@sproutboat/runtime 0.42.1 → 0.43.0

package/test/native-http.ts

@@ -3,8 +3,8 @@ import { createHash } from "node:crypto";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { connect } from "node:net";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // The native HTTP server's wire behaviour with raw sockets: keep-alive, pipelining (responses in
@@ -188,6 +188,13 @@ async function suite(port: number, label: string) {
     assert.equal(got[0].body.toString(), "n=close");
   }
 
+  // #236: an HTTP/1.0 request line (nginx's default proxy_http_version) is answered, not refused with 505.
+  {
+    const got = await exchange(port, [Buffer.from("GET /n/old HTTP/1.0\r\nHost: t\r\n\r\n")], 1);
+    assert.equal(got[0].status, 200, `${label}: HTTP/1.0 request status`);
+    assert.equal(got[0].body.toString(), "n=old", `${label}: HTTP/1.0 request body`);
+  }
+
   // 150 connections at once, 4 pipelined requests each, with garbage-heavy requests mixed in.
   {
     const results = await Promise.all(
@@ -210,9 +217,6 @@ async function suite(port: number, label: string) {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-http-"));
 const servers: Array<ReturnType<typeof Bun.spawn>> = [];
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native http test needs node on PATH");
   const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "http.generated.js");
@@ -228,21 +232,7 @@ try {
       "2026-10-21",
     ),
   );
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   for (const every of ["1", "8"]) {
     const port = freePort();

package/test/native-iterators.ts

@@ -1,16 +1,31 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 const expected = {
-  query: [["a", "1"], ["a", "2"], ["b", "3"]],
-  keys: ["a", "a", "b"], values: ["1", "2", "3"],
-  live: ["x", "y", true], form: [["x", "1"], ["x", "2"]],
-  formLive: ["x", "y", true], self: true,
-  headers: [["a", "1"], ["b", "2"]], headersMap: 2, headersFromEntries: { a: "1", b: "2" },
+  query: [
+    ["a", "1"],
+    ["a", "2"],
+    ["b", "3"],
+  ],
+  keys: ["a", "a", "b"],
+  values: ["1", "2", "3"],
+  live: ["x", "y", true],
+  form: [
+    ["x", "1"],
+    ["x", "2"],
+  ],
+  formLive: ["x", "y", true],
+  self: true,
+  headers: [
+    ["a", "1"],
+    ["b", "2"],
+  ],
+  headersMap: 2,
+  headersFromEntries: { a: "1", b: "2" },
 };
 const handler = `export default { fetch(request) {
   if (new URL(request.url).pathname === "/null") return new Response(null);
@@ -47,14 +62,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-iterators-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor({ cacheRoot: workdir });
-  const node = Bun.which("node");
-  if (!node) throw new Error("native iterators test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "iterators.generated.js");
@@ -62,18 +70,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-json-strings.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // JSON.stringify of strings as the spec defines it (Bun is the reference): quotes and backslash,
@@ -61,10 +61,6 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-json-strings-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
   const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
@@ -73,21 +69,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-json.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // JSON.stringify as the spec defines it (Bun is the reference): toJSON on Date, URL and
@@ -46,14 +46,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-json-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "json.generated.js");
@@ -61,18 +54,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -95,9 +77,17 @@ try {
   // SAFETY: the handler above is the only producer of this body: a JSON array with one
   // string per case; the comparison below reports any entry that differs.
   const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
-  const diffs = CASES.flatMap((c, i) => (got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`]));
-  assert.deepEqual(diffs, [], `JSON.stringify differs from the spec in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`);
-  console.log(`Native JSON.stringify honours toJSON in all ${CASES.length} cases: Date, URL, user objects, nested, undefined`);
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `JSON.stringify differs from the spec in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
+  console.log(
+    `Native JSON.stringify honours toJSON in all ${CASES.length} cases: Date, URL, user objects, nested, undefined`,
+  );
 } finally {
   if (server) {
     server.kill(9);

package/test/native-jwt.ts

@@ -2,9 +2,8 @@ import assert from "node:assert/strict";
 import { createHmac } from "node:crypto";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
-import { bearsslEnv } from "./bearssl";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // The pieces of a JWT check (base64url decode, TextEncoder, HMAC verify) against values that do
@@ -276,10 +275,6 @@ assert.equal(
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-jwt-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native jwt test needs node on PATH");
-
   const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
@@ -287,21 +282,7 @@ try {
   const binary = join(workdir, "jwt-native");
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
 
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      env: { ...process.env, ...(await bearsslEnv()) },
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, bearssl: true });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-model-resolver.ts

