@sproutboat/runtime 0.42.2 → 0.44.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @sproutboat/runtime
 
+## 0.44.0
+
+### Minor Changes
+
+- 8e08bb2: runtime: service bindings between apps on a sproutd host. `env.PEER.fetch()` and RPC on a callee's `WorkerEntrypoint` (`env.PEER.method(...)`) now work from compatibility date 2026-11-18, where the embedded transport had no `service.fetch` op and a call failed with `unknown op`. The caller sends the call as an HTTP request to the pseudo-host `sbsvc.<binding name in hex>` over its egress socket (`SB_EGRESS_FD`). The host looks the binding up in the services map it holds for the caller, answers `ok TICKET` with a connection to its own listener, and the transport sends the ticket as an `x-sb-svc-ticket` header. The host, which alone mints tickets, then delivers the request to the callee marked as a vouched service-binding call, so the callee's existing ingress (`x-sb-binding-call`, `x-sb-edge-token`, `x-sb-url`, `x-sb-rpc`, `x-sb-uncaught`) works unchanged. A call is bounded at 30 seconds per hop, with no depth cap: a loop unwinds on that timeout. Before 2026-11-18 a call fails as before, with a clearer message. A standalone binary, which has no peer apps, reports that. An older host answers the pseudo-host as an unresolvable name.
+
+### Patch Changes
+
+- 8e08bb2: runtime: the promise-returning R2 binding (compatibility date 2026-10-26 and later) has `createUploadUrl()` and `createDownloadUrl()` again, with the semantics of the legacy binding (the same `r2.transfer.create` call, now returning promises). They were missing there, so an app that moved past 2026-10-26 lost direct transfer with a "not a function" error. No date gate: the methods did not exist at those dates, so nothing that worked changes.
+
+## 0.43.0
+
+### Minor Changes
+
+- 201f8ff: runtime: with `SB_LOG=json` in its environment a binary writes structured records to stderr, one JSON line each (#268). A request writes `{"type":"request","v":1,"id","timestamp","method","path","status","durationMs","outcome"}` once its response is built, and every uncaught error (a handler, `scheduled()`, `queue()`, an alarm, a WebSocket handler, a rejected promise or a `waitUntil` task) writes `{"type":"error","v":1,"id","timestamp","source","name","message","stack"}` in place of the plain `Uncaught (in ...)` text. An error raised while answering a request carries that request's `id`; background work has `id: null`. Bodies, headers, the query string and the client address are never written, and the value of a declared secret that appears in a message or stack is replaced with `[redacted]`. Output is bounded: fields are cut to fixed lengths and at most 200 lines a second are written; the rest are counted and reported by a `{"type":"dropped","count"}` line when the next second starts. Without `SB_LOG=json` nothing changes, so no compatibility date applies.
+
 ## 0.42.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.42.2",
+  "version": "0.44.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/egress.test.ts

@@ -242,6 +242,82 @@ int main(void) {
   }
 });
 
