@sproutboat/runtime 0.41.0 → 0.42.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @sproutboat/runtime
 
+## 0.42.1
+
+### Patch Changes
+
+- dbba349: fetch() and connect() now also refuse reserved space that carries no public service: AS112 and the old IPv4 anycast blocks (`192.31.196.0/24`, `192.52.193.0/24`, `192.88.99.0/24`, `192.175.48.0/24`), SIIT (`::ffff:0:0:0/96`), IETF protocol assignments including Teredo (`2001::/23`), `3fff::/20` and SRv6 (`5f00::/16`). Applies to the broker, the egress service and the standalone client alike; `SB_EGRESS_ALLOW` still overrides.
+- cf519dd: Outbound TCP sockets now set `TCP_NODELAY`. Without it, Nagle's algorithm and the peer's delayed ACK stalled every fresh HTTPS `fetch()` by about 44 ms on Linux (each small TLS handshake flight waited for an ACK). This covers `fetch()`, outbound WebSockets and `connect()` from `cloudflare:sockets` on the embedded transport (standalone binaries, including sockets handed over by `SB_EGRESS_FD`), and the egress tunnel's connections to origins in `wire`. No compatibility date: only latency changes, no result, header or error does.
+
+## 0.42.0
+
+### Minor Changes
+
+- 2baeae9: `connect()` from `cloudflare:sockets`, from compatibility date 2026-11-17: plain TCP, `secureTransport: "on"` and `"starttls"` with `startTls()`, `readable`/`writable` byte streams with write backpressure, `opened`, `closed`, `close()`, half-close, workerd's error shapes, and port 25 refused. It runs on both transports: the embedded one (standalone and sproutd) opens the connection in a thread per socket and does TLS with BearSSL (extra roots through `SB_CA_BUNDLE`); the broker one tunnels through the broker, which vets every address with the `fetch()` policy (`SB_EGRESS_ALLOW`, private ranges refused), terminates TLS, and hands the tunnel to the egress service where the broker has no network. Limits: 16 sockets per app. From the same date `navigator.userAgent` is `"Cloudflare-Workers"` and a bundled `Buffer`/`process` is accepted, so unmodified `pg`, `postgres` and Redis clients run. The toolchain gains three Porffor fixes that those drivers hit: bindings named like libc macros, call arguments evaluated in order, and a writable `navigator`.
+
 ## 0.41.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.41.0",
+  "version": "0.42.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/egress.test.ts

@@ -2,13 +2,7 @@ import { expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {
-  blockedRange,
-  egressAllowList,
-  egressRefusal,
-  parseAddress,
-  spliceEgressTable,
-} from "./egress";
+import { blockedRange, egressAllowList, egressRefusal, parseAddress, spliceEgressTable } from "./egress";
 import { validateHttpSyncSource } from "./source";
 import { wrapNativeFetchHandler } from "./wrap";
 
@@ -41,6 +35,17 @@ const BLOCKED = [
   "fd12::1",
   "fe80::1",
   "ff02::1",
+  "192.31.196.1",
+  "192.52.193.1",
+  "192.88.99.1",
+  "192.175.48.1",
+  "::ffff:0:7f00:1",
+  "2001::1",
+  "2001:0:4136:e378:8000:63bf:3fff:fdd2",
+  "2001:1ff::1",
+  "3fff::1",
+  "3fff:fff:ffff::1",
+  "5f00::1",
 ];
 const PUBLIC = [
   "1.1.1.1",
@@ -54,23 +59,25 @@ const PUBLIC = [
   "2002:808:808::1",
   "2001:4860:4860::8888",
   "2606:4700::1111",
+  "192.31.195.255",
+  "192.88.100.1",
+  "2001:200::1",
+  "4000::1",
+  "3ffe::1",
+  "5f01::1",
 ];
 const ALLOW = "8.8.4.4, 10.9.9.9";
 
