build the `meta` they throw away (two clock reads), the transaction-keyword check reads character codes instead of compiling a regular expression on every query, and the column names, change count and row id come back as JavaScript values built in C instead of as JSON text that is written, parsed and discarded. Replies, errors and `meta` are unchanged.
+- 004b8e7: A request's fixed cost in a native sprout drops five items. The CPU stamp and the streamed-body probe come back as numbers instead of formatted and parsed text (a `printf` and a `parseFloat` each, per request). The ingress reads of `x-sb-trigger` and `x-sb-remote-addr` scan the stored header names instead of validating and lowercasing a name for each, and the three `x-sb-` names the runtime strips are looked for in one pass. `SB_EDGE_TOKEN` is read once. `Headers` checks a name and a value in C and only falls back to its regular expression for a name it cannot judge there, so `get`, `has`, `set`, `append` and `new Response(body, { headers })` stop compiling that expression on every call. Behavior is unchanged.
+- 4213ed7: A standalone binary stops mapping and unmapping 88 KiB for every statement that builds a temporary table. SQLite allocates 20 pages in one block for each page cache it creates, and `INSERT ... RETURNING` (and any sort that spills to a temporary table) creates one, so each such statement cost an `mmap` and an `munmap`. The runtime now sets the initial page-cache allocation to 0 before SQLite starts, so a cache takes its pages one at a time as it grows. Query results and the main database's cache size are unchanged.
+
+## 0.34.5
+
+### Patch Changes
+
+- e62b600: The client address is folded to plain IPv4 once per distinct address instead of on every request: a request read `x-sb-remote-addr` and, for an IPv4-mapped IPv6 peer, lowercased, split and hex-parsed it each time. The last address and its result are kept; a different address takes the same path as before.
+- 0b12b94: A strict D1 query hands its rows to JavaScript with fewer copies: the text of every cell goes into one arena instead of one `malloc` per cell, and a cell that is plain ASCII becomes its JS string in one copy (it used to go through a UTF-16 buffer, an 8-bit buffer and a third copy, three `malloc`s each). Non-ASCII text still takes the old path, so the strings are unchanged.
+
 ## 0.34.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.34.4",
+  "version": "0.35.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/d1-shim.test.js

@@ -64,7 +64,9 @@ for (const date of ["2026-09-28", "2026-10-24"]) {
   test(`${date}: batch() is one transaction`, async () => {
     const DB = fresh(date);
     await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
-    expect(await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")]))).toMatch(/UNIQUE/);
+    expect(
+      await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")])),
+    ).toMatch(/UNIQUE/);
     expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
   });
 }
@@ -85,13 +87,23 @@ test("before 2026-10-24: synchronous, lenient, no foreign keys, BLOBs as one cha
 
 test("from 2026-10-24: D1's parameter rules", async () => {
   const DB = fresh("2026-10-24");
-  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe("D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'");
-  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe("D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'");
-  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe("D1_TYPE_ERROR: Type 'bigint' not supported for value '10'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe(
+    "D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe(
+    "D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe(
+    "D1_TYPE_ERROR: Type 'bigint' not supported for value '10'",
+  );
   expect(await failure(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(WRONG_COUNT);
   expect(await failure(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(WRONG_COUNT);
   expect(await failure(() => DB.prepare("SELECT ?1").all())).toBe(WRONG_COUNT);
-  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
+  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({
+    a: "x",
+    b: "x",
+    c: 1,
+  });
 });
 
 test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", async () => {
@@ -104,18 +116,25 @@ test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", asy
   expect(await failure(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
     "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
   );
-  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
+  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe(
+    "D1_ERROR: no such table: nope: SQLITE_ERROR",
+  );
   expect(await DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
 });
 
