@sproutboat/runtime 0.42.1 → 0.43.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sproutboat/runtime
 
+## 0.43.0
+
+### Minor Changes
+
+- 201f8ff: runtime: with `SB_LOG=json` in its environment a binary writes structured records to stderr, one JSON line each (#268). A request writes `{"type":"request","v":1,"id","timestamp","method","path","status","durationMs","outcome"}` once its response is built, and every uncaught error (a handler, `scheduled()`, `queue()`, an alarm, a WebSocket handler, a rejected promise or a `waitUntil` task) writes `{"type":"error","v":1,"id","timestamp","source","name","message","stack"}` in place of the plain `Uncaught (in ...)` text. An error raised while answering a request carries that request's `id`; background work has `id: null`. Bodies, headers, the query string and the client address are never written, and the value of a declared secret that appears in a message or stack is replaced with `[redacted]`. Output is bounded: fields are cut to fixed lengths and at most 200 lines a second are written; the rest are counted and reported by a `{"type":"dropped","count"}` line when the next second starts. Without `SB_LOG=json` nothing changes, so no compatibility date applies.
+
+## 0.42.2
+
+### Patch Changes
+
+- 5ef3159: Security fix: on the embedded transport, a `connect()` socket opened with `secureTransport: "starttls"` could send application data in plaintext after `startTls()`. The I/O thread moved everything the app had queued, including writes issued after the upgrade call, into its write buffer and flushed it in the clear before switching the socket to TLS, so a write that raced the upgrade (about 7% of connections in a loopback test) left unencrypted. The host now records the queue position at the upgrade and only flushes the bytes queued before it in plaintext; everything after waits for the TLS engine, which only emits application data once the handshake is done. On the JS side, `startTls()` closes the plaintext socket's writable (its queued writes still go out, new writes are refused, as in workerd), and the new socket's writes are held until the upgrade is queued behind them. The I/O thread also reports a drained send queue right after flushing instead of after the next input, so a write past the high-water mark no longer waits on the peer. The broker tunnel, which already orders the upgrade among the data frames, no longer stays paused on the plain socket's drain when the upgrade happens under backpressure. Regression tests on both transports record the raw bytes at the origin and refuse anything but a TLS handshake record after the plaintext phase. No compatibility date: `connect()` ships from `2026-11-17`, and the old behaviour was never correct.
+
 ## 0.42.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.42.1",
+  "version": "0.43.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/native-fetch-prelude.js

@@ -11561,6 +11561,7 @@ function __sbMakeQueue(binding) {
 
 globalThis.__sbInstallBindings = function (target, bindings) {
   if (!target) return;
+  __sbLogSecretNames = bindings.secrets || [];
 
   __sbQueueSetup(bindings);
 
@@ -13992,7 +13993,7 @@ function __sbTrustedProxyHeader(request, name) {
 // own.
 const __SB_WAITUNTIL_TIMEOUT_MS = 25000;
 
-async function __sbDrainWaitUntil(tasks) {
+async function __sbDrainWaitUntil(tasks, logRec) {
   if (!tasks.length) return;
   const pending = tasks.splice(0, tasks.length);
   // Clear the cap's timer once the tasks finish: a pending timer kept the process
@@ -14001,16 +14002,17 @@ async function __sbDrainWaitUntil(tasks) {
   const cap = new Promise((resolve) => {
     timer = setTimeout(resolve, __SB_WAITUNTIL_TIMEOUT_MS);
   });
-  await Promise.race([__sbDrainAll(pending), cap]);
+  await Promise.race([__sbDrainAll(pending, logRec), cap]);
   clearTimeout(timer);
 }
 
