@sproutboat/runtime 0.42.2 → 0.44.0

package/test/native-raw-body.ts

@@ -1,14 +1,9 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
-import {
-  preludePath,
-  TRANSPORT_MARKER,
-  transportPath,
-  wrapNativeFetchHandler,
-} from "../src/wrap";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // fetch() hands a response's bytes back as a raw body (x-sb-raw-body, #176), and
 // they can arrive as a UTF-16 string holding one byte per unit: JSON.parse of the
@@ -33,52 +28,15 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-raw-body-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
-  assert(
-    core.includes(TRANSPORT_MARKER),
-    "runtime prelude is missing its transport marker",
-  );
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "raw.generated.js");
   const binary = join(workdir, "raw-native");
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn(
-    [
-      node,
-      resolve(porffor, "runtime/index.js"),
-      "native",
-      generated,
-      "-o",
-      binary,
-      "-s",
-      "-O0",
-    ],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(
-    exitCode,
-    0,
-    `Porffor native compile failed:\n${stderr}\n${stdout}`,
-  );
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -103,11 +61,7 @@ try {
   const response = await fetch(`http://127.0.0.1:${port}/`);
   const got = [...new Uint8Array(await response.arrayBuffer())];
   assert.deepEqual(got, want, "raw body bytes");
-  assert.equal(
-    response.headers.get("x-sb-raw-body"),
-    null,
-    "the marker never reaches the client",
-  );
+  assert.equal(response.headers.get("x-sb-raw-body"), null, "the marker never reaches the client");
   console.log("A raw UTF-16 body is sent as its bytes");
 } finally {
   if (server) {

