@sproutboat/runtime 0.35.0 → 0.37.1

package/test/native-async-local-storage.ts

@@ -0,0 +1,97 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// AsyncLocalStorage (design 02, milestone 2): the store follows the control flow across
+// awaits, promise reactions, timers, intervals, microtasks and ctx.waitUntil, and many
+// requests interleaved in one process each see only their own. The expected values are what
+// workerd (nodejs_compat) answers for test/fixtures/als-app.js.
+const cli = process.env.SB_CLI;
+if (!cli) {
+  console.log("skipped: set SB_CLI to a sproutboat-cli checkout linked to this checkout (it builds the sprouts)");
+  process.exit(0);
+}
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sb-native-als-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const project = join(workdir, "app");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "src/index.js"), readFileSync(new URL("./fixtures/als-app.js", import.meta.url)));
+  writeFileSync(
+    join(project, "sproutboat.jsonc"),
+    JSON.stringify({ name: "als", main: "src/index.js", compatibility_date: process.env.SB_COMPAT ?? "2026-11-01" }),
+  );
+  const built = Bun.spawnSync(["bun", join(cli, "src/main.ts"), "build", "--standalone", "--target", "host"], {
+    cwd: project,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  assert.equal(built.exitCode, 0, "the CLI could not build the sprout");
+  const port = freePort();
+  server = Bun.spawn([join(project, "dist/als")], {
+    cwd: project,
+    env: { ...process.env, PORT: String(port), SB_DATA_DIR: join(project, "data") },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  const base = `http://127.0.0.1:${port}`;
+  let ready = false;
+  for (let attempt = 0; attempt < 100 && !ready; attempt++) {
+    try {
+      await fetch(`${base}/none`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "the standalone app did not start");
+  const get = async (path: string) => (await fetch(`${base}${path}`)).json();
+
+  assert.deepEqual(await get("/basic"), [
+    null,
+    "a",
+    "b",
+    null,
+    ["a", "x"],
+    null,
+    ["threw", "boom", null],
+    ["args", 1, 2],
+    7,
+  ]);
+  const steps = (id: string) => [id, id, id, id, id, id, id, `q${id}`, `i${id}`, `i${id}`, `c${id}`, `s${id}`];
+  assert.deepEqual(await get("/await?id=one&d=2"), steps("one"));
+  assert.deepEqual(await get("/bind"), ["captured", "captured", "snap", null, "captured"]);
+  assert.deepEqual(await get("/nested-async?d=2"), ["outer", "inner", "outer", "outer"]);
+  assert.deepEqual(await get("/leak?d=2"), [null, null]);
+  await (await fetch(`${base}/wu?id=wu1&d=20`)).text();
+  await Bun.sleep(100);
+  assert.equal(await (await fetch(`${base}/wu-read`)).text(), "wu1");
+  console.log(
+    "run, exit and snapshot behave as workerd's; the store follows awaits, timers, intervals, microtasks and waitUntil",
+  );
+
+  // Many requests at once, each with its own store and its own delays.
+  const ids = Array.from({ length: 60 }, (_, i) => `req${i}`);
+  const answers = await Promise.all(ids.map((id, i) => get(`/await?id=${id}&d=${1 + (i % 7)}`)));
+  ids.forEach((id, i) => assert.deepEqual(answers[i], steps(id), `request ${id} saw another request's store`));
+  const nested = await Promise.all(ids.map((id, i) => get(`/nested-async?id=${id}&d=${1 + (i % 5)}`)));
+  nested.forEach((answer) => assert.deepEqual(answer, ["outer", "inner", "outer", "outer"]));
+  assert.equal(server.exitCode, null, "the server exited");
+  console.log("60 interleaved requests each saw only their own store at every await");
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  rmSync(workdir, { recursive: true, force: true });
+}

package/test/native-concurrent-requests.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { drive, startUpstream } from "./concurrent-driver";
+
+// Concurrent requests in one process (design 02, milestone 1). A standalone binary serves many
+// requests at once: they interleave on timers, request and response body streams, KV, D1 and
+// in-worker WebSockets, and each reply must hold only its own request's values (headers, body,
+// cookie, env, ctx, cf, errors, ctx.waitUntil results). The same app and driver run against a
+// sproutd worker (test/concurrency-smoke.py, which serves up to 8 requests per process).
