@sproutboat/runtime 0.34.5 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @sproutboat/runtime
 
+## 0.35.0
+
+### Minor Changes
+
+- 7f5e87b: A standalone binary now opens its SQLite databases in `PRAGMA locking_mode=EXCLUSIVE` by default, with the page cache at 2 MB (`cache_size=-2000`, unchanged). The lock is taken once and held, so a transaction no longer takes and releases file locks around itself, and the WAL index lives in heap memory instead of a shared `-shm` file. The cost: no other process can open the database while the binary runs, so the `sqlite3` shell, `sproutboat kv/d1 --local --data-dir` against a running binary, and the several-copies-behind-`SO_REUSEPORT` recipe do not work on a live binary. Set `SB_SQLITE_EXCLUSIVE=0` to opt out and keep shared locking. A database under LTX replication is never opened exclusive.
+  
+  The default belongs to the standalone binary only: the toolchain's native server shim sets `SB_SQLITE_EXCLUSIVE=1` at startup unless the variable is already set. The embedded transport itself reads only `SB_SQLITE_EXCLUSIVE` (`1` is exclusive, anything else is shared), so sproutd and the broker keep shared locking unless an operator sets it.
+  
+  `SB_SQLITE_CACHE_MB=<n>` (1 to 4096) sets each database's page cache in MiB; unset it stays at 2 MB.
+
+### Patch Changes
+
+- 2c9d885: A strict D1 query in a standalone binary does less around SQLite. It skips the generic dispatch (a request object, a walk down the op list, a result object), a statement is a class instead of an object with five closures, `raw()` and `first()` no longer build the `meta` they throw away (two clock reads), the transaction-keyword check reads character codes instead of compiling a regular expression on every query, and the column names, change count and row id come back as JavaScript values built in C instead of as JSON text that is written, parsed and discarded. Replies, errors and `meta` are unchanged.
+- 004b8e7: A request's fixed cost in a native sprout drops five items. The CPU stamp and the streamed-body probe come back as numbers instead of formatted and parsed text (a `printf` and a `parseFloat` each, per request). The ingress reads of `x-sb-trigger` and `x-sb-remote-addr` scan the stored header names instead of validating and lowercasing a name for each, and the three `x-sb-` names the runtime strips are looked for in one pass. `SB_EDGE_TOKEN` is read once. `Headers` checks a name and a value in C and only falls back to its regular expression for a name it cannot judge there, so `get`, `has`, `set`, `append` and `new Response(body, { headers })` stop compiling that expression on every call. Behavior is unchanged.
+- 4213ed7: A standalone binary stops mapping and unmapping 88 KiB for every statement that builds a temporary table. SQLite allocates 20 pages in one block for each page cache it creates, and `INSERT ... RETURNING` (and any sort that spills to a temporary table) creates one, so each such statement cost an `mmap` and an `munmap`. The runtime now sets the initial page-cache allocation to 0 before SQLite starts, so a cache takes its pages one at a time as it grows. Query results and the main database's cache size are unchanged.
+
 ## 0.34.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.34.5",
+  "version": "0.35.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/d1-shim.test.js

@@ -64,7 +64,9 @@ for (const date of ["2026-09-28", "2026-10-24"]) {
   test(`${date}: batch() is one transaction`, async () => {
     const DB = fresh(date);
     await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
-    expect(await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")]))).toMatch(/UNIQUE/);
+    expect(
+      await failure(() => DB.batch([DB.prepare("INSERT INTO t VALUES (1)"), DB.prepare("INSERT INTO t VALUES (1)")])),
+    ).toMatch(/UNIQUE/);
     expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(0);
   });
 }
@@ -85,13 +87,23 @@ test("before 2026-10-24: synchronous, lenient, no foreign keys, BLOBs as one cha
 
 test("from 2026-10-24: D1's parameter rules", async () => {
   const DB = fresh("2026-10-24");
-  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe("D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'");
-  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe("D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'");
-  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe("D1_TYPE_ERROR: Type 'bigint' not supported for value '10'");
+  expect(caught(() => DB.prepare("SELECT ?1").bind(undefined))).toBe(
+    "D1_TYPE_ERROR: Type 'undefined' not supported for value 'undefined'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind({ a: 1 }))).toBe(
+    "D1_TYPE_ERROR: Type 'object' not supported for value '[object Object]'",
+  );
+  expect(caught(() => DB.prepare("SELECT ?1").bind(10n))).toBe(
+    "D1_TYPE_ERROR: Type 'bigint' not supported for value '10'",
+  );
   expect(await failure(() => DB.prepare("SELECT ?1, ?2").bind(1).all())).toBe(WRONG_COUNT);
   expect(await failure(() => DB.prepare("SELECT ?1").bind(1, 2).all())).toBe(WRONG_COUNT);
   expect(await failure(() => DB.prepare("SELECT ?1").all())).toBe(WRONG_COUNT);
-  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({ a: "x", b: "x", c: 1 });
+  expect(await DB.prepare("SELECT ?1 AS a, ?1 AS b, ?2 AS c").bind("x", true).first()).toEqual({
+    a: "x",
+    b: "x",
+    c: 1,
+  });
 });
 
 test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", async () => {
@@ -104,18 +116,25 @@ test("from 2026-10-24: foreign keys, BLOBs as byte arrays, D1's error text", asy
   expect(await failure(() => DB.prepare("INSERT INTO p VALUES (1)").run())).toBe(
     "D1_ERROR: UNIQUE constraint failed: p.id: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_PRIMARYKEY)",
   );
-  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe("D1_ERROR: no such table: nope: SQLITE_ERROR");
+  expect(await failure(() => DB.prepare("SELECT * FROM nope").all())).toBe(
+    "D1_ERROR: no such table: nope: SQLITE_ERROR",
+  );
   expect(await DB.prepare("SELECT x'00ff' AS b").first("b")).toEqual([0, 255]);
 });
 
 test("from 2026-10-24: every query method returns a Promise", async () => {
   const DB = fresh("2026-10-24");
   const s = DB.prepare("SELECT 41 AS a");
-  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)]) expect(p).toBeInstanceOf(Promise);
+  for (const p of [s.all(), s.run(), s.first(), s.raw(), DB.batch([s]), DB.exec("SELECT 1"), DB.dump().catch(() => 0)])
+    expect(p).toBeInstanceOf(Promise);
   expect(await s.first("a").then((a) => a + 1)).toBe(42);
   expect(await Promise.all([s.first("a"), DB.prepare("SELECT 2 AS a").first("a")])).toEqual([41, 2]);
   // Errors reject rather than throw: .catch() sees them.
-  expect(await DB.prepare("SELEC 1").all().catch((e) => e.message)).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
+  expect(
+    await DB.prepare("SELEC 1")
+      .all()
+      .catch((e) => e.message),
+  ).toMatch(/^D1_ERROR: near "SELEC": syntax error/);
 });
 