 test("from 2026-10-24: every query method returns a Promise", async () => {
   const DB = fresh("2026-10-24");
   const s = DB.prepare("SELECT 41 AS a");
-  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)]) expect(p).toBeInstanceOf(Promise);
+  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)])
+    expect(p).toBeInstanceOf(Promise);
   expect(await s.first("a").then((a) => a + 1)).toBe(42);
   expect(await Promise.all([s.first("a"), DB.prepare("SELECT 2 AS a").first("a")])).toEqual([41, 2]);
   // Errors reject rather than throw: .catch() sees them.
-  expect(await DB.prepare("SELEC 1").all().catch((e) => e.message)).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
+  expect(
+    await DB.prepare("SELEC 1")
+      .all()
+      .catch((e) => e.message),
+  ).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
 });
 
 test("from 2026-10-24: results, meta, raw() and first() as in workerd", async () => {
@@ -123,16 +142,42 @@ test("from 2026-10-24: results, meta, raw() and first() as in workerd", async ()
   await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, name TEXT)");
   const inserted = await DB.prepare("INSERT INTO t (name) VALUES (?), (?)").bind("one", "two").run();
   expect(Object.keys(inserted).sort()).toEqual(["meta", "results", "success"]);
-  expect(Object.keys(inserted.meta).sort()).toEqual(["changed_db", "changes", "duration", "last_row_id", "rows_read", "rows_written", "served_by", "size_after"]);
-  expect([inserted.meta.changes, inserted.meta.last_row_id, inserted.meta.changed_db, inserted.meta.rows_written]).toEqual([2, 2, true, 2]);
+  expect(Object.keys(inserted.meta).sort()).toEqual([
+    "changed_db",
+    "changes",
+    "duration",
+    "last_row_id",
+    "rows_read",
+    "rows_written",
+    "served_by",
+    "size_after",
+  ]);
+  expect([
+    inserted.meta.changes,
+    inserted.meta.last_row_id,
+    inserted.meta.changed_db,
+    inserted.meta.rows_written,
+  ]).toEqual([2, 2, true, 2]);
   const read = await DB.prepare("SELECT id, name FROM t ORDER BY id").all();
   expect([read.meta.changes, read.meta.changed_db, read.meta.rows_written]).toEqual([0, false, 0]);
-  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([[1, "one"], [2, "two"]]);
-  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([["id", "name"], [1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([
+    [1, "one"],
+    [2, "two"],
+  ]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([
+    ["id", "name"],
+    [1, "one"],
+    [2, "two"],
+  ]);
   expect(await DB.prepare("SELECT id FROM t WHERE id > 9").raw({ columnNames: true })).toEqual([["id"]]);
-  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([["a", "a"], [1, 2]]);
+  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([
+    ["a", "a"],
+    [1, 2],
+  ]);
   expect((await DB.prepare("SELECT 1 AS a, 2 AS a").all()).results).toEqual([{ a: 2 }]);
-  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe("D1_COLUMN_NOTFOUND: Column not found (nope)");
+  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe(
+    "D1_COLUMN_NOTFOUND: Column not found (nope)",
+  );
   expect(await DB.prepare("SELECT id FROM t WHERE id > 9").first("nope")).toBeNull();
 });
 