package/test/native-request-log.ts

@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
+import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+import { isSafeInteger, isString, jsonObject, parseJsonValue, type JsonObject } from "../../wire/src/json";
+
+// #268 — SB_LOG=json makes a standalone binary write one JSON line per request and one per uncaught
+// error to stderr: correlated by id, bounded, with no bodies, headers, query strings or secret values.
+// Without it the output is the plain text it always was.
+const SECRET = "hunter2-secret-value";
+const handler = `export default {
+  async fetch(request, env, ctx) {
+    const path = new URL(request.url).pathname;
+    if (path === "/boom") throw new Error("upstream rejected token ${SECRET}");
+    if (path === "/async-boom") {
+      await Promise.resolve();
+      throw new TypeError("async failure ${SECRET}");
+    }
+    if (path === "/unawaited") {
+      async function failNow() { throw new Error("background failure"); }
+      failNow();
+      return new Response("fired");
+    }
+    if (path === "/wait") {
+      ctx.waitUntil(Promise.reject(new Error("waitUntil failure")));
+      return new Response("queued");
+    }
+    if (request.method === "POST") return new Response("echo:" + (await request.text()));
+    return new Response("ok");
+  }
+};`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+type Run = { get: (path: string, init?: RequestInit) => Promise<Response>; stop: () => Promise<string> };
+
+async function start(binary: string, workdir: string, extra: Record<string, string>): Promise<Run> {
+  const port = freePort();
+  const server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port), SB_BROKER_TOKEN: "native-test-token", TOKEN: SECRET, ...extra },
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  const stderr = new Response(server.stderr).text();
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  return {
+    get: (path, init) => fetch(`http://127.0.0.1:${port}${path}`, init),
+    stop: async () => {
+      server.kill(9);
+      await server.exited;
+      return stderr;
+    },
+  };
+}
+
+function records(log: string): JsonObject[] {
+  const found: JsonObject[] = [];
+  for (const line of log.split("\n")) {
+    // The binary also prints a startup banner of its own; every line that is JSON must be a record.
+    if (!line.startsWith("{")) continue;
+    const record = jsonObject(parseJsonValue(line));
+    assert(record, `a stderr line is not a JSON record: ${line}`);
+    found.push(record);
+  }
+  return found;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-log-"));
+try {
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "log.generated.js");
+  const binary = join(workdir, "log-native");
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(
+      handler,
+      core.replace(TRANSPORT_MARKER, broker),
+      undefined,
+      { ...EMPTY_BINDINGS, secrets: ["TOKEN"] },
+      undefined,
+      "2026-11-07",
+    ),
+  );
+  await compileNative({ generated, binary, dir: workdir });
+
+  // Off by default: the plain text line, no records.
+  const plain = await start(binary, workdir, {});
+  assert.equal(await (await plain.get("/ok")).text(), "ok");
+  assert.equal((await plain.get("/boom")).status, 500);
+  const plainLog = await plain.stop();
+  assert(plainLog.includes("Uncaught (in fetch)"), `the default error line changed: ${plainLog}`);
+  assert(!plainLog.includes('"type"'), `records were written without SB_LOG=json: ${plainLog}`);
+
+  // On: request and error records.
+  const json = await start(binary, workdir, { SB_LOG: "json" });
+  assert.equal(
+    await (await json.get("/ok?token=abc123&page=2", { headers: { authorization: "Bearer topsecret" } })).text(),
+    "ok",
+  );
+  assert.equal(
+    await (
+      await json.get("/echo", { method: "POST", headers: { cookie: "sid=cookiesecret" }, body: "body-payload-xyz" })
+    ).text(),
+    "echo:body-payload-xyz",
+  );
+  assert.equal((await json.get("/boom")).status, 500);
+  assert.equal((await json.get("/async-boom")).status, 500);
+  assert.equal(await (await json.get("/unawaited")).text(), "fired");
+  assert.equal(await (await json.get("/wait")).text(), "queued");
+  await Bun.sleep(300);
+  const log = await json.stop();
+  for (const leaked of ["abc123", "topsecret", "cookiesecret", "body-payload-xyz", SECRET, "Uncaught"]) {
+    assert(!log.includes(leaked), `"${leaked}" reached the log: ${log}`);
+  }
+  const all = records(log);
+  const requests = all.filter((record) => record.type === "request");
+  const errors = all.filter((record) => record.type === "error");
+  const request = (path: string) => {
+    const found = requests.find((record) => record.path === path);
+    assert(found, `no request record for ${path}: ${log}`);
+    return found;
+  };
+
+  const ok = request("/ok");
+  assert.equal(ok.v, 1);
+  assert.equal(ok.method, "GET");
+  assert.equal(ok.status, 200);
+  assert.equal(ok.outcome, "ok");
+  assert(isString(ok.id) && ok.id.length > 0);
+  assert(isSafeInteger(ok.durationMs) && ok.durationMs >= 0);
+  assert(isSafeInteger(ok.timestamp) && Math.abs(ok.timestamp - Date.now()) < 60_000);
+  assert.deepEqual(
+    Object.keys(ok).sort(),
+    ["durationMs", "id", "method", "outcome", "path", "status", "timestamp", "type", "v"],
+    "a request record carries exactly these fields",
+  );
+  assert.equal(request("/echo").method, "POST");
+
+  for (const [path, name] of [
+    ["/boom", "Error"],
+    ["/async-boom", "TypeError"],
+  ] as const) {
+    const failed = request(path);
+    assert.equal(failed.status, 500);
+    assert.equal(failed.outcome, "exception");
+    const error = errors.find((record) => record.id === failed.id);
+    assert(error, `no error record shares the id of ${path}: ${log}`);
+    assert.equal(error.source, "fetch");
+    assert.equal(error.name, name);
+    assert(String(error.message).includes("[redacted]"), `the secret was not redacted: ${error.message}`);
+  }
+  const background = errors.find((record) => record.source === "promise");
+  assert(background, `no record for the unawaited rejection: ${log}`);
+  assert.equal(background.id, null);
+  const waitUntil = errors.find((record) => record.source === "waitUntil");
+  assert(waitUntil, `no record for the waitUntil rejection: ${log}`);
+  assert.equal(waitUntil.id, request("/wait").id);
+
+  // Bounded: a burst past 200 lines a second is counted, not written, and the count is reported.
+  const flood = await start(binary, workdir, { SB_LOG: "json" });
+  const burst = 700;
+  for (let sent = 0; sent < burst; sent += 50) {
+    await Promise.all(Array.from({ length: 50 }, () => flood.get("/ok")));
+  }
+  await Bun.sleep(1100);
+  await flood.get("/ok");
+  await Bun.sleep(200);
+  const floodRecords = records(await flood.stop());
+  const written = floodRecords.filter((record) => record.type === "request").length;
+  const dropped = floodRecords
+    .filter((record) => record.type === "dropped")
+    .reduce((sum, record) => sum + Number(record.count), 0);
+  assert(dropped > 0, "a burst past the rate limit was not reported as dropped");
+  assert.equal(written + dropped, burst + 2, "every request is either written or counted as dropped");
+  console.log("Native request and error records are structured, correlated, redacted and bounded");
+} finally {
+  await rm(workdir, { recursive: true, force: true });
+}