+const cli = process.env.SB_CLI;
+if (!cli) {
+  console.log("skipped: set SB_CLI to a sproutboat-cli checkout linked to this checkout (it builds the sprouts)");
+  process.exit(0);
+}
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = mkdtempSync(join(tmpdir(), "sb-native-concurrent-"));
+const upstream = startUpstream();
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const project = join(workdir, "app");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "src/index.js"), readFileSync(new URL("./fixtures/concurrent-app.js", import.meta.url)));
+  writeFileSync(
+    join(project, "sproutboat.jsonc"),
+    JSON.stringify({
+      name: "conc",
+      main: "src/index.js",
+      compatibility_date: process.env.SB_COMPAT ?? "2026-11-01",
+      vars: { GREETING: "hi" },
+      kv_namespaces: ["KV"],
+      d1_databases: ["DB"],
+    }),
+  );
+  const built = Bun.spawnSync(["bun", join(cli, "src/main.ts"), "build", "--standalone", "--target", "host"], {
+    cwd: project,
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  assert.equal(built.exitCode, 0, "the CLI could not build the sprout");
+  const port = freePort();
+  server = Bun.spawn([join(project, "dist/conc")], {
+    cwd: project,
+    env: { ...process.env, PORT: String(port), SB_EGRESS_ALLOW: "127.0.0.1", SB_DATA_DIR: join(project, "data") },
+    stdout: "ignore",
+    stderr: "ignore",
+  });
+  const base = `http://127.0.0.1:${port}`;
+  let ready = false;
+  for (let attempt = 0; attempt < 100 && !ready; attempt++) {
+    try {
+      await fetch(`${base}/ping`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "the standalone app did not start");
+
+  const { requests, failures } = await drive({
+    base,
+    upstream: `http://127.0.0.1:${upstream.port}`,
+    requests: Number(process.env.SB_CONC_REQUESTS ?? 40),
+    rounds: Number(process.env.SB_CONC_ROUNDS ?? 5),
+    clientSockets: false,
+    store: true,
+  });
+  assert.equal(failures.length, 0, `cross-request leaks or failures:\n${failures.slice(0, 20).join("\n")}`);
+  assert.equal(server.exitCode, null, "the server exited");
+  console.log(`Standalone: ${requests} interleaved requests, no value crossed between them`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  upstream.stop(true);
+  rmSync(workdir, { recursive: true, force: true });
+}

package/test/native-cpu-requests.ts

@@ -0,0 +1,156 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Per-request CPU (design 02): x-sb-cpu-ms counts the thread CPU time of the slices in which one
+// request ran. A spinner interleaved with requests that wait is charged for its own work, the
+// waiters for theirs, whatever order they run in. An async handler reports it from compatibility
+// date 2026-11-02; before that only a handler that answers synchronously does.
+const handler = `export default {async fetch(request) {
+  const url = new URL(request.url);
+  const ms = Number(url.searchParams.get("ms") || 0);
+  const sleep = (n) => new Promise((resolve) => setTimeout(resolve, n));
+  // Work, not wall time: a loaded machine deschedules the process, and CPU time must not follow wall time.
+  const spin = (n) => { let x = 1; for (let i = 0; i < n * 40000; i++) x = (x * 1.0000001 + i) % 1000003; return x; };
+  if (url.pathname === "/spin") {
+    await sleep(5);
+    spin(ms / 2);
+    await sleep(5);
+    spin(ms / 2);
+    return new Response("spun");
+  }
+  if (url.pathname === "/wait") {
+    await sleep(ms);
+    return new Response("waited");
+  }
+  if (url.pathname === "/sync") {
+    spin(ms);
+    return new Response("sync");
+  }
+  return new Response("none", { status: 404 });
+}};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-cpu-requests-"));
+const servers: ReturnType<typeof Bun.spawn>[] = [];
+async function build(date: string): Promise<number> {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native cpu test needs node on PATH");
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, `cpu-${date}.generated.js`);
+  const binary = join(workdir, `cpu-${date}`);
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker), undefined, undefined, undefined, date),
+  );
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  const port = freePort();
+  const server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  servers.push(server);
+  for (let attempt = 0; attempt < 50; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/none`, { signal: AbortSignal.timeout(500) });
+      return port;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  throw new Error("compiled handler did not start");
+}
+
+try {
+  const port = await build("2026-11-02");
+  const cpu = async (path: string) => {
+    const response = await fetch(`http://127.0.0.1:${port}${path}`);
+    await response.text();
+    const header = response.headers.get("x-sb-cpu-ms");
+    assert(header !== null, `${path} has no x-sb-cpu-ms`);
+    return Number(header);
+  };
+
+  const alone = await cpu("/spin?ms=200");
+  assert(alone > 10, `a spinner alone reports only ${alone} ms`);
+  const sync = await cpu("/sync?ms=200");
+  assert(
+    sync > alone * 0.5 && sync < alone * 2,
+    `a synchronous spinner of the same work reports ${sync} ms, the async one ${alone}`,
+  );
+  const idle = await cpu("/wait?ms=50");
+  assert(idle < alone / 4 && idle < 30, `a request that only waits reports ${idle} ms (a spinner: ${alone})`);
+
+  // Together: the spinner next to eight waiters, repeated so the slices interleave differently.