 test("from 2026-10-24: results, meta, raw() and first() as in workerd", async () => {
@@ -123,16 +142,42 @@ test("from 2026-10-24: results, meta, raw() and first() as in workerd", async ()
   await DB.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, name TEXT)");
   const inserted = await DB.prepare("INSERT INTO t (name) VALUES (?), (?)").bind("one", "two").run();
   expect(Object.keys(inserted).sort()).toEqual(["meta", "results", "success"]);
-  expect(Object.keys(inserted.meta).sort()).toEqual(["changed_db", "changes", "duration", "last_row_id", "rows_read", "rows_written", "served_by", "size_after"]);
-  expect([inserted.meta.changes, inserted.meta.last_row_id, inserted.meta.changed_db, inserted.meta.rows_written]).toEqual([2, 2, true, 2]);
+  expect(Object.keys(inserted.meta).sort()).toEqual([
+    "changed_db",
+    "changes",
+    "duration",
+    "last_row_id",
+    "rows_read",
+    "rows_written",
+    "served_by",
+    "size_after",
+  ]);
+  expect([
+    inserted.meta.changes,
+    inserted.meta.last_row_id,
+    inserted.meta.changed_db,
+    inserted.meta.rows_written,
+  ]).toEqual([2, 2, true, 2]);
   const read = await DB.prepare("SELECT id, name FROM t ORDER BY id").all();
   expect([read.meta.changes, read.meta.changed_db, read.meta.rows_written]).toEqual([0, false, 0]);
-  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([[1, "one"], [2, "two"]]);
-  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([["id", "name"], [1, "one"], [2, "two"]]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw()).toEqual([
+    [1, "one"],
+    [2, "two"],
+  ]);
+  expect(await DB.prepare("SELECT id, name FROM t ORDER BY id").raw({ columnNames: true })).toEqual([
+    ["id", "name"],
+    [1, "one"],
+    [2, "two"],
+  ]);
   expect(await DB.prepare("SELECT id FROM t WHERE id > 9").raw({ columnNames: true })).toEqual([["id"]]);
-  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([["a", "a"], [1, 2]]);
+  expect(await DB.prepare("SELECT 1 AS a, 2 AS a").raw({ columnNames: true })).toEqual([
+    ["a", "a"],
+    [1, 2],
+  ]);
   expect((await DB.prepare("SELECT 1 AS a, 2 AS a").all()).results).toEqual([{ a: 2 }]);
-  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe("D1_COLUMN_NOTFOUND: Column not found (nope)");
+  expect(await failure(() => DB.prepare("SELECT id FROM t").first("nope"))).toBe(
+    "D1_COLUMN_NOTFOUND: Column not found (nope)",
+  );
   expect(await DB.prepare("SELECT id FROM t WHERE id > 9").first("nope")).toBeNull();
 });
 
@@ -140,15 +185,74 @@ test("from 2026-10-24: empty SQL, transactions, exec() and sessions as in worker
   const DB = fresh("2026-10-24");
   expect(await failure(() => DB.prepare("").all())).toBe(NO_STATEMENTS);
   expect(await failure(() => DB.batch([]))).toBe(NO_STATEMENTS);
-  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(/^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/);
+  expect(await failure(() => DB.prepare("BEGIN TRANSACTION").run())).toMatch(
+    /^D1_ERROR: To execute a transaction, please use the state\.storage\.transaction\(\)/,
+  );
   expect(await failure(() => DB.prepare("savepoint x").run())).toMatch(/^D1_ERROR: To execute a transaction/);
   const done = await DB.exec("CREATE TABLE t (id INTEGER)\nINSERT INTO t VALUES (1);\n\nINSERT INTO t VALUES (2);\n");
   expect([done.count, Number.isFinite(done.duration)]).toEqual([3, true]);
   expect(await DB.exec("SELECT 1").then((r) => r.count)).toBe(1);
-  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(/^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/);
+  expect(await failure(() => DB.exec("INSERT INTO t VALUES (3);\nSELEC 2"))).toMatch(
+    /^D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error/,
+  );
   expect(await DB.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
   const session = DB.withSession("first-unconstrained");
   expect(await session.prepare("SELECT count(*) AS n FROM t").first("n")).toBe(2);
   expect(session.getBookmark()).toBeNull();
   expect(await session.batch([session.prepare("SELECT 1 AS a")]).then((r) => r[0].results)).toEqual([{ a: 1 }]);
 });
+
+// __sbD1IsTransaction replaced `/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)`.
+test("a statement is a transaction keyword exactly as the regular expression it replaced said", () => {
+  // oxlint-disable-next-line no-function-constructor -- the prelude is prepended as text in production too
+  const { isTx } = new Function("Porffor", `${source}\nreturn { isTx: __sbD1IsTransaction };`)({ c: () => "" });
+  const old = (text) => /^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text);
+  const cases = [
+    "BEGIN",
+    "begin",
+    "Begin TRANSACTION",
+    "begin;",
+    "BEGIN\n",
+    "commit",
+    "COMMIT;",
+    "end",
+    "END TRANSACTION",
+    "rollback to x",
+    "ROLLBACK",
+    "savepoint x",
+    "SAVEPOINT\tx",
+    "release x",
+    "RELEASE",
+    "beginning",
+    "begin_x",
+    "begin1",
+    "ending",
+    "endx",
+    "ender",
+    "committed",
+    "rollbacks",
+    "savepoints",
+    "released",
+    "select 1",
+    "SELECT begin FROM t",
+    "insert into t values (1)",
+    "be",
+    "en",
+    "e",
+    "",
+    "BEGINX",
+    "begin-",
+    "end(",
+    "end.",
+    "release@",
+    "commité",
+    "xbegin",
+    " begin",
+    "savepoint",
+    "savepointx",
+    "rollback_",
+    "ROLLBACKĀ",
+    "bégin",
+  ];
+  for (const text of cases) expect([text, isTx(text)]).toEqual([text, old(text)]);
+});

package/src/native-fetch-prelude.js

@@ -3092,18 +3092,34 @@ __sbStartupMark();
 // string via the same primitives as __sbEnv / __sbRandomBytes (proven working),
 // then parsed — Porffor's number boxing for a bare inline-C assignment is not
 // relied on. `__sbEntry` samples it around the handler for per-invocation CPU.
+// The number comes back as a number: no text and no parse around it.
 function __sbCpuMs() {
-  let res = "";
+  let ms = 0;
   // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
   Porffor.c`
     struct timespec __ts;
     clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
-    double __ms = (double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0;
+    ms = (f64)((double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0);
+  `;
+  return ms;
+}
+
+// The `x-sb-cpu-ms` value for the CPU time since `t0`, as three decimals, floored at zero: one
+// clock read and one format call in C, where it was a read, a format, a parse and a toFixed.
+// oxlint-disable-next-line no-unused-vars -- `t0` is read inside the RawC block below, not by JS.
+function __sbCpuStamp(t0) {
+  let res = "0.000";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    struct timespec __ts;
+    clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &__ts);
+    double __d = ((double)__ts.tv_sec * 1000.0 + (double)__ts.tv_nsec / 1000000.0) - (t0.type == 1 ? (double)t0.val : 0.0);
+    if (!(__d >= 0)) __d = 0;
     char __b[32];
-    int __n = snprintf(__b, sizeof(__b), "%.3f", __ms);
+    int __n = snprintf(__b, sizeof(__b), "%.3f", __d);
     if (__n > 0) res = porf_box((f64)porf_native_fetch_alloc_bytestring(__b, (size_t)__n), 195);
   `;
-  return res === "" ? 0 : parseFloat(res);
+  return res;
 }
 