-async function __sbDrainAll(pending) {
+async function __sbDrainAll(pending, logRec) {
   for (let i = 0; i < pending.length; i++) {
     try {
       await pending[i];
-    } catch {
-      /* a background task's rejection must not fail the response */
+    } catch (error) {
+      /* a background task's rejection must not fail the response; with SB_LOG=json it is recorded (#268) */
+      if (__sbLogJson()) __sbLogError("waitUntil", error, logRec);
     }
   }
 }
@@ -14704,8 +14706,18 @@ function __sbTcpRelease(st) {
   __sbTcpOpen--;
 }
 
-// One socket facade over a host connection. `st` is shared with the socket startTls() returns.
-function __sbTcpFacade(st, mode) {
+// Queues bytes for the host; a write past the high-water mark settles when the queue drains.
+function __sbTcpQueue(st, bytes) {
+  if (st.id === 0) throw new TypeError("This WritableStream has been closed.");
+  const queued = Number(__sbWsOp("b", st.id, __sbToBytes(bytes), 0));
+  if (queued > __SB_TCP_HWM) return new Promise((resolve) => (st.drain = resolve));
+  return undefined;
+}
+
+// One socket facade over a host connection. `st` is shared with the socket startTls() returns;
+// that socket gets `upgrade`, whose `pending` promise holds its writes back until the "S" op
+// is queued behind everything the plaintext socket had already accepted.
+function __sbTcpFacade(st, mode, upgrade) {
   const closed = new Promise((resolve, reject) => {
     st.closedResolve = resolve;
     st.closedReject = reject;
@@ -14759,12 +14771,15 @@ function __sbTcpFacade(st, mode) {
       },
       write(chunk) {
         const bytes = __sbTcpChunk(chunk);
-        if (st.id === 0) throw new TypeError("This WritableStream has been closed.");
-        const queued = Number(__sbWsOp("b", st.id, __sbToBytes(bytes), 0));
-        if (queued > __SB_TCP_HWM) return new Promise((resolve) => (st.drain = resolve));
-        return undefined;
+        if (upgrade !== null && upgrade.pending !== null) return upgrade.pending.then(() => __sbTcpQueue(st, bytes));
+        return __sbTcpQueue(st, bytes);
       },
       close() {
+        if (st.upgrading) {
+          // startTls() closed this stream: its queued writes are out, the write side stays open for TLS
+          st.upgrading = false;
+          return undefined;
+        }
         if (st.id !== 0) __sbWsOp("H", st.id, "", 0);
         st.writeClosed = true;
         return undefined;
@@ -14804,10 +14819,36 @@ function __sbTcpFacade(st, mode) {
       st.upgradedOnce = true;
       let sni = st.host;
       if (options != null && options.expectedServerHostname != null) sni = String(options.expectedServerHostname);
-      __sbWsOp("S", st.id, sni, 0);
+      // This socket's streams end here, as workerd detaches them. Its writable is closed first:
+      // what a writer had already queued still goes out in the clear, then the "S" op marks the
+      // queue position after which only TLS records leave the host; the new socket's writes wait
+      // on that (upgrade.pending), so no write issued after startTls() can precede the handshake.
+      const upgrade = { pending: null };
+      upgrade.pending = new Promise((resolve) => {
+        const request = () => {
+          st.upgrading = false;
+          if (st.id !== 0) __sbWsOp("S", st.id, sni, 0);
+          upgrade.pending = null;
+          resolve(undefined);
+        };
+        if (st.writeClosed) request();
+        else {
+          st.upgrading = true;
+          writable.close().then(request, request);
+        }
+      });
+      st.pullWake = null;
+      const oldReadable = st.readableController;
+      if (oldReadable !== null) {
+        try {
+          oldReadable.close();
+        } catch {
+          // already closed or errored
+        }
+      }
       // the old socket ends once the upgrade is under way (workerd resolves its `closed`)
       const oldResolve = st.closedResolve;
-      const next = __sbTcpFacade(st, "on");
+      const next = __sbTcpFacade(st, "on", upgrade);
       setTimeout(() => oldResolve(undefined), 0);
       return next;
     },
@@ -14832,11 +14873,11 @@ function __sbConnect(address, options) {
   const st = {
     id: 0, host: target.host, port: target.port, inbox: [], eof: false, failed: null, settled: false,
     allowHalfOpen, pullWake: null, drain: null, timer: undefined, opening: null, upgradedOnce: false,
-    closedByUser: false, writableController: null, readableController: null, reason: "", writeClosed: false, writeEnd: false,
+    closedByUser: false, writableController: null, readableController: null, reason: "", writeClosed: false, writeEnd: false, upgrading: false,
     release: null, closedResolve: null, closedReject: null,
   };
   st.release = () => __sbTcpRelease(st);
-  const socket = __sbTcpFacade(st, mode);
+  const socket = __sbTcpFacade(st, mode, null);
   if (target.port === 25) {
     st.failed = new Error("proxy request failed, cannot connect to the specified address");
     st.eof = true;
@@ -15293,8 +15334,9 @@ function __sbInstallWebSockets() {
   globalThis.WebSocketRequestResponsePair = __SbWebSocketRequestResponsePair;
 }
 