+  for (let round = 0; round < 3; round++) {
+    const results = await Promise.all([
+      cpu("/spin?ms=200"),
+      ...Array.from({ length: 8 }, (_, i) => cpu(`/wait?ms=${150 + i * 20}`)),
+    ]);
+    const [spinner, ...waiters] = results;
+    assert(
+      spinner > alone * 0.5 && spinner < alone * 2,
+      `round ${round}: the spinner reports ${spinner} ms, alone it did ${alone}`,
+    );
+    for (const waiter of waiters)
+      assert(
+        waiter < alone / 4 && waiter < 60,
+        `round ${round}: a waiter was charged ${waiter} ms (the spinner: ${spinner})`,
+      );
+  }
+  // Two spinners at once are each charged their own work, not both.
+  const [a, b] = await Promise.all([cpu("/spin?ms=200"), cpu("/spin?ms=200")]);
+  assert(
+    a > alone * 0.5 && a < alone * 1.6 && b > alone * 0.5 && b < alone * 1.6,
+    `two spinners report ${a} and ${b} ms, one alone ${alone}`,
+  );
+  console.log(`per-request CPU holds under interleaving (a spinner ${alone.toFixed(0)} ms, waiters a few ms)`);
+
+  // Before 2026-11-02 an async handler still reports nothing.
+  const oldPort = await build("2026-11-01");
+  const old = await fetch(`http://127.0.0.1:${oldPort}/spin?ms=20`);
+  await old.text();
+  assert.equal(old.headers.get("x-sb-cpu-ms"), null, "an async handler is stamped before 2026-11-02");
+  const oldSync = await fetch(`http://127.0.0.1:${oldPort}/sync?ms=20`);
+  await oldSync.text();
+  assert.equal(
+    oldSync.headers.get("x-sb-cpu-ms"),
+    null,
+    "this handler is async, so it is not stamped before 2026-11-02",
+  );
+  console.log("before 2026-11-02 an async handler is not stamped");
+} finally {
+  for (const server of servers) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-d1.ts

@@ -373,6 +373,77 @@ int main(void) {
     (e: Error) => e.message === 'D1_EXEC_ERROR: Error in line 2: SELEC 2: near "SELEC": syntax error',
   );
   assert.equal(ops.__sbD1Run(ex, "SELECT count(*) AS n FROM x", [], false).results[0].n, 2, "exec rolled back");
+  // From 2026-11-03 (parity): D1's text, with the failing statement's own offset (counted from its first
+  // non-space character) and SQLite's result code.
+  const parityError = (lines: string[]) => {
+    try {
+      ops.__sbD1ExecLines(ex, lines, true);
+    } catch (e) {
+      return e instanceof Error ? e.message : String(e);
+    }
+    return "did not throw";
+  };
+  const parityCases: [string[], string][] = [
+    [
+      ["INSERT INTO x VALUES (3); SELEC 2"],
+      'Error in line 1: INSERT INTO x VALUES (3); SELEC 2: near "SELEC": syntax error at offset 0: SQLITE_ERROR',
+    ],
+    [["SELEC 2"], 'Error in line 1: SELEC 2: near "SELEC": syntax error at offset 0: SQLITE_ERROR'],
+    [["SELECT 1;", "  SELEC 3"], 'Error in line 2:   SELEC 3: near "SELEC": syntax error at offset 2: SQLITE_ERROR'],
+    [["/*c*/ SELEC 1"], 'Error in line 1: /*c*/ SELEC 1: near "SELEC": syntax error at offset 6: SQLITE_ERROR'],
+    [["SELECT * FROM nope"], "Error in line 1: SELECT * FROM nope: no such table: nope: SQLITE_ERROR"],
+    [["SELECT 1,"], "Error in line 1: SELECT 1,: incomplete input: SQLITE_ERROR"],
+  ];
+  for (const [lines, text] of parityCases) assert.equal(parityError(lines), "D1_EXEC_ERROR: " + text);
+  ops.__sbD1ExecLines(ex, ["CREATE TABLE ux (a UNIQUE)", "INSERT INTO ux VALUES (1)"], true);
+  assert.equal(
+    parityError(["INSERT INTO ux VALUES (1)"]),
+    "D1_EXEC_ERROR: Error in line 1: INSERT INTO ux VALUES (1): UNIQUE constraint failed: ux.a: SQLITE_CONSTRAINT (extended: SQLITE_CONSTRAINT_UNIQUE)",
+  );
+  // From 2026-11-03 (multi): a statement with more behind it runs them all, in one savepoint, and answers with the last.
+  const mdb = join(work, "data/d1/MULTI.sqlite");
+  const multi = (sql: string, params: unknown[] = []) => ops.__sbD1Run(mdb, sql, params, true, true);
+  const multiError = (sql: string, params: unknown[] = []) => {
+    try {
+      multi(sql, params);
+    } catch (e) {
+      return e instanceof Error ? e.message : String(e);
+    }
+    return "did not throw";
+  };
+  multi("CREATE TABLE m (id INTEGER PRIMARY KEY, name TEXT, v TEXT UNIQUE)");
+  const two = multi("INSERT INTO m (id) VALUES (7); INSERT INTO m (id) VALUES (8)");
+  assert.deepEqual([two.meta.changes, two.meta.last_row_id, two.rows.length], [2, 8, 0]);
+  assert.equal(multi("INSERT INTO m (id) VALUES (10); UPDATE m SET name = 'x'").meta.changes, 4);
+  assert.deepEqual(multi("SELECT 1 AS a; SELECT 2 AS b").columns, ["b"]);
+  assert.deepEqual(multi("SELECT 1; SELECT ? AS p", [5]).rows, [[5]]);
+  assert.equal(multi("INSERT INTO m (id) VALUES (30); INSERT INTO m (id) VALUES (31); ").meta.changes, 2);
+  const mcount = () => ops.__sbD1Run(mdb, "SELECT count(*) FROM m", [], true, true).rows[0][0];
+  const mbefore = mcount();
+  assert.equal(
+    multiError("INSERT INTO m (id) VALUES (40); garbage"),
+    'D1_ERROR: near "garbage": syntax error at offset 0: SQLITE_ERROR',
+  );
+  assert.match(
+    multiError("INSERT INTO m (id, v) VALUES (41, 'a'); INSERT INTO m (id, v) VALUES (42, 'a')"),
+    /^D1_ERROR: UNIQUE constraint failed: m\.v: SQLITE_CONSTRAINT/,
+  );
+  assert.equal(
+    multiError("INSERT INTO m (id) VALUES (?); INSERT INTO m (id) VALUES (?)", [50, 51]),
+    "D1_ERROR: When executing multiple SQL statements in a single call, only the last statement can have parameters.",
+  );
+  assert.equal(multiError("SELECT 1;;"), "D1_ERROR: SQL code did not contain a statement.");
+  assert.equal(multiError("SELECT 1; -- c"), "D1_ERROR: SQL code did not contain a statement.");
+  assert.equal(
+    multiError("SELECT 1; SELECT ? AS p", [1, 2]),
+    "D1_ERROR: Wrong number of parameter bindings for SQL query.",
+  );
+  assert.equal(mcount(), mbefore, "a failing script left nothing behind");
+  assert.equal(
+    ops.__sbD1Run(mdb, "INSERT INTO m (id) VALUES (60); INSERT INTO m (id) VALUES (61)", [], true, false).meta.changes,
+    1,
+    "without multi only the first runs",
+  );
   const db2 = join(work, "data/d1/OPS.sqlite");
   ops.__sbD1Run(db2, "CREATE TABLE p (id INTEGER PRIMARY KEY)", [], false);
   ops.__sbD1Run(db2, "CREATE TABLE c (id INTEGER PRIMARY KEY, p INTEGER REFERENCES p(id))", [], false);

package/test/native-domexception.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// DOMException in a compiled handler, compared with Bun. Porffor ships a stub global that
+// cannot be constructed; the prelude replaces it (found while testing third-party packages).
+const CASES = [
+  `(() => { const e = new DOMException("m", "AbortError"); return [e.name, e.message, e.code, e instanceof Error, e instanceof DOMException].join(); })()`,
+  `(() => { const e = new DOMException(); return [e.name, JSON.stringify(e.message), e.code].join(); })()`,
+  `(() => { const e = new DOMException("m", { name: "TimeoutError", cause: "c" }); return [e.name, e.code, e.cause].join(); })()`,
+  `(() => { const e = new DOMException("x", "CustomName"); return [e.name, e.code].join(); })()`,
+  `[DOMException.ABORT_ERR, DOMException.TIMEOUT_ERR, DOMException.DATA_CLONE_ERR, DOMException.NOT_SUPPORTED_ERR, DOMException.INVALID_STATE_ERR].join()`,
+  `(() => { const r = AbortSignal.abort().reason; return [r instanceof DOMException, r.name, r.code].join(); })()`,
+  `(() => { const c = new AbortController(); c.abort(); try { c.signal.throwIfAborted(); return "no throw"; } catch (e) { return [e instanceof DOMException, e.name].join(); } })()`,
+  `(() => { try { throw new DOMException("boom", "InvalidStateError"); } catch (e) { return String(e); } })()`,
+];
+const handler = `export default {async fetch() {
+  const cases = [
+${CASES.map((c) => `    () => (${c}),`).join("\n")}
+  ];
+  const out = [];
+  for (const run of cases) {
+    try { out.push(String(await run())); } catch (e) { out.push("THROWS " + (e && e.message)); }
+  }
+  return new Response(JSON.stringify(out));
+}};`;
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-domexception-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native streams test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "domexception.generated.js");
+  const binary = join(workdir, "domexception-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  // SAFETY: the handler above is the only producer of this body: a JSON array with one
+  // string per case; the comparison below reports any entry that differs.
+  const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `DOMException results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(`Native DOMException matches Bun in all ${CASES.length} cases`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-getrandomvalues.ts

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// crypto.getRandomValues on wider integer views, in a compiled handler, compared with Bun. It filled only the
+// low byte of each element (found while testing third-party packages).
+const CASES = [
+  `(() => { const b = new Uint32Array(256); crypto.getRandomValues(b); return [b.some((x) => x > 65535), b.some((x) => x > 16777215), b.length].join(); })()`,
+  `(() => { const b = new Uint16Array(512); crypto.getRandomValues(b); return b.some((x) => x > 255); })()`,
+  `(() => { const b = new BigUint64Array(64); crypto.getRandomValues(b); return b.some((x) => x > 4294967295n); })()`,
+  `(() => { const b = new Int32Array(256); crypto.getRandomValues(b); return b.some((x) => x < 0); })()`,
+  `(() => { const c = new Array(37).fill(0); const b = new Uint32Array(1); for (let i = 0; i < 3700; i++) { crypto.getRandomValues(b); c[Math.floor((b[0] / 2 ** 32) * 37)]++; } return c.filter((n) => n > 0).length > 30; })()`,
+  `(() => { const buf = new Uint8Array(16); const view = new Uint32Array(buf.buffer, 4, 2); crypto.getRandomValues(view); return [buf.slice(0, 4).every((x) => x === 0), buf.slice(12).every((x) => x === 0), buf.slice(4, 12).some((x) => x > 0)].join(); })()`,
+  `(() => { const b = new Uint8Array(8); return crypto.getRandomValues(b) === b; })()`,
+  `(() => { try { crypto.getRandomValues(new Float32Array(2)); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { try { crypto.getRandomValues(new DataView(new ArrayBuffer(4))); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { try { crypto.getRandomValues([1, 2]); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { const b = new Uint8Array(0); return crypto.getRandomValues(b).length; })()`,
+];
+const handler = `export default {async fetch() {
+  const cases = [
+${CASES.map((c) => `    () => (${c}),`).join("\n")}
+  ];
+  const out = [];
+  for (const run of cases) {
+    try { out.push(String(await run())); } catch (e) { out.push("THROWS " + (e && e.message)); }
+  }
+  return new Response(JSON.stringify(out));
+}};`;
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-getrandomvalues-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native streams test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "getrandomvalues.generated.js");
+  const binary = join(workdir, "getrandomvalues-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  // SAFETY: the handler above is the only producer of this body: a JSON array with one
+  // string per case; the comparison below reports any entry that differs.
+  const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `getRandomValues results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(`Native getRandomValues matches Bun in all ${CASES.length} cases`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}