@sproutboat/runtime 0.43.0 → 0.44.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @sproutboat/runtime
 
+## 0.44.0
+
+### Minor Changes
+
+- 8e08bb2: runtime: service bindings between apps on a sproutd host. `env.PEER.fetch()` and RPC on a callee's `WorkerEntrypoint` (`env.PEER.method(...)`) now work from compatibility date 2026-11-18, where the embedded transport had no `service.fetch` op and a call failed with `unknown op`. The caller sends the call as an HTTP request to the pseudo-host `sbsvc.<binding name in hex>` over its egress socket (`SB_EGRESS_FD`). The host looks the binding up in the services map it holds for the caller, answers `ok TICKET` with a connection to its own listener, and the transport sends the ticket as an `x-sb-svc-ticket` header. The host, which alone mints tickets, then delivers the request to the callee marked as a vouched service-binding call, so the callee's existing ingress (`x-sb-binding-call`, `x-sb-edge-token`, `x-sb-url`, `x-sb-rpc`, `x-sb-uncaught`) works unchanged. A call is bounded at 30 seconds per hop, with no depth cap: a loop unwinds on that timeout. Before 2026-11-18 a call fails as before, with a clearer message. A standalone binary, which has no peer apps, reports that. An older host answers the pseudo-host as an unresolvable name.
+
+### Patch Changes
+
+- 8e08bb2: runtime: the promise-returning R2 binding (compatibility date 2026-10-26 and later) has `createUploadUrl()` and `createDownloadUrl()` again, with the semantics of the legacy binding (the same `r2.transfer.create` call, now returning promises). They were missing there, so an app that moved past 2026-10-26 lost direct transfer with a "not a function" error. No date gate: the methods did not exist at those dates, so nothing that worked changes.
+
 ## 0.43.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/egress.test.ts

@@ -242,6 +242,82 @@ int main(void) {
   }
 });
 
+test('SB_EGRESS_FD: a service-binding call\'s "ok TICKET" answer leaves the ticket for the request', () => {
+  const source = readFileSync(transportFile, "utf8");
+  const block = source.slice(source.indexOf("// EGRESS-FD:BEGIN"), source.indexOf("// EGRESS-FD:END"));
+  const dir = mkdtempSync(join(tmpdir(), "sb-egress-ticket-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <errno.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <sys/time.h>
+#include <sys/wait.h>
+${block}
+static void answer(int via, const char* text, int fd) {
+  union { struct cmsghdr align; char space[CMSG_SPACE(sizeof(int))]; } control;
+  struct iovec io = { (void*)text, strlen(text) };
+  struct msghdr msg;
+  memset(&msg, 0, sizeof(msg));
+  msg.msg_iov = &io; msg.msg_iovlen = 1;
+  if (fd >= 0) {
+    msg.msg_control = control.space; msg.msg_controllen = sizeof(control.space);
+    struct cmsghdr* c = CMSG_FIRSTHDR(&msg);
+    c->cmsg_level = SOL_SOCKET; c->cmsg_type = SCM_RIGHTS; c->cmsg_len = CMSG_LEN(sizeof(int));
+    memcpy(CMSG_DATA(c), &fd, sizeof(fd));
+  }
+  sendmsg(via, &msg, 0);
+}
+int main(void) {
+  int pair[2];
+  socketpair(AF_UNIX, SOCK_STREAM, 0, pair);
+  if (fork() == 0) {
+    close(pair[0]);
+    char line[512];
+    int remote[2];
+    read(pair[1], line, sizeof(line) - 1);
+    socketpair(AF_UNIX, SOCK_STREAM, 0, remote);
+    answer(pair[1], "ok 0123abcd\\n", remote[0]);
+    read(pair[1], line, sizeof(line) - 1);
+    socketpair(AF_UNIX, SOCK_STREAM, 0, remote);
+    answer(pair[1], "ok\\n", remote[0]);
+    _exit(0);
+  }
+  close(pair[1]);
+  char refused[512] = "";
+  int fd = sb_egress_fd_connect(pair[0], "sbsvc.70", 80, refused, sizeof(refused));
+  printf("service %s ticket=%s\\n", fd >= 0 ? "yes" : "no", sb_svc_ticket);
+  fd = sb_egress_fd_connect(pair[0], "up.test", 80, refused, sizeof(refused));
+  printf("plain %s ticket=%s\\n", fd >= 0 ? "yes" : "no", sb_svc_ticket);
+  wait(0);
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-Wno-unused-result",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const run = Bun.spawnSync([join(dir, "check")]);
+    expect(run.stdout.toString().trimEnd().split("\n")).toEqual(["service yes ticket=0123abcd", "plain yes ticket="]);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("sb_tcp_connect sets TCP_NODELAY on the socket it returns", () => {
   // Nagle plus the peer's delayed ACK stalled every fresh HTTPS fetch about 44 ms on Linux (a TLS
   // handshake writes small flights). Timing is flaky on CI and loopback on macOS does not show

