@sproutboat/runtime 0.42.1 → 0.43.0

package/test/native-request-streaming.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // Streamed request bodies, from compatibility date 2026-10-27: the handler runs once the
@@ -79,9 +79,6 @@ const expectedSum = (total: number) => {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-streaming-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native request-streaming test needs node on PATH");
   const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "stream.generated.js");
@@ -95,20 +92,7 @@ try {
     "2026-10-27",
   );
   await writeFile(generated, source);
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   const linux = process.platform === "linux";

package/test/native-request.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // new Request(request, init) and fetch-style Request copies, compared with Bun: the copy
@@ -31,7 +31,15 @@ ${CASES.map((c) => `    () => (${c}),`).join("\n")}
   }
   return new Response(JSON.stringify(out));
 }};`;
-const want = await Promise.all(CASES.map(async (c) => { try { return String(await new Function("return " + c)()); } catch (e) { return "THROWS " + (e instanceof Error ? e.message : String(e)); } }));
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
 
 function freePort(): number {
   const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
@@ -43,14 +51,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "request.generated.js");
@@ -58,18 +59,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -92,11 +82,19 @@ try {
   // SAFETY: the handler above is the only producer of this body: a JSON array with one
   // string per case; the comparison below reports any entry that differs.
   const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
-  const diffs = CASES.flatMap((c, i) => (got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`]));
-  assert.deepEqual(diffs, [], `Request copies differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`);
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `Request copies differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
   const posted = await (await fetch(`http://127.0.0.1:${port}/`, { method: "POST", body: "posted é" })).text();
   assert.equal(posted, "false:string:posted é", "before 2026-10-21 the incoming body stays the raw value");
-  console.log(`Native Request copies match Bun in all ${CASES.length} cases; an app before 2026-10-21 keeps its raw body`);
+  console.log(
+    `Native Request copies match Bun in all ${CASES.length} cases; an app before 2026-10-21 keeps its raw body`,
+  );
 } finally {
   if (server) {
     server.kill(9);

package/test/native-response-defaults.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // What workerd answers for the same handler (checked 2026-10-19, workerd 2026-10-16).
@@ -37,14 +37,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-response-defaults-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "response.generated.js");
@@ -52,18 +45,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-service-bindings.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { createBroker, listen } from "../../wire/src/broker";
 import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
@@ -182,7 +182,11 @@ const edge = Bun.serve({
       });
     }
     if (url.pathname === "/typed") {
-      return Response.json({ method: request.method, type: request.headers.get("content-type"), body: await request.text() });
+      return Response.json({
+        method: request.method,
+        type: request.headers.get("content-type"),
+        body: await request.text(),
+      });
     }
     if (url.pathname === "/redirect") {
       const status = Number(url.searchParams.get("status"));
@@ -246,9 +250,6 @@ const get = async (path: string) => {
   return { status: res.status, text: await res.text(), ms: performance.now() - t0 };
 };
 try {
-  const porffor = await ensurePorffor({ cacheRoot: workdir });
-  const node = Bun.which("node");
-  if (!node) throw new Error("native service-binding test needs node on PATH");
   const [core, transport] = await Promise.all([
     readFile(preludePath, "utf8"),
     readFile(transportPath("broker"), "utf8"),
@@ -256,20 +257,12 @@ try {
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "services.generated.js");
   const binary = join(workdir, "services-native");
-  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-22"));
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-22"),
+  );
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
 
   server = Bun.spawn([binary], {
     cwd: workdir,
@@ -329,7 +322,10 @@ try {
   const t0 = performance.now();
   const all = await Promise.all(Array.from({ length: 8 }, () => get("/slow?ms=500")));
   const total = performance.now() - t0;
-  assert(all.every((r) => r.text === "slow done"), JSON.stringify(all));
+  assert(
+    all.every((r) => r.text === "slow done"),
+    JSON.stringify(all),
+  );
   assert(total < 1500, `8 concurrent 500 ms calls took ${Math.round(total)} ms`);
 
