@sproutboat/runtime 0.34.4 → 0.35.0

package/src/transport-embedded.js

@@ -1195,6 +1195,17 @@ static unsigned long sb_db_tick = 0;
 static int sb_is_do_sql(const char* path) { return strstr(path, "/do-sql/") != 0; }
 static void sb_db_evict(int idx);
 
+// SQLite allocates 20 pages in one block for every page cache it creates, and a statement that
+// builds a temporary table (INSERT ... RETURNING, a sort) creates one: an 88 KiB mmap and munmap
+// per such statement. A page count of 0 turns the bulk allocation off; the cache then takes
+// its pages one at a time, as it always does past the first 20. Must run before SQLite starts.
+extern int sqlite3_config(int, ...);
+static int sb_sqlite_booted = 0;
+static void sb_sqlite_boot(void) {
+  if (sb_sqlite_booted) return;
+  sb_sqlite_booted = 1;
+  sqlite3_config(7 /* SQLITE_CONFIG_PAGECACHE */, (void*)0, 0, 0);
+}
 static int sb_db_for(const char* path) {
   for (int i = 0; i < sb_db_count; i++) {
     if (sb_dbs[i] && strcmp(sb_db_names[i], path) == 0) {
@@ -1202,6 +1213,7 @@ static int sb_db_for(const char* path) {
       return sb_ltx_states[i].failed ? -1 : i;
     }
   }
+  sb_sqlite_boot();
   const int do_sql = sb_is_do_sql(path);
   // A name that would not fit could never be found again.
   if (do_sql && strlen(path) >= sizeof(sb_db_names[0])) return -1;
@@ -1240,9 +1252,30 @@ static int sb_db_for(const char* path) {
   // copies of the binary behind SO_REUSEPORT (#154 scaling recipe): WAL takes
   // concurrent readers plus one writer across processes, and this makes a
   // writer wait for the lock instead of failing SQLITE_BUSY.
+  // SB_SQLITE_EXCLUSIVE=1 holds the database's lock for the life of the process: no fcntl lock
+  // and unlock around each transaction, and the WAL index lives in heap memory instead of a shared
+  // -shm file. Set before journal_mode, because the heap index is only chosen when WAL starts in
+  // exclusive mode. No other process can open the database while the binary runs, which also rules
+  // out the several-copies-behind-SO_REUSEPORT recipe above. Off unless set (see below), and never for a
+  // database under LTX replication: capture reads the WAL through its shared index, and in
+  // exclusive mode (no -shm file) every capture failed (native-d1's LTX database).
+  // The transport itself only reads the variable, so a host that embeds it (sproutd, the broker) stays
+  // in shared mode unless it is set. A standalone binary sets it to 1 at startup (patch.ts, the shim's
+  // constructor) unless the operator has set it, so SB_SQLITE_EXCLUSIVE=0 opts a standalone binary out.
+  // SB_SQLITE_CACHE_MB sizes each database's page cache in MiB (default 2, about -2000 KiB).
+  {
+    const char* excl = getenv("SB_SQLITE_EXCLUSIVE");
+    if (excl && excl[0] == '1' && !excl[1] && !replicated) sqlite3_exec(db, "PRAGMA locking_mode=EXCLUSIVE", 0, 0, 0);
+    char cache[64];
+    const char* mb = getenv("SB_SQLITE_CACHE_MB");
+    long mib = mb && *mb ? strtol(mb, 0, 10) : 0;
+    if (mib >= 1 && mib <= 4096) snprintf(cache, sizeof(cache), "PRAGMA cache_size=-%ld", mib * 1024);
+    else snprintf(cache, sizeof(cache), "PRAGMA cache_size=-2000");
+    sqlite3_exec(db, cache, 0, 0, 0);
+  }
   sqlite3_exec(db,
     "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA busy_timeout=5000;"
-    "PRAGMA cache_size=-2000; PRAGMA journal_size_limit=16777216;",
+    "PRAGMA journal_size_limit=16777216;",
     0, 0, 0);
   // Durable Object SQLite enforces foreign keys, as in workerd.
   if (do_sql) sqlite3_exec(db, "PRAGMA foreign_keys=ON", 0, 0, 0);
@@ -2162,13 +2195,35 @@ static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip)
 // A strict D1 query can hand its rows back as cells instead of JSON text: the caller turns
 // them into JS arrays, with no JSON written here and none parsed there. t is 0 NULL,
 // 1 number, 2 TEXT (UTF-8 in p), 3 BLOB (bytes in p).