package/src/native-fetch-prelude.js

@@ -11174,6 +11174,31 @@ function __sbMakeR2(name) {
     resumeMultipartUpload(key, uploadId) {
       return upload(String(key), String(uploadId));
     },
+    // Direct transfer (a sproutboat extension, as on the legacy binding): a URL the client sends the bytes to or
+    // fetches them from without passing through the app. Promises, like the rest of this binding.
+    createUploadUrl(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.transfer.create", {
+          bucket: name,
+          key: String(key),
+          method: "upload",
+          maxBytes: o.maxBytes,
+          expiresIn: o.expiresIn,
+          sha256: o.sha256,
+          httpMetadata: o.httpMetadata || {},
+          customMetadata: o.customMetadata || {},
+        });
+        return { url: r.url, expiresAt: r.expiresAt };
+      });
+    },
+    createDownloadUrl(key, options) {
+      return attempt(() => {
+        const o = options || {};
+        const r = __sbRpc("r2.transfer.create", { bucket: name, key: String(key), method: "download", expiresIn: o.expiresIn });
+        return { url: r.url, expiresAt: r.expiresAt };
+      });
+    },
   };
 }
 
@@ -11970,6 +11995,8 @@ async function __sbRpcCall(binding, method, args) {
   const msg = {
     binding,
     url: "https://rpc.sproutboat.internal/" + method,
+    // Marks an RPC call for a transport that has to tell it from a fetch that carries an x-sb-rpc header of its own.
+    rpc: true,
     method: "POST",
     headers: [
       ["x-sb-rpc", method],

package/src/transport-embedded.js

@@ -2679,6 +2679,8 @@ static void sb_tcp_nodelay(int fd) {
 // broken exchange closes N for good, so a late answer can never be taken for the
 // next one.
 static int sb_egress_fd_ask(int via, const char* host, int port, char* refused, size_t refused_len);
+// The ticket of the last service-binding connect on this thread ("" for any other connect).
+static __thread char sb_svc_ticket[72];
 static int sb_egress_fd_connect(int via, const char* host, int port, char* refused, size_t refused_len) {
   static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
   pthread_mutex_lock(&lock);
@@ -2714,7 +2716,16 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
     return -1;
   }
   answer[got - 1] = 0;
+  // "ok TICKET" (a service-binding call, host "sbsvc.HEX"): the host connected us to itself and the
+  // ticket, which only it could mint, tells it who is calling. The request carries it as a header.
+  sb_svc_ticket[0] = 0;
+  if (!strncmp(answer, "ok ", 3) && fd >= 0 && strlen(answer + 3) > 0 && strlen(answer + 3) < sizeof(sb_svc_ticket)) {
+    snprintf(sb_svc_ticket, sizeof(sb_svc_ticket), "%s", answer + 3);
+    answer[2] = 0;
+  }
   if (!strcmp(answer, "ok") && fd >= 0) {
+    // A service call is bounded per hop at 30 s, as the callee's own wall limit is.
+    if (sb_svc_ticket[0]) tv.tv_sec = 30;
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
     sb_tcp_nodelay(fd);
@@ -2885,11 +2896,22 @@ static char* sb_error_json(const char* prefix, const char* detail) {
 static char* sb_http_plain(const char* host, int port, const char* path, const char* method,
                            const char* headers, const char* body, size_t body_len) {
   char refused[512] = "";
+  sb_svc_ticket[0] = 0;
   int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
   if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
+  // A service-binding call: the ticket the host minted for it goes first among the headers.
+  sb_buf tagged = { 0, 0, 0 };
+  if (sb_svc_ticket[0]) {
+    sb_puts(&tagged, "x-sb-svc-ticket: ");
+    sb_puts(&tagged, sb_svc_ticket);
+    sb_puts(&tagged, "\r\n");
+    if (headers && *headers) sb_puts(&tagged, headers);
+    headers = tagged.p;
+  }
   sb_buf req = { 0, 0, 0 };
   sb_build_request(&req, host, port, 80, path, method, headers, body, body_len);
+  free(tagged.p);
   size_t sent = 0;
   while (sent < req.len) {
     long n = write(fd, req.p + sent, req.len - sent);
@@ -5154,24 +5176,73 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, found: false, status: 404, body: "Not Found" };
   }
 