 test("private and reserved addresses are blocked, public ones are not", () => {
-  for (const address of BLOCKED)
-    expect([address, blockedRange(address)]).not.toEqual([address, null]);
-  for (const address of PUBLIC)
-    expect([address, blockedRange(address)]).toEqual([address, null]);
+  for (const address of BLOCKED) expect([address, blockedRange(address)]).not.toEqual([address, null]);
+  for (const address of PUBLIC) expect([address, blockedRange(address)]).toEqual([address, null]);
   expect(blockedRange("::ffff:127.0.0.1")).toBe("127.0.0.0/8");
   expect(blockedRange("64:ff9b::a00:1")).toBe("10.0.0.0/8");
 });
 
 test("the operator allow list lets an exact address or everything through", () => {
   expect(egressRefusal("db", "10.9.9.9", egressAllowList(ALLOW))).toBeNull();
-  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain(
-    "SB_EGRESS_ALLOW=10.9.9.8",
-  );
+  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain("SB_EGRESS_ALLOW=10.9.9.8");
   expect(egressRefusal("db", "127.0.0.1", ["*"])).toBeNull();
   expect(egressRefusal("x", "169.254.169.254", [])).toBe(
     "fetch() refused: x resolves to 169.254.169.254, a private or reserved address (169.254.0.0/16). An operator can allow it with SB_EGRESS_ALLOW=169.254.169.254",
@@ -78,15 +85,7 @@ test("the operator allow list lets an exact address or everything through", () =
 });
 
 test("parseAddress rejects what is not an address", () => {
-  for (const bad of [
-    "",
-    "1.2.3",
-    "256.1.1.1",
-    "example.com",
-    "1::2::3",
-    "1:2:3:4:5:6:7:8:9",
-    "12345::",
-  ])
+  for (const bad of ["", "1.2.3", "256.1.1.1", "example.com", "1::2::3", "1:2:3:4:5:6:7:8:9", "12345::"])
     expect([bad, parseAddress(bad)]).toEqual([bad, null]);
 });
 
@@ -99,10 +98,7 @@ test("the C table in transport-embedded.js is generated from this one (bun run g
 
 test("the C check gives the same answer and message as the TS one", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// EGRESS:BEGIN"),
-    source.indexOf("// EGRESS:END"),
-  );
+  const block = source.slice(source.indexOf("// EGRESS:BEGIN"), source.indexOf("// EGRESS:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-egress-"));
   try {
     writeFileSync(
@@ -130,23 +126,14 @@ int main(int argc, char** argv) {
 }
 `,
     );
-    const cc = Bun.spawnSync([
-      "cc",
-      "-Wall",
-      "-Werror",
-      "-o",
-      join(dir, "check"),
-      join(dir, "check.c"),
-    ]);
+    const cc = Bun.spawnSync(["cc", "-Wall", "-Werror", "-o", join(dir, "check"), join(dir, "check.c")]);
     expect(cc.stderr.toString()).toBe("");
     const addresses = [...BLOCKED, ...PUBLIC, "10.9.9.9"];
     const run = Bun.spawnSync([join(dir, "check"), ...addresses], {
       env: { ...process.env, SB_EGRESS_ALLOW: ALLOW },
     });
     const fromC = run.stdout.toString().trimEnd().split("\n");
-    const fromTs = addresses.map(
-      (a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok",
-    );
+    const fromTs = addresses.map((a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok");
     expect(fromC).toEqual(fromTs);
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -156,21 +143,13 @@ int main(int argc, char** argv) {
 test("#174: fetch() needs no config, so every sprout gets it", () => {
   const handler = `export default { async fetch() { return await fetch("https://api.example.com/"); } };`;
   expect(validateHttpSyncSource(handler)).toEqual({ ok: true });
-  const prelude = readFileSync(
-    new URL("./native-fetch-prelude.js", import.meta.url),
-    "utf8",
-  );
-  expect(wrapNativeFetchHandler(handler, prelude)).toContain(
-    "__sbInstallFetch();",
-  );
+  const prelude = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+  expect(wrapNativeFetchHandler(handler, prelude)).toContain("__sbInstallFetch();");
 });
 
 test("SB_EGRESS_FD: the host connects, the sprout gets the socket", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// EGRESS-FD:BEGIN"),
-    source.indexOf("// EGRESS-FD:END"),
-  );
+  const block = source.slice(source.indexOf("// EGRESS-FD:BEGIN"), source.indexOf("// EGRESS-FD:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-egress-fd-"));
   try {
     // A fake host on one end of a socketpair: "up" gets a socket whose peer says
@@ -184,6 +163,8 @@ test("SB_EGRESS_FD: the host connects, the sprout gets the socket", () => {
 #include <string.h>
 #include <unistd.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <sys/time.h>
 #include <sys/wait.h>
 ${block}
@@ -261,18 +242,76 @@ int main(void) {
   }
 });
 