+test('SB_EGRESS_FD: a service-binding call\'s "ok TICKET" answer leaves the ticket for the request', () => {
+  const source = readFileSync(transportFile, "utf8");
+  const block = source.slice(source.indexOf("// EGRESS-FD:BEGIN"), source.indexOf("// EGRESS-FD:END"));
+  const dir = mkdtempSync(join(tmpdir(), "sb-egress-ticket-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <errno.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <sys/time.h>
+#include <sys/wait.h>
+${block}
+static void answer(int via, const char* text, int fd) {
+  union { struct cmsghdr align; char space[CMSG_SPACE(sizeof(int))]; } control;
+  struct iovec io = { (void*)text, strlen(text) };
+  struct msghdr msg;
+  memset(&msg, 0, sizeof(msg));
+  msg.msg_iov = &io; msg.msg_iovlen = 1;
+  if (fd >= 0) {
+    msg.msg_control = control.space; msg.msg_controllen = sizeof(control.space);
+    struct cmsghdr* c = CMSG_FIRSTHDR(&msg);
+    c->cmsg_level = SOL_SOCKET; c->cmsg_type = SCM_RIGHTS; c->cmsg_len = CMSG_LEN(sizeof(int));
+    memcpy(CMSG_DATA(c), &fd, sizeof(fd));
+  }
+  sendmsg(via, &msg, 0);
+}
+int main(void) {
+  int pair[2];
+  socketpair(AF_UNIX, SOCK_STREAM, 0, pair);
+  if (fork() == 0) {
+    close(pair[0]);
+    char line[512];
+    int remote[2];
+    read(pair[1], line, sizeof(line) - 1);
+    socketpair(AF_UNIX, SOCK_STREAM, 0, remote);
+    answer(pair[1], "ok 0123abcd\\n", remote[0]);
+    read(pair[1], line, sizeof(line) - 1);
+    socketpair(AF_UNIX, SOCK_STREAM, 0, remote);
+    answer(pair[1], "ok\\n", remote[0]);
+    _exit(0);
+  }
+  close(pair[1]);
+  char refused[512] = "";
+  int fd = sb_egress_fd_connect(pair[0], "sbsvc.70", 80, refused, sizeof(refused));
+  printf("service %s ticket=%s\\n", fd >= 0 ? "yes" : "no", sb_svc_ticket);
+  fd = sb_egress_fd_connect(pair[0], "up.test", 80, refused, sizeof(refused));
+  printf("plain %s ticket=%s\\n", fd >= 0 ? "yes" : "no", sb_svc_ticket);
+  wait(0);
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-Wno-unused-result",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const run = Bun.spawnSync([join(dir, "check")]);
+    expect(run.stdout.toString().trimEnd().split("\n")).toEqual(["service yes ticket=0123abcd", "plain yes ticket="]);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("sb_tcp_connect sets TCP_NODELAY on the socket it returns", () => {
   // Nagle plus the peer's delayed ACK stalled every fresh HTTPS fetch about 44 ms on Linux (a TLS
   // handshake writes small flights). Timing is flaky on CI and loopback on macOS does not show

package/src/native-fetch-prelude.js

@@ -11174,6 +11174,31 @@ function __sbMakeR2(name) {
     resumeMultipartUpload(key, uploadId) {
       return upload(String(key), String(uploadId));
     },
+    // Direct transfer (a sproutboat extension, as on the legacy binding): a URL the client sends the bytes to or
+    // fetches them from without passing through the app. Promises, like the rest of this binding.
+    createUploadUrl(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.transfer.create", {
+          bucket: name,
+          key: String(key),
+          method: "upload",
+          maxBytes: o.maxBytes,
+          expiresIn: o.expiresIn,
+          sha256: o.sha256,
+          httpMetadata: o.httpMetadata || {},
+          customMetadata: o.customMetadata || {},
+        });
+        return { url: r.url, expiresAt: r.expiresAt };
+      });
+    },
+    createDownloadUrl(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.transfer.create", { bucket: name, key: String(key), method: "download", expiresIn: o.expiresIn });
+        return { url: r.url, expiresAt: r.expiresAt };
+      });
+    },
   };
 }
 
@@ -11561,6 +11586,7 @@ function __sbMakeQueue(binding) {
 
 globalThis.__sbInstallBindings = function (target, bindings) {
   if (!target) return;
+  __sbLogSecretNames = bindings.secrets || [];
 
   __sbQueueSetup(bindings);
 
@@ -11969,6 +11995,8 @@ async function __sbRpcCall(binding, method, args) {
   const msg = {
     binding,
     url: "https://rpc.sproutboat.internal/" + method,
+    // Marks an RPC call for a transport that has to tell it from a fetch that carries an x-sb-rpc header of its own.
+    rpc: true,
     method: "POST",
     headers: [
       ["x-sb-rpc", method],
@@ -13992,7 +14020,7 @@ function __sbTrustedProxyHeader(request, name) {
 // own.
 const __SB_WAITUNTIL_TIMEOUT_MS = 25000;
 
-async function __sbDrainWaitUntil(tasks) {
+async function __sbDrainWaitUntil(tasks, logRec) {
   if (!tasks.length) return;
   const pending = tasks.splice(0, tasks.length);
   // Clear the cap's timer once the tasks finish: a pending timer kept the process
@@ -14001,16 +14029,17 @@ async function __sbDrainWaitUntil(tasks) {
   const cap = new Promise((resolve) => {
     timer = setTimeout(resolve, __SB_WAITUNTIL_TIMEOUT_MS);
   });
-  await Promise.race([__sbDrainAll(pending), cap]);
+  await Promise.race([__sbDrainAll(pending, logRec), cap]);
   clearTimeout(timer);
 }
 