-  if (op === "fetch") {
-    const url = new URL(String(msg.url));
-    const tls = url.protocol === "https:";
-    if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
+  // A service-binding call (compatibility date 2026-11-18): the host the app runs on routes it to the
+  // callee. The call is an HTTP request to the pseudo-host "sbsvc.HEX" (the binding's name in hex): the
+  // host sees the name on the egress socket the question came in on, finds the callee in its services
+  // map and answers "ok TICKET" with a connection to its own listener. __sbHttpRaw sends the ticket as
+  // a header (sb_http_plain) and the host's frontend, which alone mints tickets, delivers the request
+  // to the callee marked as a service-binding call. See sproutd's docs/bindings.md, "Service bindings".
+  if (op === "fetch" || op === "service.fetch") {
+    const service = op === "service.fetch";
+    let hostname;
+    let port;
+    let pathname;
+    let tls = false;
     let headerText = "";
+    if (service) {
+      if (__sbCompatDate() < "2026-11-18") {
+        throw new Error(
+          "service binding " + msg.binding + " needs compatibility_date 2026-11-18 or later to reach another app on this host",
+        );
+      }
+      if (!__sbEnv("SB_EGRESS_FD")) {
+        throw new Error(
+          "service binding " + msg.binding + " has no app to reach here: a standalone binary has no peer apps, only a platform host (sproutd) has",
+        );
+      }
+      const binding = String(msg.binding);
+      let hex = "";
+      for (let i = 0; i < binding.length; i++) {
+        const c = binding.charCodeAt(i);
+        if (c > 127) throw new Error("service binding names are ASCII: " + binding);
+        hex += (c < 16 ? "0" : "") + c.toString(16);
+      }
+      if (hex.length > 200) throw new Error("service binding name too long: " + binding);
+      hostname = "sbsvc." + hex;
+      port = "80";
+      // The callee sees the URL its caller passed (x-sb-url, vouched for by the host); the request line
+      // carries only its path.
+      try {
+        const parsed = new URL(String(msg.url));
+        pathname = parsed.pathname + parsed.search;
+        headerText += "x-sb-url: " + parsed.href + "\r\n";
+      } catch (e) {
+        const p = String(msg.url || "/");
+        pathname = p.charAt(0) === "/" ? p : "/" + p;
+      }
+    } else {
+      const url = new URL(String(msg.url));
+      tls = url.protocol === "https:";
+      if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
+      hostname = url.hostname;
+      port = url.port ? url.port : tls ? "443" : "80";
+      pathname = url.pathname + url.search;
+    }
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
       const key = String(pairs[i][0]).toLowerCase();
       // Host, Connection and Content-Length are ours to set.
       if (key === "host" || key === "connection" || key === "content-length") continue;
+      // The host's markers are its own: the caller's x-sb-* headers do not travel. Only an RPC call (the prelude's
+      // __sbRpcCall, msg.rpc) sends x-sb-rpc, which names the method.
+      if (service && key.slice(0, 5) === "x-sb-" && !(msg.rpc === true && key === "x-sb-rpc")) continue;
       headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
     }
-    const port = url.port ? url.port : tls ? "443" : "80";
     const asyncId = msg.asyncId > 0 ? msg.asyncId : 0;
     const raw = __sbHttpRaw(
-      url.hostname,
+      hostname,
       port,
-      url.pathname + url.search,
+      pathname,
       String(msg.method || "GET").toUpperCase(),
       headerText,
       msg.body == null ? "" : String(msg.body),