+test("sb_tcp_connect sets TCP_NODELAY on the socket it returns", () => {
+  // Nagle plus the peer's delayed ACK stalled every fresh HTTPS fetch about 44 ms on Linux (a TLS
+  // handshake writes small flights). Timing is flaky on CI and loopback on macOS does not show
+  // it, so ask the kernel: connect to a local listener and read the option back.
+  const source = readFileSync(transportFile, "utf8");
+  const between = (from: string, to: string) => source.slice(source.indexOf(from), source.indexOf(to));
+  const dir = mkdtempSync(join(tmpdir(), "sb-nodelay-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <errno.h>
+#include <pthread.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <arpa/inet.h>
+${between("// EGRESS:BEGIN", "// EGRESS:END")}
+${between("// EGRESS-FD:BEGIN", "// EGRESS-FD:END")}
+${between("// TCP-CONNECT:BEGIN", "// TCP-CONNECT:END")}
+int main(void) {
+  int listener = socket(AF_INET, SOCK_STREAM, 0);
+  struct sockaddr_in addr;
+  memset(&addr, 0, sizeof(addr));
+  addr.sin_family = AF_INET;
+  addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  if (bind(listener, (struct sockaddr*)&addr, sizeof(addr)) || listen(listener, 1)) return 2;
+  socklen_t len = sizeof(addr);
+  getsockname(listener, (struct sockaddr*)&addr, &len);
+  char refused[512] = "";
+  int fd = sb_tcp_connect("127.0.0.1", ntohs(addr.sin_port), refused, sizeof(refused));
+  int value = -1;
+  socklen_t vlen = sizeof(value);
+  if (fd >= 0) getsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &value, &vlen);
+  printf("fd %s nodelay %s\\n", fd >= 0 ? "yes" : "no", value > 0 ? "on" : "off");
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-Wno-unused-function",
+      "-Wno-unused-result",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const run = Bun.spawnSync([join(dir, "check")], {
+      env: { ...process.env, SB_EGRESS_ALLOW: "127.0.0.1", SB_EGRESS_FD: "" },
+    });
+    expect(run.stdout.toString().trim()).toBe("fd yes nodelay on");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("the Host header carries a non-default port", () => {
   const source = readFileSync(transportFile, "utf8");
-  const between = (from: string, to: string) =>
-    source.slice(source.indexOf(from), source.indexOf(to));
-  const buffer = between(
-    "typedef struct { char* p; size_t len; size_t cap; } sb_buf;",
-    "static void sb_putjson(",
-  );
-  const builder = between(
-    "// body_len, not strlen(body)",
-    "// Turn a whole raw response",
-  );
+  const between = (from: string, to: string) => source.slice(source.indexOf(from), source.indexOf(to));
+  const buffer = between("typedef struct { char* p; size_t len; size_t cap; } sb_buf;", "static void sb_putjson(");
+  const builder = between("// body_len, not strlen(body)", "// Turn a whole raw response");
   const dir = mkdtempSync(join(tmpdir(), "sb-host-"));
   try {
     writeFileSync(
@@ -318,10 +357,7 @@ int main(void) { show(80, 80); show(8080, 80); show(443, 443); show(8443, 443);
 