@@ -140,15 +185,74 @@ test("from 2026-10-24: empty SQL, transactions, exec() and sessions as in worker
   const DB = fresh("2026-10-24");
   expect(await failure(() => DB.prepare("").all())).toBe(NO_STATEMENTS);
   expect(await failure(() => DB.batch([]))).toBe(NO_STATEMENTS);
-  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(/^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/);
+  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(
+    /^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/,
+  );
   expect(await failure(() => DB.prepare("savepoint x").run())).toMatch(/^D1_ERROR: To execute a transaction/);
   const done = await DB.exec("CREATE TABLE t (id INTEGER)\nINSERT INTO t VALUES (1);\n\nINSERT INTO t VALUES (2);\n");
   expect([done.count, Number.isFinite(done.duration)]).toEqual([3, true]);
   expect(await DB.exec("SELECT 1").then((r) => r.count)).toBe(1);
-  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(/^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/);
+  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(
+    /^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/,
+  );
   expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
   const session = DB.withSession("first-unconstrained");
   expect(await session.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
   expect(session.getBookmark()).toBeNull();
   expect(await session.batch([session.prepare("SELECT 1 AS a")]).then((r) => r[0].results)).toEqual([{ a: 1 }]);
 });
+
+// __sbD1IsTransaction replaced `/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)`.
+test("a statement is a transaction keyword exactly as the regular expression it replaced said", () => {
+  // oxlint-disable-next-line no-function-constructor -- the prelude is prepended as text in production too
+  const { isTx } = new Function("Porffor", `${source}\nreturn { isTx: __sbD1IsTransaction };`)({ c: () => "" });
+  const old = (text) => /^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text);
+  const cases = [
+    "BEGIN",
+    "begin",
+    "Begin TRANSACTION",
+    "begin;",
+    "BEGIN\n",
+    "commit",
+    "COMMIT;",
+    "end",
+    "END TRANSACTION",
+    "rollback to x",
+    "ROLLBACK",
+    "savepoint x",
+    "SAVEPOINT\tx",
+    "release x",
+    "RELEASE",
+    "beginning",
+    "begin_x",
+    "begin1",
+    "ending",
+    "endx",
+    "ender",
+    "committed",
+    "rollbacks",
+    "savepoints",
+    "released",
+    "select 1",
+    "SELECT begin FROM t",
+    "insert into t values (1)",
+    "be",
+    "en",
+    "e",
+    "",
+    "BEGINX",
+    "begin-",
+    "end(",
+    "end.",
+    "release@",
+    "commité",
+    "xbegin",
+    " begin",
+    "savepoint",
+    "savepointx",
+    "rollback_",
+    "ROLLBACKĀ",
+    "bégin",
+  ];
+  for (const text of cases) expect([text, isTx(text)]).toEqual([text, old(text)]);
+});

package/src/native-fetch-prelude.js

@@ -3092,18 +3092,34 @@ __sbStartupMark();
 // string via the same primitives as __sbEnv / __sbRandomBytes (proven working),
 // then parsed — Porffor's number boxing for a bare inline-C assignment is not
 // relied on. `__sbEntry` samples it around the handler for per-invocation CPU.
+// The number comes back as a number: no text and no parse around it.
 function __sbCpuMs() {
-  let res = "";
+  let ms = 0;
   // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
   Porffor.c`
     struct timespec __ts;
     clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
-    double __ms = (double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0;
+    ms = (f64)((double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0);
+  `;
+  return ms;
+}
+
+// The `x-sb-cpu-ms` value for the CPU time since `t0`, as three decimals, floored at zero: one
+// clock read and one format call in C, where it was a read, a format, a parse and a toFixed.
+// oxlint-disable-next-line no-unused-vars -- `t0` is read inside the RawC block below, not by JS.
+function __sbCpuStamp(t0) {
+  let res = "0.000";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    struct timespec __ts;
+    clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
+    double __d = ((double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0) - (t0.type == 1 ? (double)t0.val : 0.0);
+    if (!(__d >= 0)) __d = 0;
     char __b[32];
-    int __n = snprintf(__b, sizeof(__b), "%.3f", __ms);
+    int __n = snprintf(__b, sizeof(__b), "%.3f", __d);
     if (__n > 0) res = porf_box((f64)porf_native_fetch_alloc_bytestring(__b, (size_t)__n), 195);
   `;
-  return res === "" ? 0 : parseFloat(res);
+  return res;
 }
 