-typedef struct { unsigned char t; double d; char* p; int n; } sb_cell;
-typedef struct { sb_cell* c; size_t n; size_t cap; int ncol; int used; } sb_cells;
+// The text and blob bytes of every cell share one arena (a cell holds an offset into it), and a
+// TEXT cell says whether it is all ASCII: that one becomes a JS string with a single copy.
+typedef struct { unsigned char t; unsigned char ascii; double d; size_t off; int n; } sb_cell;
+// hdr: how many of the first cells are the column names, not row data; changes and rowid are the
+// statement's counts, so a native reply needs no JSON header at all.
+typedef struct { sb_cell* c; size_t n; size_t cap; int ncol; int used; char* a; size_t alen; size_t acap; int hdr; long long changes; long long rowid; } sb_cells;
 static void sb_cells_free(sb_cells* cs) {
   if (!cs) return;
-  for (size_t i = 0; i < cs->n; i++) free(cs->c[i].p);
   free(cs->c);
-  cs->c = 0; cs->n = cs->cap = 0;
+  free(cs->a);
+  cs->c = 0; cs->a = 0; cs->n = cs->cap = cs->alen = cs->acap = 0;
+}
+// Copies n bytes into the arena and returns their offset, or (size_t)-1 when out of memory.
+static size_t sb_cells_bytes(sb_cells* cs, const unsigned char* src, size_t n, unsigned char* ascii) {
+  if (cs->alen + n + 1 > cs->acap) {
+    size_t cap = cs->acap ? cs->acap * 2 : 1024;
+    while (cap < cs->alen + n + 1) cap *= 2;
+    char* grown = (char*)realloc(cs->a, cap);
+    if (!grown) return (size_t)-1;
+    cs->a = grown; cs->acap = cap;
+  }
+  const size_t off = cs->alen;
+  unsigned char high = 0;
+  for (size_t i = 0; i < n; i++) high |= src[i];
+  if (n) memcpy(cs->a + off, src, n);
+  cs->a[off + n] = 0;
+  cs->alen = off + n + 1;
+  *ascii = high < 0x80;
+  return off;
 }
 static sb_cell* sb_cells_add(sb_cells* cs) {
   if (cs->n == cs->cap) {
@@ -2178,7 +2233,7 @@ static sb_cell* sb_cells_add(sb_cells* cs) {
     cs->c = grown; cs->cap = cap;
   }
   sb_cell* cell = &cs->c[cs->n++];
-  cell->t = 0; cell->d = 0; cell->p = 0; cell->n = 0;
+  cell->t = 0; cell->ascii = 0; cell->d = 0; cell->off = 0; cell->n = 0;
   return cell;
 }
 static char* sb_sql_run_x(const char* path, const char* sql, const char* params, sb_cells* cells) {
@@ -2202,17 +2257,30 @@ static char* sb_sql_run_x(const char* path, const char* sql, const char* params,
     return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
   }
 
-  sb_puts(&b, "{\"ok\":true,\"cols\":[");
   int ncol = sqlite3_column_count(st);
-  for (int i = 0; i < ncol; i++) {
-    if (i) sb_puts(&b, ",");
-    const char* name = sqlite3_column_name(st, i);
-    sb_putjson_text(&b, name ? name : "", name ? strlen(name) : 0);
-  }
-  sb_puts(&b, "],\"rows\":[");
-  // Cells only for a strict D1 statement: its BLOBs are byte arrays either way.