 test("async fetch: requests run on threads and come back through the host", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// ASYNC:BEGIN"),
-    source.indexOf("// ASYNC:END"),
-  );
+  const block = source.slice(source.indexOf("// ASYNC:BEGIN"), source.indexOf("// ASYNC:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-async-"));
   try {
     // Stand-ins: a client that takes 200 ms, and a host that records which timers fire.
@@ -385,13 +421,8 @@ int main(void) {
       .trimEnd()
       .split("\n");
     // 16 requests of 200 ms on 8 threads: two rounds, not sixteen.
-    expect(lines.slice(0, 16).sort()).toEqual(
-      Array.from({ length: 16 }, (_, i) => `${i + 1} h/${i + 1} body`).sort(),
-    );
-    expect(lines.slice(16)).toEqual([
-      "elapsed overlapped",
-      "outside a callback nothing",
-    ]);
+    expect(lines.slice(0, 16).sort()).toEqual(Array.from({ length: 16 }, (_, i) => `${i + 1} h/${i + 1} body`).sort());
+    expect(lines.slice(16)).toEqual(["elapsed overlapped", "outside a callback nothing"]);
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

package/src/egress.ts

@@ -41,6 +41,18 @@ export const BLOCKED_RANGES = [
   "fe80::/10",
   "fec0::/10",
   "ff00::/8",
+  // Reserved space that carries no public service: AS112 and the IETF's old anycast
+  // blocks, SIIT (`::ffff:0:0:0/96`, which embeds an IPv4 address the mapped rule
+  // above does not see), IETF protocol assignments (includes Teredo, `2001::/32`),
+  // the second documentation block and SRv6 SIDs.
+  "192.31.196.0/24",
+  "192.52.193.0/24",
+  "192.88.99.0/24",
+  "192.175.48.0/24",
+  "::ffff:0:0:0/96",
+  "2001::/23",
+  "3fff::/20",
+  "5f00::/16",
 ] as const;
 
 /** Parse an IPv4 or IPv6 literal to its bytes; `null` when it is neither. */
@@ -123,11 +135,7 @@ export function egressAllowList(raw: string | undefined): string[] {
 
 /** Why `fetch()` may not connect to `address`, or `null` when it may. The
  *  message is identical in the C client; keep the two in step. */
-export function egressRefusal(
-  host: string,
-  address: string,
-  allow: readonly string[],
-): string | null {
+export function egressRefusal(host: string, address: string, allow: readonly string[]): string | null {
   if (allow.includes("*") || allow.includes(address)) return null;
   const range = blockedRange(address);
   if (range === null) return null;
@@ -149,8 +157,5 @@ const TABLE_BEGIN = /( *\/\/ EGRESS-TABLE:BEGIN[^\n]*\n)[\s\S]*?( *\/\/ EGRESS-T
 /** `source` with the generated table between its EGRESS-TABLE markers replaced. */
 export function spliceEgressTable(source: string): string {
   if (!TABLE_BEGIN.test(source)) throw new Error("EGRESS-TABLE markers not found");
-  return source.replace(
-    TABLE_BEGIN,
-    (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`,
-  );
+  return source.replace(TABLE_BEGIN, (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`);
 }