package/test/native-request-streaming.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // Streamed request bodies, from compatibility date 2026-10-27: the handler runs once the
@@ -79,9 +79,6 @@ const expectedSum = (total: number) => {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-streaming-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native request-streaming test needs node on PATH");
   const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "stream.generated.js");
@@ -95,20 +92,7 @@ try {
     "2026-10-27",
   );
   await writeFile(generated, source);
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   const linux = process.platform === "linux";

package/test/native-request.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // new Request(request, init) and fetch-style Request copies, compared with Bun: the copy
@@ -31,7 +31,15 @@ ${CASES.map((c) => `    () => (${c}),`).join("\n")}
   }
   return new Response(JSON.stringify(out));
 }};`;
-const want = await Promise.all(CASES.map(async (c) => { try { return String(await new Function("return " + c)()); } catch (e) { return "THROWS " + (e instanceof Error ? e.message : String(e)); } }));
+const want = await Promise.all(
+  CASES.map(async (c) => {
+    try {
+      return String(await new Function("return " + c)());
+    } catch (e) {
+      return "THROWS " + (e instanceof Error ? e.message : String(e));
+    }
+  }),
+);
 
 function freePort(): number {
   const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
@@ -43,14 +51,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-request-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "request.generated.js");
@@ -58,18 +59,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {
@@ -92,11 +82,19 @@ try {
   // SAFETY: the handler above is the only producer of this body: a JSON array with one
   // string per case; the comparison below reports any entry that differs.
   const got = JSON.parse(await (await fetch(`http://127.0.0.1:${port}/`)).text()) as string[];
-  const diffs = CASES.flatMap((c, i) => (got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`]));
-  assert.deepEqual(diffs, [], `Request copies differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`);
+  const diffs = CASES.flatMap((c, i) =>
+    got[i] === want[i] ? [] : [`${c}\n    want ${JSON.stringify(want[i])}\n    got  ${JSON.stringify(got[i])}`],
+  );
+  assert.deepEqual(
+    diffs,
+    [],
+    `Request copies differ from Bun in ${diffs.length} of ${CASES.length} cases:\n${diffs.join("\n")}`,
+  );
   const posted = await (await fetch(`http://127.0.0.1:${port}/`, { method: "POST", body: "posted é" })).text();
   assert.equal(posted, "false:string:posted é", "before 2026-10-21 the incoming body stays the raw value");
-  console.log(`Native Request copies match Bun in all ${CASES.length} cases; an app before 2026-10-21 keeps its raw body`);
+  console.log(
+    `Native Request copies match Bun in all ${CASES.length} cases; an app before 2026-10-21 keeps its raw body`,
+  );
 } finally {
   if (server) {
     server.kill(9);