-async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell) {
+async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell, logRec) {
   let r;
+  let threw = 0;
   try {
     r = res && __sbIsFn(res.then) ? await res : res;
     if (top && __sbHasWebSocket(r)) r = __sbWsHostResponse(r);
@@ -15309,7 +15351,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
       throw error;
     }
     // #179 — a rejected handler promise must not take the process down with it.
-    r = __sbErrorResponse(error, bindingCall);
+    threw = 1;
+    r = __sbErrorResponse(error, bindingCall, logRec);
   }
   // From 2026-11-02 an async handler reports its CPU too: the thread time of the slices in which this
   // request ran, not its neighbours' (before it, only a handler that answered synchronously did).
@@ -15320,7 +15363,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
   // The response goes out now and ctx.waitUntil work keeps running after it, as in
   // workerd; it was awaited first, so a 1.5 s background task delayed the response by
   // 1.5 s. The 25 s cap still bounds it. Not called for no tasks: an async call is a coroutine and a promise.
-  if (tasks.length) __sbDrainWaitUntil(tasks);
+  if (logRec) __sbLogRequest(logRec, r, threw);
+  if (tasks.length) __sbDrainWaitUntil(tasks, logRec);
   return r;
 }
 
@@ -15328,8 +15372,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
 // propagate past __sbEntry and crash the whole server. Logged first, the way a
 // Worker logs "Uncaught Error: ...": a swallowed exception left a 500 with
 // nothing on stderr, which hid #168 entirely.
-function __sbErrorResponse(error, bindingCall) {
-  __sbLogUncaught("fetch", error);
+function __sbErrorResponse(error, bindingCall, logRec) {
+  __sbLogUncaught("fetch", error, logRec);
   // Untyped, as workerd sends it: the text/plain default is for handlers' bodies.
   const response = new Response("Internal Server Error", { status: 500 });
   response.headers.delete("content-type");
@@ -15399,7 +15443,11 @@ function __sbHeader(headers, name) {
   return count > 1 ? headers.get(name) : found;
 }
 
-function __sbLogUncaught(where, error) {
+function __sbLogUncaught(where, error, logRec) {
+  if (__sbLogJson()) {
+    __sbLogError(where, error, logRec);
+    return;
+  }
   try {
     let text = "";
     if (error && error.stack) text = String(error.stack);
@@ -15411,6 +15459,113 @@ function __sbLogUncaught(where, error) {
   }
 }
 