 // #28 — stamp `x-sb-cpu-ms` onto a handler Response. Porffor alpha-10's
@@ -3114,7 +3130,6 @@ function __sbCpuMs() {
 // http-sync-v0) with no Set-Cookie to comma-fold; anything else is returned
 // untouched and the edge simply omits cpuMs for that request.
 function __sbTagCpu(res, t0) {
-  const cpu = __sbCpuMs() - t0;
   try {
     // A string body and no Set-Cookie, as before. The native writer reads Headers' flat `_entries`,
     // so the stamp is appended to the handler's own Response instead of building a second one (a
@@ -3122,7 +3137,7 @@ function __sbTagCpu(res, t0) {
     // the handler set itself is replaced by the measured one, as before.
     const headers = res && res.headers;
     if (headers && __sbIsStr(__sbRawBody(res)) && !headers.has("set-cookie")) {
-      const stamp = (cpu >= 0 ? cpu : 0).toFixed(3);
+      const stamp = __sbCpuStamp(t0);
       const entries = headers._entries;
       let set = false;
       for (let i = 0; i < entries.length; i += 2) {
@@ -5295,6 +5310,11 @@ function __sbD1Param(value, strict) {
 // The broker transport leaves it unset and keeps the string hop. (No initializer: the transport is placed ahead of the prelude, and `= null` would run after its assignment.)
 // oxlint-disable-next-line no-unassigned-vars -- the embedded transport assigns it; the broker transport does not.
 var __sbCallDirect;
+// The embedded transport also answers a strict D1 query without the generic dispatch around it
+// (a request object, a walk down the op list, a result object): (db, sql, params) -> the reply
+// __sbD1Run builds. Unset elsewhere, and the query goes through __sbD1Rpc as before.
+// oxlint-disable-next-line no-unassigned-vars -- the embedded transport assigns it; the broker transport does not.
+var __sbD1QueryDirect;
 function __sbRpcDirect(op, extra) {
   if (!__sbCallDirect) return __sbRpc(op, extra);
   const req = { v: 1, id: ++__sbReqId, op };
@@ -5355,10 +5375,30 @@ function __sbD1Fail(message) {
 // transaction statements are refused, exec() runs line by line, and withSession() exists.
 var __sbD1NoTransactions =
   "D1_ERROR: To execute a transaction, please use the state.storage.transaction() or state.storage.transactionSync() APIs instead of the SQL BEGIN TRANSACTION or SAVEPOINT statements. The JavaScript API is safer because it will automatically roll back on exceptions, and because it interacts correctly with Durable Objects' automatic atomic write coalescing.";
+// A statement's first word is one of the transaction keywords: read by character code, where the
+// regular expression this replaced was compiled on every query. The word ends at the first character
+// that is not a letter, digit or underscore (the regular expression's \b after a keyword).
+function __sbD1IsTransaction(text) {
+  let end = 0;
+  while (end < text.length && end < 10) {
+    const c = text.charCodeAt(end) | 32;
+    if (c < 97 || c > 122) break;
+    end++;
+  }
+  if (end < 3 || end > 9) return false;
+  if (end < text.length) {
+    const c = text.charCodeAt(end);
+    if ((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || c === 95 || (c >= 97 && c <= 122)) return false;
+  }
+  const word = text.slice(0, end).toLowerCase();
+  return (
+    word === "begin" || word === "commit" || word === "end" || word === "rollback" || word === "savepoint" || word === "release"
+  );
+}
 function __sbD1Check(sql) {
   const text = String(sql).trim();
   if (!text) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
-  if (/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) throw __sbD1Fail(__sbD1NoTransactions);
+  if (__sbD1IsTransaction(text)) throw __sbD1Fail(__sbD1NoTransactions);
 }
 function __sbD1Meta(meta, started) {
   const changes = Number(meta.changes) || 0;
@@ -5394,70 +5434,91 @@ function __sbD1Promise(run) {
     return Promise.reject(err);
   }
 }
-function __sbMakeD1(dbName) {
-  // The synchronous core: the answer to one statement as columns, rows and meta.
-  function query(sql, params, strict) {
-    if (strict) __sbD1Check(sql);
-    const started = Date.now();
-    const r = __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
-    if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
-    const table = __sbD1Table(r);
-    return { columns: table.columns, rows: table.rows, meta: __sbD1Meta(r.meta || {}, started) };
-  }
-  function stmt(sql, params) {
-    const s = {
-      __sql: sql,
-      __params: params,
-      bind() {
-        const strict = __sbD1Strict();
-        const list = [];
-        for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
-        return stmt(sql, list);
-      },
-      all() {
-        if (!__sbD1Strict()) return query(sql, params, false);
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          return { success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) };
-        });
-      },
-      run() {
-        return s.all();
-      },
-      raw(options) {
-        if (!__sbD1Strict()) {
-          const rows = query(sql, params, false).results;
-          const out = [];
-          for (let i = 0; i < rows.length; i++) {
-            const cols = [];
-            for (const k in rows[i]) cols.push(rows[i][k]);
-            out.push(cols);
-          }
-          return out;
-        }
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          return options && options.columnNames ? [t.columns].concat(t.rows) : t.rows;
-        });
-      },
-      first(column) {
-        if (!__sbD1Strict()) {
-          const rows = query(sql, params, false).results;
-          if (rows.length === 0) return null;
-          return column == null ? rows[0] : rows[0][column];
-        }
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          if (column == null) return t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null;