 // #28 — stamp `x-sb-cpu-ms` onto a handler Response. Porffor alpha-10's
@@ -3114,7 +3130,6 @@ function __sbCpuMs() {
 // http-sync-v0) with no Set-Cookie to comma-fold; anything else is returned
 // untouched and the edge simply omits cpuMs for that request.
 function __sbTagCpu(res, t0) {
-  const cpu = __sbCpuMs() - t0;
   try {
     // A string body and no Set-Cookie, as before. The native writer reads Headers' flat `_entries`,
     // so the stamp is appended to the handler's own Response instead of building a second one (a
@@ -3122,7 +3137,7 @@ function __sbTagCpu(res, t0) {
     // the handler set itself is replaced by the measured one, as before.
     const headers = res && res.headers;
     if (headers && __sbIsStr(__sbRawBody(res)) && !headers.has("set-cookie")) {
-      const stamp = (cpu >= 0 ? cpu : 0).toFixed(3);
+      const stamp = __sbCpuStamp(t0);
       const entries = headers._entries;
       let set = false;
       for (let i = 0; i < entries.length; i += 2) {
@@ -5295,6 +5310,11 @@ function __sbD1Param(value, strict) {
 // The broker transport leaves it unset and keeps the string hop. (No initializer: the transport is placed ahead of the prelude, and `= null` would run after its assignment.)
 // oxlint-disable-next-line no-unassigned-vars -- the embedded transport assigns it; the broker transport does not.
 var __sbCallDirect;
+// The embedded transport also answers a strict D1 query without the generic dispatch around it
+// (a request object, a walk down the op list, a result object): (db, sql, params) -> the reply
+// __sbD1Run builds. Unset elsewhere, and the query goes through __sbD1Rpc as before.
+// oxlint-disable-next-line no-unassigned-vars -- the embedded transport assigns it; the broker transport does not.
+var __sbD1QueryDirect;
 function __sbRpcDirect(op, extra) {
   if (!__sbCallDirect) return __sbRpc(op, extra);
   const req = { v: 1, id: ++__sbReqId, op };
@@ -5355,10 +5375,30 @@ function __sbD1Fail(message) {
 // transaction statements are refused, exec() runs line by line, and withSession() exists.
 var __sbD1NoTransactions =
   "D1_ERROR: To execute a transaction, please use the state.storage.transaction() or state.storage.transactionSync() APIs instead of the SQL BEGIN TRANSACTION or SAVEPOINT statements. The JavaScript API is safer because it will automatically roll back on exceptions, and because it interacts correctly with Durable Objects' automatic atomic write coalescing.";
+// A statement's first word is one of the transaction keywords: read by character code, where the
+// regular expression this replaced was compiled on every query. The word ends at the first character
+// that is not a letter, digit or underscore (the regular expression's \b after a keyword).
+function __sbD1IsTransaction(text) {
+  let end = 0;
+  while (end < text.length && end < 10) {
+    const c = text.charCodeAt(end) | 32;
+    if (c < 97 || c > 122) break;
+    end++;
+  }
+  if (end < 3 || end > 9) return false;
+  if (end < text.length) {
+    const c = text.charCodeAt(end);
+    if ((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || c === 95 || (c >= 97 && c <= 122)) return false;
+  }
+  const word = text.slice(0, end).toLowerCase();
+  return (
+    word === "begin" || word === "commit" || word === "end" || word === "rollback" || word === "savepoint" || word === "release"
+  );
+}
 function __sbD1Check(sql) {
   const text = String(sql).trim();
   if (!text) throw __sbD1Fail("D1_ERROR: No SQL statements detected.");
-  if (/^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) throw __sbD1Fail(__sbD1NoTransactions);
+  if (__sbD1IsTransaction(text)) throw __sbD1Fail(__sbD1NoTransactions);
 }
 function __sbD1Meta(meta, started) {
   const changes = Number(meta.changes) || 0;
@@ -5394,70 +5434,91 @@ function __sbD1Promise(run) {
     return Promise.reject(err);
   }
 }
-function __sbMakeD1(dbName) {
-  // The synchronous core: the answer to one statement as columns, rows and meta.
-  function query(sql, params, strict) {
-    if (strict) __sbD1Check(sql);
-    const started = Date.now();
-    const r = __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
-    if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
-    const table = __sbD1Table(r);
-    return { columns: table.columns, rows: table.rows, meta: __sbD1Meta(r.meta || {}, started) };
-  }
-  function stmt(sql, params) {
-    const s = {
-      __sql: sql,
-      __params: params,
-      bind() {
-        const strict = __sbD1Strict();
-        const list = [];
-        for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
-        return stmt(sql, list);
-      },
-      all() {
-        if (!__sbD1Strict()) return query(sql, params, false);
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          return { success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) };
-        });
-      },
-      run() {
-        return s.all();
-      },
-      raw(options) {
-        if (!__sbD1Strict()) {
-          const rows = query(sql, params, false).results;
-          const out = [];
-          for (let i = 0; i < rows.length; i++) {
-            const cols = [];
-            for (const k in rows[i]) cols.push(rows[i][k]);
-            out.push(cols);
-          }
-          return out;
-        }
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          return options && options.columnNames ? [t.columns].concat(t.rows) : t.rows;
-        });
-      },
-      first(column) {
-        if (!__sbD1Strict()) {
-          const rows = query(sql, params, false).results;
-          if (rows.length === 0) return null;
-          return column == null ? rows[0] : rows[0][column];
-        }
-        return __sbD1Promise(() => {
-          const t = query(sql, params, true);
-          if (column == null) return t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null;
-          const at = t.columns.indexOf(String(column));
-          if (!t.rows.length) return null;
-          if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
-          return t.rows[0][t.columns.lastIndexOf(String(column))];
-        });
-      },
-    };
-    return s;
+// A strict query's reply from the embedded transport's direct lane, or through the generic
+// dispatch. The errors read the same either way: "D1_ERROR: ..." for SQLite's, and the
+// transport's own prefix for anything else.
+function __sbD1Direct(name, sql, params) {
+  try {
+    return __sbD1QueryDirect(name, sql, params);
+  } catch (err) {
+    const message = "sproutboat d1.query: " + (String((err && err.message) || err) || "failed");
+    const at = message.indexOf("D1_");
+    throw new Error(at > 0 ? message.slice(at) : message);
+  }
+}
+// The synchronous core: the answer to one statement as columns, rows and meta. meta is only built
+// when the caller will hand it out (all() and run()): raw() and first() drop it, and building it
+// reads the clock twice.
+function __sbD1Query(dbName, sql, params, strict, wantMeta) {
+  if (strict) __sbD1Check(sql);
+  const started = !strict || wantMeta ? Date.now() : 0;
+  const r = strict && __sbD1QueryDirect ? __sbD1Direct(dbName, sql, params) : __sbD1Rpc("d1.query", { db: dbName, sql, params }, strict);
+  if (!strict) return { results: r.results || [], success: true, meta: r.meta || {} };
+  const table = __sbD1Table(r);
+  return { columns: table.columns, rows: table.rows, meta: wantMeta ? __sbD1Meta(r.meta || {}, started) : null };
+}
+// A prepared statement. A class, so a prepare() or bind() does not allocate five closures.
+class __SbD1Statement {
+  constructor(dbName, sql, params) {
+    this.__name = dbName;
+    this.__sql = sql;
+    this.__params = params;
   }
+  bind() {
+    const strict = __sbD1Strict();
+    const list = [];
+    for (let i = 0; i < arguments.length; i++) list.push(__sbD1Param(arguments[i], strict));
+    return new __SbD1Statement(this.__name, this.__sql, list);
+  }
+  all() {
+    if (!__sbD1Strict()) return __sbD1Query(this.__name, this.__sql, this.__params, false, true);
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, true);
+      return Promise.resolve({ success: true, meta: t.meta, results: __sbD1Objects(t.columns, t.rows) });
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  run() {
+    return this.all();
+  }
+  raw(options) {
+    if (!__sbD1Strict()) {
+      const rows = __sbD1Query(this.__name, this.__sql, this.__params, false, true).results;
+      const out = [];
+      for (let i = 0; i < rows.length; i++) {
+        const cols = [];
+        for (const k in rows[i]) cols.push(rows[i][k]);
+        out.push(cols);
+      }
+      return out;
+    }
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, false);
+      return Promise.resolve(options && options.columnNames ? [t.columns].concat(t.rows) : t.rows);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  first(column) {
+    if (!__sbD1Strict()) {
+      const rows = __sbD1Query(this.__name, this.__sql, this.__params, false, true).results;
+      if (rows.length === 0) return null;
+      return column == null ? rows[0] : rows[0][column];
+    }
+    try {
+      const t = __sbD1Query(this.__name, this.__sql, this.__params, true, false);
+      if (column == null) return Promise.resolve(t.rows.length ? __sbD1Objects(t.columns, [t.rows[0]])[0] : null);
+      const at = t.columns.indexOf(String(column));
+      if (!t.rows.length) return Promise.resolve(null);
+      if (at < 0) throw __sbD1Fail("D1_COLUMN_NOTFOUND: Column not found (" + column + ")");
+      return Promise.resolve(t.rows[0][t.columns.lastIndexOf(String(column))]);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+}
+function __sbMakeD1(dbName) {
   function batch(statements) {
     const strict = __sbD1Strict();
     const list = [];
@@ -5495,7 +5556,7 @@ function __sbMakeD1(dbName) {
   }
   const db = {
     prepare(sql) {
-      return stmt(String(sql), []);
+      return new __SbD1Statement(dbName, String(sql), []);
     },
     batch(statements) {
       if (!__sbD1Strict()) return batch(statements);
@@ -9111,7 +9172,7 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
   } catch (error) {
     // A Durable Object's stub.fetch() from 2026-10-29: the caller gets the exception.
     if (rethrow) {
-      __sbDrainWaitUntil(tasks);
+      if (tasks.length) __sbDrainWaitUntil(tasks);
       throw error;
     }
     // #179 — a rejected handler promise must not take the process down with it.
@@ -9119,8 +9180,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top) {
   }
   // The response goes out now and ctx.waitUntil work keeps running after it, as in
   // workerd; it was awaited first, so a 1.5 s background task delayed the response by
-  // 1.5 s. The 25 s cap still bounds it.
-  __sbDrainWaitUntil(tasks);
+  // 1.5 s. The 25 s cap still bounds it. Not called for no tasks: an async call is a coroutine and a promise.
+  if (tasks.length) __sbDrainWaitUntil(tasks);
   return r;
 }
 