+  // Cells only for a strict D1 statement: its BLOBs are byte arrays either way. The column names
+  // are its first cells and the reply is no JSON text: success returns NULL, with the counts in cells.
   const int native = cells && strict && d1;
-  if (native) { cells->ncol = ncol; cells->used = 1; }
+  if (native) {
+    cells->ncol = ncol; cells->used = 1; cells->hdr = ncol;
+    for (int i = 0; i < ncol && cells->used > 0; i++) {
+      sb_cell* cell = sb_cells_add(cells);
+      if (!cell) { cells->used = -1; break; }
+      const char* name = sqlite3_column_name(st, i);
+      cell->t = 2;
+      cell->n = name ? (int)strlen(name) : 0;
+      cell->off = sb_cells_bytes(cells, (const unsigned char*)(name ? name : ""), (size_t)cell->n, &cell->ascii);
+      if (cell->off == (size_t)-1) { cells->used = -1; break; }
+    }
+  } else {
+    sb_puts(&b, "{\"ok\":true,\"cols\":[");
+    for (int i = 0; i < ncol; i++) {
+      if (i) sb_puts(&b, ",");
+      const char* name = sqlite3_column_name(st, i);
+      sb_putjson_text(&b, name ? name : "", name ? strlen(name) : 0);
+    }
+    sb_puts(&b, "],\"rows\":[");
+  }
   int rc, first = 1;
   while ((rc = sqlite3_step(st)) == SB_SQLITE_ROW) {
     if (native) {
@@ -2226,10 +2294,8 @@ static char* sb_sql_run_x(const char* path, const char* sql, const char* params,
         int n = sqlite3_column_bytes(st, i);
         cell->t = t == 4 ? 3 : 2;
         cell->n = txt ? n : 0;
-        cell->p = (char*)malloc((size_t)cell->n + 1);
-        if (!cell->p) { cells->used = -1; break; }
-        if (cell->n) memcpy(cell->p, txt, (size_t)cell->n);
-        cell->p[cell->n] = 0;
+        cell->off = sb_cells_bytes(cells, txt, (size_t)cell->n, &cell->ascii);
+        if (cell->off == (size_t)-1) { cells->used = -1; break; }
       }
       if (cells->used < 0) break;
       continue;
@@ -2262,10 +2328,15 @@ static char* sb_sql_run_x(const char* path, const char* sql, const char* params,
     }
     sb_puts(&b, "]");
   }
-  char tail[96];
   // A read-only statement changed nothing: sqlite3_changes still holds the last write's count.
-  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
-  sb_put(&b, tail, (size_t)k);
+  if (native) {
+    cells->changes = sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db);
+    cells->rowid = (long long)sqlite3_last_insert_rowid(db);
+  } else {
+    char tail[96];
+    int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
+    sb_put(&b, tail, (size_t)k);
+  }
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
@@ -4011,6 +4082,22 @@ function __sbDirBytesRaw(dir) {
   return res;
 }
 
+// "captured" of __sbD1DbRaw as a number: no text made in C and parsed here, on every D1 query.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbD1Captured_(path) {
+  let status = -1;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    status = (f64)sb_db_quota_freeze(__path, -1);
+    free(__path);
+  `;
+  return status;
+}
+
 // sb_db_page_size and sb_db_quota_freeze, for the quota (a path and a "0"/"1" in, a number out).
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbD1DbRaw(path, what) {
@@ -4217,10 +4304,10 @@ function __sbSqlRaw(path, sql, paramsJson) {
   return res;
 }
 
-// One strict D1 statement: [header JSON, rows]. The header is {"ok":true,"cols":[...],"changes":n,
-// "rowid":n} (or the error reply) and rows is an array of row arrays built here from the
-// cells, BLOBs as byte arrays, so no JSON for the rows is written or parsed. rows is
-// undefined when the reply is not a result.
