@sproutboat/runtime 0.41.0 → 0.42.1

package/src/transport-embedded.js

@@ -20,6 +20,8 @@ Porffor.c`
 #include <stdint.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <netdb.h>
 #include <arpa/inet.h>
 #include <string.h>
@@ -2594,6 +2596,14 @@ static const char* sb_egress_blocked(const unsigned char* a, int len) {
     { 16, 10, { 254, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fe80::/10" },
     { 16, 10, { 254, 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fec0::/10" },
     { 16, 8, { 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "ff00::/8" },
+    { 4, 24, { 192, 31, 196, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.31.196.0/24" },
+    { 4, 24, { 192, 52, 193, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.52.193.0/24" },
+    { 4, 24, { 192, 88, 99, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.88.99.0/24" },
+    { 4, 24, { 192, 175, 48, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.175.48.0/24" },
+    { 16, 96, { 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 0, 0, 0, 0, 0, 0 }, "::ffff:0:0:0/96" },
+    { 16, 23, { 32, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "2001::/23" },
+    { 16, 20, { 63, 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "3fff::/20" },
+    { 16, 16, { 95, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "5f00::/16" },
   };
   // EGRESS-TABLE:END
   static const unsigned char mapped[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };
@@ -2653,6 +2663,14 @@ static int sb_egress_refused(const char* host, const struct sockaddr* sa, char*
 // EGRESS:END
 
 // EGRESS-FD:BEGIN
+// TCP_NODELAY on an outbound socket. Without it Nagle holds a small write until the peer ACKs the
+// last one, and the peer delays that ACK: about 44 ms per TLS handshake flight on Linux. A unix
+// socket (an fd handed over by sproutd) refuses the option, which is fine: only TCP needs it.
+static void sb_tcp_nodelay(int fd) {
+  int one = 1;
+  setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+}
+
 // SB_EGRESS_FD=N: a sandboxed host (sproutd) opens outbound connections for the
 // sprout, which may not open sockets itself. Ask on unix socket N with
 // "HOST PORT\n"; the host resolves, applies its policy and answers "ok\n" with the
@@ -2699,6 +2717,7 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
   if (!strcmp(answer, "ok") && fd >= 0) {
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+    sb_tcp_nodelay(fd);
     return fd;
   }
   if (fd >= 0) close(fd);
@@ -2707,6 +2726,7 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
 }
 // EGRESS-FD:END
 
+// TCP-CONNECT:BEGIN
 // refused gets the first refusal; a caller reports it when nothing connected.
 static int sb_tcp_connect(const char* host, int port, char* refused, size_t refused_len) {
   const char* via = getenv("SB_EGRESS_FD");
@@ -2739,13 +2759,14 @@ static int sb_tcp_connect(const char* host, int port, char* refused, size_t refu
     struct timeval tv; tv.tv_sec = 30; tv.tv_usec = 0;
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
-    if (connect(fd, it->ai_addr, it->ai_addrlen) == 0) break;
+    if (connect(fd, it->ai_addr, it->ai_addrlen) == 0) { sb_tcp_nodelay(fd); break; }
     close(fd);
     fd = -1;
   }
   freeaddrinfo(res);
   return fd;
 }
+// TCP-CONNECT:END
 
 // body_len, not strlen(body): a binary body can contain NUL bytes (#232).
 // Host carries the port unless it is the scheme's default (RFC 9110 7.2).
@@ -3302,6 +3323,10 @@ typedef struct sb_wsc {
   uint64_t rng;
   char *host, *path, *headers, *protocols;
   int port, tls;
+  // Raw TCP (cloudflare:sockets connect()): no WebSocket framing, bytes both ways.
+  int raw, starttls_req, shutdown_req, want_drain;
+  size_t unsent, window;
+  char sni[256];
 } sb_wsc;
 static pthread_mutex_t sb_wsc_lock = PTHREAD_MUTEX_INITIALIZER;
 static sb_wsc* sb_wscs = 0;
@@ -3496,6 +3521,7 @@ static long sb_wsio_pump(sb_wsc* c, sb_wsio* io, unsigned char* buf, size_t cap,
   }
 }
 