@@ -9151,7 +9212,7 @@ function __sbErrorResponse(error, bindingCall) {
 // sees it. Returns whether the edge vouched for this one.
 function __sbBindingCallIngress(request) {
   const headers = request.headers;
-  const want = __sbEnv("SB_EDGE_TOKEN");
+  const want = __sbEdgeToken();
   const vouched = !!want && headers.get("x-sb-binding-call") === "1" && __sbEqCt(headers.get("x-sb-edge-token") || "", want);
   if (vouched) {
     const url = headers.get("x-sb-url");
@@ -9159,12 +9220,46 @@ function __sbBindingCallIngress(request) {
     if (url && URL.canParse(url) && __sbCompatDate() >= "2026-10-22") request.url = url;
     headers.delete("x-sb-remote-addr");
   }
-  for (const name of ["x-sb-binding-call", "x-sb-url", "x-sb-edge-token"]) {
-    if (headers.get(name) != null) headers.delete(name);
+  // Nearly every request carries none of the three: one look at the stored names tells, where
+  // three lookups (each validating and lowercasing its name) and an array of them did.
+  const stored = headers._entries;
+  let present = stored === undefined;
+  for (let i = 0; !present && i < stored.length; i += 2) {
+    const key = stored[i];
+    if (key === "x-sb-binding-call" || key === "x-sb-url" || key === "x-sb-edge-token") present = true;
+  }
+  if (present) {
+    for (const name of ["x-sb-binding-call", "x-sb-url", "x-sb-edge-token"]) {
+      if (headers.get(name) != null) headers.delete(name);
+    }
   }
   return vouched;
 }
 
+// SB_EDGE_TOKEN is fixed for the life of a process, like SB_TRUSTED_PROXIES above: read once.
+let __sbEdgeTokenCache;
+function __sbEdgeToken() {
+  if (__sbEdgeTokenCache === undefined) __sbEdgeTokenCache = __sbEnv("SB_EDGE_TOKEN");
+  return __sbEdgeTokenCache;
+}
+
+// One header of a request the native server built, by a name that is already lowercase and valid:
+// its stored names are scanned directly, where get() validates and lowercases the name first. A
+// name stored twice, or a headers object that is not the runtime's, goes through get().
+function __sbHeader(headers, name) {
+  const stored = headers._entries;
+  if (stored === undefined) return headers.get(name);
+  let found = null;
+  let count = 0;
+  for (let i = 0; i < stored.length; i += 2) {
+    if (stored[i] === name) {
+      found = stored[i + 1];
+      count++;
+    }
+  }
+  return count > 1 ? headers.get(name) : found;
+}
+
 function __sbLogUncaught(where, error) {
   try {
     let text = "";
@@ -9328,12 +9423,24 @@ function __sbIngressStream(request, id) {
   request.bytes = async () => await all();
 }
 
+// The id of the current request's streamed body, 0 when it has none (op "t" of __sbReqBodyOp),
+// as a number: every request asks, and the text round trip was a format and a parse.
+function __sbReqBodyTake() {
+  let id = 0;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    extern unsigned int sb_reqbody_take_current(void);
+    id = (f64)sb_reqbody_take_current();
+  `;
+  return id;
+}
+
 // Native HTTP ingress stores the body as one character per raw byte. Keep
 // that representation for binary consumers, but decode text lazily before
 // handing the request to user code. Request.text() in Porffor otherwise treats
 // the raw bytes as already-decoded characters and corrupts Unicode/HMAC input.
 function __sbDecodeIngress(request) {
-  const streamed = __sbCompatDate() >= "2026-10-27" ? Number(__sbReqBodyOp("t", 0, "")) : 0;
+  const streamed = __sbCompatDate() >= "2026-10-27" ? __sbReqBodyTake() : 0;
   if (streamed > 0) {
     __sbIngressStream(request, streamed);
     return;
@@ -9369,7 +9476,7 @@ function __sbTrustedProxiesOnce() {
 
 globalThis.__sbEntry = function (handlers, request) {
   __sbDecodeIngress(request);
-  const trigger = request.headers.get("x-sb-trigger");
+  const trigger = __sbHeader(request.headers, "x-sb-trigger");
   if (!trigger) {
     const bindingCall = __sbBindingCallIngress(request);
     // #163/#128 — expose the request metadata the edge already has, the
@@ -9379,7 +9486,7 @@ globalThis.__sbEntry = function (handlers, request) {
     const __cf = request.cf || {};
     if (__sbTrustedProxiesOnce().length === 0) {
       // No trusted proxy (the usual case): the peer is the client and no forwarded header counts.
-      __cf.clientIp = __sbNormalizeIp(request.headers.get("x-sb-remote-addr") || "");
+      __cf.clientIp = __sbNormalizeIp(__sbHeader(request.headers, "x-sb-remote-addr") || "");
     } else {
       __cf.clientIp = __sbClientIp(request);
       const __httpProtocol = __sbTrustedProxyHeader(request, "x-sb-http-protocol");

package/src/transport-embedded.js

@@ -1195,6 +1195,17 @@ static unsigned long sb_db_tick = 0;
 static int sb_is_do_sql(const char* path) { return strstr(path, "/do-sql/") != 0; }
 static void sb_db_evict(int idx);
 