+// One strict D1 statement: [header, rows, columns, changes, rowid]. A result has the empty string
+// for its header, rows an array of row arrays built here from the cells (BLOBs as byte arrays),
+// columns the array of names, and changes and rowid numbers: no JSON is written or parsed. Any
+// other reply is the error JSON in the header, with nothing after it.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbSqlRowsRaw(path, sql, paramsJson) {
   let res = "";
@@ -4244,29 +4331,38 @@ function __sbSqlRowsRaw(path, sql, paramsJson) {
     sb_cells __cells = { 0, 0, 0, 0, 0 };
     char* __out = sb_sql_run_x(__path, __sql, __args, &__cells);
     free(__path); free(__sql); free(__args);
-    const u32 __pair = porf_arr_new(2, 2);
+    const u32 __pair = porf_arr_new(5, 5);
     res = porf_box((f64)__pair, 72);
-    if (!__out) __out = strdup("{\"ok\":false,\"error\":\"no result\"}");
-    porf_arr_set(__pair, 0, porf_box((f64)porf_native_fetch_alloc_bytestring(__out, strlen(__out)), 195));
+    const int __native = !__out && __cells.used == 1;
+    if (!__out && !__native) __out = strdup("{\"ok\":false,\"error\":\"no result\"}");
+    porf_arr_set(__pair, 0, porf_box((f64)porf_native_fetch_alloc_bytestring(__out ? __out : "", __out ? strlen(__out) : 0), 195));
     free(__out);
-    if (__cells.used == 1) {
+    if (__native) {
       const size_t __ncol = (size_t)__cells.ncol;
-      const size_t __nrow = __ncol ? __cells.n / __ncol : 0;
+      const size_t __hdr = (size_t)__cells.hdr;
+      const size_t __nrow = __ncol ? (__cells.n - __hdr) / __ncol : 0;
       const u32 __rows = porf_arr_new(0, (i32)(__nrow ? __nrow : 1));
       porf_arr_set(__pair, 1, porf_box((f64)__rows, 72));
-      for (size_t __r = 0; __r < __nrow; __r++) {
+      porf_arr_set(__pair, 3, porf_box_num((f64)__cells.changes));
+      porf_arr_set(__pair, 4, porf_box_num((f64)__cells.rowid));
+      if (!__ncol) porf_arr_set(__pair, 2, porf_box((f64)porf_arr_new(0, 1), 72));
+      // Row index -1 is the column names; the data rows follow.
+      for (long long __r = (__ncol ? -1 : 0); __r < (long long)__nrow; __r++) {
         const u32 __row = porf_arr_new((i32)__ncol, (i32)__ncol);
-        porf_arr_set(__rows, (u32)__r, porf_box((f64)__row, 72));
+        if (__r < 0) porf_arr_set(__pair, 2, porf_box((f64)__row, 72));
+        else porf_arr_set(__rows, (u32)__r, porf_box((f64)__row, 72));
         for (size_t __c = 0; __c < __ncol; __c++) {
-          const sb_cell* __cell = &__cells.c[__r * __ncol + __c];
+          const sb_cell* __cell = &__cells.c[(__r < 0 ? 0 : __hdr + (size_t)__r * __ncol) + __c];
           jsval __v = porf_box(0.0, 7);
           if (__cell->t == 1) __v = porf_box_num(__cell->d);
-          else if (__cell->t == 2) {
+          else if (__cell->t == 2 && __cell->ascii) {
+            __v = porf_box((f64)porf_native_fetch_alloc_bytestring(__cells.a + __cell->off, (size_t)__cell->n), 195);
+          } else if (__cell->t == 2) {
             const size_t __n = (size_t)__cell->n;
             uint16_t* __u = (uint16_t*)malloc(__n * 2 + 2);
             if (__u) {
               int __wide = 0;
-              const size_t __k = sb_text_units((const unsigned char*)__cell->p, __n, __u, &__wide);
+              const size_t __k = sb_text_units((const unsigned char*)(__cells.a + __cell->off), __n, __u, &__wide);
               if (__wide) {
                 const u32 __str = porf_native_fetch_alloc((u32)(4 + __k * 2), 67);
                 *(u32*)(MEM + __str) = (u32)__k;
@@ -4284,7 +4380,7 @@ function __sbSqlRowsRaw(path, sql, paramsJson) {
             }
           } else if (__cell->t == 3) {
             const u32 __bytes = porf_arr_new((i32)__cell->n, (i32)__cell->n);
-            for (int __i = 0; __i < __cell->n; __i++) porf_arr_set(__bytes, (u32)__i, porf_box_num((f64)(unsigned char)__cell->p[__i]));
+            for (int __i = 0; __i < __cell->n; __i++) porf_arr_set(__bytes, (u32)__i, porf_box_num((f64)(unsigned char)__cells.a[__cell->off + __i]));
             __v = porf_box((f64)__bytes, 72);
           }
           porf_arr_set(__row, (u32)__c, __v);
@@ -4366,7 +4462,7 @@ function __sbD1Quota(path) {
   // Whether capture owns this database, from the private helper (no SQL), before anything
   // below depends on it. A database that cannot open (or whose capture failed) is left to
   // the call itself, which reports why.