-          const at = t.columns.indexOf(String(column));
-          if (!t.rows.length) return null;
-          if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
-          return t.rows[0][t.columns.lastIndexOf(String(column))];
-        });
-      },
-    };
-    return s;
+// A strict query's reply from the embedded transport's direct lane, or through the generic
+// dispatch. The errors read the same either way: "D1_ERROR: ..." for SQLite's, and the
+// transport's own prefix for anything else.
+function __sbD1Direct(name, sql, params) {
+  try {
+    return __sbD1QueryDirect(name, sql, params);
+  } catch (err) {
+    const message = "sproutboat d1.query: " + (String((err && err.message) || err) || "failed");
+    const at = message.indexOf("D1_");
+    throw new Error(at > 0 ? message.slice(at) : message);
   }
+}
+// The synchronous core: the answer to one statement as columns, rows and meta. meta is only built
+// when the caller will hand it out (all() and run()): raw() and first() drop it, and building it
+// reads the clock twice.
+function __sbD1Query(dbName, sql, params, strict, wantMeta) {
+  if (strict) __sbD1Check(sql);
+  const started = !strict || wantMeta ? Date.now() : 0;
+  const r = strict && __sbD1QueryDirect ? __sbD1Direct(dbName, sql, params) : __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
+  if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+  const table = __sbD1Table(r);
+  return { columns: table.columns, rows: table.rows, meta: wantMeta ? __sbD1Meta(r.meta || {}, started) : null };
+}
+// A prepared statement. A class, so a prepare() or bind() does not allocate five closures.
+class __SbD1Statement {
+  constructor(dbName, sql, params) {
+    this.__name = dbName;
+    this.__sql = sql;
+    this.__params = params;
+  }
+  bind() {
+    const strict = __sbD1Strict();
+    const list = [];
+    for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
+    return new __SbD1Statement(this.__name, this.__sql, list);
+  }
+  all() {
+    if (!__sbD1Strict()) return __sbD1Query(this.__name, this.__sql, this.__params, false, true);
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, true);
+      return Promise.resolve({ success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) });
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  run() {
+    return this.all();
+  }
+  raw(options) {
+    if (!__sbD1Strict()) {
+      const rows = __sbD1Query(this.__name, this.__sql, this.__params, false, true).results;
+      const out = [];
+      for (let i = 0; i < rows.length; i++) {
+        const cols = [];
+        for (const k in rows[i]) cols.push(rows[i][k]);
+        out.push(cols);
+      }
+      return out;
+    }
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, false);
+      return Promise.resolve(options && options.columnNames ? [t.columns].concat(t.rows) : t.rows);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  first(column) {
+    if (!__sbD1Strict()) {
+      const rows = __sbD1Query(this.__name, this.__sql, this.__params, false, true).results;
+      if (rows.length === 0) return null;
+      return column == null ? rows[0] : rows[0][column];
+    }
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, false);
+      if (column == null) return Promise.resolve(t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null);
+      const at = t.columns.indexOf(String(column));
+      if (!t.rows.length) return Promise.resolve(null);
+      if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
+      return Promise.resolve(t.rows[0][t.columns.lastIndexOf(String(column))]);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+}
+function __sbMakeD1(dbName) {
   function batch(statements) {
     const strict = __sbD1Strict();
     const list = [];
@@ -5495,7 +5556,7 @@ function __sbMakeD1(dbName) {
   }
   const db = {
     prepare(sql) {
-      return stmt(String(sql), []);
+      return new __SbD1Statement(dbName, String(sql), []);
     },
     batch(statements) {
       if (!__sbD1Strict()) return batch(statements);
@@ -7959,8 +8020,19 @@ function __sbParseHex(s) {
 // uWS hands back IPv4-mapped IPv6 for IPv4 clients on a dual-stack socket
 // (`::ffff:1.2.3.4`, or fully expanded `0:0:0:0:0:ffff:0102:0304`). Fold those
 // to the dotted IPv4 so CIDR matching and `clientIp` see a plain address.
+// The last address folded and its result: a client keeps the same address from one request to the
+// next, and folding an IPv6 text costs a lowercase, a split and eight hex parses.
+let __sbIpRaw = "";
+let __sbIpFolded = "";
 function __sbNormalizeIp(ip) {
   const s = String(ip || "");
+  if (s === __sbIpRaw) return __sbIpFolded;
+  const folded = __sbFoldIp(s);
+  __sbIpRaw = s;
+  __sbIpFolded = folded;
+  return folded;
+}
+function __sbFoldIp(s) {
   if (s.indexOf(":") === -1) return s;
   const low = s.toLowerCase();
   const dotted = low.indexOf("::ffff:");
@@ -9100,7 +9172,7 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
   } catch (error) {
     // A Durable Object's stub.fetch() from 2026-10-29: the caller gets the exception.
     if (rethrow) {
-      __sbDrainWaitUntil(tasks);
+      if (tasks.length) __sbDrainWaitUntil(tasks);
       throw error;
     }
     // #179 — a rejected handler promise must not take the process down with it.
@@ -9108,8 +9180,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
   }
   // The response goes out now and ctx.waitUntil work keeps running after it, as in
   // workerd; it was awaited first, so a 1.5 s background task delayed the response by
-  // 1.5 s. The 25 s cap still bounds it.
-  __sbDrainWaitUntil(tasks);
+  // 1.5 s. The 25 s cap still bounds it. Not called for no tasks: an async call is a coroutine and a promise.
+  if (tasks.length) __sbDrainWaitUntil(tasks);
   return r;
 }
 