+// SQLite allocates 20 pages in one block for every page cache it creates, and a statement that
+// builds a temporary table (INSERT ... RETURNING, a sort) creates one: an 88 KiB mmap and munmap
+// per such statement. A page count of 0 turns the bulk allocation off; the cache then takes
+// its pages one at a time, as it always does past the first 20. Must run before SQLite starts.
+extern int sqlite3_config(int, ...);
+static int sb_sqlite_booted = 0;
+static void sb_sqlite_boot(void) {
+  if (sb_sqlite_booted) return;
+  sb_sqlite_booted = 1;
+  sqlite3_config(7 /* SQLITE_CONFIG_PAGECACHE */, (void*)0, 0, 0);
+}
 static int sb_db_for(const char* path) {
   for (int i = 0; i < sb_db_count; i++) {
     if (sb_dbs[i] && strcmp(sb_db_names[i], path) == 0) {
@@ -1202,6 +1213,7 @@ static int sb_db_for(const char* path) {
       return sb_ltx_states[i].failed ? -1 : i;
     }
   }
+  sb_sqlite_boot();
   const int do_sql = sb_is_do_sql(path);
   // A name that would not fit could never be found again.
   if (do_sql && strlen(path) >= sizeof(sb_db_names[0])) return -1;
@@ -1240,9 +1252,30 @@ static int sb_db_for(const char* path) {
   // copies of the binary behind SO_REUSEPORT (#154 scaling recipe): WAL takes
   // concurrent readers plus one writer across processes, and this makes a
   // writer wait for the lock instead of failing SQLITE_BUSY.
+  // SB_SQLITE_EXCLUSIVE=1 holds the database's lock for the life of the process: no fcntl lock
+  // and unlock around each transaction, and the WAL index lives in heap memory instead of a shared
+  // -shm file. Set before journal_mode, because the heap index is only chosen when WAL starts in
+  // exclusive mode. No other process can open the database while the binary runs, which also rules
+  // out the several-copies-behind-SO_REUSEPORT recipe above. Off unless set (see below), and never for a
+  // database under LTX replication: capture reads the WAL through its shared index, and in
+  // exclusive mode (no -shm file) every capture failed (native-d1's LTX database).
+  // The transport itself only reads the variable, so a host that embeds it (sproutd, the broker) stays
+  // in shared mode unless it is set. A standalone binary sets it to 1 at startup (patch.ts, the shim's
+  // constructor) unless the operator has set it, so SB_SQLITE_EXCLUSIVE=0 opts a standalone binary out.
+  // SB_SQLITE_CACHE_MB sizes each database's page cache in MiB (default 2, about -2000 KiB).
+  {
+    const char* excl = getenv("SB_SQLITE_EXCLUSIVE");
+    if (excl && excl[0] == '1' && !excl[1] && !replicated) sqlite3_exec(db, "PRAGMA locking_mode=EXCLUSIVE", 0, 0, 0);
+    char cache[64];
+    const char* mb = getenv("SB_SQLITE_CACHE_MB");
+    long mib = mb && *mb ? strtol(mb, 0, 10) : 0;
+    if (mib >= 1 && mib <= 4096) snprintf(cache, sizeof(cache), "PRAGMA cache_size=-%ld", mib * 1024);
+    else snprintf(cache, sizeof(cache), "PRAGMA cache_size=-2000");
+    sqlite3_exec(db, cache, 0, 0, 0);
+  }
   sqlite3_exec(db,
     "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA busy_timeout=5000;"
-    "PRAGMA cache_size=-2000; PRAGMA journal_size_limit=16777216;",
+    "PRAGMA journal_size_limit=16777216;",
     0, 0, 0);
   // Durable Object SQLite enforces foreign keys, as in workerd.
   if (do_sql) sqlite3_exec(db, "PRAGMA foreign_keys=ON", 0, 0, 0);
@@ -2165,7 +2198,9 @@ static char* sb_sql_error(sqlite3* db, const char* message, int code, int skip)
 // The text and blob bytes of every cell share one arena (a cell holds an offset into it), and a
 // TEXT cell says whether it is all ASCII: that one becomes a JS string with a single copy.
 typedef struct { unsigned char t; unsigned char ascii; double d; size_t off; int n; } sb_cell;
-typedef struct { sb_cell* c; size_t n; size_t cap; int ncol; int used; char* a; size_t alen; size_t acap; } sb_cells;
+// hdr: how many of the first cells are the column names, not row data; changes and rowid are the
+// statement's counts, so a native reply needs no JSON header at all.
+typedef struct { sb_cell* c; size_t n; size_t cap; int ncol; int used; char* a; size_t alen; size_t acap; int hdr; long long changes; long long rowid; } sb_cells;
 static void sb_cells_free(sb_cells* cs) {
   if (!cs) return;
   free(cs->c);
@@ -2222,17 +2257,30 @@ static char* sb_sql_run_x(const char* path, const char* sql, const char* params,
     return sb_sql_error(db, "Wrong number of parameter bindings for SQL query.", 0, 0);
   }
 
-  sb_puts(&b, "{\"ok\":true,\"cols\":[");
   int ncol = sqlite3_column_count(st);
-  for (int i = 0; i < ncol; i++) {
-    if (i) sb_puts(&b, ",");
-    const char* name = sqlite3_column_name(st, i);
-    sb_putjson_text(&b, name ? name : "", name ? strlen(name) : 0);
-  }
-  sb_puts(&b, "],\"rows\":[");
-  // Cells only for a strict D1 statement: its BLOBs are byte arrays either way.
+  // Cells only for a strict D1 statement: its BLOBs are byte arrays either way. The column names
+  // are its first cells and the reply is no JSON text: success returns NULL, with the counts in cells.
   const int native = cells && strict && d1;
-  if (native) { cells->ncol = ncol; cells->used = 1; }
+  if (native) {
+    cells->ncol = ncol; cells->used = 1; cells->hdr = ncol;
+    for (int i = 0; i < ncol && cells->used > 0; i++) {
+      sb_cell* cell = sb_cells_add(cells);
+      if (!cell) { cells->used = -1; break; }
+      const char* name = sqlite3_column_name(st, i);
+      cell->t = 2;
+      cell->n = name ? (int)strlen(name) : 0;
+      cell->off = sb_cells_bytes(cells, (const unsigned char*)(name ? name : ""), (size_t)cell->n, &cell->ascii);
+      if (cell->off == (size_t)-1) { cells->used = -1; break; }
+    }
+  } else {
+    sb_puts(&b, "{\"ok\":true,\"cols\":[");
+    for (int i = 0; i < ncol; i++) {
+      if (i) sb_puts(&b, ",");
+      const char* name = sqlite3_column_name(st, i);
+      sb_putjson_text(&b, name ? name : "", name ? strlen(name) : 0);
+    }
+    sb_puts(&b, "],\"rows\":[");
+  }
   int rc, first = 1;
   while ((rc = sqlite3_step(st)) == SB_SQLITE_ROW) {
     if (native) {
@@ -2280,10 +2328,15 @@ static char* sb_sql_run_x(const char* path, const char* sql, const char* params,
     }
     sb_puts(&b, "]");
   }
-  char tail[96];
   // A read-only statement changed nothing: sqlite3_changes still holds the last write's count.
-  int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
-  sb_put(&b, tail, (size_t)k);
+  if (native) {
+    cells->changes = sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db);
+    cells->rowid = (long long)sqlite3_last_insert_rowid(db);
+  } else {
+    char tail[96];
+    int k = snprintf(tail, 96, "],\"changes\":%d,\"rowid\":%lld}", sqlite3_stmt_readonly(st) ? 0 : sqlite3_changes(db), (long long)sqlite3_last_insert_rowid(db));
+    sb_put(&b, tail, (size_t)k);
+  }
   // Reset, don't finalize: the statement stays compiled in sb_stmt_cache. Reset
   // now (not just on next reuse) so a SELECT stops holding its read transaction.
   sqlite3_reset(st);
@@ -4029,6 +4082,22 @@ function __sbDirBytesRaw(dir) {
   return res;
 }
 
