@sproutboat/runtime 0.36.0 → 0.38.0

package/test/native-domexception.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// DOMException in a compiled handler, compared with Bun. Porffor ships a stub global that
+// cannot be constructed; the prelude replaces it (found while testing third-party packages).
+const CASES = [
+  `(() => { const e = new DOMException("m", "AbortError"); return [e.name, e.message, e.code, e instanceof Error, e instanceof DOMException].join(); })()`,
+  `(() => { const e = new DOMException(); return [e.name, JSON.stringify(e.message), e.code].join(); })()`,
+  `(() => { const e = new DOMException("m", { name: "TimeoutError", cause: "c" }); return [e.name, e.code, e.cause].join(); })()`,
+  `(() => { const e = new DOMException("x", "CustomName"); return [e.name, e.code].join(); })()`,
+  `[DOMException.ABORT_ERR, DOMException.TIMEOUT_ERR, DOMException.DATA_CLONE_ERR, DOMException.NOT_SUPPORTED_ERR, DOMException.INVALID_STATE_ERR].join()`,
+  `(() => { const r = AbortSignal.abort().reason; return [r instanceof DOMException, r.name, r.code].join(); })()`,
+  `(() => { const c = new AbortController(); c.abort(); try { c.signal.throwIfAborted(); return "no throw"; } catch (e) { return [e instanceof DOMException, e.name].join(); } })()`,
+  `(() => { try { throw new DOMException("boom", "InvalidStateError"); } catch (e) { return String(e); } })()`,
+];
+const handler = `export default {async fetch() {
+  const cases = [
+${CASES.map((c) => `    () => (${c}),`).join("\n")}
+  ];
+  const out = [];
+  for (const run of cases) {
+    try { out.push(String(await run())); } catch (e) { out.push("THROWS " + (e && e.message)); }
+  }
+  return new Response(JSON.stringify(out));
+}};`;
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-domexception-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native streams test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "domexception.generated.js");
+  const binary = join(workdir, "domexception-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  // SAFETY: the handler above is the only producer of this body: a JSON array with one
+  // string per case; the comparison below reports any entry that differs.
+  const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `DOMException results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(`Native DOMException matches Bun in all ${CASES.length} cases`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-getrandomvalues.ts

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// crypto.getRandomValues on wider integer views, in a compiled handler, compared with Bun. It filled only the
+// low byte of each element (found while testing third-party packages).
+const CASES = [
+  `(() => { const b = new Uint32Array(256); crypto.getRandomValues(b); return [b.some((x) => x > 65535), b.some((x) => x > 16777215), b.length].join(); })()`,
+  `(() => { const b = new Uint16Array(512); crypto.getRandomValues(b); return b.some((x) => x > 255); })()`,
+  `(() => { const b = new BigUint64Array(64); crypto.getRandomValues(b); return b.some((x) => x > 4294967295n); })()`,
+  `(() => { const b = new Int32Array(256); crypto.getRandomValues(b); return b.some((x) => x < 0); })()`,
+  `(() => { const c = new Array(37).fill(0); const b = new Uint32Array(1); for (let i = 0; i < 3700; i++) { crypto.getRandomValues(b); c[Math.floor((b[0] / 2 ** 32) * 37)]++; } return c.filter((n) => n > 0).length > 30; })()`,
+  `(() => { const buf = new Uint8Array(16); const view = new Uint32Array(buf.buffer, 4, 2); crypto.getRandomValues(view); return [buf.slice(0, 4).every((x) => x === 0), buf.slice(12).every((x) => x === 0), buf.slice(4, 12).some((x) => x > 0)].join(); })()`,
+  `(() => { const b = new Uint8Array(8); return crypto.getRandomValues(b) === b; })()`,
+  `(() => { try { crypto.getRandomValues(new Float32Array(2)); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { try { crypto.getRandomValues(new DataView(new ArrayBuffer(4))); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { try { crypto.getRandomValues([1, 2]); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { const b = new Uint8Array(0); return crypto.getRandomValues(b).length; })()`,
+];
+const handler = `export default {async fetch() {
+  const cases = [
+${CASES.map((c) => `    () => (${c}),`).join("\n")}
+  ];
+  const out = [];
+  for (const run of cases) {
+    try { out.push(String(await run())); } catch (e) { out.push("THROWS " + (e && e.message)); }
+  }
+  return new Response(JSON.stringify(out));
+}};`;
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-getrandomvalues-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native streams test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "getrandomvalues.generated.js");
+  const binary = join(workdir, "getrandomvalues-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  // SAFETY: the handler above is the only producer of this body: a JSON array with one
+  // string per case; the comparison below reports any entry that differs.
