@sproutboat/runtime 0.40.0 → 0.42.0

package/src/transport-embedded.js

@@ -3302,6 +3302,10 @@ typedef struct sb_wsc {
   uint64_t rng;
   char *host, *path, *headers, *protocols;
   int port, tls;
+  // Raw TCP (cloudflare:sockets connect()): no WebSocket framing, bytes both ways.
+  int raw, starttls_req, shutdown_req, want_drain;
+  size_t unsent, window;
+  char sni[256];
 } sb_wsc;
 static pthread_mutex_t sb_wsc_lock = PTHREAD_MUTEX_INITIALIZER;
 static sb_wsc* sb_wscs = 0;
@@ -3496,6 +3500,7 @@ static long sb_wsio_pump(sb_wsc* c, sb_wsio* io, unsigned char* buf, size_t cap,
   }
 }
 
+static int sb_wsio_start_tls(sb_wsio* io, const char* host, char* why, size_t whylen);
 static int sb_wsio_open(sb_wsio* io, const char* host, int port, int tls, char* why, size_t whylen) {
   memset(io, 0, sizeof(*io));
   io->fd = sb_tcp_connect(host, port, why, whylen);
@@ -3506,6 +3511,11 @@ static int sb_wsio_open(sb_wsio* io, const char* host, int port, int tls, char*
   fcntl(io->fd, F_SETFL, fcntl(io->fd, F_GETFL) | O_NONBLOCK);
   io->tls = tls;
   if (!tls) return 0;
+  return sb_wsio_start_tls(io, host, why, whylen);
+}
+// Starts TLS on an open fd (connect with secureTransport "on", or startTls()).
+static int sb_wsio_start_tls(sb_wsio* io, const char* host, char* why, size_t whylen) {
+  io->tls = 1;
   io->sc = (br_ssl_client_context*)malloc(sizeof(br_ssl_client_context));
   io->xc = (br_x509_minimal_context*)malloc(sizeof(br_x509_minimal_context));
   io->iobuf = (unsigned char*)malloc(BR_SSL_BUFSIZE_BIDI);
@@ -3759,6 +3769,91 @@ finish:
   return 0;
 }
 
+// Raw TCP: the thread for connect(). Events: 1 data, 3 error (reason in data), 4 connected (plain),
+// 6 end of input, 8 send queue drained (after a write left more than the high-water mark queued),
+// 9 TLS handshake finished.
+#define SB_TCP_READ_WINDOW (256u << 10)
+static void* sb_tcp_thread(void* arg) {
+  sb_wsc* c = (sb_wsc*)arg;
+  sb_wsio io;
+  memset(&io, 0, sizeof(io));
+  io.fd = -1;
+  char why[512] = "";
+  unsigned char buf[16384];
+  unsigned char* wq = 0; size_t wq_len = 0, wq_cap = 0;
+  int tls_waiting = 0, eof = 0, shut = 0;
+  if (sb_wsio_open(&io, c->host, c->port, c->tls, why, sizeof(why)) != 0) { sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+  if (c->tls) tls_waiting = 1; else sb_wsc_push(c, 4, 0, "", 0);
+  for (;;) {
+    pthread_mutex_lock(&c->lock);
+    int rel = c->released;
+    size_t window = c->unacked;
+    int st = c->starttls_req; c->starttls_req = 0;
+    int sh = c->shutdown_req;
+    char sni[256]; memcpy(sni, c->sni, sizeof(sni));
+    if (c->outq_len) {
+      if (wq_len + c->outq_len > wq_cap) {
+        size_t cap = wq_cap ? wq_cap : 4096;
+        while (cap < wq_len + c->outq_len) cap *= 2;
+        unsigned char* grown = (unsigned char*)realloc(wq, cap);
+        if (grown) { wq = grown; wq_cap = cap; }
+      }
+      if (wq_len + c->outq_len <= wq_cap) { memcpy(wq + wq_len, c->outq, c->outq_len); wq_len += c->outq_len; c->outq_len = 0; }
+    }
+    c->unsent = wq_len;
+    pthread_mutex_unlock(&c->lock);
+    if (rel) {
+      if (wq_len) sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0);
+      goto finish;
+    }
+    if (st && !io.tls) {
+      if (wq_len) sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0);
+      if (sb_wsio_start_tls(&io, sni[0] ? sni : c->host, why, sizeof(why)) != 0) { sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      tls_waiting = 1;
+    }
+    long n = sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, !eof && window < SB_TCP_READ_WINDOW, tls_waiting ? 20 : -1);
+    if (tls_waiting && io.tls && (br_ssl_engine_current_state(&io.sc->eng) & (BR_SSL_SENDAPP | BR_SSL_RECVAPP))) {
+      tls_waiting = 0;
+      sb_wsc_push(c, 9, 0, "", 0);
+    }
+    if (n == -2) continue;
+    if (n < 0) {
+      int err = io.tls ? br_ssl_engine_last_error(&io.sc->eng) : 0;
+      if (err != 0 && err != BR_ERR_IO) { snprintf(why, sizeof(why), "TLS error %d", err); sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      if (tls_waiting) { snprintf(why, sizeof(why), "connection closed during the TLS handshake"); sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      if (!eof) { eof = 1; sb_wsc_push(c, 6, 0, "", 0); }
+      // keep serving writes until released; with no reader the pump just waits for the wake pipe
+      n = 0;
+    }
+    if (n == 0) sb_wsc_drain_wake(c);
+    else sb_wsc_push(c, 1, 0, (const char*)buf, (size_t)n);
+    if (sh && wq_len == 0 && !shut) {
+      shut = 1;
+      if (io.tls) br_ssl_engine_close(&io.sc->eng); else shutdown(io.fd, SHUT_WR);
+    }
+    int drained = 0;
+    pthread_mutex_lock(&c->lock);
+    c->unsent = wq_len;
+    if (c->want_drain && c->outq_len + wq_len == 0) { c->want_drain = 0; drained = 1; }
+    pthread_mutex_unlock(&c->lock);
+    if (drained) sb_wsc_push(c, 8, 0, "", 0);
+  }
+finish:
+  sb_wsio_close(&io);
+  free(wq);
+  pthread_mutex_lock(&c->lock);
+  c->finished = 1;
+  int rel2 = c->released;
+  pthread_mutex_unlock(&c->lock);
+  if (rel2) {
+    pthread_mutex_lock(&sb_wsc_lock);
+    for (sb_wsc** at = &sb_wscs; *at; at = &(*at)->next) if (*at == c) { *at = c->next; break; }
+    pthread_mutex_unlock(&sb_wsc_lock);
+    sb_wsc_free(c);
+  }
+  return 0;
+}
+
 static sb_wsc* sb_wsc_find(unsigned id) {
   pthread_mutex_lock(&sb_wsc_lock);
   sb_wsc* c = sb_wscs;
@@ -3787,6 +3882,52 @@ static void sb_wsc_drain(void) {
 
 // The JS side's ops. data is borrowed for the call.
 static long long sb_wsc_op(int op, unsigned id, const char* data, size_t len, size_t n, char* out, size_t cap) {
+  if (op == 'T') {
+    // data: host \n port \n mode (0 off, 1 on, 2 starttls) \n servername
+    sb_wsc* c = (sb_wsc*)calloc(1, sizeof(sb_wsc));
+    if (!c) return 0;
+    char* copy = (char*)malloc(len + 1);
+    if (!copy) { free(c); return 0; }
+    memcpy(copy, data, len); copy[len] = 0;
+    char* parts[4]; char* cur = copy;
+    for (int i = 0; i < 4; i++) {
+      parts[i] = cur;
+      char* nl = strchr(cur, '\n');
+      if (nl) { *nl = 0; cur = nl + 1; } else cur += strlen(cur);
+    }
+    c->raw = 1; c->window = SB_TCP_READ_WINDOW;
+    c->host = strdup(parts[0]); c->port = atoi(parts[1]); c->tls = atoi(parts[2]) == 1;
+    snprintf(c->sni, sizeof(c->sni), "%s", parts[3]);
+    c->path = strdup(""); c->protocols = strdup(""); c->headers = strdup("");
+    free(copy);
+    if (!c->host || !c->path || !c->protocols || !c->headers || pipe(c->wake) != 0) { free(c->host); free(c->path); free(c->protocols); free(c->headers); free(c); return 0; }
+    for (int k = 0; k < 2; k++) { fcntl(c->wake[k], F_SETFD, FD_CLOEXEC); fcntl(c->wake[k], F_SETFL, fcntl(c->wake[k], F_GETFL) | O_NONBLOCK); }
+    pthread_mutex_init(&c->lock, 0);
+    pthread_mutex_lock(&sb_wsc_lock);
+    int live = 0;
+    for (sb_wsc* k = sb_wscs; k; k = k->next) live++;
+    if (live >= SB_WSC_MAX) { pthread_mutex_unlock(&sb_wsc_lock); sb_wsc_free(c); return 0; }
+    sb_wsc_next = (sb_wsc_next + 1) & 0x7fffffffu;
+    if (!sb_wsc_next) sb_wsc_next = 1;
+    c->id = sb_wsc_next | SB_WSC_BIT;
+    c->next = sb_wscs; sb_wscs = c;
+    pthread_mutex_unlock(&sb_wsc_lock);
+    pthread_attr_t attr;
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    pthread_attr_setstacksize(&attr, 512 * 1024);
+    pthread_t thread;
+    int failed = pthread_create(&thread, &attr, sb_tcp_thread, c);
+    pthread_attr_destroy(&attr);
+    if (failed) {
+      pthread_mutex_lock(&sb_wsc_lock);
+      for (sb_wsc** at = &sb_wscs; *at; at = &(*at)->next) if (*at == c) { *at = c->next; break; }
+      pthread_mutex_unlock(&sb_wsc_lock);
+      sb_wsc_free(c);
+      return 0;
+    }
+    return (long long)c->id;
+  }
   if (op == 'u') {
     // data: host \n port \n tls(0|1) \n path \n protocols \n header lines (to the end)
     sb_wsc* c = (sb_wsc*)calloc(1, sizeof(sb_wsc));
@@ -3836,7 +3977,40 @@ static long long sb_wsc_op(int op, unsigned id, const char* data, size_t len, si
   sb_wsc* c = sb_wsc_find(id);
   if (!c) return op == 'p' || op == 'k' || op == 'w' || op == 'r' ? 0 : -1;
   switch (op) {
-    case 't': case 'b': return sb_wsc_frame(c, op == 't' ? 1 : 2, data, len, 0, 0);
+    case 'b': if (c->raw) {
+      // raw bytes: queue them, say how many are still unsent, and ask for a drain event past the mark
+      pthread_mutex_lock(&c->lock);
+      size_t need = c->outq_len + len;
+      if (need > c->outq_cap) {
+        size_t cap = c->outq_cap ? c->outq_cap : 4096;
+        while (cap < need) cap *= 2;
+        unsigned char* grown = (unsigned char*)realloc(c->outq, cap);
+        if (!grown) { pthread_mutex_unlock(&c->lock); return -1; }
+        c->outq = grown; c->outq_cap = cap;
+      }
+      memcpy(c->outq + c->outq_len, data, len);
+      c->outq_len += len;
+      size_t queued = c->outq_len + c->unsent;
+      if (queued > (256u << 10)) c->want_drain = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return (long long)queued;
+    }
+    /* fall through */
+    case 't': return sb_wsc_frame(c, op == 't' ? 1 : 2, data, len, 0, 0);
+    case 'S':
+      pthread_mutex_lock(&c->lock);
+      snprintf(c->sni, sizeof(c->sni), "%.*s", (int)(len < sizeof(c->sni) - 1 ? len : sizeof(c->sni) - 1), data ? data : "");
+      c->starttls_req = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return 0;
+    case 'H':
+      pthread_mutex_lock(&c->lock);
+      c->shutdown_req = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return 0;
     case 'c': {
       pthread_mutex_lock(&c->lock);
       int already = c->close_queued;
@@ -4962,8 +5136,13 @@ function __sbEmbeddedDispatch(msg) {
   if (op === "secret.get") {
     // Secrets reach a standalone binary through the environment, the same
     // channel the launcher and the supervisor use; there is nothing to decrypt.
-    const value = __sbEnv(String(msg.name));
-    if (!value) throw new Error("secret not set: " + msg.name);
+    const raw = __sbEnv(String(msg.name));
+    if (!raw) throw new Error("secret not set: " + msg.name);
+    // __sbEnv hands back the environment's bytes as a bytestring, one char per byte, so a UTF-8 secret ("é" is
+    // C3 A9) reached the app as "é". From compatibility date 2026-11-07 it is decoded as UTF-8, as workerd's
+    // secrets are text. Bytes that are not valid UTF-8 pass through unchanged (__sbFromUtf8's rule). The broker
+    // transport is not touched: its secrets arrive as JSON, already real strings.
+    const value = __sbCompatDate() >= "2026-11-07" ? __sbFromUtf8(raw) : raw;
     return { ok: true, value };
   }
 