@@ -1,11 +1,11 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
-const expected = {a: "user", b: "account", again: "user", plural: "user", custom: "user"};
+const expected = { a: "user", b: "account", again: "user", plural: "user", custom: "user" };
 const handler = `
 const makeResolver = ({usePlural, schema}) => {
   return (model) => {
@@ -31,7 +31,6 @@ export default {fetch() {
     custom:makeResolver({schema:{user:{modelName:"members"}},usePlural:false})("members")});
 }};`;
 
-
 function freePort(): number {
   const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
   const port = listener.port;
@@ -42,14 +41,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-model-resolver-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "model-resolver.generated.js");
@@ -57,18 +49,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-raw-body.ts

@@ -1,14 +1,9 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
-import {
-  preludePath,
-  TRANSPORT_MARKER,
-  transportPath,
-  wrapNativeFetchHandler,
-} from "../src/wrap";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // fetch() hands a response's bytes back as a raw body (x-sb-raw-body, #176), and
 // they can arrive as a UTF-16 string holding one byte per unit: JSON.parse of the
@@ -33,52 +28,15 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-raw-body-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
-  assert(
-    core.includes(TRANSPORT_MARKER),
-    "runtime prelude is missing its transport marker",
-  );
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "raw.generated.js");
   const binary = join(workdir, "raw-native");
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn(
-    [
-      node,
-      resolve(porffor, "runtime/index.js"),
-      "native",
-      generated,
-      "-o",
-      binary,
-      "-s",
-      "-O0",
-    ],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(
-    exitCode,
-    0,
-    `Porffor native compile failed:\n${stderr}\n${stdout}`,
-  );
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -103,11 +61,7 @@ try {
   const response = await fetch(`http://127.0.0.1:${port}/`);
   const got = [...new Uint8Array(await response.arrayBuffer())];
   assert.deepEqual(got, want, "raw body bytes");
-  assert.equal(
-    response.headers.get("x-sb-raw-body"),
-    null,
-    "the marker never reaches the client",
-  );
+  assert.equal(response.headers.get("x-sb-raw-body"), null, "the marker never reaches the client");
   console.log("A raw UTF-16 body is sent as its bytes");
 } finally {
   if (server) {