@@ -9140,7 +9212,7 @@ function __sbErrorResponse(error, bindingCall) {
 // sees it. Returns whether the edge vouched for this one.
 function __sbBindingCallIngress(request) {
   const headers = request.headers;
-  const want = __sbEnv("SB_EDGE_TOKEN");
+  const want = __sbEdgeToken();
   const vouched = !!want && headers.get("x-sb-binding-call") === "1" && __sbEqCt(headers.get("x-sb-edge-token") || "", want);
   if (vouched) {
     const url = headers.get("x-sb-url");
@@ -9148,12 +9220,46 @@ function __sbBindingCallIngress(request) {
     if (url && URL.canParse(url) && __sbCompatDate() >= "2026-10-22") request.url = url;
     headers.delete("x-sb-remote-addr");
   }
-  for (const name of ["x-sb-binding-call", "x-sb-url", "x-sb-edge-token"]) {
-    if (headers.get(name) != null) headers.delete(name);
+  // Nearly every request carries none of the three: one look at the stored names tells, where
+  // three lookups (each validating and lowercasing its name) and an array of them did.
+  const stored = headers._entries;
+  let present = stored === undefined;
+  for (let i = 0; !present && i < stored.length; i += 2) {
+    const key = stored[i];
+    if (key === "x-sb-binding-call" || key === "x-sb-url" || key === "x-sb-edge-token") present = true;
+  }
+  if (present) {
+    for (const name of ["x-sb-binding-call", "x-sb-url", "x-sb-edge-token"]) {
+      if (headers.get(name) != null) headers.delete(name);
+    }
   }
   return vouched;
 }
 