+static int sb_wsio_start_tls(sb_wsio* io, const char* host, char* why, size_t whylen);
 static int sb_wsio_open(sb_wsio* io, const char* host, int port, int tls, char* why, size_t whylen) {
   memset(io, 0, sizeof(*io));
   io->fd = sb_tcp_connect(host, port, why, whylen);
@@ -3506,6 +3532,11 @@ static int sb_wsio_open(sb_wsio* io, const char* host, int port, int tls, char*
   fcntl(io->fd, F_SETFL, fcntl(io->fd, F_GETFL) | O_NONBLOCK);
   io->tls = tls;
   if (!tls) return 0;
+  return sb_wsio_start_tls(io, host, why, whylen);
+}
+// Starts TLS on an open fd (connect with secureTransport "on", or startTls()).
+static int sb_wsio_start_tls(sb_wsio* io, const char* host, char* why, size_t whylen) {
+  io->tls = 1;
   io->sc = (br_ssl_client_context*)malloc(sizeof(br_ssl_client_context));
   io->xc = (br_x509_minimal_context*)malloc(sizeof(br_x509_minimal_context));
   io->iobuf = (unsigned char*)malloc(BR_SSL_BUFSIZE_BIDI);
@@ -3759,6 +3790,91 @@ finish:
   return 0;
 }
 
+// Raw TCP: the thread for connect(). Events: 1 data, 3 error (reason in data), 4 connected (plain),
+// 6 end of input, 8 send queue drained (after a write left more than the high-water mark queued),
+// 9 TLS handshake finished.
+#define SB_TCP_READ_WINDOW (256u << 10)
+static void* sb_tcp_thread(void* arg) {
+  sb_wsc* c = (sb_wsc*)arg;
+  sb_wsio io;
+  memset(&io, 0, sizeof(io));
+  io.fd = -1;
+  char why[512] = "";
+  unsigned char buf[16384];
+  unsigned char* wq = 0; size_t wq_len = 0, wq_cap = 0;
+  int tls_waiting = 0, eof = 0, shut = 0;
+  if (sb_wsio_open(&io, c->host, c->port, c->tls, why, sizeof(why)) != 0) { sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+  if (c->tls) tls_waiting = 1; else sb_wsc_push(c, 4, 0, "", 0);
+  for (;;) {
+    pthread_mutex_lock(&c->lock);
+    int rel = c->released;
+    size_t window = c->unacked;
+    int st = c->starttls_req; c->starttls_req = 0;
+    int sh = c->shutdown_req;
+    char sni[256]; memcpy(sni, c->sni, sizeof(sni));
+    if (c->outq_len) {
+      if (wq_len + c->outq_len > wq_cap) {
+        size_t cap = wq_cap ? wq_cap : 4096;
+        while (cap < wq_len + c->outq_len) cap *= 2;
+        unsigned char* grown = (unsigned char*)realloc(wq, cap);
+        if (grown) { wq = grown; wq_cap = cap; }
+      }
+      if (wq_len + c->outq_len <= wq_cap) { memcpy(wq + wq_len, c->outq, c->outq_len); wq_len += c->outq_len; c->outq_len = 0; }
+    }
+    c->unsent = wq_len;
+    pthread_mutex_unlock(&c->lock);
+    if (rel) {
+      if (wq_len) sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0);
+      goto finish;
+    }
+    if (st && !io.tls) {
+      if (wq_len) sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0);
+      if (sb_wsio_start_tls(&io, sni[0] ? sni : c->host, why, sizeof(why)) != 0) { sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      tls_waiting = 1;
+    }
+    long n = sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, !eof && window < SB_TCP_READ_WINDOW, tls_waiting ? 20 : -1);
+    if (tls_waiting && io.tls && (br_ssl_engine_current_state(&io.sc->eng) & (BR_SSL_SENDAPP | BR_SSL_RECVAPP))) {
+      tls_waiting = 0;
+      sb_wsc_push(c, 9, 0, "", 0);
+    }
+    if (n == -2) continue;
+    if (n < 0) {
+      int err = io.tls ? br_ssl_engine_last_error(&io.sc->eng) : 0;
+      if (err != 0 && err != BR_ERR_IO) { snprintf(why, sizeof(why), "TLS error %d", err); sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      if (tls_waiting) { snprintf(why, sizeof(why), "connection closed during the TLS handshake"); sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
+      if (!eof) { eof = 1; sb_wsc_push(c, 6, 0, "", 0); }
+      // keep serving writes until released; with no reader the pump just waits for the wake pipe
+      n = 0;
+    }
+    if (n == 0) sb_wsc_drain_wake(c);
+    else sb_wsc_push(c, 1, 0, (const char*)buf, (size_t)n);
+    if (sh && wq_len == 0 && !shut) {
+      shut = 1;
+      if (io.tls) br_ssl_engine_close(&io.sc->eng); else shutdown(io.fd, SHUT_WR);
+    }
+    int drained = 0;
+    pthread_mutex_lock(&c->lock);
+    c->unsent = wq_len;
+    if (c->want_drain && c->outq_len + wq_len == 0) { c->want_drain = 0; drained = 1; }
+    pthread_mutex_unlock(&c->lock);
+    if (drained) sb_wsc_push(c, 8, 0, "", 0);
+  }
+finish:
+  sb_wsio_close(&io);
+  free(wq);
+  pthread_mutex_lock(&c->lock);
+  c->finished = 1;
+  int rel2 = c->released;
+  pthread_mutex_unlock(&c->lock);
+  if (rel2) {
+    pthread_mutex_lock(&sb_wsc_lock);
+    for (sb_wsc** at = &sb_wscs; *at; at = &(*at)->next) if (*at == c) { *at = c->next; break; }
+    pthread_mutex_unlock(&sb_wsc_lock);
+    sb_wsc_free(c);
+  }
+  return 0;
+}
+
 static sb_wsc* sb_wsc_find(unsigned id) {
   pthread_mutex_lock(&sb_wsc_lock);
   sb_wsc* c = sb_wscs;
@@ -3787,6 +3903,52 @@ static void sb_wsc_drain(void) {
 