-async function __sbDrainAll(pending) {
+async function __sbDrainAll(pending, logRec) {
   for (let i = 0; i < pending.length; i++) {
     try {
       await pending[i];
-    } catch {
-      /* a background task's rejection must not fail the response */
+    } catch (error) {
+      /* a background task's rejection must not fail the response; with SB_LOG=json it is recorded (#268) */
+      if (__sbLogJson()) __sbLogError("waitUntil", error, logRec);
     }
   }
 }
@@ -15332,8 +15361,9 @@ function __sbInstallWebSockets() {
   globalThis.WebSocketRequestResponsePair = __SbWebSocketRequestResponsePair;
 }
 
-async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell) {
+async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell, logRec) {
   let r;
+  let threw = 0;
   try {
     r = res && __sbIsFn(res.then) ? await res : res;
     if (top && __sbHasWebSocket(r)) r = __sbWsHostResponse(r);
@@ -15348,7 +15378,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
       throw error;
     }
     // #179 — a rejected handler promise must not take the process down with it.
-    r = __sbErrorResponse(error, bindingCall);
+    threw = 1;
+    r = __sbErrorResponse(error, bindingCall, logRec);
   }
   // From 2026-11-02 an async handler reports its CPU too: the thread time of the slices in which this
   // request ran, not its neighbours' (before it, only a handler that answered synchronously did).
@@ -15359,7 +15390,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
   // The response goes out now and ctx.waitUntil work keeps running after it, as in
   // workerd; it was awaited first, so a 1.5 s background task delayed the response by
   // 1.5 s. The 25 s cap still bounds it. Not called for no tasks: an async call is a coroutine and a promise.
-  if (tasks.length) __sbDrainWaitUntil(tasks);
+  if (logRec) __sbLogRequest(logRec, r, threw);
+  if (tasks.length) __sbDrainWaitUntil(tasks, logRec);
   return r;
 }
 
@@ -15367,8 +15399,8 @@ async function __sbFetchWithDrain(res, tasks, bindingCall, rethrow, top, cpuCell
 // propagate past __sbEntry and crash the whole server. Logged first, the way a
 // Worker logs "Uncaught Error: ...": a swallowed exception left a 500 with
 // nothing on stderr, which hid #168 entirely.
-function __sbErrorResponse(error, bindingCall) {
-  __sbLogUncaught("fetch", error);
+function __sbErrorResponse(error, bindingCall, logRec) {
+  __sbLogUncaught("fetch", error, logRec);
   // Untyped, as workerd sends it: the text/plain default is for handlers' bodies.
   const response = new Response("Internal Server Error", { status: 500 });
   response.headers.delete("content-type");
@@ -15438,7 +15470,11 @@ function __sbHeader(headers, name) {
   return count > 1 ? headers.get(name) : found;
 }
 
-function __sbLogUncaught(where, error) {
+function __sbLogUncaught(where, error, logRec) {
+  if (__sbLogJson()) {
+    __sbLogError(where, error, logRec);
+    return;
+  }
   try {
     let text = "";
     if (error && error.stack) text = String(error.stack);
@@ -15450,6 +15486,113 @@ function __sbLogUncaught(where, error) {
   }
 }
 