package/test/native-response-defaults.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
 // What workerd answers for the same handler (checked 2026-10-19, workerd 2026-10-16).
@@ -37,14 +37,7 @@ function freePort(): number {
 const workdir = await mkdtemp(join(tmpdir(), "sb-native-response-defaults-"));
 let server: ReturnType<typeof Bun.spawn> | undefined;
 try {
-  const porffor = await ensurePorffor();
-  const node = Bun.which("node");
-  if (!node) throw new Error("native streams test needs node on PATH");
-
-  const [core, broker] = await Promise.all([
-    readFile(preludePath, "utf8"),
-    readFile(transportPath("broker"), "utf8"),
-  ]);
+  const [core, broker] = await Promise.all([readFile(preludePath, "utf8"), readFile(transportPath("broker"), "utf8")]);
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const prelude = core.replace(TRANSPORT_MARKER, broker);
   const generated = join(workdir, "response.generated.js");
@@ -52,18 +45,7 @@ try {
   await writeFile(generated, wrapNativeFetchHandler(handler, prelude));
   await rm(binary, { force: true });
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir });
 
   const port = freePort();
   server = Bun.spawn([binary], {

package/test/native-service-bindings.ts

@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
 import { createBroker, listen } from "../../wire/src/broker";
 import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
@@ -182,7 +182,11 @@ const edge = Bun.serve({
       });
     }
     if (url.pathname === "/typed") {
-      return Response.json({ method: request.method, type: request.headers.get("content-type"), body: await request.text() });
+      return Response.json({
+        method: request.method,
+        type: request.headers.get("content-type"),
+        body: await request.text(),
+      });
     }
     if (url.pathname === "/redirect") {
       const status = Number(url.searchParams.get("status"));
@@ -246,9 +250,6 @@ const get = async (path: string) => {
   return { status: res.status, text: await res.text(), ms: performance.now() - t0 };
 };
 try {
-  const porffor = await ensurePorffor({ cacheRoot: workdir });
-  const node = Bun.which("node");
-  if (!node) throw new Error("native service-binding test needs node on PATH");
   const [core, transport] = await Promise.all([
     readFile(preludePath, "utf8"),
     readFile(transportPath("broker"), "utf8"),
@@ -256,20 +257,12 @@ try {
   assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
   const generated = join(workdir, "services.generated.js");
   const binary = join(workdir, "services-native");
-  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-22"));
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-22"),
+  );
 
-  const compile = Bun.spawn([node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"], {
-    cwd: workdir,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
 
   server = Bun.spawn([binary], {
     cwd: workdir,
@@ -329,7 +322,10 @@ try {
   const t0 = performance.now();
   const all = await Promise.all(Array.from({ length: 8 }, () => get("/slow?ms=500")));
   const total = performance.now() - t0;
-  assert(all.every((r) => r.text === "slow done"), JSON.stringify(all));
+  assert(
+    all.every((r) => r.text === "slow done"),
+    JSON.stringify(all),
+  );
   assert(total < 1500, `8 concurrent 500 ms calls took ${Math.round(total)} ms`);
 
   // Cancellation: an aborted signal rejects at once, and the abort reaches the upstream
@@ -337,7 +333,11 @@ try {
   const abandonedBefore = slowAbandoned;
   const aborts = await get("/abort");
   assert.equal(aborts.status, 200, aborts.text);
-  assert.deepEqual(JSON.parse(aborts.text), { aborted: "AbortError fast", timedOut: "TimeoutError fast", already: "AbortError fast" });
+  assert.deepEqual(JSON.parse(aborts.text), {
+    aborted: "AbortError fast",
+    timedOut: "TimeoutError fast",
+    already: "AbortError fast",
+  });
   await Bun.sleep(300);
   assert.equal(slowAbandoned - abandonedBefore, 2, "both in-flight calls were stopped upstream");
 