+  const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `getRandomValues results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(`Native getRandomValues matches Bun in all ${CASES.length} cases`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-jwt.ts

@@ -4,6 +4,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { ensurePorffor } from "../../toolchain/src/acquire";
+import { bearsslEnv } from "./bearssl";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // The pieces of a JWT check (base64url decode, TextEncoder, HMAC verify) against values that do
@@ -290,7 +291,7 @@ try {
     [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
     {
       cwd: workdir,
-      env: process.env,
+      env: { ...process.env, ...(await bearsslEnv()) },
       stdout: "pipe",
       stderr: "pipe",
     },

package/test/native-subtle.ts

@@ -0,0 +1,182 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { bearsslEnv } from "./bearssl";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { jsonObject, parseJsonValue, type JsonObject, type JsonValue } from "../../wire/src/json";
+import { SUBTLE_DATE } from "../src/subtle-date";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// The date gate and the parts of crypto.subtle that need no native half (the broker transport has
+// none): HMAC, digest, JWK for symmetric keys, and every error's DOMException name, against what
+// workerd answers for the same calls. The RSA/ECDSA/Ed25519/AES paths run in the embedded
+// transport and are covered by src/subtle/subtle.test.ts (C against BoringSSL) and the
+// conformance run in the PR description.
+const handler = `
+const hex = (b) => [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, "0")).join("");
+async function t(f) {
+  try { return await f(); } catch (e) { return "ERR " + e.name + (e instanceof DOMException ? " dom" : ""); }
+}
+const raw = new Uint8Array(32).fill(7);
+const hmac = { name: "HMAC", hash: "SHA-256" };
+export default {
+  async fetch() {
+    const s = crypto.subtle;
+    const out = {};
+    out.jwkImport = await t(async () => {
+      const k = await s.importKey("jwk", { kty: "oct", k: "AAECAwQFBgc", alg: "HS256", ext: true }, hmac, true, ["sign"]);
+      return [k.algorithm.length, k.type, k.usages, hex(await s.exportKey("raw", k))];
+    });
+    out.jwkExport = await t(async () => {
+      const k = await s.importKey("raw", raw, hmac, true, ["sign", "verify"]);
+      const j = await s.exportKey("jwk", k);
+      return [j.kty, j.alg, j.k, j.key_ops, j.ext];
+    });
+    out.badFormat = await t(() => s.importKey("foo", raw, hmac, true, ["sign"]));
+    out.badUsage = await t(() => s.importKey("raw", raw, hmac, true, ["encrypt"]));
+    out.empty = await t(() => s.importKey("raw", new Uint8Array(0), hmac, true, ["sign"]));
+    out.noHash = await t(() => s.importKey("raw", raw, { name: "HMAC" }, true, ["sign"]));
+    out.unknown = await t(() => s.digest("FOO", raw));
+    out.nonExtractable = await t(async () => s.exportKey("raw", await s.importKey("raw", raw, hmac, false, ["sign"])));
+    out.wrongUsage = await t(async () => s.sign("HMAC", await s.importKey("raw", raw, hmac, true, ["verify"]), raw));