+// #268 — structured request and error records for a standalone binary. Off unless SB_LOG=json, so
+// nothing an app can observe changes and the per-request cost of "off" is one cached boolean. On, every
+// request writes one JSON line to stderr after its response is built, and every uncaught error (in a
+// handler, scheduled(), queue(), an alarm, a WebSocket handler, a rejected promise or a waitUntil task)
+// writes one more, in place of the plain "Uncaught (in ...)" text, so the stream stays parseable.
+//
+// What is never written: request or response bodies, headers (cookies and authorization among them), the
+// query string (it is where tokens end up), the client address, and the value of any declared secret (the
+// ones the message or stack happens to contain are replaced). Output is bounded: fields are cut to fixed
+// lengths and at most 200 lines a second go out; the rest are counted and reported by one "dropped" line
+// when the next second starts. A record's "id" ties a request line to the errors of the same request;
+// background work has id null.
+let __sbLogOn;
+let __sbLogSecretNames = [];
+let __sbLogSeq = 0;
+let __sbLogWindow = 0;
+let __sbLogCount = 0;
+let __sbLogDropped = 0;
+const __SB_LOG_PER_SECOND = 200;
+function __sbLogJson() {
+  if (__sbLogOn === undefined) __sbLogOn = __sbEnv("SB_LOG") === "json";
+  return __sbLogOn;
+}
+// Tests turn the records on without an environment, like __sbSetCompat.
+function __sbSetLog(on) {
+  __sbLogOn = on;
+}
+function __sbLogCut(text, max) {
+  const s = String(text);
+  return s.length > max ? s.slice(0, max) + "..." : s;
+}
+function __sbLogRedact(text) {
+  let out = text;
+  for (let i = 0; i < __sbLogSecretNames.length; i++) {
+    const raw = __sbEnv(__sbLogSecretNames[i]);
+    if (!raw || raw.length < 4) continue;
+    out = out.split(raw).join("[redacted]");
+    const decoded = __sbFromUtf8(raw);
+    if (decoded !== raw && decoded.length >= 4) out = out.split(decoded).join("[redacted]");
+  }
+  return out;
+}
+function __sbLogWrite(record) {
+  const now = Date.now();
+  const second = Math.floor(now / 1000);
+  if (second !== __sbLogWindow) {
+    if (__sbLogDropped > 0) {
+      console.error(JSON.stringify({ type: "dropped", v: 1, timestamp: now, count: __sbLogDropped, reason: "rate" }));
+      __sbLogDropped = 0;
+    }
+    __sbLogWindow = second;
+    __sbLogCount = 0;
+  }
+  if (__sbLogCount >= __SB_LOG_PER_SECOND) {
+    __sbLogDropped++;
+    return;
+  }
+  __sbLogCount++;
+  console.error(JSON.stringify(record));
+}
+function __sbLogBegin(request) {
+  __sbLogSeq++;
+  let path = "/";
+  try {
+    path = new URL(request.url).pathname;
+  } catch {
+    /* a request without a parseable URL is logged as "/" */
+  }
+  return { id: String(Math.floor(Date.now() / 1000)) + "-" + __sbLogSeq, t0: Date.now(), method: String(request.method), path: __sbLogCut(path, 256) };
+}
+function __sbLogRequest(rec, response, threw) {
+  try {
+    __sbLogWrite({
+      type: "request",
+      v: 1,
+      id: rec.id,
+      timestamp: rec.t0,
+      method: __sbLogCut(rec.method, 16),
+      path: rec.path,
+      status: response && response.status ? response.status : 0,
+      durationMs: Date.now() - rec.t0,
+      outcome: threw === 1 ? "exception" : "ok",
+    });
+  } catch {
+    /* logging must never turn a served request into a crash */
+  }
+}
+function __sbLogError(where, error, rec) {
+  try {
+    const name = error && error.name ? String(error.name) : "Error";
+    const message = error && error.message != null ? String(error.message) : String(error);
+    const record = {
+      type: "error",
+      v: 1,
+      id: rec ? rec.id : null,
+      timestamp: Date.now(),
+      source: __sbLogCut(where, 40),
+      name: __sbLogCut(name, 100),
+      message: __sbLogCut(__sbLogRedact(message), 1000),
+    };
+    if (error && error.stack) record.stack = __sbLogCut(__sbLogRedact(String(error.stack)), 2000);
+    __sbLogWrite(record);
+  } catch {
+    /* logging must never turn a handled error into a crash */
+  }
+}
+
 // A promise rejected and nothing was waiting on it (an un-awaited `db.prepare(...).run()`
 // that failed, say). As on Workers the request, the process and every other request go on:
 // the rejection is logged, and an "unhandledrejection" event fires on the global scope when
@@ -15785,6 +15928,8 @@ globalThis.__sbEntry = function (handlers, request) {
     // async handlers (see LogEvent in services/edge) — that is this.
     const __cpuCell = __sbCpuBegin();
     const __t0 = __cpuCell ? 0 : __sbCpuMs();
+    // #268 — one record per request when SB_LOG=json; null (and no work at all) otherwise.
+    const __logRec = __sbLogJson() ? __sbLogBegin(request) : null;
     const __sbTasks = [];
     const ctx = {
       waitUntil(p) {
@@ -15807,19 +15952,24 @@ globalThis.__sbEntry = function (handlers, request) {
       // #179 — a synchronous throw anywhere in the handler must not take the
       // whole process (and every other in-flight request) down with it.
       __sbCpuEnd(__cpuCell);
-      return __sbErrorResponse(error, bindingCall);
+      const __failed = __sbErrorResponse(error, bindingCall, __logRec);
+      if (__logRec) __sbLogRequest(__logRec, __failed, 1);
+      return __failed;
     }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
-    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true, __cpuCell);
+    if (__sbTasks.length || (__res && __sbIsFn(__res.then)) || __sbHasStreamBody(__res)) return __sbFetchWithDrain(__res, __sbTasks, bindingCall, false, true, __cpuCell, __logRec);
     // A WebSocket handshake answer (from 2026-10-30): its client end becomes the host socket.
     if (__sbHasWebSocket(__res)) {
       __sbCpuEnd(__cpuCell);
-      return __sbWsHostResponse(__res);
+      const __ws = __sbWsHostResponse(__res);
+      if (__logRec) __sbLogRequest(__logRec, __ws, 0);
+      return __ws;
     }
     // The request ran alone from start to here: its own slices, or the process delta where no slot was free.
     const __cpu = __cpuCell ? __sbCpuTake(__cpuCell) : __sbCpuMs() - __t0;
     __sbCpuEnd(__cpuCell);
+    if (__logRec) __sbLogRequest(__logRec, __res, 0);
     return __sbTagCpu(__res, __cpu);
   }
   if (!__sbTriggerAuthed(request)) return new Response("forbidden", { status: 403 });