+// #268 — structured request and error records for a standalone binary. Off unless SB_LOG=json, so
+// nothing an app can observe changes and the per-request cost of "off" is one cached boolean. On, every
+// request writes one JSON line to stderr after its response is built, and every uncaught error (in a
+// handler, scheduled(), queue(), an alarm, a WebSocket handler, a rejected promise or a waitUntil task)
+// writes one more, in place of the plain "Uncaught (in ...)" text, so the stream stays parseable.
+//
+// What is never written: request or response bodies, headers (cookies and authorization among them), the
+// query string (it is where tokens end up), the client address, and the value of any declared secret (the
+// ones the message or stack happens to contain are replaced). Output is bounded: fields are cut to fixed
+// lengths and at most 200 lines a second go out; the rest are counted and reported by one "dropped" line
+// when the next second starts. A record's "id" ties a request line to the errors of the same request;
+// background work has id null.
+let __sbLogOn;
+let __sbLogSecretNames = [];
+let __sbLogSeq = 0;
+let __sbLogWindow = 0;
+let __sbLogCount = 0;
+let __sbLogDropped = 0;
+const __SB_LOG_PER_SECOND = 200;
+function __sbLogJson() {
+  if (__sbLogOn === undefined) __sbLogOn = __sbEnv("SB_LOG") === "json";
+  return __sbLogOn;
+}
+// Tests turn the records on without an environment, like __sbSetCompat.
+function __sbSetLog(on) {
+  __sbLogOn = on;
+}
+function __sbLogCut(text, max) {
+  const s = String(text);
+  return s.length > max ? s.slice(0, max) + "..." : s;
+}
+function __sbLogRedact(text) {
+  let out = text;
+  for (let i = 0; i < __sbLogSecretNames.length; i++) {
+    const raw = __sbEnv(__sbLogSecretNames[i]);
+    if (!raw || raw.length < 4) continue;
+    out = out.split(raw).join("[redacted]");
+    const decoded = __sbFromUtf8(raw);
+    if (decoded !== raw && decoded.length >= 4) out = out.split(decoded).join("[redacted]");
+  }
+  return out;
+}
+function __sbLogWrite(record) {
+  const now = Date.now();
+  const second = Math.floor(now / 1000);
+  if (second !== __sbLogWindow) {
+    if (__sbLogDropped > 0) {
+      console.error(JSON.stringify({ type: "dropped", v: 1, timestamp: now, count: __sbLogDropped, reason: "rate" }));
+      __sbLogDropped = 0;
+    }
+    __sbLogWindow = second;
+    __sbLogCount = 0;
+  }
+  if (__sbLogCount >= __SB_LOG_PER_SECOND) {
+    __sbLogDropped++;
+    return;
+  }
+  __sbLogCount++;
+  console.error(JSON.stringify(record));
+}
+function __sbLogBegin(request) {
+  __sbLogSeq++;
+  let path = "/";
+  try {
+    path = new URL(request.url).pathname;
+  } catch {
+    /* a request without a parseable URL is logged as "/" */
+  }
+  return { id: String(Math.floor(Date.now() / 1000)) + "-" + __sbLogSeq, t0: Date.now(), method: String(request.method), path: __sbLogCut(path, 256) };
+}
+function __sbLogRequest(rec, response, threw) {
+  try {
+    __sbLogWrite({
+      type: "request",
+      v: 1,
+      id: rec.id,
+      timestamp: rec.t0,
+      method: __sbLogCut(rec.method, 16),