+    out.wrongAlgorithm = await t(async () => s.sign("ECDSA", await s.importKey("raw", raw, hmac, true, ["sign"]), raw));
+    out.stringData = await t(async () => s.sign("HMAC", await s.importKey("raw", raw, hmac, true, ["sign"]), "abc"));
+    out.badJwkAlg = await t(() => s.importKey("jwk", { kty: "oct", k: "AAECAwQFBgc", alg: "HS384" }, hmac, true, ["sign"]));
+    out.badJwkKty = await t(() => s.importKey("jwk", { kty: "RSA", k: "AAECAwQFBgc" }, hmac, true, ["sign"]));
+    out.badJwkB64 = await t(() => s.importKey("jwk", { kty: "oct", k: "!!!" }, hmac, true, ["sign"]));
+    out.extFalse = await t(() => s.importKey("jwk", { kty: "oct", k: "AAECAwQFBgc", ext: false }, hmac, true, ["sign"]));
+    out.signVerify = await t(async () => {
+      const k = await s.importKey("raw", raw, { name: "HMAC", hash: "SHA-512" }, false, ["sign", "verify"]);
+      const sig = await s.sign("HMAC", k, raw);
+      return [sig.byteLength, await s.verify("HMAC", k, sig, raw), await s.verify("HMAC", k, sig, new Uint8Array(3))];
+    });
+    out.digests = await t(async () => [hex(await s.digest("SHA-1", raw)), hex(await s.digest({ name: "sha-256" }, raw)), hex(await s.digest("MD5", raw))]);
+    out.tse = await t(() => [s.timingSafeEqual(raw, raw), s.timingSafeEqual(raw, new Uint8Array(32))]);
+    out.tseLength = await t(() => s.timingSafeEqual(raw, new Uint8Array(3)));
+    out.isKey = await t(async () => { const k = await s.importKey("raw", raw, hmac, true, ["sign"]); return [k instanceof CryptoKey, Object.keys(k)]; });
+    // The native half is in the prelude on every transport.
+    out.needsNative = await t(async () => { const k = await s.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]); const sig = await s.sign({ name: "ECDSA", hash: "SHA-256" }, k.privateKey, raw); return await s.verify({ name: "ECDSA", hash: "SHA-256" }, k.publicKey, sig, raw); });
+    out.unsupportedCurve = await t(() => s.generateKey({ name: "ECDSA", namedCurve: "secp256k1" }, true, ["sign"]));
+    return Response.json(out);
+  },
+};`;
+
+const dom = " dom";
+const expectedNew: JsonObject = {
+  jwkImport: [64, "secret", ["sign"], "0001020304050607"],
+  jwkExport: ["oct", "HS256", "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc", ["sign", "verify"], true],
+  badFormat: "ERR NotSupportedError" + dom,
+  badUsage: "ERR SyntaxError" + dom,
+  empty: "ERR DataError" + dom,
+  noHash: "ERR TypeError",
+  unknown: "ERR NotSupportedError" + dom,
+  nonExtractable: "ERR InvalidAccessError" + dom,
+  wrongUsage: "ERR InvalidAccessError" + dom,
+  wrongAlgorithm: "ERR InvalidAccessError" + dom,
+  stringData: "ERR TypeError",
+  badJwkAlg: "ERR DataError" + dom,
+  badJwkKty: "ERR DataError" + dom,
+  badJwkB64: "ERR DataError" + dom,
+  extFalse: "ERR DataError" + dom,
+  signVerify: [64, true, false],
+  digests: [],
+  tse: [true, false],
+  tseLength: "ERR TypeError",
+  isKey: [true, ["usages", "algorithm", "extractable", "type"]],
+  needsNative: true,
+  unsupportedCurve: "ERR NotSupportedError" + dom,
+};
+// The digests are checked against Bun, not typed in.
+const bunHex = async (algo: string, data: Uint8Array) =>
+  Buffer.from(await crypto.subtle.digest(algo, data)).toString("hex");
+const rawBytes = new Uint8Array(32).fill(7);
+const digests: JsonValue[] = [
+  await bunHex("SHA-1", rawBytes),
+  await bunHex("SHA-256", rawBytes),
+  Buffer.from(new Bun.CryptoHasher("md5").update(rawBytes).digest()).toString("hex"),
+];
+expectedNew.digests = digests;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+async function run(date: string): Promise<JsonObject> {
+  const workdir = await mkdtemp(join(tmpdir(), "sb-native-subtle-"));
+  let server: ReturnType<typeof Bun.spawn> | undefined;
+  try {
+    const porffor = await ensurePorffor();
+    const node = Bun.which("node");
+    if (!node) throw new Error("native subtle test needs node on PATH");
+    const [core, broker] = await Promise.all([
+      readFile(preludePath, "utf8"),
+      readFile(transportPath("broker"), "utf8"),
+    ]);
+    assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+    const generated = join(workdir, "subtle.generated.js");
+    const binary = join(workdir, "subtle-native");
+    await writeFile(
+      generated,
+      wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker), undefined, undefined, undefined, date),
+    );
+    const compile = Bun.spawn(
+      [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+      {
+        cwd: workdir,
+        env: { ...process.env, ...(await bearsslEnv()) },
+        stdout: "pipe",
+        stderr: "pipe",
+      },
+    );
+    const [exitCode, stdout, stderr] = await Promise.all([
+      compile.exited,
+      new Response(compile.stdout).text(),
+      new Response(compile.stderr).text(),
+    ]);
+    assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+    const port = freePort();
+    server = Bun.spawn([binary], {
+      cwd: workdir,
+      env: { ...process.env, PORT: String(port) },
+      stdout: "ignore",
+      stderr: "inherit",
+    });
+    for (let attempt = 0; attempt < 50; attempt++) {
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+        assert.equal(response.status, 200);
+        const body = jsonObject(parseJsonValue(await response.text()));
+        assert(body, "the handler returns a JSON object");
+        return body;
+      } catch (error) {
+        if (error instanceof assert.AssertionError) throw error;
+        if (server.exitCode !== null) break;
+        await Bun.sleep(100);
+      }
+    }
+    throw new Error(`compiled handler did not start (${date})`);
+  } finally {
+    if (server) {
+      server.kill(9);
+      await server.exited;
+    }
+    await rm(workdir, { recursive: true, force: true });
+  }
+}
+
+const prelude = await readFile(preludePath, "utf8");
+assert(prelude.includes(`const __SB_SUBTLE_DATE = "${SUBTLE_DATE}";`), "SUBTLE_DATE and __SB_SUBTLE_DATE differ");
+const [before, after] = await Promise.all([
+  run(new Date(Date.parse(SUBTLE_DATE) - 86_400_000).toISOString().slice(0, 10)),
+  run(SUBTLE_DATE),
+]);
+assert.deepEqual(after, expectedNew, "from the new date crypto.subtle answers as workerd does");
+// Before the date nothing changed: the old subset, its plain-object keys and its errors.
+assert.equal(before.jwkImport, "ERR NotSupportedError dom", "before the date, jwk import is not supported");
+assert.equal(before.needsNative, "ERR NotSupportedError dom", "before the date, ECDSA is not supported");
+assert.deepEqual(before.signVerify, [64, true, false]);
+console.log("crypto.subtle: the date gate and the transport-independent surface match workerd");

package/test/native-textdecoder-encodings.ts

@@ -0,0 +1,123 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// TextDecoder encodings (UTF-16LE/BE, windows-1252), Blob.stream and Response.url in a compiled handler, compared with Bun
+// (found while testing third-party packages).
+const CASES = [
+  `new TextDecoder("utf-16le").decode(new Uint8Array([104, 0, 105, 0, 0x3d, 0xd8, 0x00, 0xde]))`,
+  `new TextDecoder("utf-16be").decode(new Uint8Array([0, 104, 0, 105]))`,
+  `JSON.stringify(new TextDecoder("utf-16le").decode(new Uint8Array([0xff, 0xfe, 65, 0])))`,
+  `JSON.stringify(new TextDecoder("utf-16le", { ignoreBOM: true }).decode(new Uint8Array([0xff, 0xfe, 65, 0])))`,
+  `JSON.stringify(new TextDecoder("utf-16le").decode(new Uint8Array([0x00, 0xd8, 65, 0])))`,
+  `JSON.stringify(new TextDecoder("utf-16le").decode(new Uint8Array([65, 0, 66])))`,
+  `(() => { try { new TextDecoder("utf-16le", { fatal: true }).decode(new Uint8Array([0x00, 0xd8])); return "no throw"; } catch (e) { return e.name; } })()`,
+  `(() => { const d = new TextDecoder("utf-16le"); return [d.decode(new Uint8Array([104]), { stream: true }), d.decode(new Uint8Array([0, 105]), { stream: true }), d.decode(new Uint8Array([0x3d, 0xd8]), { stream: true }), d.decode(new Uint8Array([0x00, 0xde]))].join("|"); })()`,
+  `new TextDecoder("windows-1252").decode(new Uint8Array([0x80, 0x41, 0xe9, 0x9f, 0xff, 0x7f]))`,
+  `JSON.stringify(new TextDecoder("windows-1252").decode(new Uint8Array([0x81, 0x8d, 0x8f, 0x90, 0x9d])))`,
+  `[new TextDecoder("latin1").encoding, new TextDecoder("ISO-8859-1").encoding, new TextDecoder(" ascii ").encoding, new TextDecoder("utf-16").encoding, new TextDecoder("UTF8").encoding, new TextDecoder("unicodefffe").encoding].join()`,
+  `(() => { try { new TextDecoder("not-an-encoding"); return "no throw"; } catch (e) { return e.name; } })()`,
+  `new TextDecoder("utf-8").decode(new Uint8Array([0xe2, 0x82, 0xac]))`,
+  `new Response(new Blob(["abc", new Uint8Array([100, 101])]).stream()).text()`,
+  `(async () => { const r = new Blob(["hello"]).stream().getReader(); const a = await r.read(); const b = await r.read(); return [a.done, a.value.length, b.done].join(); })()`,
+  `JSON.stringify([new Response("x").url, new Response("x").redirected, new Response(null, { status: 429 }).url + "|"])`,
+  `(async () => { const r = new Blob([]).stream().getReader(); const a = await r.read(); return a.done; })()`,
+];
+const handler = `export default {async fetch() {
+  const cases = [
+${CASES.map((c) => `    () => (${c}),`).join("\n")}
+  ];
+  const out = [];
+  for (const run of cases) {
+    try { out.push(String(await run())); } catch (e) { out.push("THROWS " + (e && e.message)); }
+  }
+  return new Response(JSON.stringify(out));
+}};`;
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-textdecoder-encodings-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native streams test needs node on PATH");
+
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const prelude = core.replace(TRANSPORT_MARKER, broker);
+  const generated = join(workdir, "textdecoder-encodings.generated.js");
+  const binary = join(workdir, "textdecoder-encodings-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
+  await rm(binary, { force: true });
+
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: process.env,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  // SAFETY: the handler above is the only producer of this body: a JSON array with one
+  // string per case; the comparison below reports any entry that differs.
+  const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `TextDecoder, Blob.stream and Response.url results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(`Native TextDecoder encodings, Blob.stream and Response.url match Bun in all ${CASES.length} cases`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-web-apis.ts

@@ -3,6 +3,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { ensurePorffor } from "../../toolchain/src/acquire";
+import { bearsslEnv } from "./bearssl";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // Web API behaviour the W2 conformance suite found wrong, compared with Bun: Headers
@@ -25,7 +26,8 @@ const CASES = [
   `new URL("http://münchen.test/x").host`,
   `crypto.subtle.digest("SHA-1", new TextEncoder().encode("abc")).then((b) => Array.from(new Uint8Array(b), (x) => x.toString(16).padStart(2, "0")).join(""))`,
   `crypto.subtle.importKey("raw", new TextEncoder().encode("key"), { name: "HMAC", hash: "SHA-1" }, true, ["sign"]).then(async (k) => [k.algorithm.hash.name, k.algorithm.length, Array.from(new Uint8Array(await crypto.subtle.sign("HMAC", k, new TextEncoder().encode("msg"))), (x) => x.toString(16).padStart(2, "0")).join(""), new Uint8Array(await crypto.subtle.exportKey("raw", k)).length].join())`,
-  `crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-512" }, true, ["sign"]).then(async (k) => [k.type, k.algorithm.length, (await crypto.subtle.exportKey("raw", k)).byteLength].join())`,  `(async () => { const collect = async (rs) => { const r = rs.getReader(); const out = []; for (;;) { const { value, done } = await r.read(); if (done) return out; out.push(value); } }; const bytes = new ReadableStream({ start(c) { c.enqueue(new Uint8Array([0x61, 0xe2])); c.enqueue(new Uint8Array([0x82, 0xac, 0xf0, 0x9f])); c.enqueue(new Uint8Array([0x98, 0x80])); c.close(); } }); const text = new ReadableStream({ start(c) { c.enqueue("a\\uD83D"); c.enqueue("\\uDE00b"); c.close(); } }); return (await collect(bytes.pipeThrough(new TextDecoderStream()))).join("|") + ";" + (await collect(text.pipeThrough(new TextEncoderStream()))).map((u) => Array.from(u).join(",")).join("|"); })()`,
+  `crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-512" }, true, ["sign"]).then(async (k) => [k.type, k.algorithm.length, (await crypto.subtle.exportKey("raw", k)).byteLength].join())`,
+  `(async () => { const collect = async (rs) => { const r = rs.getReader(); const out = []; for (;;) { const { value, done } = await r.read(); if (done) return out; out.push(value); } }; const bytes = new ReadableStream({ start(c) { c.enqueue(new Uint8Array([0x61, 0xe2])); c.enqueue(new Uint8Array([0x82, 0xac, 0xf0, 0x9f])); c.enqueue(new Uint8Array([0x98, 0x80])); c.close(); } }); const text = new ReadableStream({ start(c) { c.enqueue("a\\uD83D"); c.enqueue("\\uDE00b"); c.close(); } }); return (await collect(bytes.pipeThrough(new TextDecoderStream()))).join("|") + ";" + (await collect(text.pipeThrough(new TextEncoderStream()))).map((u) => Array.from(u).join(",")).join("|"); })()`,
 ];
 const handler = `export default {async fetch() {
   const cases = [
@@ -37,7 +39,15 @@ ${CASES.map((c) => `    () => (${c}),`).join("\n")}
   }
   return new Response(JSON.stringify(out));
 }};`;
-const want = await Promise.all(CASES.map(async (c) => { try { return String(await new Function("return " + c)()); } catch (e) { return "THROWS " + (e instanceof Error ? e.message : String(e)); } }));
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
 
 function freePort(): number {
   const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
@@ -53,10 +63,7 @@ try {
   const node = Bun.which("node");
   if (!node) throw new Error("native streams test needs node on PATH");
 
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "web-apis.generated.js");
@@ -64,12 +71,15 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      env: { ...process.env, ...(await bearsslEnv()) },
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
   const [exitCode, stdout, stderr] = await Promise.all([
     compile.exited,
     new Response(compile.stdout).text(),
@@ -98,8 +108,14 @@ try {
   // SAFETY: the handler above is the only producer of this body: a JSON array with one
   // string per case; the comparison below reports any entry that differs.
   const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
-  const diffs = CASES.flatMap((c, i) => (got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`]));
-  assert.deepEqual(diffs, [], `Web API results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`);
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `Web API results differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
   console.log(`Native Web APIs match Bun in all ${CASES.length} cases`);
 } finally {
   if (server) {