@@ -375,7 +375,11 @@ try {
     context: { env: true, waitUntil: true },
   });
   // A client cannot call a method: without the edge's vouching, x-sb-rpc is just a header.
-  const forgedRpc = await fetch(`http://127.0.0.1:${port}/ping`, { method: "POST", headers: { "x-sb-rpc": "fail" }, body: "[\"x\"]" });
+  const forgedRpc = await fetch(`http://127.0.0.1:${port}/ping`, {
+    method: "POST",
+    headers: { "x-sb-rpc": "fail" },
+    body: '["x"]',
+  });
   assert.equal(await forgedRpc.text(), "pong");
 
   // A deployment calling itself, 30 levels deep: every level waits on the next at once.
@@ -394,19 +398,41 @@ export default {
   const legacyPort = freePort();
   const legacySource = join(workdir, "legacy.generated.js");
   const legacyBinary = join(workdir, "legacy-native");
-  await writeFile(legacySource, wrapNativeFetchHandler(legacyHandler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-21"));
-  const legacyCompile = Bun.spawnSync([node, resolve(porffor, "runtime/index.js"), "native", legacySource, "-o", legacyBinary, "-s", "-O0"], { cwd: workdir });
-  assert.equal(legacyCompile.exitCode, 0, `legacy compile failed:\n${legacyCompile.stderr}`);
+  await writeFile(
+    legacySource,
+    wrapNativeFetchHandler(
+      legacyHandler,
+      core.replace(TRANSPORT_MARKER, transport),
+      {},
+      bindings,
+      undefined,
+      "2026-10-21",
+    ),
+  );
+  await compileNative({
+    generated: legacySource,
+    binary: legacyBinary,
+    dir: workdir,
+    cacheRoot: workdir,
+    failure: "legacy compile failed",
+  });
   legacy = Bun.spawn([legacyBinary], {
     cwd: workdir,
-    env: { ...process.env, PORT: String(legacyPort), SB_BROKER_PORT: String(brokerServer.port), SB_BROKER_TOKEN: "native-services" },
+    env: {
+      ...process.env,
+      PORT: String(legacyPort),
+      SB_BROKER_PORT: String(brokerServer.port),
+      SB_BROKER_TOKEN: "native-services",
+    },
     stdout: "ignore",
     stderr: "inherit",
   });
   let legacyText = "";
   for (let attempt = 0; attempt < 50 && !legacyText; attempt++) {
     try {
-      legacyText = await (await fetch(`http://127.0.0.1:${legacyPort}/`, { signal: AbortSignal.timeout(20_000) })).text();
+      legacyText = await (
+        await fetch(`http://127.0.0.1:${legacyPort}/`, { signal: AbortSignal.timeout(20_000) })
+      ).text();
     } catch {
       await Bun.sleep(100);
     }

package/test/native-sockets-broker.ts

@@ -2,10 +2,10 @@ import assert from "node:assert/strict";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import net from "node:net";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import { Duplex } from "node:stream";
 import tls from "node:tls";
-import { ensurePorffor } from "../../toolchain/src/acquire";
+import { compileNative } from "./native-compile";
 import { createBroker, listen } from "../../wire/src/broker";
 import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
 
@@ -364,9 +364,6 @@ const get = async (path: string, base = port) => {
 };
 
 try {
-  const porffor = await ensurePorffor({ cacheRoot: workdir });
-  const node = Bun.which("node");
-  if (!node) throw new Error("native sockets test needs node on PATH");
   const [core, transport] = await Promise.all([
     readFile(preludePath, "utf8"),
     readFile(transportPath("broker"), "utf8"),
@@ -385,21 +382,7 @@ try {
       "2026-11-17",
     ),
   );
-  const compile = Bun.spawn(
-    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
-    {
-      cwd: workdir,
-      env: process.env,
-      stdout: "pipe",
-      stderr: "pipe",
-    },
-  );
-  const [exitCode, stdout, stderr] = await Promise.all([
-    compile.exited,
-    new Response(compile.stdout).text(),
-    new Response(compile.stderr).text(),
-  ]);
-  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
 
   const start = async (listening: number, brokerPort: number) => {
     const child = Bun.spawn([binary], {