-  const status = Number(__sbD1DbRaw(path, "captured"));
+  const status = __sbD1Captured_(path);
   if (status < 0) return;
   __sbD1Captured[path] = status === 1;
   let full = __sbQuotaFull();
@@ -4414,8 +4510,16 @@ function __sbDOSqlPath(cls, file) {
   if (!__sbDOSqlName(c, false) || !__sbDOSqlName(f, true)) throw new Error("invalid Durable Object SQL database");
   return __sbDir() + "/do-sql/" + c + "/" + f + ".sqlite";
 }
+// The last database's path: an app has one or two, and every query asks, so three concatenations
+// are done once. The directory cannot change mid-run (see __sbDir).
+var __sbD1PathName = "";
+var __sbD1PathValue = "";
 function __sbD1Path(name) {
-  return __sbDir() + "/d1/" + name + ".sqlite";
+  if (name === __sbD1PathName) return __sbD1PathValue;
+  const path = __sbDir() + "/d1/" + name + ".sqlite";
+  __sbD1PathName = name;
+  __sbD1PathValue = path;
+  return path;
 }
 
 function __sbSql(path, sql, params) {
@@ -5336,10 +5440,12 @@ function __sbD1Run(path, sql, params, strict) {
   if (strict) {
     // Rows come back as arrays, built in C (see __sbSqlRowsRaw); the header is small JSON.
     const pair = __sbSqlRowsRaw(path, "/*sb-d1-strict*/" + String(sql), JSON.stringify(params || []));
-    const head = JSON.parse(pair[0]);
-    if (head.ok === false) throw __sbD1Error(head);
+    if (pair[0] !== "") {
+      const head = JSON.parse(pair[0]);
+      if (head.ok === false) throw __sbD1Error(head);
+    }
     const rows = pair[1];
-    return { columns: head.cols, rows, native: true, meta: { changes: head.changes, last_row_id: head.rowid, rows_read: rows.length } };
+    return { columns: pair[2], rows, native: true, meta: { changes: pair[3], last_row_id: pair[4], rows_read: rows.length } };
   }
   const r = JSON.parse(__sbSqlRaw(path, (strict ? "/*sb-d1-strict*/" : "") + String(sql), JSON.stringify(params || [])));
   if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
@@ -5504,6 +5610,17 @@ function __sbCall(reqJson) {
   }
 }
 
+// A strict D1 query without the generic dispatch: no request object, no copy of its fields, no walk
+// down the op list and no result object. The same steps __sbEmbeddedDispatch runs for "d1.query".
+__sbD1QueryDirect = function (db, sql, params) {
+  if (__sbCompatDate() >= "2026-10-22") __sbLtxConfigure();
+  __sbEnsureSchema();
+  const path = __sbD1Path(String(db));
+  __sbD1Open(path, true);
+  __sbD1Quota(path);
+  return __sbD1Run(path, sql, params, true);
+};
+
 // The same dispatch without the JSON text either side: D1 calls take this (see __sbRpcDirect).