+// "captured" of __sbD1DbRaw as a number: no text made in C and parsed here, on every D1 query.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbD1Captured_(path) {
+  let status = -1;
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+    status = (f64)sb_db_quota_freeze(__path, -1);
+    free(__path);
+  `;
+  return status;
+}
+
 // sb_db_page_size and sb_db_quota_freeze, for the quota (a path and a "0"/"1" in, a number out).
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbD1DbRaw(path, what) {
@@ -4235,10 +4304,10 @@ function __sbSqlRaw(path, sql, paramsJson) {
   return res;
 }
 
-// One strict D1 statement: [header JSON, rows]. The header is {"ok":true,"cols":[...],"changes":n,
-// "rowid":n} (or the error reply) and rows is an array of row arrays built here from the
-// cells, BLOBs as byte arrays, so no JSON for the rows is written or parsed. rows is
-// undefined when the reply is not a result.
+// One strict D1 statement: [header, rows, columns, changes, rowid]. A result has the empty string
+// for its header, rows an array of row arrays built here from the cells (BLOBs as byte arrays),
+// columns the array of names, and changes and rowid numbers: no JSON is written or parsed. Any
+// other reply is the error JSON in the header, with nothing after it.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbSqlRowsRaw(path, sql, paramsJson) {
   let res = "";
@@ -4262,21 +4331,28 @@ function __sbSqlRowsRaw(path, sql, paramsJson) {
     sb_cells __cells = { 0, 0, 0, 0, 0 };
     char* __out = sb_sql_run_x(__path, __sql, __args, &__cells);
     free(__path); free(__sql); free(__args);
-    const u32 __pair = porf_arr_new(2, 2);
+    const u32 __pair = porf_arr_new(5, 5);
     res = porf_box((f64)__pair, 72);
-    if (!__out) __out = strdup("{\"ok\":false,\"error\":\"no result\"}");
-    porf_arr_set(__pair, 0, porf_box((f64)porf_native_fetch_alloc_bytestring(__out, strlen(__out)), 195));
+    const int __native = !__out && __cells.used == 1;
+    if (!__out && !__native) __out = strdup("{\"ok\":false,\"error\":\"no result\"}");
+    porf_arr_set(__pair, 0, porf_box((f64)porf_native_fetch_alloc_bytestring(__out ? __out : "", __out ? strlen(__out) : 0), 195));
     free(__out);
-    if (__cells.used == 1) {
+    if (__native) {
       const size_t __ncol = (size_t)__cells.ncol;
-      const size_t __nrow = __ncol ? __cells.n / __ncol : 0;
+      const size_t __hdr = (size_t)__cells.hdr;
+      const size_t __nrow = __ncol ? (__cells.n - __hdr) / __ncol : 0;
       const u32 __rows = porf_arr_new(0, (i32)(__nrow ? __nrow : 1));
       porf_arr_set(__pair, 1, porf_box((f64)__rows, 72));
-      for (size_t __r = 0; __r < __nrow; __r++) {
+      porf_arr_set(__pair, 3, porf_box_num((f64)__cells.changes));
+      porf_arr_set(__pair, 4, porf_box_num((f64)__cells.rowid));
+      if (!__ncol) porf_arr_set(__pair, 2, porf_box((f64)porf_arr_new(0, 1), 72));
+      // Row index -1 is the column names; the data rows follow.
+      for (long long __r = (__ncol ? -1 : 0); __r < (long long)__nrow; __r++) {
         const u32 __row = porf_arr_new((i32)__ncol, (i32)__ncol);
-        porf_arr_set(__rows, (u32)__r, porf_box((f64)__row, 72));
+        if (__r < 0) porf_arr_set(__pair, 2, porf_box((f64)__row, 72));
+        else porf_arr_set(__rows, (u32)__r, porf_box((f64)__row, 72));
         for (size_t __c = 0; __c < __ncol; __c++) {
-          const sb_cell* __cell = &__cells.c[__r * __ncol + __c];
+          const sb_cell* __cell = &__cells.c[(__r < 0 ? 0 : __hdr + (size_t)__r * __ncol) + __c];
           jsval __v = porf_box(0.0, 7);
           if (__cell->t == 1) __v = porf_box_num(__cell->d);
           else if (__cell->t == 2 && __cell->ascii) {
@@ -4386,7 +4462,7 @@ function __sbD1Quota(path) {
   // Whether capture owns this database, from the private helper (no SQL), before anything
   // below depends on it. A database that cannot open (or whose capture failed) is left to
   // the call itself, which reports why.
-  const status = Number(__sbD1DbRaw(path, "captured"));
+  const status = __sbD1Captured_(path);
   if (status < 0) return;
   __sbD1Captured[path] = status === 1;
   let full = __sbQuotaFull();
@@ -4434,8 +4510,16 @@ function __sbDOSqlPath(cls, file) {
   if (!__sbDOSqlName(c, false) || !__sbDOSqlName(f, true)) throw new Error("invalid Durable Object SQL database");
   return __sbDir() + "/do-sql/" + c + "/" + f + ".sqlite";
 }
+// The last database's path: an app has one or two, and every query asks, so three concatenations
+// are done once. The directory cannot change mid-run (see __sbDir).
+var __sbD1PathName = "";
+var __sbD1PathValue = "";
 function __sbD1Path(name) {
-  return __sbDir() + "/d1/" + name + ".sqlite";
+  if (name === __sbD1PathName) return __sbD1PathValue;
+  const path = __sbDir() + "/d1/" + name + ".sqlite";
+  __sbD1PathName = name;
+  __sbD1PathValue = path;
+  return path;
 }
 
 function __sbSql(path, sql, params) {
@@ -5356,10 +5440,12 @@ function __sbD1Run(path, sql, params, strict) {
   if (strict) {
     // Rows come back as arrays, built in C (see __sbSqlRowsRaw); the header is small JSON.
     const pair = __sbSqlRowsRaw(path, "/*sb-d1-strict*/" + String(sql), JSON.stringify(params || []));
-    const head = JSON.parse(pair[0]);
-    if (head.ok === false) throw __sbD1Error(head);
+    if (pair[0] !== "") {
+      const head = JSON.parse(pair[0]);
+      if (head.ok === false) throw __sbD1Error(head);
+    }
     const rows = pair[1];
-    return { columns: head.cols, rows, native: true, meta: { changes: head.changes, last_row_id: head.rowid, rows_read: rows.length } };
+    return { columns: pair[2], rows, native: true, meta: { changes: pair[3], last_row_id: pair[4], rows_read: rows.length } };
   }
   const r = JSON.parse(__sbSqlRaw(path, (strict ? "/*sb-d1-strict*/" : "") + String(sql), JSON.stringify(params || [])));
   if (r.ok === false) throw strict ? __sbD1Error(r) : new Error("sqlite: " + r.error);
@@ -5524,6 +5610,17 @@ function __sbCall(reqJson) {
   }
 }
 
+// A strict D1 query without the generic dispatch: no request object, no copy of its fields, no walk
+// down the op list and no result object. The same steps __sbEmbeddedDispatch runs for "d1.query".
+__sbD1QueryDirect = function (db, sql, params) {
+  if (__sbCompatDate() >= "2026-10-22") __sbLtxConfigure();
+  __sbEnsureSchema();
+  const path = __sbD1Path(String(db));
+  __sbD1Open(path, true);
+  __sbD1Quota(path);
+  return __sbD1Run(path, sql, params, true);
+};
+
 // The same dispatch without the JSON text either side: D1 calls take this (see __sbRpcDirect).
 __sbCallDirect = function (req) {
   if (__sbCompatDate() >= "2026-10-22") __sbLtxConfigure();

package/test/native-d1.ts

@@ -56,12 +56,18 @@ int main(void) {
     if (!strncmp(line, ":cells ", 7)) {
       sb_cells cs = { 0, 0, 0, 0, 0 };
       char* head = sb_sql_run_x(line + 7, sql, params, &cs);
-      printf("{\\"head\\":%s,\\"rows\\":[", head);
-      size_t nrow = cs.ncol ? cs.n / (size_t)cs.ncol : 0;
+      // A result has no JSON header: its column names are the first cells and its counts are in cs.
+      if (head) printf("{\\"head\\":%s,\\"rows\\":[", head);
+      else {
+        printf("{\\"head\\":{\\"ok\\":true,\\"cols\\":[");
+        for (int c = 0; c < cs.hdr; c++) printf(c ? ",\\"%.*s\\"" : "\\"%.*s\\"", cs.c[c].n, cs.a + cs.c[c].off);
+        printf("],\\"changes\\":%lld,\\"rowid\\":%lld},\\"rows\\":[", cs.changes, cs.rowid);
+      }
+      size_t nrow = cs.ncol ? (cs.n - (size_t)cs.hdr) / (size_t)cs.ncol : 0;
       for (size_t r = 0; r < nrow; r++) {
         printf(r ? ",[" : "[");
         for (int c = 0; c < cs.ncol; c++) {
-          sb_cell* x = &cs.c[r * (size_t)cs.ncol + (size_t)c];
+          sb_cell* x = &cs.c[(size_t)cs.hdr + r * (size_t)cs.ncol + (size_t)c];
           if (c) printf(",");
           if (x->t == 0) printf("null");
           else if (x->t == 1) printf("%.17g", x->d);
@@ -162,6 +168,7 @@ int main(void) {
     assert.deepEqual(cells.rows, json.rows, `cells equal the JSON rows for ${t}`);
     assert.deepEqual(cells.head.cols, json.cols);
     assert.equal(cells.head.changes, json.changes);
+    assert.equal(cells.head.rowid, json.rowid);
   }
   const empty = cellRun("SELECT a FROM t WHERE 0");
   assert.deepEqual(empty.cells.rows, []);
@@ -252,15 +259,16 @@ int main(void) {
   };
   // oxlint-disable-next-line no-function-constructor -- lifting a block out of the text-only transport
   const scriptRaw = (path: string, text: string) => sqlRaw(":script " + path, text, "[]");
-  // __sbSqlRowsRaw as the transport's C block gives it: [header JSON, rows], BLOBs as byte arrays.
+  // __sbSqlRowsRaw as the transport's C block gives it: an error is [header JSON], a result is
+  // ["", rows, columns, changes, rowid], BLOBs as byte arrays.
   const rowsOf =
     (raw: (path: string, text: string, params: string) => string) => (path: string, text: string, params: string) => {
       const r = JSON.parse(raw(":cells " + path, text, params));
-      if (r.head.ok === false) return [JSON.stringify(r.head), undefined];
+      if (r.head.ok === false) return [JSON.stringify(r.head)];
       const rows = r.rows.map((row: unknown[]) =>
         row.map((c) => (c instanceof Object && "$blob" in c ? [...Buffer.from(String(c.$blob), "hex")] : c)),
       );
-      return [JSON.stringify(r.head), rows];
+      return ["", rows, r.head.cols, r.head.changes, r.head.rowid];
     };
   const ops = new Function(
     "__sbSqlRaw",
@@ -279,6 +287,7 @@ int main(void) {
       "__sbDir",
       "__sbDirBytesRaw",
       "__sbD1DbRaw",
+      "__sbD1Captured_",
       "__sbSql",
       "__sbSqlRaw",
       `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull, expire() { __sbQuotaAt = -1; } };`,
@@ -287,6 +296,7 @@ int main(void) {
       () => dir,
       (d: string) => String(JSON.parse(sqlRaw(":bytes " + d, "", "")).n),
       (path: string, what: string) => String(JSON.parse(sqlRaw(":db " + path, what, "")).n),
+      (path: string) => JSON.parse(sqlRaw(":db " + path, "c", "")).n,
       sql,
       sqlRaw,
     );
@@ -334,6 +344,7 @@ int main(void) {
         "__sbDir",
         "__sbDirBytesRaw",
         "__sbD1DbRaw",
+        "__sbD1Captured_",
         "__sbSql",
         "__sbSqlRaw",
         `${transport.slice(quotaStart, quotaEnd)}\nreturn { __sbQuotaCheck, __sbD1Quota, __sbQuotaFull };`,
@@ -342,6 +353,7 @@ int main(void) {
         () => dir,
         (d: string) => String(JSON.parse(raw(":bytes " + d, "", "")).n),
         (path: string, what: string) => String(JSON.parse(raw(":db " + path, what, "")).n),
+        (path: string) => JSON.parse(raw(":db " + path, "c", "")).n,
         run,
         raw,
       );
@@ -629,6 +641,24 @@ int main(void) {
   assert.match(failedOver.error, /^LTX capture failed/);
   third.close();
   await third.exited;
+  // Locking mode. This driver is the transport on its own, as sproutd and the broker embed it (no
+  // standalone shim): unset it must stay shared, so those hosts behave as before. SB_SQLITE_EXCLUSIVE=1 is
+  // exclusive for a plain database; anything else, 0 included, is shared. A database under LTX replication
+  // is never exclusive.
+  const lockingMode = (env: Record<string, string>, path: string) => {
+    const e = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== "SB_SQLITE_EXCLUSIVE"));
+    const p = Bun.spawnSync([binary], {
+      stdin: Buffer.from(`${path}\tPRAGMA locking_mode\t[]\n`),
+      env: { ...e, ...env },
+    });
+    assert.equal(p.exitCode, 0, p.stderr.toString());
+    return JSON.parse(p.stdout.toString().trim()).rows[0][0];
+  };
+  const lockDb = join(work, "data/d1/LOCK.sqlite");
+  assert.equal(lockingMode({}, lockDb), "normal", "the bare transport keeps shared locking unless asked");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "0" }, lockDb), "normal");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "1" }, lockDb), "exclusive");
+  assert.equal(lockingMode({ SB_SQLITE_EXCLUSIVE: "1" }, join(work, "data/d1/LOCK2.sqlite")), "exclusive");
   console.log(
     "native d1: sb_sql_run and the D1 ops pass (blob binds, atomic batch, strict counts, foreign keys, error text)",
   );