   // Cancellation: an aborted signal rejects at once, and the abort reaches the upstream
@@ -337,7 +333,11 @@ try {
   const abandonedBefore = slowAbandoned;
   const aborts = await get("/abort");
   assert.equal(aborts.status, 200, aborts.text);
-  assert.deepEqual(JSON.parse(aborts.text), { aborted: "AbortError fast", timedOut: "TimeoutError fast", already: "AbortError fast" });
+  assert.deepEqual(JSON.parse(aborts.text), {
+    aborted: "AbortError fast",
+    timedOut: "TimeoutError fast",
+    already: "AbortError fast",
+  });
   await Bun.sleep(300);
   assert.equal(slowAbandoned - abandonedBefore, 2, "both in-flight calls were stopped upstream");
 
@@ -375,7 +375,11 @@ try {
     context: { env: true, waitUntil: true },
   });
   // A client cannot call a method: without the edge's vouching, x-sb-rpc is just a header.
-  const forgedRpc = await fetch(`http://127.0.0.1:${port}/ping`, { method: "POST", headers: { "x-sb-rpc": "fail" }, body: "[\"x\"]" });
+  const forgedRpc = await fetch(`http://127.0.0.1:${port}/ping`, {
+    method: "POST",
+    headers: { "x-sb-rpc": "fail" },
+    body: '["x"]',
+  });
   assert.equal(await forgedRpc.text(), "pong");
 
   // A deployment calling itself, 30 levels deep: every level waits on the next at once.
@@ -394,19 +398,41 @@ export default {
   const legacyPort = freePort();
   const legacySource = join(workdir, "legacy.generated.js");
   const legacyBinary = join(workdir, "legacy-native");
-  await writeFile(legacySource, wrapNativeFetchHandler(legacyHandler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-21"));
-  const legacyCompile = Bun.spawnSync([node, resolve(porffor, "runtime/index.js"), "native", legacySource, "-o", legacyBinary, "-s", "-O0"], { cwd: workdir });
-  assert.equal(legacyCompile.exitCode, 0, `legacy compile failed:\n${legacyCompile.stderr}`);
+  await writeFile(
+    legacySource,
+    wrapNativeFetchHandler(
+      legacyHandler,
+      core.replace(TRANSPORT_MARKER, transport),
+      {},
+      bindings,
+      undefined,
+      "2026-10-21",
+    ),
+  );
+  await compileNative({
+    generated: legacySource,
+    binary: legacyBinary,
+    dir: workdir,
+    cacheRoot: workdir,
+    failure: "legacy compile failed",
+  });
   legacy = Bun.spawn([legacyBinary], {
     cwd: workdir,
-    env: { ...process.env, PORT: String(legacyPort), SB_BROKER_PORT: String(brokerServer.port), SB_BROKER_TOKEN: "native-services" },
+    env: {
+      ...process.env,
+      PORT: String(legacyPort),
+      SB_BROKER_PORT: String(brokerServer.port),
+      SB_BROKER_TOKEN: "native-services",
+    },
     stdout: "ignore",
     stderr: "inherit",
   });
   let legacyText = "";
   for (let attempt = 0; attempt < 50 && !legacyText; attempt++) {
     try {
-      legacyText = await (await fetch(`http://127.0.0.1:${legacyPort}/`, { signal: AbortSignal.timeout(20_000) })).text();
+      legacyText = await (
+        await fetch(`http://127.0.0.1:${legacyPort}/`, { signal: AbortSignal.timeout(20_000) })
+      ).text();
     } catch {
       await Bun.sleep(100);
     }