 __sbCallDirect = function (req) {
   if (__sbCompatDate() >= "2026-10-22") __sbLtxConfigure();

package/test/native-d1.ts

@@ -56,23 +56,29 @@ int main(void) {
     if (!strncmp(line, ":cells ", 7)) {
       sb_cells cs = { 0, 0, 0, 0, 0 };
       char* head = sb_sql_run_x(line + 7, sql, params, &cs);
-      printf("{\\"head\\":%s,\\"rows\\":[", head);
-      size_t nrow = cs.ncol ? cs.n / (size_t)cs.ncol : 0;
+      // A result has no JSON header: its column names are the first cells and its counts are in cs.
+      if (head) printf("{\\"head\\":%s,\\"rows\\":[", head);
+      else {
+        printf("{\\"head\\":{\\"ok\\":true,\\"cols\\":[");
+        for (int c = 0; c < cs.hdr; c++) printf(c ? ",\\"%.*s\\"" : "\\"%.*s\\"", cs.c[c].n, cs.a + cs.c[c].off);
+        printf("],\\"changes\\":%lld,\\"rowid\\":%lld},\\"rows\\":[", cs.changes, cs.rowid);
+      }
+      size_t nrow = cs.ncol ? (cs.n - (size_t)cs.hdr) / (size_t)cs.ncol : 0;
       for (size_t r = 0; r < nrow; r++) {
         printf(r ? ",[" : "[");
         for (int c = 0; c < cs.ncol; c++) {
-          sb_cell* x = &cs.c[r * (size_t)cs.ncol + (size_t)c];
+          sb_cell* x = &cs.c[(size_t)cs.hdr + r * (size_t)cs.ncol + (size_t)c];
           if (c) printf(",");
           if (x->t == 0) printf("null");
           else if (x->t == 1) printf("%.17g", x->d);
           else if (x->t == 2) {
             uint16_t* u = (uint16_t*)malloc((size_t)x->n * 2 + 2); int wide = 0;
-            size_t k = sb_text_units((const unsigned char*)x->p, (size_t)x->n, u, &wide);
+            size_t k = sb_text_units((const unsigned char*)(cs.a + x->off), (size_t)x->n, u, &wide);
             printf("\\"");
             for (size_t i = 0; i < k; i++) printf("\\\\u%04x", u[i]);
             printf("\\"");
             free(u);
-          } else { printf("{\\"$blob\\":\\""); for (int i = 0; i < x->n; i++) printf("%02x", (unsigned char)x->p[i]); printf("\\"}"); }
+          } else { printf("{\\"$blob\\":\\""); for (int i = 0; i < x->n; i++) printf("%02x", (unsigned char)cs.a[x->off + i]); printf("\\"}"); }
         }
         printf("]");
       }
@@ -162,6 +168,7 @@ int main(void) {
     assert.deepEqual(cells.rows, json.rows, `cells equal the JSON rows for ${t}`);
     assert.deepEqual(cells.head.cols, json.cols);
     assert.equal(cells.head.changes, json.changes);
+    assert.equal(cells.head.rowid, json.rowid);
   }
   const empty = cellRun("SELECT a FROM t WHERE 0");
   assert.deepEqual(empty.cells.rows, []);
@@ -252,15 +259,16 @@ int main(void) {
   };
   // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
   const scriptRaw = (path: string, text: string) => sqlRaw(":script " + path, text, "[]");
-  // __sbSqlRowsRaw as the transport's C block gives it: [header JSON, rows], BLOBs as byte arrays.
+  // __sbSqlRowsRaw as the transport's C block gives it: an error is [header JSON], a result is
+  // ["", rows, columns, changes, rowid], BLOBs as byte arrays.