 // The JS side's ops. data is borrowed for the call.
 static long long sb_wsc_op(int op, unsigned id, const char* data, size_t len, size_t n, char* out, size_t cap) {
+  if (op == 'T') {
+    // data: host \n port \n mode (0 off, 1 on, 2 starttls) \n servername
+    sb_wsc* c = (sb_wsc*)calloc(1, sizeof(sb_wsc));
+    if (!c) return 0;
+    char* copy = (char*)malloc(len + 1);
+    if (!copy) { free(c); return 0; }
+    memcpy(copy, data, len); copy[len] = 0;
+    char* parts[4]; char* cur = copy;
+    for (int i = 0; i < 4; i++) {
+      parts[i] = cur;
+      char* nl = strchr(cur, '\n');
+      if (nl) { *nl = 0; cur = nl + 1; } else cur += strlen(cur);
+    }
+    c->raw = 1; c->window = SB_TCP_READ_WINDOW;
+    c->host = strdup(parts[0]); c->port = atoi(parts[1]); c->tls = atoi(parts[2]) == 1;
+    snprintf(c->sni, sizeof(c->sni), "%s", parts[3]);
+    c->path = strdup(""); c->protocols = strdup(""); c->headers = strdup("");
+    free(copy);
+    if (!c->host || !c->path || !c->protocols || !c->headers || pipe(c->wake) != 0) { free(c->host); free(c->path); free(c->protocols); free(c->headers); free(c); return 0; }
+    for (int k = 0; k < 2; k++) { fcntl(c->wake[k], F_SETFD, FD_CLOEXEC); fcntl(c->wake[k], F_SETFL, fcntl(c->wake[k], F_GETFL) | O_NONBLOCK); }
+    pthread_mutex_init(&c->lock, 0);
+    pthread_mutex_lock(&sb_wsc_lock);
+    int live = 0;
+    for (sb_wsc* k = sb_wscs; k; k = k->next) live++;
+    if (live >= SB_WSC_MAX) { pthread_mutex_unlock(&sb_wsc_lock); sb_wsc_free(c); return 0; }
+    sb_wsc_next = (sb_wsc_next + 1) & 0x7fffffffu;
+    if (!sb_wsc_next) sb_wsc_next = 1;
+    c->id = sb_wsc_next | SB_WSC_BIT;
+    c->next = sb_wscs; sb_wscs = c;
+    pthread_mutex_unlock(&sb_wsc_lock);
+    pthread_attr_t attr;
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    pthread_attr_setstacksize(&attr, 512 * 1024);
+    pthread_t thread;
+    int failed = pthread_create(&thread, &attr, sb_tcp_thread, c);
+    pthread_attr_destroy(&attr);
+    if (failed) {
+      pthread_mutex_lock(&sb_wsc_lock);
+      for (sb_wsc** at = &sb_wscs; *at; at = &(*at)->next) if (*at == c) { *at = c->next; break; }
+      pthread_mutex_unlock(&sb_wsc_lock);
+      sb_wsc_free(c);
+      return 0;
+    }
+    return (long long)c->id;
+  }
   if (op == 'u') {
     // data: host \n port \n tls(0|1) \n path \n protocols \n header lines (to the end)
     sb_wsc* c = (sb_wsc*)calloc(1, sizeof(sb_wsc));
@@ -3836,7 +3998,40 @@ static long long sb_wsc_op(int op, unsigned id, const char* data, size_t len, si
   sb_wsc* c = sb_wsc_find(id);
   if (!c) return op == 'p' || op == 'k' || op == 'w' || op == 'r' ? 0 : -1;
   switch (op) {
-    case 't': case 'b': return sb_wsc_frame(c, op == 't' ? 1 : 2, data, len, 0, 0);
+    case 'b': if (c->raw) {
+      // raw bytes: queue them, say how many are still unsent, and ask for a drain event past the mark
+      pthread_mutex_lock(&c->lock);
+      size_t need = c->outq_len + len;
+      if (need > c->outq_cap) {
+        size_t cap = c->outq_cap ? c->outq_cap : 4096;
+        while (cap < need) cap *= 2;
+        unsigned char* grown = (unsigned char*)realloc(c->outq, cap);
+        if (!grown) { pthread_mutex_unlock(&c->lock); return -1; }
+        c->outq = grown; c->outq_cap = cap;
+      }
+      memcpy(c->outq + c->outq_len, data, len);
+      c->outq_len += len;
+      size_t queued = c->outq_len + c->unsent;
+      if (queued > (256u << 10)) c->want_drain = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return (long long)queued;
+    }
+    /* fall through */
+    case 't': return sb_wsc_frame(c, op == 't' ? 1 : 2, data, len, 0, 0);
+    case 'S':
+      pthread_mutex_lock(&c->lock);
+      snprintf(c->sni, sizeof(c->sni), "%.*s", (int)(len < sizeof(c->sni) - 1 ? len : sizeof(c->sni) - 1), data ? data : "");
+      c->starttls_req = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return 0;
+    case 'H':
+      pthread_mutex_lock(&c->lock);
+      c->shutdown_req = 1;
+      pthread_mutex_unlock(&c->lock);
+      sb_wsc_wake_thread(c);
+      return 0;
     case 'c': {
       pthread_mutex_lock(&c->lock);
       int already = c->close_queued;