+// SB_EDGE_TOKEN is fixed for the life of a process, like SB_TRUSTED_PROXIES above: read once.
+let __sbEdgeTokenCache;
+function __sbEdgeToken() {
+  if (__sbEdgeTokenCache === undefined) __sbEdgeTokenCache = __sbEnv("SB_EDGE_TOKEN");
+  return __sbEdgeTokenCache;
+}
+
+// One header of a request the native server built, by a name that is already lowercase and valid:
+// its stored names are scanned directly, where get() validates and lowercases the name first. A
+// name stored twice, or a headers object that is not the runtime's, goes through get().
+function __sbHeader(headers, name) {
+  const stored = headers._entries;
+  if (stored === undefined) return headers.get(name);
+  let found = null;
+  let count = 0;
+  for (let i = 0; i < stored.length; i += 2) {
+    if (stored[i] === name) {
+      found = stored[i + 1];
+      count++;
+    }
+  }
+  return count > 1 ? headers.get(name) : found;
+}
+
 function __sbLogUncaught(where, error) {
   try {
     let text = "";
@@ -9317,12 +9423,24 @@ function __sbIngressStream(request, id) {
   request.bytes = async () => await all();
 }
 
+// The id of the current request's streamed body, 0 when it has none (op "t" of __sbReqBodyOp),
+// as a number: every request asks, and the text round trip was a format and a parse.
+function __sbReqBodyTake() {
+  let id = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    extern unsigned int sb_reqbody_take_current(void);
+    id = (f64)sb_reqbody_take_current();
+  `;
+  return id;
+}
+
 // Native HTTP ingress stores the body as one character per raw byte. Keep
 // that representation for binary consumers, but decode text lazily before
 // handing the request to user code. Request.text() in Porffor otherwise treats
 // the raw bytes as already-decoded characters and corrupts Unicode/HMAC input.
 function __sbDecodeIngress(request) {
-  const streamed = __sbCompatDate() >= "2026-10-27" ? Number(__sbReqBodyOp("t", 0, "")) : 0;
+  const streamed = __sbCompatDate() >= "2026-10-27" ? __sbReqBodyTake() : 0;
   if (streamed > 0) {
     __sbIngressStream(request, streamed);
     return;
@@ -9358,7 +9476,7 @@ function __sbTrustedProxiesOnce() {
 
 globalThis.__sbEntry = function (handlers, request) {
   __sbDecodeIngress(request);
-  const trigger = request.headers.get("x-sb-trigger");
+  const trigger = __sbHeader(request.headers, "x-sb-trigger");
   if (!trigger) {
     const bindingCall = __sbBindingCallIngress(request);
     // #163/#128 — expose the request metadata the edge already has, the
@@ -9368,7 +9486,7 @@ globalThis.__sbEntry = function (handlers, request) {
     const __cf = request.cf || {};
     if (__sbTrustedProxiesOnce().length === 0) {
       // No trusted proxy (the usual case): the peer is the client and no forwarded header counts.
-      __cf.clientIp = __sbNormalizeIp(request.headers.get("x-sb-remote-addr") || "");
+      __cf.clientIp = __sbNormalizeIp(__sbHeader(request.headers, "x-sb-remote-addr") || "");
     } else {
       __cf.clientIp = __sbClientIp(request);
       const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");