package/test/native-headers.ts

@@ -0,0 +1,182 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Headers validates a name and trims a value in C before it falls back to the regular expression and
+// the JS loops. Every kind of name and value must come out as the Fetch spec says: valid names
+// lowercased, invalid ones a TypeError, values trimmed, forbidden characters refused, and a name
+// that is not a plain bytestring (a wide character) still judged by the expression.
+const handler = `export default {fetch(request) {
+  const out = {};
+  const names = ["a", "Content-Type", "X-Sb-Test", "x_y", "a.b", "a~b", "a|b", "a^b", "a+b", "a*b", "a!b", "a#b", "a$b", "a%b", "a&b", "a'b", "a-b", "9", "A9z", "",
+    "a b", "a:b", "a/b", "a(b", "a@b", "a[b", "a\\u0000b", "a\\nb", "\\u00e9", "caf\\u00e9", "a\\u0100b", "a,b", "a;b", "a=b", "a?b", "a\\"b", "a\\\\b", "a<b", "a>b", "a{b", "a}b"];
+  const h = new Headers();
+  for (const name of names) {
+    try { h.append(name, "v"); out["n:" + name] = h.has(name.toLowerCase()) ? "ok" : "stored?"; }
+    catch (e) { out["n:" + name] = e instanceof TypeError ? "TypeError" : String(e); }
+  }
+  const values = ["plain", "", " lead", "trail ", "\\t both \\t", "\\r\\nx", "a\\u0000b", "a\\nb", "a\\rb", "in ner", "caf\\u00e9", "\\u4e2d", " \\u4e2d ", "x\\ty"];
+  for (const value of values) {
+    const g = new Headers();
+    try { g.set("x", value); out["v:" + JSON.stringify(value)] = g.get("x"); }
+    catch (e) { out["v:" + JSON.stringify(value)] = e instanceof TypeError ? "TypeError" : String(e); }
+  }
+  const dup = new Headers();
+  dup.append("Accept", "a"); dup.append("accept", "b");
+  out.dup = dup.get("ACCEPT");
+  out.fromObject = new Headers({ "Content-Type": "text/plain", "X-A": " 1 " }).get("x-a");
+  out.getCase = new Headers({ "x-a": "1" }).get("X-A");
+  out.trigger = request.headers.get("X-Sb-Trigger");
+  out.custom = request.headers.get("X-Custom");
+  return new Response(JSON.stringify(out), { headers: { "Content-Type": "application/json", "X-Case": " kept " } });
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+// What the Fetch spec (and workerd) say, from the names and values above.
+function expectedName(name: string): string {
+  const valid = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
+  return valid ? "ok" : "TypeError";
+}
+function expectedValue(value: string): string {
+  const trimmed = value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+  return /[\0\n\r]/.test(trimmed) ? "TypeError" : trimmed;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-headers-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native headers test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "headers.generated.js");
+  const binary = join(workdir, "headers-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let response: Response | undefined;
+  for (let attempt = 0; attempt < 50 && !response; attempt++) {
+    try {
+      response = await fetch(`http://127.0.0.1:${port}/`, {
+        headers: { "X-Custom": "custom" },
+        signal: AbortSignal.timeout(2000),
+      });
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(response, "compiled handler did not start");
+  // SAFETY: the handler above answers a flat JSON object of strings (and null), read key by key below.
+  const out = (await response.json()) as Record<string, string>;
+  const names = [
+    "a",
+    "Content-Type",
+    "X-Sb-Test",
+    "x_y",
+    "a.b",
+    "a~b",
+    "a|b",
+    "a^b",
+    "a+b",
+    "a*b",
+    "a!b",
+    "a#b",
+    "a$b",
+    "a%b",
+    "a&b",
+    "a'b",
+    "a-b",
+    "9",
+    "A9z",
+    "",
+    "a b",
+    "a:b",
+    "a/b",
+    "a(b",
+    "a@b",
+    "a[b",
+    "a\u0000b",
+    "a\nb",
+    "é",
+    "café",
+    "aĀb",
+    "a,b",
+    "a;b",
+    "a=b",
+    "a?b",
+    'a"b',
+    "a\\b",
+    "a<b",
+    "a>b",
+    "a{b",
+    "a}b",
+  ];
+  for (const name of names) assert.equal(out["n:" + name], expectedName(name), `header name ${JSON.stringify(name)}`);
+  const values = [
+    "plain",
+    "",
+    " lead",
+    "trail ",
+    "\t both \t",
+    "\r\nx",
+    "a\u0000b",
+    "a\nb",
+    "a\rb",
+    "in ner",
+    "café",
+    "中",
+    " 中 ",
+    "x\ty",
+  ];
+  for (const value of values)
+    assert.equal(out["v:" + JSON.stringify(value)], expectedValue(value), `header value ${JSON.stringify(value)}`);
+  assert.equal(out.dup, "a, b");
+  assert.equal(out.fromObject, "1");
+  assert.equal(out.getCase, "1");
+  assert.equal(out.trigger, null);
+  assert.equal(out.custom, "custom");
+  assert.equal(response.headers.get("x-case"), "kept");
+  console.log("Native Headers: names and values validated in C match the Fetch spec for every class of input");
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-sqlite-lock.ts

@@ -0,0 +1,94 @@
+import assert from "node:assert/strict";
+import { Database } from "bun:sqlite";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// A standalone binary (the embedded transport, built by the CLI) opens its SQLite databases in
+// EXCLUSIVE locking mode by default; SB_SQLITE_EXCLUSIVE=0 opts out and =1 is the default. The
+// transport on its own, as sproutd and the broker embed it, stays shared unless the variable is
+// set: native-d1.ts covers that. Needs SB_CLI, a sproutboat-cli checkout linked to this one.
+const handler = `export default {
+  async fetch() {
+    await env.DB.prepare("CREATE TABLE IF NOT EXISTS t (v INTEGER)").run();
+    const row = await env.DB.prepare("PRAGMA locking_mode").first();
+    return Response.json({ mode: row.locking_mode });
+  },
+};`;
+
+const cli = process.env.SB_CLI;
+if (!cli) {
+  console.log("skipped: set SB_CLI to a sproutboat-cli checkout linked to this checkout (it builds the sprout)");
+  process.exit(0);
+}
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sb-native-sqlite-lock-"));
+const servers: ReturnType<typeof Bun.spawn>[] = [];
+try {
+  const project = join(workdir, "lock");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "src/index.js"), handler);
+  writeFileSync(
+    join(project, "sproutboat.jsonc"),
+    JSON.stringify({ name: "lock", main: "src/index.js", compatibility_date: "2026-10-28", d1_databases: ["DB"] }),
+  );
+  const built = Bun.spawnSync(["bun", join(cli, "src/main.ts"), "build", "--standalone", "--target", "host"], {
+    cwd: project,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  assert.equal(built.exitCode, 0, "the CLI could not build the sprout");
+
+  const run = async (label: string, setting: string | undefined, expected: string) => {
+    const data = join(workdir, `data-${label}`);
+    const base = Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== "SB_SQLITE_EXCLUSIVE"));
+    const env = setting === undefined ? base : { ...base, SB_SQLITE_EXCLUSIVE: setting };
+    const port = freePort();
+    const server = Bun.spawn([join(project, "dist/lock")], {
+      cwd: project,
+      env: { ...env, SB_DATA_DIR: data, PORT: String(port) },
+      stdout: "ignore",
+      stderr: "inherit",
+    });
+    servers.push(server);
+    let response: Response | undefined;
+    for (let attempt = 0; attempt < 100 && !response; attempt++) {
+      try {
+        response = await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(2000) });
+      } catch {
+        if (server.exitCode !== null) break;
+        await Bun.sleep(100);
+      }
+    }
+    assert(response, `${label}: the compiled handler did not start`);
+    assert.deepEqual(await response.json(), { mode: expected }, label);
+    // Another process can open the database while the binary runs only in shared mode.
+    let other = "";
+    try {
+      const db = new Database(join(data, "d1/DB.sqlite"), { readonly: true });
+      other = String(db.query("SELECT count(*) AS n FROM t").get()?.n);
+      db.close();
+    } catch (error) {
+      other = String(error);
+    }
+    if (expected === "exclusive")
+      assert.match(other, /locked|busy/i, `${label}: a second opener is locked out (${other})`);
+    else assert.equal(other, "0", `${label}: a second opener can read`);
+    server.kill(9);
+    await server.exited;
+  };
+  await run("default", undefined, "exclusive");
+  await run("one", "1", "exclusive");
+  await run("zero", "0", "normal");
+  console.log("standalone SQLite: EXCLUSIVE by default, SB_SQLITE_EXCLUSIVE=0 opts out");
+} finally {
+  for (const server of servers) server.kill(9);
+  rmSync(workdir, { recursive: true, force: true });
+}