   const rowsOf =
     (raw: (path: string, text: string, params: string) => string) => (path: string, text: string, params: string) => {
       const r = JSON.parse(raw(":cells " + path, text, params));
-      if (r.head.ok === false) return [JSON.stringify(r.head), undefined];
+      if (r.head.ok === false) return [JSON.stringify(r.head)];
       const rows = r.rows.map((row: unknown[]) =>
         row.map((c) => (c instanceof Object && "$blob" in c ? [...Buffer.from(String(c.$blob), "hex")] : c)),
       );
-      return [JSON.stringify(r.head), rows];
+      return ["", rows, r.head.cols, r.head.changes, r.head.rowid];
     };
   const ops = new Function(
     "__sbSqlRaw",
@@ -279,6 +287,7 @@ int main(void) {
       "__sbDir",
       "__sbDirBytesRaw",
       "__sbD1DbRaw",
+      "__sbD1Captured_",
       "__sbSql",
       "__sbSqlRaw",
       `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull, expire() { __sbQuotaAt = -1; } };`,
@@ -287,6 +296,7 @@ int main(void) {
       () => dir,
       (d: string) => String(JSON.parse(sqlRaw(":bytes " + d, "", "")).n),
       (path: string, what: string) => String(JSON.parse(sqlRaw(":db " + path, what, "")).n),
+      (path: string) => JSON.parse(sqlRaw(":db " + path, "c", "")).n,
       sql,
       sqlRaw,
     );
@@ -334,6 +344,7 @@ int main(void) {
         "__sbDir",
         "__sbDirBytesRaw",
         "__sbD1DbRaw",
+        "__sbD1Captured_",
         "__sbSql",
         "__sbSqlRaw",
         `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull };`,
@@ -342,6 +353,7 @@ int main(void) {
         () => dir,
         (d: string) => String(JSON.parse(raw(":bytes " + d, "", "")).n),
         (path: string, what: string) => String(JSON.parse(raw(":db " + path, what, "")).n),
+        (path: string) => JSON.parse(raw(":db " + path, "c", "")).n,
         run,
         raw,
       );
@@ -629,6 +641,24 @@ int main(void) {
   assert.match(failedOver.error, /^LTX capture failed/);
   third.close();
   await third.exited;
+  // Locking mode. This driver is the transport on its own, as sproutd and the broker embed it (no
+  // standalone shim): unset it must stay shared, so those hosts behave as before. SB_SQLITE_EXCLUSIVE=1 is
+  // exclusive for a plain database; anything else, 0 included, is shared. A database under LTX replication
+  // is never exclusive.
+  const lockingMode = (env: Record<string, string>, path: string) => {
+    const e = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== "SB_SQLITE_EXCLUSIVE"));
+    const p = Bun.spawnSync([binary], {
+      stdin: Buffer.from(`${path}\tPRAGMA locking_mode\t[]\n`),
+      env: { ...e, ...env },
+    });
+    assert.equal(p.exitCode, 0, p.stderr.toString());
+    return JSON.parse(p.stdout.toString().trim()).rows[0][0];
+  };
+  const lockDb = join(work, "data/d1/LOCK.sqlite");
+  assert.equal(lockingMode({}, lockDb), "normal", "the bare transport keeps shared locking unless asked");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "0" }, lockDb), "normal");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "1" }, lockDb), "exclusive");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "1" }, join(work, "data/d1/LOCK2.sqlite")), "exclusive");
   console.log(
     "native d1: sb_sql_run and the D1 ops pass (blob binds, atomic batch, strict counts, foreign keys, error text)",
   );

package/test/native-headers.ts

@@ -0,0 +1,182 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Headers validates a name and trims a value in C before it falls back to the regular expression and
+// the JS loops. Every kind of name and value must come out as the Fetch spec says: valid names
+// lowercased, invalid ones a TypeError, values trimmed, forbidden characters refused, and a name
+// that is not a plain bytestring (a wide character) still judged by the expression.