package/test/native-request-log.ts

@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
+import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+import { isSafeInteger, isString, jsonObject, parseJsonValue, type JsonObject } from "../../wire/src/json";
+
+// #268 — SB_LOG=json makes a standalone binary write one JSON line per request and one per uncaught
+// error to stderr: correlated by id, bounded, with no bodies, headers, query strings or secret values.
+// Without it the output is the plain text it always was.
+const SECRET = "hunter2-secret-value";
+const handler = `export default {
+  async fetch(request, env, ctx) {
+    const path = new URL(request.url).pathname;
+    if (path === "/boom") throw new Error("upstream rejected token ${SECRET}");
+    if (path === "/async-boom") {
+      await Promise.resolve();
+      throw new TypeError("async failure ${SECRET}");
+    }
+    if (path === "/unawaited") {
+      async function failNow() { throw new Error("background failure"); }
+      failNow();
+      return new Response("fired");
+    }
+    if (path === "/wait") {
+      ctx.waitUntil(Promise.reject(new Error("waitUntil failure")));
+      return new Response("queued");
+    }
+    if (request.method === "POST") return new Response("echo:" + (await request.text()));
+    return new Response("ok");
+  }
+};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+type Run = { get: (path: string, init?: RequestInit) => Promise<Response>; stop: () => Promise<string> };
+
+async function start(binary: string, workdir: string, extra: Record<string, string>): Promise<Run> {
+  const port = freePort();
+  const server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port), SB_BROKER_TOKEN: "native-test-token", TOKEN: SECRET, ...extra },
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  const stderr = new Response(server.stderr).text();
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  return {
+    get: (path, init) => fetch(`http://127.0.0.1:${port}${path}`, init),
+    stop: async () => {
+      server.kill(9);
+      await server.exited;
+      return stderr;
+    },
+  };
+}
+
+function records(log: string): JsonObject[] {
+  const found: JsonObject[] = [];
+  for (const line of log.split("\n")) {
+    // The binary also prints a startup banner of its own; every line that is JSON must be a record.
+    if (!line.startsWith("{")) continue;
+    const record = jsonObject(parseJsonValue(line));
+    assert(record, `a stderr line is not a JSON record: ${line}`);
+    found.push(record);
+  }
+  return found;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-log-"));
+try {
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "log.generated.js");
+  const binary = join(workdir, "log-native");
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(
+      handler,
+      core.replace(TRANSPORT_MARKER, broker),
+      undefined,
+      { ...EMPTY_BINDINGS, secrets: ["TOKEN"] },
+      undefined,
+      "2026-11-07",
+    ),
+  );
+  await compileNative({ generated, binary, dir: workdir });
+
+  // Off by default: the plain text line, no records.
+  const plain = await start(binary, workdir, {});
+  assert.equal(await (await plain.get("/ok")).text(), "ok");
+  assert.equal((await plain.get("/boom")).status, 500);
+  const plainLog = await plain.stop();
+  assert(plainLog.includes("Uncaught (in fetch)"), `the default error line changed: ${plainLog}`);
+  assert(!plainLog.includes('"type"'), `records were written without SB_LOG=json: ${plainLog}`);
+
+  // On: request and error records.
+  const json = await start(binary, workdir, { SB_LOG: "json" });
+  assert.equal(
+    await (await json.get("/ok?token=abc123&page=2", { headers: { authorization: "Bearer topsecret" } })).text(),
+    "ok",
+  );
+  assert.equal(
+    await (
+      await json.get("/echo", { method: "POST", headers: { cookie: "sid=cookiesecret" }, body: "body-payload-xyz" })
+    ).text(),
+    "echo:body-payload-xyz",
+  );
+  assert.equal((await json.get("/boom")).status, 500);
+  assert.equal((await json.get("/async-boom")).status, 500);
+  assert.equal(await (await json.get("/unawaited")).text(), "fired");
+  assert.equal(await (await json.get("/wait")).text(), "queued");
+  await Bun.sleep(300);
+  const log = await json.stop();
+  for (const leaked of ["abc123", "topsecret", "cookiesecret", "body-payload-xyz", SECRET, "Uncaught"]) {
+    assert(!log.includes(leaked), `"${leaked}" reached the log: ${log}`);
+  }
+  const all = records(log);
+  const requests = all.filter((record) => record.type === "request");
+  const errors = all.filter((record) => record.type === "error");
+  const request = (path: string) => {
+    const found = requests.find((record) => record.path === path);
+    assert(found, `no request record for ${path}: ${log}`);
+    return found;
+  };
+
+  const ok = request("/ok");
+  assert.equal(ok.v, 1);
+  assert.equal(ok.method, "GET");
+  assert.equal(ok.status, 200);
+  assert.equal(ok.outcome, "ok");
+  assert(isString(ok.id) && ok.id.length > 0);
+  assert(isSafeInteger(ok.durationMs) && ok.durationMs >= 0);
+  assert(isSafeInteger(ok.timestamp) && Math.abs(ok.timestamp - Date.now()) < 60_000);
+  assert.deepEqual(
+    Object.keys(ok).sort(),
+    ["durationMs", "id", "method", "outcome", "path", "status", "timestamp", "type", "v"],
+    "a request record carries exactly these fields",
+  );
+  assert.equal(request("/echo").method, "POST");
+
+  for (const [path, name] of [
+    ["/boom", "Error"],
+    ["/async-boom", "TypeError"],
+  ] as const) {
+    const failed = request(path);
+    assert.equal(failed.status, 500);
+    assert.equal(failed.outcome, "exception");
+    const error = errors.find((record) => record.id === failed.id);
+    assert(error, `no error record shares the id of ${path}: ${log}`);
+    assert.equal(error.source, "fetch");
+    assert.equal(error.name, name);
+    assert(String(error.message).includes("[redacted]"), `the secret was not redacted: ${error.message}`);
+  }
+  const background = errors.find((record) => record.source === "promise");
+  assert(background, `no record for the unawaited rejection: ${log}`);
+  assert.equal(background.id, null);
+  const waitUntil = errors.find((record) => record.source === "waitUntil");
+  assert(waitUntil, `no record for the waitUntil rejection: ${log}`);
+  assert.equal(waitUntil.id, request("/wait").id);
+
+  // Bounded: a burst past 200 lines a second is counted, not written, and the count is reported.
+  const flood = await start(binary, workdir, { SB_LOG: "json" });
+  const burst = 700;
+  for (let sent = 0; sent < burst; sent += 50) {
+    await Promise.all(Array.from({ length: 50 }, () => flood.get("/ok")));
+  }
+  await Bun.sleep(1100);
+  await flood.get("/ok");
+  await Bun.sleep(200);
+  const floodRecords = records(await flood.stop());
+  const written = floodRecords.filter((record) => record.type === "request").length;
+  const dropped = floodRecords
+    .filter((record) => record.type === "dropped")
+    .reduce((sum, record) => sum + Number(record.count), 0);
+  assert(dropped > 0, "a burst past the rate limit was not reported as dropped");
+  assert.equal(written + dropped, burst + 2, "every request is either written or counted as dropped");
+  console.log("Native request and error records are structured, correlated, redacted and bounded");
+} finally {
+  await rm(workdir, { recursive: true, force: true });
+}