+      path: rec.path,
+      status: response && response.status ? response.status : 0,
+      durationMs: Date.now() - rec.t0,
+      outcome: threw === 1 ? "exception" : "ok",
+    });
+  } catch {
+    /* logging must never turn a served request into a crash */
+  }
+}
+function __sbLogError(where, error, rec) {
+  try {
+    const name = error && error.name ? String(error.name) : "Error";
+    const message = error && error.message != null ? String(error.message) : String(error);
+    const record = {
+      type: "error",
+      v: 1,
+      id: rec ? rec.id : null,
+      timestamp: Date.now(),
+      source: __sbLogCut(where, 40),
+      name: __sbLogCut(name, 100),
+      message: __sbLogCut(__sbLogRedact(message), 1000),
+    };
+    if (error && error.stack) record.stack = __sbLogCut(__sbLogRedact(String(error.stack)), 2000);
+    __sbLogWrite(record);
+  } catch {
+    /* logging must never turn a handled error into a crash */
+  }
+}
+
 // A promise rejected and nothing was waiting on it (an un-awaited `db.prepare(...).run()`
 // that failed, say). As on Workers the request, the process and every other request go on:
 // the rejection is logged, and an "unhandledrejection" event fires on the global scope when
@@ -15746,6 +15901,8 @@ globalThis.__sbEntry = function (handlers, request) {
     // async handlers (see LogEvent in services/edge) — that is this.
     const __cpuCell = __sbCpuBegin();
     const __t0 = __cpuCell ? 0 : __sbCpuMs();
+    // #268 — one record per request when SB_LOG=json; null (and no work at all) otherwise.
+    const __logRec = __sbLogJson() ? __sbLogBegin(request) : null;
     const __sbTasks = [];
     const ctx = {
       waitUntil(p) {
@@ -15768,19 +15925,24 @@ globalThis.__sbEntry = function (handlers, request) {
       // #179 — a synchronous throw anywhere in the handler must not take the
       // whole process (and every other in-flight request) down with it.
       __sbCpuEnd(__cpuCell);
-      return __sbErrorResponse(error, bindingCall);
+      const __failed = __sbErrorResponse(error, bindingCall, __logRec);
+      if (__logRec) __sbLogRequest(__logRec, __failed, 1);
+      return __failed;
     }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
-    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true, __cpuCell);
+    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true, __cpuCell, __logRec);
     // A WebSocket handshake answer (from 2026-10-30): its client end becomes the host socket.
     if (__sbHasWebSocket(__res)) {
       __sbCpuEnd(__cpuCell);
-      return __sbWsHostResponse(__res);
+      const __ws = __sbWsHostResponse(__res);
+      if (__logRec) __sbLogRequest(__logRec, __ws, 0);
+      return __ws;
     }
     // The request ran alone from start to here: its own slices, or the process delta where no slot was free.
     const __cpu = __cpuCell ? __sbCpuTake(__cpuCell) : __sbCpuMs() - __t0;
     __sbCpuEnd(__cpuCell);
+    if (__logRec) __sbLogRequest(__logRec, __res, 0);
     return __sbTagCpu(__res, __cpu);
   }
   if (!__sbTriggerAuthed(request)) return new Response("forbidden", { status: 403 });