package/test/native-sockets-broker.ts

@@ -2,9 +2,10 @@ import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import net from "node:net";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
+import { Duplex } from "node:stream";
 import tls from "node:tls";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { compileNative } from "./native-compile";
 import { createBroker, listen } from "../../wire/src/broker";
 import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
@@ -82,6 +83,31 @@ export default {
         await secure.close();
         return Response.json({ greeting, go, echoed, upgraded: s.upgraded });
       }
+      if (url.pathname === "/starttls-race") {
+        const s = connect("127.0.0.1:" + port, { secureTransport: "starttls" });
+        const w = s.writable.getWriter();
+        const r = s.readable.getReader();
+        await withTimeout(readN(r, 11), 5000, "greeting");
+        await w.write(enc.encode("STARTTLS\\r\\n"));
+        await withTimeout(readN(r, 4), 5000, "go");
+        r.releaseLock();
+        w.releaseLock();
+        const secure = s.startTls({ expectedServerHostname: "localhost" });
+        const w2 = secure.writable.getWriter();
+        const r2 = secure.readable.getReader();
+        w2.write(enc.encode("secret-1"));
+        w2.write(enc.encode("secret-2"));
+        w2.write(enc.encode("secret-3"));
+        await withTimeout(secure.opened, 5000, "tls");
+        let echoed = "";
+        while (!echoed.includes("secret-3")) {
+          const chunk = await withTimeout(r2.read(), 5000, "tls echo");
+          if (chunk.done) break;
+          echoed += dec.decode(chunk.value);
+        }
+        await secure.close();
+        return Response.json({ echoed });
+      }
       if (url.pathname === "/tls") {
         const host = q.get("host") || "localhost";
         const s = connect({ hostname: host, port }, { secureTransport: "on" });
@@ -271,6 +297,34 @@ const starttlsPort = listenOn(
     });
   }),
 );
+// Every raw byte the recording origin receives after it sent "go", TLS records included.
+const rawAfterGo: Buffer[] = [];
+const starttlsRecordingPort = listenOn(
+  net.createServer((s) => {
+    // a TLSSocket over a net.Socket reads the handle directly, so the TLS side runs over a tap
+    // that replays the bytes this listener saw
+    const tap = new Duplex({
+      read() {},
+      write(chunk, _enc, done) {
+        s.write(chunk, done);
+      },
+    });
+    let afterGo = false;
+    s.prependListener("data", (c: Buffer) => {
+      if (!afterGo) return;
+      rawAfterGo.push(Buffer.from(c));
+      tap.push(c);
+    });
+    s.write("220 hello\r\n");
+    s.once("data", () => {
+      afterGo = true;
+      s.write("go\r\n");
+      const secure = new tls.TLSSocket(tap, { isServer: true, key, cert });
+      secure.on("data", (c) => secure.write(Buffer.concat([Buffer.from("tls:"), c])));
+      secure.on("error", () => {});
+    });
+  }),
+);
 const tlsPort = listenOn(
   tls.createServer({ key, cert }, (s) => {
     s.on("data", (c) => s.write(c));
@@ -310,9 +364,6 @@ const get = async (path: string, base = port) => {
 };
 
 try {
-  const porffor = await ensurePorffor({ cacheRoot: workdir });
-  const node = Bun.which("node");
-  if (!node) throw new Error("native sockets test needs node on PATH");
   const [core, transport] = await Promise.all([
     readFile(preludePath, "utf8"),
     readFile(transportPath("broker"), "utf8"),
@@ -331,21 +382,7 @@ try {
       "2026-11-17",
     ),
   );
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
 
   const start = async (listening: number, brokerPort: number) => {
     const child = Bun.spawn([binary], {
@@ -386,6 +423,14 @@ try {
   });
   console.log("startTls upgrades in the broker, verified against the expected host name");
 
+  const race = await get(`/starttls-race?port=${starttlsRecordingPort}`);
+  const echoedRace = String(race.echoed);
+  for (const part of ["secret-1", "secret-2", "secret-3"]) assert.ok(echoedRace.includes(part), `echoed ${part}`);
+  const rawBytes = Buffer.concat(rawAfterGo);
+  assert.equal(rawBytes[0], 0x16, "the first bytes after the upgrade are a TLS handshake record");
+  assert.equal(rawBytes.includes("secret"), false, "no application bytes reached the origin in plaintext");
+  console.log("startTls: writes issued before the handshake finished only reach the origin inside TLS");
+
   assert.deepEqual(await get(`/tls?port=${tlsPort}`), { got: "secret" });
   const wrongName = await get(`/tls?port=${tlsPort}&host=127.0.0.1`);
   assert.match(String(wrongName.error), /proxy request failed, cannot connect/);