package/src/native-fetch-prelude.js

@@ -11,6 +11,8 @@ function __sbEnvValue() {
 // Setters, not bare assignments in the tail: the template and every app must compile the prelude identically.
 function __sbSetCompat(date) {
   __sbCompatNow = date;
+  // navigator.userAgent as workerd has it: pg picks its Workers socket code on exactly this string.
+  if (date >= "2026-11-17") navigator.userAgent = "Cloudflare-Workers";
   Request._cd = date;
   if (date >= "2026-11-15" && Error.captureStackTrace === undefined) Error.captureStackTrace = __sbCaptureStackTrace;
 }
@@ -14162,7 +14164,7 @@ function __sbWsOp(op, id, data, n) {
     const unsigned int __id = id.type == 1 && id.val > 0 ? (unsigned int)id.val : 0;
     const size_t __n = n.type == 1 && n.val > 0 ? (size_t)n.val : 0;
     char __r[64]; __r[0] = 0;
-    if (__op == 'u' || __op == 'W' || (__id & 0x80000000u)) {
+    if (__op == 'u' || __op == 'T' || __op == 'W' || (__id & 0x80000000u)) {
       long long __w = -1;
       if (!sb_wsc_hook) snprintf(__r, sizeof(__r), "0");
       else if (__op == 'W') snprintf(__r, sizeof(__r), "%d", sb_wsc_wakeable_hook && sb_wsc_wakeable_hook() ? 1 : 0);
@@ -14181,7 +14183,7 @@ function __sbWsOp(op, id, data, n) {
         const char* __d = 0; size_t __dl = 0;
         if (porf_native_fetch_read_raw_bytes(data, &__d, &__dl) == 0) __w = sb_wsc_hook('b', __id, __d, __dl, 0, 0, 0);
         snprintf(__r, sizeof(__r), "%lld", __w);
-      } else if (__op == 't' || __op == 'c' || __op == 'u') {
+      } else if (__op == 't' || __op == 'c' || __op == 'u' || __op == 'T' || __op == 'S') {
         const char* __d; size_t __dl; char* __do = 0;
         porf_native_fetch_read_value(data, &__d, &__dl, &__do);
         __w = sb_wsc_hook(__op, __id, __d, __dl, __n, 0, 0);
@@ -14573,6 +14575,289 @@ function __sbWsPump(ws) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// cloudflare:sockets connect(), from compatibility date 2026-11-17. A socket is a host
+// socket in the outbound WebSocket table (sb_wsc, raw mode); this end speaks the __sbWsOp ops:
+// "T" open (host, port, secureTransport mode, server name), "b" queue bytes (returns how many
+// are still unsent), "S" start TLS, "H" shut the write side, "p" "i" take an event, "k" ack,
+// "w" park a timer, "r" release. Events: 1 data, 3 error, 4 connected, 6 end of input,
+// 8 send queue drained, 9 TLS handshake done.
+const __SB_SOCKETS_DATE = "2026-11-17";
+const __SB_TCP_HWM = 262144;
+let __sbTcpOpen = 0;
+
+function __sbTcpBadInt() {
+  return new TypeError("The value cannot be converted because it is not an integer.");
+}
+function __sbTcpTarget(address) {
+  let host;
+  let port;
+  if (__sbIsStr(address)) {
+    let rest = address;
+    let cut;
+    if (rest.charAt(0) === "[") {
+      const close = rest.indexOf("]");
+      cut = close >= 0 && rest.charAt(close + 1) === ":" ? close + 1 : -1;
+    } else cut = rest.lastIndexOf(":");
+    if (cut < 0) {
+      if (rest === "") throw new TypeError("Specified address is missing hostname.");
+      throw new TypeError("Specified address is missing port.");
+    }
+    host = rest.slice(0, cut);
+    port = rest.slice(cut + 1);
+  } else if (address != null && __sbIsObj(address)) {
+    host = address.hostname;
+    port = address.port;
+    if (host === undefined || host === "") throw new TypeError("Specified address is missing hostname.");
+    if (port === undefined) throw new TypeError("Specified address is missing port.");
+  } else throw new TypeError("connect() takes an address string or { hostname, port }.");
+  const n = Number(port);
+  if (!(Number.isInteger(n)) || String(port).trim() === "") throw __sbTcpBadInt();
+  if (n < 0 || n > 65535) throw new RangeError("Port out of range.");
+  return { host: String(host), port: n };
+}
+
+function __sbTcpChunk(chunk) {
+  if (__sbIsStr(chunk)) return new TextEncoder().encode(chunk);
+  if (chunk instanceof ArrayBuffer) return new Uint8Array(chunk);
+  if (ArrayBuffer.isView(chunk)) return new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+  throw new TypeError("This TransformStream is being used as a byte stream, but received an object of non-ArrayBuffer/ArrayBufferView type on its writable side.");
+}
+