package/src/transport-embedded.js

@@ -3325,6 +3325,7 @@ typedef struct sb_wsc {
   int port, tls;
   // Raw TCP (cloudflare:sockets connect()): no WebSocket framing, bytes both ways.
   int raw, starttls_req, shutdown_req, want_drain;
+  size_t starttls_at;  // outq bytes queued before the "S" op: the last ones allowed out in the clear
   size_t unsent, window;
   char sni[256];
 } sb_wsc;
@@ -3458,10 +3459,13 @@ static int sb_wsio_raw_write(sb_wsio* io, const unsigned char* buf, size_t len)
 // connection ends (-1). out/outlen is application data to send first. With may_read false (the
 // reader is far behind) it only sends, and waits for the wake pipe.
 static long sb_wsio_pump(sb_wsc* c, sb_wsio* io, unsigned char* buf, size_t cap, unsigned char* out, size_t* outlen, int may_read, int ms) {
+  // Returns right after application bytes went out (0, as for a wake) instead of waiting for
+  // input: the caller reports the drain then, which a write past the high-water mark waits on.
   if (!io->tls) {
     if (*outlen) {
       if (sb_wsio_raw_write(io, out, *outlen) != 0) return -1;
       *outlen = 0;
+      return 0;
     }
     for (;;) {
       if (may_read) {
@@ -3478,6 +3482,7 @@ static long sb_wsio_pump(sb_wsc* c, sb_wsio* io, unsigned char* buf, size_t cap,
     }
   }
   br_ssl_engine_context* eng = &io->sc->eng;
+  int wrote = 0;
   for (;;) {
     unsigned st = br_ssl_engine_current_state(eng);
     if (st & BR_SSL_CLOSED) return -1;
@@ -3501,9 +3506,10 @@ static long sb_wsio_pump(sb_wsc* c, sb_wsio* io, unsigned char* buf, size_t cap,
       br_ssl_engine_sendapp_ack(eng, n);
       memmove(out, out + n, *outlen - n);
       *outlen -= n;
-      if (*outlen == 0) br_ssl_engine_flush(eng, 0);
+      if (*outlen == 0) { br_ssl_engine_flush(eng, 0); wrote = 1; }
       continue;
     }
+    if (wrote) return 0;
     // Handshaking, or waiting for the peer: read records while the reader may; else only wake.
     int reading = (st & BR_SSL_RECVREC) && (may_read || !(st & BR_SSL_SENDAPP));
     if (reading) {
@@ -3812,15 +3818,30 @@ static void* sb_tcp_thread(void* arg) {
     int st = c->starttls_req; c->starttls_req = 0;
     int sh = c->shutdown_req;
     char sni[256]; memcpy(sni, c->sni, sizeof(sni));
-    if (c->outq_len) {
-      if (wq_len + c->outq_len > wq_cap) {
+    // A pending startTls() splits the queue: only what the app queued before the "S" op may
+    // leave in the clear. The rest stays here until the TLS engine owns the socket, so a write
+    // that races the upgrade can only ever go out inside a TLS record.
+    size_t take = c->outq_len;
+    if (st && c->starttls_at < take) take = c->starttls_at;
+    if (take) {
+      if (wq_len + take > wq_cap) {
         size_t cap = wq_cap ? wq_cap : 4096;
-        while (cap < wq_len + c->outq_len) cap *= 2;
+        while (cap < wq_len + take) cap *= 2;
         unsigned char* grown = (unsigned char*)realloc(wq, cap);
         if (grown) { wq = grown; wq_cap = cap; }
       }
-      if (wq_len + c->outq_len <= wq_cap) { memcpy(wq + wq_len, c->outq, c->outq_len); wq_len += c->outq_len; c->outq_len = 0; }
+      if (wq_len + take <= wq_cap) {
+        memcpy(wq + wq_len, c->outq, take);
+        wq_len += take;
+        if (take < c->outq_len) memmove(c->outq, c->outq + take, c->outq_len - take);
+        c->outq_len -= take;
+      } else if (st) {
+        // no room to move the plaintext part: retry the upgrade on the next pass
+        c->starttls_req = 1;
+        st = 0;
+      }
     }
+    if (st) c->starttls_at = 0;
     c->unsent = wq_len;
     pthread_mutex_unlock(&c->lock);
     if (rel) {
@@ -3828,7 +3849,14 @@ static void* sb_tcp_thread(void* arg) {
       goto finish;
     }
     if (st && !io.tls) {
-      if (wq_len) sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0);
+      // Everything queued before startTls() is written in the clear here (the plain write path
+      // blocks until the kernel took it all); the socket then belongs to the TLS engine, which
+      // only emits application data once the handshake is done (BR_SSL_SENDAPP).
+      if (wq_len && sb_wsio_pump(c, &io, buf, sizeof(buf), wq, &wq_len, 0, 0) < 0) {
+        snprintf(why, sizeof(why), "connection closed before the TLS handshake");
+        sb_wsc_push(c, 3, 0, why, strlen(why));
+        goto finish;
+      }
       if (sb_wsio_start_tls(&io, sni[0] ? sni : c->host, why, sizeof(why)) != 0) { sb_wsc_push(c, 3, 0, why, strlen(why)); goto finish; }
       tls_waiting = 1;
     }
@@ -4023,6 +4051,7 @@ static long long sb_wsc_op(int op, unsigned id, const char* data, size_t len, si
       pthread_mutex_lock(&c->lock);
       snprintf(c->sni, sizeof(c->sni), "%.*s", (int)(len < sizeof(c->sni) - 1 ? len : sizeof(c->sni) - 1), data ? data : "");
       c->starttls_req = 1;
+      c->starttls_at = c->outq_len;
       pthread_mutex_unlock(&c->lock);
       sb_wsc_wake_thread(c);
       return 0;