+const handler = `export default {fetch(request) {
+  const out = {};
+  const names = ["a", "Content-Type", "X-Sb-Test", "x_y", "a.b", "a~b", "a|b", "a^b", "a+b", "a*b", "a!b", "a#b", "a$b", "a%b", "a&b", "a'b", "a-b", "9", "A9z", "",
+    "a b", "a:b", "a/b", "a(b", "a@b", "a[b", "a\\u0000b", "a\\nb", "\\u00e9", "caf\\u00e9", "a\\u0100b", "a,b", "a;b", "a=b", "a?b", "a\\"b", "a\\\\b", "a<b", "a>b", "a{b", "a}b"];
+  const h = new Headers();
+  for (const name of names) {
+    try { h.append(name, "v"); out["n:" + name] = h.has(name.toLowerCase()) ? "ok" : "stored?"; }
+    catch (e) { out["n:" + name] = e instanceof TypeError ? "TypeError" : String(e); }
+  }
+  const values = ["plain", "", " lead", "trail ", "\\t both \\t", "\\r\\nx", "a\\u0000b", "a\\nb", "a\\rb", "in ner", "caf\\u00e9", "\\u4e2d", " \\u4e2d ", "x\\ty"];
+  for (const value of values) {
+    const g = new Headers();
+    try { g.set("x", value); out["v:" + JSON.stringify(value)] = g.get("x"); }
+    catch (e) { out["v:" + JSON.stringify(value)] = e instanceof TypeError ? "TypeError" : String(e); }
+  }
+  const dup = new Headers();
+  dup.append("Accept", "a"); dup.append("accept", "b");
+  out.dup = dup.get("ACCEPT");
+  out.fromObject = new Headers({ "Content-Type": "text/plain", "X-A": " 1 " }).get("x-a");
+  out.getCase = new Headers({ "x-a": "1" }).get("X-A");
+  out.trigger = request.headers.get("X-Sb-Trigger");
+  out.custom = request.headers.get("X-Custom");
+  return new Response(JSON.stringify(out), { headers: { "Content-Type": "application/json", "X-Case": " kept " } });
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+// What the Fetch spec (and workerd) say, from the names and values above.
+function expectedName(name: string): string {
+  const valid = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
+  return valid ? "ok" : "TypeError";
+}
+function expectedValue(value: string): string {
+  const trimmed = value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+  return /[\0\n\r]/.test(trimmed) ? "TypeError" : trimmed;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-headers-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native headers test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "headers.generated.js");
+  const binary = join(workdir, "headers-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let response: Response | undefined;
+  for (let attempt = 0; attempt < 50 && !response; attempt++) {
+    try {
+      response = await fetch(`http://127.0.0.1:${port}/`, {
+        headers: { "X-Custom": "custom" },
+        signal: AbortSignal.timeout(2000),
+      });
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(response, "compiled handler did not start");
+  // SAFETY: the handler above answers a flat JSON object of strings (and null), read key by key below.
+  const out = (await response.json()) as Record<string, string>;
+  const names = [
+    "a",
+    "Content-Type",
+    "X-Sb-Test",
+    "x_y",
+    "a.b",
+    "a~b",
+    "a|b",
+    "a^b",
+    "a+b",
+    "a*b",
+    "a!b",
+    "a#b",
+    "a$b",
+    "a%b",
+    "a&b",
+    "a'b",
+    "a-b",
+    "9",
+    "A9z",
+    "",
+    "a b",
+    "a:b",
+    "a/b",
+    "a(b",
+    "a@b",
+    "a[b",
+    "a\u0000b",
+    "a\nb",
+    "é",
+    "café",
+    "aĀb",
+    "a,b",
+    "a;b",
+    "a=b",
+    "a?b",
+    'a"b',
+    "a\\b",
+    "a<b",
+    "a>b",
+    "a{b",
+    "a}b",
+  ];
+  for (const name of names) assert.equal(out["n:" + name], expectedName(name), `header name ${JSON.stringify(name)}`);
+  const values = [
+    "plain",
+    "",
+    " lead",
+    "trail ",
+    "\t both \t",
+    "\r\nx",
+    "a\u0000b",
+    "a\nb",
+    "a\rb",
+    "in ner",
+    "café",
+    "中",
+    " 中 ",
+    "x\ty",
+  ];
+  for (const value of values)
+    assert.equal(out["v:" + JSON.stringify(value)], expectedValue(value), `header value ${JSON.stringify(value)}`);
+  assert.equal(out.dup, "a, b");
+  assert.equal(out.fromObject, "1");
+  assert.equal(out.getCase, "1");
+  assert.equal(out.trigger, null);
+  assert.equal(out.custom, "custom");
+  assert.equal(response.headers.get("x-case"), "kept");
+  console.log("Native Headers: names and values validated in C match the Fetch spec for every class of input");
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}