package/test/native-r2-transfer.ts

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { compileNative } from "./native-compile";
+import { createBroker, listen } from "../../wire/src/broker";
+import { EMPTY_BINDINGS, preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// Direct R2 transfer on the promise-returning binding (compatibility date 2026-10-26 and later): createUploadUrl()
+// and createDownloadUrl() exist there as on the legacy binding, return promises, and answer {url, expiresAt}.
+const handler = `
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.pathname === "/ping") return new Response("pong");
+    const up = env.UPLOADS.createUploadUrl("k", { maxBytes: 10 });
+    const upIsPromise = up instanceof Promise;
+    const upload = await up;
+    await env.UPLOADS.put("k", "hello");
+    const down = env.UPLOADS.createDownloadUrl("k");
+    const downIsPromise = down instanceof Promise;
+    const download = await down;
+    return Response.json({
+      upIsPromise,
+      downIsPromise,
+      upload: { url: typeof upload.url, expiresAt: typeof upload.expiresAt },
+      download: { url: typeof download.url, expiresAt: typeof download.expiresAt },
+    });
+  },
+};
+`;
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const port = freePort();
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-r2-transfer-"));
+const bindings = { ...EMPTY_BINDINGS, r2: ["UPLOADS"] };
+const broker = createBroker({
+  db: join(workdir, "state.sqlite"),
+  token: "native-r2",
+  bindings: { ...bindings, resources: {} },
+});
+const brokerServer = listen(broker, "127.0.0.1", 0);
+let server: ReturnType<typeof Bun.spawn> | undefined;
+const get = async (path: string) => {
+  const res = await fetch(`http://127.0.0.1:${port}${path}`, { signal: AbortSignal.timeout(20_000) });
+  return { status: res.status, text: await res.text() };
+};
+try {
+  const [core, transport] = await Promise.all([
+    readFile(preludePath, "utf8"),
+    readFile(transportPath("broker"), "utf8"),
+  ]);
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "r2.generated.js");
+  const binary = join(workdir, "r2-native");
+  await writeFile(
+    generated,
+    wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, transport), {}, bindings, undefined, "2026-10-26"),
+  );
+  await compileNative({ generated, binary, dir: workdir, cacheRoot: workdir });
+  server = Bun.spawn([binary], {
+    cwd: workdir,
+    env: {
+      ...process.env,
+      PORT: String(port),
+      SB_BROKER_PORT: String(brokerServer.port),
+      SB_BROKER_TOKEN: "native-r2",
+    },
+    stdout: "ignore",
+    stderr: "inherit",
+  });
+  let started = false;
+  for (let attempt = 0; attempt < 50 && !started; attempt++) {
+    try {
+      started = (await get("/ping")).text === "pong";
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(started, "compiled R2 handler did not start");
+  const answer = await get("/");
+  assert.equal(answer.status, 200, answer.text);
+  assert.deepEqual(JSON.parse(answer.text), {
+    upIsPromise: true,
+    downIsPromise: true,
+    upload: { url: "string", expiresAt: "string" },
+    download: { url: "string", expiresAt: "string" },
+  });
+  console.log("native R2 direct transfer: ok");
+} finally {
+  server?.kill();
+  brokerServer.stop();
+  await rm(workdir, { recursive: true, force: true });
+}