+// Takes every event the host has, then parks a timer (or polls, where nothing can wake the loop).
+function __sbTcpPump(st) {
+  if (st.id === 0) return;
+  for (;;) {
+    const head = __sbWsOp("p", st.id, "", 0);
+    if (head === "") {
+      if (st.id === 0) return;
+      if (__sbWsCanWake()) {
+        st.timer = setTimeout(() => __sbTcpPump(st), 2147483647);
+        __sbWsOp("w", st.id, "", st.timer);
+      } else st.timer = setTimeout(() => __sbTcpPump(st), 10);
+      return;
+    }
+    const parts = head.split(" ");
+    const kind = Number(parts[0]);
+    const length = Number(parts[1]);
+    const bytes = new Uint8Array(length);
+    if (length > 0) __sbWsOp("i", st.id, bytes, 0);
+    else __sbWsOp("i", st.id, new Uint8Array(0), 0);
+    if (kind === 1) {
+      st.inbox.push(bytes);
+    } else if (kind === 4 || kind === 9) {
+      if (st.opening) {
+        const o = st.opening;
+        st.opening = null;
+        o.resolve({ remoteAddress: st.host + ":" + st.port, localAddress: null });
+      }
+    } else if (kind === 6) {
+      st.eof = true;
+      if (!st.allowHalfOpen) st.writeEnd = true;
+    } else if (kind === 8) {
+      const d = st.drain;
+      st.drain = null;
+      if (d) d();
+    } else if (kind === 3) {
+      // workerd words every connect failure the same; the host's reason stays on st.reason
+      st.reason = new TextDecoder().decode(bytes);
+      st.failed = new Error("proxy request failed, cannot connect to the specified address");
+      st.eof = true;
+    }
+    __sbTcpSettle(st);
+    if (st.id === 0) return;
+  }
+}
+
+// Applies state changes to the streams and promises.
+function __sbTcpSettle(st) {
+  if (st.opening && st.failed) {
+    const o = st.opening;
+    st.opening = null;
+    o.reject(st.failed);
+  }
+  const wake = st.pullWake;
+  if (wake && (st.inbox.length > 0 || st.eof)) {
+    st.pullWake = null;
+    wake();
+  }
+  if (st.eof && st.inbox.length === 0 && !st.settled) {
+    if (st.failed) {
+      st.settled = true;
+      st.closedReject(st.failed);
+      st.release();
+    } else if (!st.allowHalfOpen) {
+      st.settled = true;
+      st.closedResolve(undefined);
+      if (st.writableController) st.writableController.error(new TypeError("This WritableStream has been closed."));
+      st.release();
+    }
+  }
+}
+
+function __sbTcpRelease(st) {
+  const id = st.id;
+  if (id === 0) return;
+  st.id = 0;
+  if (st.timer !== undefined) clearTimeout(st.timer);
+  __sbWsOp("r", id, "", 0);
+  __sbTcpOpen--;
+}
+
+// One socket facade over a host connection. `st` is shared with the socket startTls() returns.
+function __sbTcpFacade(st, mode) {
+  const closed = new Promise((resolve, reject) => {
+    st.closedResolve = resolve;
+    st.closedReject = reject;
+  });
+  // A rejected `closed` nobody awaits must not surface as an unhandled rejection.
+  closed.catch(() => {});
+  const opened = new Promise((resolve, reject) => {
+    st.opening = { resolve, reject };
+  });
+  opened.catch(() => {});
+  const readable = new ReadableStream(
+    {
+      start(controller) {
+        st.readableController = controller;
+      },
+      pull(controller) {
+        if (st.inbox.length > 0) {
+          const chunk = st.inbox.shift();
+          controller.enqueue(chunk);
+          if (st.id !== 0) __sbWsOp("k", st.id, "", chunk.length);
+          return undefined;
+        }
+        if (st.eof) {
+          if (st.failed && !st.closedByUser) {
+            // a failed connect reads as an empty stream, as in workerd
+          }
+          controller.close();
+          return undefined;
+        }
+        return new Promise((resolve) => {
+          st.pullWake = () => {
+            if (st.inbox.length > 0) {
+              const chunk = st.inbox.shift();
+              controller.enqueue(chunk);
+              if (st.id !== 0) __sbWsOp("k", st.id, "", chunk.length);
+            } else controller.close();
+            resolve();
+          };
+        });
+      },
+      cancel() {
+        return undefined;
+      },
+    },
+    { highWaterMark: 0 },
+  );
+  const writable = new WritableStream(
+    {
+      start(controller) {
+        st.writableController = controller;
+      },
+      write(chunk) {
+        const bytes = __sbTcpChunk(chunk);