package/src/transport-embedded.js

@@ -2679,6 +2679,8 @@ static void sb_tcp_nodelay(int fd) {
 // broken exchange closes N for good, so a late answer can never be taken for the
 // next one.
 static int sb_egress_fd_ask(int via, const char* host, int port, char* refused, size_t refused_len);
+// The ticket of the last service-binding connect on this thread ("" for any other connect).
+static __thread char sb_svc_ticket[72];
 static int sb_egress_fd_connect(int via, const char* host, int port, char* refused, size_t refused_len) {
   static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
   pthread_mutex_lock(&lock);
@@ -2714,7 +2716,16 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
     return -1;
   }
   answer[got - 1] = 0;
+  // "ok TICKET" (a service-binding call, host "sbsvc.HEX"): the host connected us to itself and the
+  // ticket, which only it could mint, tells it who is calling. The request carries it as a header.
+  sb_svc_ticket[0] = 0;
+  if (!strncmp(answer, "ok ", 3) && fd >= 0 && strlen(answer + 3) > 0 && strlen(answer + 3) < sizeof(sb_svc_ticket)) {
+    snprintf(sb_svc_ticket, sizeof(sb_svc_ticket), "%s", answer + 3);
+    answer[2] = 0;
+  }
   if (!strcmp(answer, "ok") && fd >= 0) {
+    // A service call is bounded per hop at 30 s, as the callee's own wall limit is.
+    if (sb_svc_ticket[0]) tv.tv_sec = 30;
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
     sb_tcp_nodelay(fd);
@@ -2885,11 +2896,22 @@ static char* sb_error_json(const char* prefix, const char* detail) {
 static char* sb_http_plain(const char* host, int port, const char* path, const char* method,
                            const char* headers, const char* body, size_t body_len) {
   char refused[512] = "";
+  sb_svc_ticket[0] = 0;
   int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
   if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
+  // A service-binding call: the ticket the host minted for it goes first among the headers.
+  sb_buf tagged = { 0, 0, 0 };
+  if (sb_svc_ticket[0]) {
+    sb_puts(&tagged, "x-sb-svc-ticket: ");
+    sb_puts(&tagged, sb_svc_ticket);
+    sb_puts(&tagged, "\r\n");
+    if (headers && *headers) sb_puts(&tagged, headers);
+    headers = tagged.p;
+  }
   sb_buf req = { 0, 0, 0 };
   sb_build_request(&req, host, port, 80, path, method, headers, body, body_len);
+  free(tagged.p);
   size_t sent = 0;
   while (sent < req.len) {
     long n = write(fd, req.p + sent, req.len - sent);
@@ -5154,24 +5176,73 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, found: false, status: 404, body: "Not Found" };
   }
 