package/src/wrap.ts

@@ -137,6 +137,20 @@ function hasBindings(b: Bindings): boolean {
  * leaves the specifier external for this.
  */
 export function inlineWorkersImports(source: string): string {
+  // `cloudflare:sockets` (compatibility date 2026-11-17): connect() lives on a prelude global.
+  // postgres/cf loads it lazily: `await import("cloudflare:sockets")`.
+  source = source.replace(/\bimport\(\s*["']cloudflare:sockets["']\s*\)/g, "Promise.resolve(globalThis.__sbSockets)");
+  source = source.replace(
+    /^import\s*\{([^}]*)\}\s*from\s*["']cloudflare:sockets["'];?[ \t]*$/gm,
+    (_match, names: string) => {
+      const pairs = names
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => part.replace(/^(\S+)\s+as\s+(\S+)$/, "$1: $2"));
+      return `const { ${pairs.join(", ")} } = globalThis.__sbSockets;`;
+    },
+  );
   return source.replace(
     /^import\s*\{([^}]*)\}\s*from\s*["']cloudflare:workers["'];?[ \t]*$/gm,
     (_match, names: string) => {

package/test/bearssl.ts

@@ -7,9 +7,10 @@ import { join, resolve } from "node:path";
 // The prelude carries crypto.subtle's native half on every transport, so a test that compiles a
 // handler using crypto.subtle needs BearSSL on the include path and link line, as the CLI arranges
 // for a build. Same pinned source as the CLI's src/bearssl.ts; built once into the toolchain cache.
-const VERSION = "0.6";
-const URL_ = `https://bearssl.org/bearssl-${VERSION}.tar.gz`;
-const SHA256 = "6705bba1714961b41a728dfc5debbe348d2966c117649392f8c8139efc83ff14";
+const COMMIT = "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f";
+const VERSION = COMMIT.slice(0, 7);
+const URL_ = `https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=${COMMIT};sf=tgz`;
+const SHA256 = "ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372";
 
 const walk = async (dir: string): Promise<string[]> =>
   (
@@ -28,7 +29,7 @@ export async function bearsslEnv(): Promise<{ SB_EXTRA_CFLAGS: string; SB_EXTRA_
     process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? join(homedir(), ".cache/sproutboat"),
     `bearssl-${VERSION}-test`,
   );
-  const tree = join(root, `bearssl-${VERSION}`);
+  const tree = join(root, `BearSSL-${VERSION}`);
   const objects = join(root, "obj");
   const marker = join(objects, ".complete");
   if (!existsSync(marker)) {