package/test/native-base64.ts

@@ -1,14 +1,18 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
-const expected = Array.from({length:10}, (_,length) => {
-  const bytes=Uint8Array.from({length}, (_,i) => (i*71+251)%256);
-  const padded=Buffer.from(bytes).toString("base64");
-  return {padded,url:padded.replaceAll("+","-").replaceAll("/","_").replace(/=+$/, ""),decoded:Array.from(bytes)};
+const expected = Array.from({ length: 10 }, (_, length) => {
+  const bytes = Uint8Array.from({ length }, (_, i) => (i * 71 + 251) % 256);
+  const padded = Buffer.from(bytes).toString("base64");
+  return {
+    padded,
+    url: padded.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, ""),
+    decoded: Array.from(bytes),
+  };
 });
 const handler = `export default {fetch() {
   const rows=[];
@@ -37,14 +41,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-base64-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "base64.generated.js");
@@ -52,18 +49,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-bodies.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // Bodies on the wire and the Fetch classes, against Bun: byte bodies go out as their bytes
@@ -80,14 +80,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-bodies-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "bodies.generated.js");
@@ -95,18 +88,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude, undefined, undefined, undefined, "2026-10-21"));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -142,7 +124,9 @@ try {
   const form = await fetch(`http://127.0.0.1:${port}/form`);
   const boundary = (form.headers.get("content-type") || "").split("boundary=")[1];
   assert(boundary, "multipart content type");
-  const parsed = await new Response(await form.arrayBuffer(), { headers: { "content-type": `multipart/form-data; boundary=${boundary}` } }).formData();
+  const parsed = await new Response(await form.arrayBuffer(), {
+    headers: { "content-type": `multipart/form-data; boundary=${boundary}` },
+  }).formData();
   assert.equal(parsed.get("a"), "1");
   const file = parsed.get("f");
   assert(file instanceof File, "the file part parses back as a File");
@@ -153,11 +137,20 @@ try {
   const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/cases`)).text()) as string[];
   const want: string[] = [];
   // SAFETY: CASE_SOURCES is the handler's own literal list of case functions.
-  const reference = new Function(`return (() => { ${CASE_SOURCES} return cases; })()`)() as Array<() => Promise<string> | string>;
+  const reference = new Function(`return (() => { ${CASE_SOURCES} return cases; })()`)() as Array<
+    () => Promise<string> | string
+  >;
   for (const run of reference) {
-    try { want.push(String(await run())); } catch (e) { want.push("THROWS " + (e instanceof Error ? e.name : String(e))); }
+    try {
+      want.push(String(await run()));
+    } catch (e) {
+      want.push("THROWS " + (e instanceof Error ? e.name : String(e)));
+    }
   }
-  assert.deepEqual(got, want.map((w) => (w.startsWith("workerd:") ? "workerd:TypeError" : w)));
+  assert.deepEqual(
+    got,
+    want.map((w) => (w.startsWith("workerd:") ? "workerd:TypeError" : w)),
+  );
   console.log(`Native bodies are sent as bytes and ${want.length} Fetch class cases match Bun`);
 } finally {
   if (server) {

package/test/native-byte-text.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // sproutd #22: __sbFromUtf8 and __sbToBytes run in C (__sbFromUtf8Native, __sbToBytesNative).
@@ -92,28 +92,12 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-byte-text-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native byte-text test needs node on PATH");
   const broker = await readFile(transportPath("broker"), "utf8");
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "bytes.generated.js");
   const binary = join(workdir, "bytes-native");
   await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker)));
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   // Peak RSS: /proc's high-water mark on Linux, time(1) on macOS.