+        if (st.id === 0) throw new TypeError("This WritableStream has been closed.");
+        const queued = Number(__sbWsOp("b", st.id, __sbToBytes(bytes), 0));
+        if (queued > __SB_TCP_HWM) return new Promise((resolve) => (st.drain = resolve));
+        return undefined;
+      },
+      close() {
+        if (st.id !== 0) __sbWsOp("H", st.id, "", 0);
+        st.writeClosed = true;
+        return undefined;
+      },
+      abort() {
+        return undefined;
+      },
+    },
+    { highWaterMark: 1 },
+  );
+  const socket = {
+    readable,
+    writable,
+    opened,
+    closed,
+    upgraded: false,
+    secureTransport: mode,
+    close() {
+      st.closedByUser = true;
+      if (st.writableController) st.writableController.error(new TypeError("This WritableStream belongs to an object that is closing."));
+      const wake = st.pullWake;
+      st.pullWake = null;
+      if (!st.settled) {
+        st.settled = true;
+        st.closedResolve(undefined);
+      }
+      st.inbox.length = 0;
+      st.eof = true;
+      if (wake && st.readableController) st.readableController.error(new TypeError("This socket has been closed."));
+      __sbTcpRelease(st);
+      return Promise.resolve();
+    },
+    startTls(options) {
+      if (mode !== "starttls" || st.upgradedOnce)
+        throw new TypeError(st.upgradedOnce ? "The connection was closed before startTls could be started." : "The `secureTransport` socket option must be set to 'starttls' for startTls to be used.");
+      if (readable.locked || writable.locked) throw new TypeError("Cannot startTls while the streams are locked.");
+      st.upgradedOnce = true;
+      let sni = st.host;
+      if (options != null && options.expectedServerHostname != null) sni = String(options.expectedServerHostname);
+      __sbWsOp("S", st.id, sni, 0);
+      // the old socket ends once the upgrade is under way (workerd resolves its `closed`)
+      const oldResolve = st.closedResolve;
+      const next = __sbTcpFacade(st, "on");
+      setTimeout(() => oldResolve(undefined), 0);
+      return next;
+    },
+  };
+  return socket;
+}
+
+function __sbConnect(address, options) {
+  if (__sbCompatDate() < __SB_SOCKETS_DATE)
+    throw new Error("connect() needs compatibility_date " + __SB_SOCKETS_DATE + " or later");
+  const target = __sbTcpTarget(address);
+  let mode = "off";
+  let allowHalfOpen = false;
+  if (options != null) {
+    if (options.secureTransport !== undefined) {
+      mode = String(options.secureTransport);
+      if (mode !== "off" && mode !== "on" && mode !== "starttls")
+        throw new TypeError("Unsupported secureTransport value: " + mode);
+    }
+    allowHalfOpen = options.allowHalfOpen === true;
+  }
+  const st = {
+    id: 0, host: target.host, port: target.port, inbox: [], eof: false, failed: null, settled: false,
+    allowHalfOpen, pullWake: null, drain: null, timer: undefined, opening: null, upgradedOnce: false,
+    closedByUser: false, writableController: null, readableController: null, reason: "", writeClosed: false, writeEnd: false,
+    release: null, closedResolve: null, closedReject: null,
+  };
+  st.release = () => __sbTcpRelease(st);
+  const socket = __sbTcpFacade(st, mode);
+  if (target.port === 25) {
+    st.failed = new Error("proxy request failed, cannot connect to the specified address");
+    st.eof = true;
+    setTimeout(() => __sbTcpSettle(st), 0);
+    return socket;
+  }
+  const spec = target.host + "\n" + target.port + "\n" + (mode === "on" ? "1" : mode === "starttls" ? "2" : "0") + "\n" + target.host;
+  const id = __sbTcpOpen >= 16 ? 0 : Number(__sbWsOp("T", 0, spec, 0));
+  if (!(id > 0)) {
+    st.failed = new Error(__sbTcpOpen >= 16 ? "Too many open connections" : "TCP sockets are not available on this host");
+    st.eof = true;
+    setTimeout(() => __sbTcpSettle(st), 0);
+    return socket;
+  }
+  st.id = id;
+  __sbTcpOpen++;
+  __sbTcpPump(st);
+  return socket;
+}
+globalThis.__sbSockets = { connect: __sbConnect };
+
 // ---------------------------------------------------------------------------
 // Outbound WebSockets, from compatibility date 2026-11-01: new WebSocket(url, protocols) and
 // fetch(url, { headers: { Upgrade: "websocket" } }), whose Response carries the connected