package/src/wrap.ts

@@ -137,6 +137,20 @@ function hasBindings(b: Bindings): boolean {
  * leaves the specifier external for this.
  */
 export function inlineWorkersImports(source: string): string {
+  // `cloudflare:sockets` (compatibility date 2026-11-17): connect() lives on a prelude global.
+  // postgres/cf loads it lazily: `await import("cloudflare:sockets")`.
+  source = source.replace(/\bimport\(\s*["']cloudflare:sockets["']\s*\)/g, "Promise.resolve(globalThis.__sbSockets)");
+  source = source.replace(
+    /^import\s*\{([^}]*)\}\s*from\s*["']cloudflare:sockets["'];?[ \t]*$/gm,
+    (_match, names: string) => {
+      const pairs = names
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => part.replace(/^(\S+)\s+as\s+(\S+)$/, "$1: $2"));
+      return `const { ${pairs.join(", ")} } = globalThis.__sbSockets;`;
+    },
+  );
   return source.replace(
     /^import\s*\{([^}]*)\}\s*from\s*["']cloudflare:workers["'];?[ \t]*$/gm,
     (_match, names: string) => {

package/test/bearssl.ts

@@ -1,16 +1,14 @@
-import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { BEARSSL_SHA256, BEARSSL_URLS, BEARSSL_VENDORED_PATH, BEARSSL_VERSION } from "../../toolchain/src/deps";
+import { fetchPinned } from "../../toolchain/src/fetch-pinned";
 
 // The prelude carries crypto.subtle's native half on every transport, so a test that compiles a
 // handler using crypto.subtle needs BearSSL on the include path and link line, as the CLI arranges
 // for a build. Same pinned source as the CLI's src/bearssl.ts; built once into the toolchain cache.
-const COMMIT = "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f";
-const VERSION = COMMIT.slice(0, 7);
-const URL_ = `https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=${COMMIT};sf=tgz`;
-const SHA256 = "ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372";
+const VERSION = BEARSSL_VERSION;
 
 const walk = async (dir: string): Promise<string[]> =>
   (
@@ -34,10 +32,14 @@ export async function bearsslEnv(): Promise<{ SB_EXTRA_CFLAGS: string; SB_EXTRA_
   const marker = join(objects, ".complete");
   if (!existsSync(marker)) {
     await mkdir(root, { recursive: true });
-    const response = await fetch(URL_);
-    if (!response.ok) throw new Error(`could not download ${URL_}: HTTP ${response.status}`);
-    const bytes = Buffer.from(await response.arrayBuffer());
-    if (createHash("sha256").update(bytes).digest("hex") !== SHA256) throw new Error("BearSSL checksum mismatch");
+    // Vendored tarball first (vendor/bearssl), then bearssl.org with bounded retry; both sha256-pinned: see
+    // toolchain/src/deps.ts. A downloaded copy is cached so a later run needs no network.
+    const bytes = await fetchPinned({
+      localPath: BEARSSL_VENDORED_PATH,
+      urls: BEARSSL_URLS,
+      sha256: BEARSSL_SHA256,
+      cachePath: join(dirname(root), "deps", `bearssl-src-${BEARSSL_SHA256}.tar.gz`),
+    });
     await writeFile(join(root, "bearssl.tar.gz"), bytes);
     await rm(tree, { recursive: true, force: true });
     const untar = Bun.spawnSync(["tar", "xzf", join(root, "bearssl.tar.gz"), "-C", root]);