-  if (op === "fetch") {
-    const url = new URL(String(msg.url));
-    const tls = url.protocol === "https:";
-    if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
+  // A service-binding call (compatibility date 2026-11-18): the host the app runs on routes it to the
+  // callee. The call is an HTTP request to the pseudo-host "sbsvc.HEX" (the binding's name in hex): the
+  // host sees the name on the egress socket the question came in on, finds the callee in its services
+  // map and answers "ok TICKET" with a connection to its own listener. __sbHttpRaw sends the ticket as
+  // a header (sb_http_plain) and the host's frontend, which alone mints tickets, delivers the request
+  // to the callee marked as a service-binding call. See sproutd's docs/bindings.md, "Service bindings".
+  if (op === "fetch" || op === "service.fetch") {
+    const service = op === "service.fetch";
+    let hostname;
+    let port;
+    let pathname;
+    let tls = false;
     let headerText = "";
+    if (service) {
+      if (__sbCompatDate() < "2026-11-18") {
+        throw new Error(
+          "service binding " + msg.binding + " needs compatibility_date 2026-11-18 or later to reach another app on this host",
+        );
+      }
+      if (!__sbEnv("SB_EGRESS_FD")) {
+        throw new Error(
+          "service binding " + msg.binding + " has no app to reach here: a standalone binary has no peer apps, only a platform host (sproutd) has",
+        );
+      }
+      const binding = String(msg.binding);
+      let hex = "";
+      for (let i = 0; i < binding.length; i++) {
+        const c = binding.charCodeAt(i);
+        if (c > 127) throw new Error("service binding names are ASCII: " + binding);
+        hex += (c < 16 ? "0" : "") + c.toString(16);
+      }
+      if (hex.length > 200) throw new Error("service binding name too long: " + binding);
+      hostname = "sbsvc." + hex;
+      port = "80";
+      // The callee sees the URL its caller passed (x-sb-url, vouched for by the host); the request line
+      // carries only its path.
+      try {
+        const parsed = new URL(String(msg.url));
+        pathname = parsed.pathname + parsed.search;
+        headerText += "x-sb-url: " + parsed.href + "\r\n";
+      } catch (e) {
+        const p = String(msg.url || "/");
+        pathname = p.charAt(0) === "/" ? p : "/" + p;
+      }
+    } else {
+      const url = new URL(String(msg.url));
+      tls = url.protocol === "https:";
+      if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
+      hostname = url.hostname;
+      port = url.port ? url.port : tls ? "443" : "80";
+      pathname = url.pathname + url.search;
+    }
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
       const key = String(pairs[i][0]).toLowerCase();
       // Host, Connection and Content-Length are ours to set.
       if (key === "host" || key === "connection" || key === "content-length") continue;
+      // The host's markers are its own: the caller's x-sb-* headers do not travel. Only an RPC call (the prelude's
+      // __sbRpcCall, msg.rpc) sends x-sb-rpc, which names the method.
+      if (service && key.slice(0, 5) === "x-sb-" && !(msg.rpc === true && key === "x-sb-rpc")) continue;
       headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
     }
-    const port = url.port ? url.port : tls ? "443" : "80";
     const asyncId = msg.asyncId > 0 ? msg.asyncId : 0;
     const raw = __sbHttpRaw(
-      url.hostname,
+      hostname,
       port,
-      url.pathname + url.search,
+      pathname,
       String(msg.method || "GET").toUpperCase(),
       headerText,
       msg.body == null ? "" : String(msg.body),

package/test/native-base64.ts

@@ -1,14 +1,18 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
-const expected = Array.from({length:10}, (_,length) => {
-  const bytes=Uint8Array.from({length}, (_,i) => (i*71+251)%256);
-  const padded=Buffer.from(bytes).toString("base64");
-  return {padded,url:padded.replaceAll("+","-").replaceAll("/","_").replace(/=+$/, ""),decoded:Array.from(bytes)};
+const expected = Array.from({ length: 10 }, (_, length) => {
+  const bytes = Uint8Array.from({ length }, (_, i) => (i * 71 + 251) % 256);
+  const padded = Buffer.from(bytes).toString("base64");
+  return {
+    padded,
+    url: padded.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, ""),
+    decoded: Array.from(bytes),
+  };
 });
 const handler = `export default {fetch() {
   const rows=[];
@@ -37,14 +41,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-base64-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "base64.generated.js");
@@ -52,18 +49,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {