@sproutboat/runtime 0.38.0 → 0.39.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @sproutboat/runtime
 
+## 0.39.0
+
+### Minor Changes
+
+- 7030f76: Database clients that need only fetch or WebSocket (`@libsql/client`, `@neondatabase/serverless`, `@supabase/supabase-js`, `@upstash/redis`, `@planetscale/database`) run unmodified. In the runtime: `fetch()` returns a promise on the standalone binary from the compatibility date that already promises it (2026-10-22), so `fetch(url).then(...)` works and a refused request rejects; a fetched 204, 205 or 304 response no longer throws "Response with null body status cannot have body"; from the proposed compatibility date 2026-11-15 the Node/Bun/Deno global check in the bundle skips a use behind a `typeof` feature test, a global the bundle declares itself, and mentions inside strings and comments, and `Error.captureStackTrace` exists. In the toolchain: a typed array with an underlying object (a `Buffer` polyfill) shadows the builtin methods it redefines, so `buf.toString("utf8")` is the Buffer one.
+
 ## 0.38.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/native-fetch-prelude.js

@@ -12,6 +12,15 @@ function __sbEnvValue() {
 function __sbSetCompat(date) {
   __sbCompatNow = date;
   Request._cd = date;
+  if (date >= "2026-11-15" && Error.captureStackTrace === undefined) Error.captureStackTrace = __sbCaptureStackTrace;
+}
+// V8's Error.captureStackTrace(target): drivers (pg, @neondatabase/serverless) call it on the errors they
+// build and rethrow. Porffor keeps no frames, so the stack is the first line, as Error.stack is.
+function __sbCaptureStackTrace(target) {
+  if (Object(target) !== target) throw new TypeError("Invalid argument");
+  const name = target.name === undefined ? "Error" : String(target.name);
+  const message = target.message === undefined ? "" : String(target.message);
+  Object.defineProperty(target, "stack", { value: message === "" ? name : name + ": " + message, configurable: true, writable: true, enumerable: false });
 }
 function __sbSetEnv(value) {
   __sbEnvNow = value;
@@ -4253,8 +4262,12 @@ function __sbRequestBody(body) {
 }
 
 function __sbRawBodyResponse(body, init) {
-  const resp = new Response(body == null ? "" : body, init);
-  if (body != null) {
+  // 204, 205 and 304 carry no body: the constructor refuses even an empty string for them, so a
+  // fetch() of any 204 (a DELETE, a PostgREST write) threw before the caller saw the response.
+  const status = init == null ? 200 : init.status;
+  const bodiless = status === 204 || status === 205 || status === 304;
+  const resp = new Response(bodiless ? null : body == null ? "" : body, init);
+  if (body != null && !bodiless) {
     let decoded = null;
     resp.text = () => {
       if (decoded === null) decoded = __sbFromUtf8(body);
@@ -12243,7 +12256,19 @@ function __sbFollowHop(op, msg, label, mode, signal, hops) {
 function __sbUpstream(op, msg, label, signal, always) {
   if (signal) signal.throwIfAborted();
   const promised = always || __sbCompatDate() >= "2026-10-22" || __sbAsyncAtAnyDate();
-  if (!__sbHttpAsyncEnabled() || !promised) return __sbUpstreamResponse(globalThis.__sbFetchUpstream(op, msg));
+  if (!promised) return __sbUpstreamResponse(globalThis.__sbFetchUpstream(op, msg));
+  if (!__sbHttpAsyncEnabled()) {
+    // A host that runs the exchange to the end before it returns (the standalone binary) still hands
+    // back a promise from 2026-10-22: fetch(url).then(...) is how most libraries call it, and a refusal
+    // rejects instead of throwing. Earlier dates keep the Response (the embedded transport's
+    // __sbAsyncAtAnyDate is true for sproutd's sake, not for this).
+    if (!always && __sbCompatDate() < "2026-10-22") return __sbUpstreamResponse(globalThis.__sbFetchUpstream(op, msg));
+    try {
+      return Promise.resolve(__sbUpstreamResponse(globalThis.__sbFetchUpstream(op, msg)));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  }
   if (__sbCompatDate() >= "2026-10-22") return __sbUpstreamStreamed(op, msg, label, signal);
   return new Promise((resolve, reject) => {
     let onAbort = null;

package/src/source.test.ts

@@ -0,0 +1,44 @@
+import { expect, test } from "bun:test";
+import { GUARDED_GLOBALS_DATE, validateHttpSyncSource } from "./source";
+
+const wrap = (body: string) => `var d={fetch(){${body}return new Response("ok");}};export{d as default};`;
+
+const GUARDED = [
+  // a bundled `buffer` polyfill declares its own Buffer
+  `function Buffer(a){return a;}Buffer.isBuffer=function(b){return b instanceof Buffer;};`,
+  // upstash: a polyfill behind a test for another global
+  `if(typeof atob==="undefined"){global.atob=(b)=>Buffer.from(b,"base64").toString("utf8");}`,
+  // supabase-js: a Node branch behind a feature test
+  `function b64(d){if(typeof Buffer!=="undefined")return Buffer.from(d).toString("base64");return btoa(d);}`,
+  `if(typeof Deno!=="undefined"&&typeof Deno.unrefTimer==="function"){Deno.unrefTimer(t);}`,
+  // @neondatabase/serverless: the feature test names the member itself
+  `var B=typeof globalThis.Buffer=="function"&&typeof globalThis.Buffer.allocUnsafe=="function"?globalThis.Buffer:null;`,
+  // an error message that mentions an API
+  `throw new Error("Buffer.write(string, encoding, offset[, length]) is no longer supported");`,
+  `// process.env is read here in Node\n`,
+];
+
+test("before the guarded-globals date every Node global match fails, as it always did", () => {
+  for (const body of GUARDED) {
+    expect(validateHttpSyncSource(wrap(body), "2026-10-22").ok).toBe(false);
+    expect(validateHttpSyncSource(wrap(body)).ok).toBe(false);
+  }
+});
+
+test("from the guarded-globals date a feature-tested use, a string and a comment pass", () => {
+  for (const body of GUARDED) expect(validateHttpSyncSource(wrap(body), GUARDED_GLOBALS_DATE).ok).toBe(true);
+});
+
+test("from the guarded-globals date an unguarded use still fails", () => {
+  for (const body of [
+    `var x=process.env.TOKEN;`,
+    `var b=Buffer.from("a");`,
+    `var b=new Buffer(4);`,
+    `var x=Bun.file("a");`,
+    // a feature test far above does not guard this one
+    `if(typeof Deno!=="undefined"){}${" ".repeat(700)}var x=process.env.TOKEN;`,
+  ]) {
+    const result = validateHttpSyncSource(wrap(body), GUARDED_GLOBALS_DATE);
+    expect(result.ok).toBe(false);
+  }
+});

package/src/source.ts

@@ -6,6 +6,8 @@ export type SourceValidation = { ok: true } | { ok: false; errors: string[] };
 // bundling there are no imports left to reject, and a dependency reaching for a
 // Node API has to fail exactly as hand-written code would. A bare specifier
 // that resolves to nothing never gets this far — the bundler fails first.
+const NODE_GLOBAL_USE = /\b(process|Bun|Deno|Buffer)\.[a-zA-Z_$]|\bnew\s+Buffer\s*\(/;
+
 const alwaysForbidden: Array<[RegExp, string]> = [
   [/^\s*import\s/m, "an import survived bundling — only static imports can be resolved at build time"],
   [/\bimport\s*\(/, "dynamic import() is not supported: nothing can resolve it at build time"],
@@ -20,13 +22,48 @@ const alwaysForbidden: Array<[RegExp, string]> = [
   // No whitespace is allowed around the `.`: real member access never has
   // any (`process.env`, always contiguous), while prose mentioning the word
   // does (a bundled comment ending "...unique to this process. The id...").
-  [/\b(process|Bun|Deno|Buffer)\.[a-zA-Z_$]|\bnew\s+Buffer\s*\(/, "Node, Bun, and Deno APIs are not supported"],
+  [NODE_GLOBAL_USE, "Node, Bun, and Deno APIs are not supported"],
   // `node:` only means something as an import specifier; a bare substring
   // match would also flag it appearing in an ordinary string a dependency
   // happens to construct (a doc link, a log message).
   [/['"`]node:/, "Node, Bun, and Deno APIs are not supported"],
 ];
 
+/**
+ * From this compatibility date the Node/Bun/Deno global check skips a use that sits behind a
+ * `typeof X` feature test (supabase-js, @neondatabase/serverless and many others carry a Node or
+ * Deno branch next to the Web one), a global the bundle declares itself (a bundled `buffer`
+ * polyfill) and one that only appears inside a string or comment. Earlier
+ * dates keep the plain pattern match. Proposed value, to be chosen by a maintainer.
+ */
+export const GUARDED_GLOBALS_DATE = "2026-11-15";
+
+const STRINGS_AND_COMMENTS = /"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+
+/**
+ * True when the module reaches for a Node/Bun/Deno global that it neither declares itself nor
+ * feature-tests first. A bundled polyfill declares its own `Buffer` (`function Buffer(){}`), and a
+ * Node branch sits behind `typeof X !== "undefined"` or `typeof atob === "undefined"`.
+ */
+function usesNodeGlobalUnguarded(module: string): boolean {
+  const code = module.replace(STRINGS_AND_COMMENTS, (m) => (m[0] === "/" ? " " : m[0] + m[0]));
+  const declared = (name: string) => new RegExp("(?:function|class|var|let|const)\\s+" + name + "\\b").test(code);
+  const local = new Set(["process", "Bun", "Deno", "Buffer"].filter(declared));
+  const re = new RegExp(NODE_GLOBAL_USE.source, "g");
+  for (let m = re.exec(code); m !== null; m = re.exec(code)) {
+    const name = m[1] ?? "Buffer";
+    if (local.has(name)) continue;
+    const before = code.slice(Math.max(0, m.index - 600), m.index);
+    // `typeof globalThis.Buffer.from`: the use is the feature test itself.
+    if (/typeof\s+(?:(?:globalThis|self|global|window)\.)?$/.test(before)) continue;
+    if (new RegExp("typeof\\s+(?:(?:globalThis|self|global|window)\\.)?" + name + "\\b").test(before)) continue;
+    // `if (typeof atob === "undefined") { ... Buffer.from(...) }`: a test for something else, just before.
+    if (/typeof\s+[\w$.]+\s*[!=]==?\s*""/.test(before.slice(-200))) continue;
+    return true;
+  }
+  return false;
+}
+
 /** `new WebSocket(url)` connects out from this compatibility date (earlier, only WebSocketPair makes one). */
 export const OUTBOUND_WEBSOCKET_DATE = "2026-11-01";
 
@@ -48,7 +85,12 @@ export function validateHttpSyncSource(module: string, compatibilityDate?: strin
       "handler must default-export an object with fetch(request), scheduled() or queue(), or a WorkerEntrypoint class",
     );
   }
-  for (const [pattern, message] of alwaysForbidden) if (pattern.test(source)) errors.push(message);
+  const guardedGlobals = compatibilityDate !== undefined && compatibilityDate >= GUARDED_GLOBALS_DATE;
+  for (const [pattern, message] of alwaysForbidden) {
+    if (pattern === NODE_GLOBAL_USE && guardedGlobals ? !usesNodeGlobalUnguarded(source) : !pattern.test(source))
+      continue;
+    errors.push(message);
+  }
   if (
     /\bWebSocket\s*\(/.test(source) &&
     !(compatibilityDate !== undefined && compatibilityDate >= OUTBOUND_WEBSOCKET_DATE)