@sproutboat/runtime 0.6.5 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @sproutboat/runtime
 
+## 0.7.0
+
+### Minor Changes
+
+- 6998a15: R2 object bytes no longer live inside SQLite, on either transport (baronunread/sproutboat#56). Every `put()` used to bind the whole object into a `body` column, and every `get()` read it back out — doubling the object through SQLite's own page cache/WAL machinery on top of the buffer it already arrived in, which was the real driver of #56's "large uploads make memory skyrocket" complaint (the JSON-escaping half of that was already fixed in #63).
+  
+  Objects now live in their own file under `r2-blobs/`, named by a hash of bucket+key (so unicode keys and directory traversal are non-issues):
+  
+  - **Embedded (standalone):** `<data-dir>/r2-blobs/` — `sb_r2_put_c`/`sb_r2_get_c` write/read the file directly via C `fopen`/`fwrite`/`fread`, no SQLite blob column at all. `sb_r2_delete_blob` removes the file on delete.
+  - **Broker:** colocated with whichever store file already holds that bucket's metadata — the main `db` for a bare-string binding, the resource's own file under `resourceDir` for an account-level one (#74) — so blobs persist across a redeploy exactly when that metadata does. `:memory:` stores (tests, local dev) fall back to an in-memory map.
+  
+  No migration: this is a schema change for new writes going forward, not a converter for objects already stored inline from before.
+  
+  Verified end-to-end against both transports (kitchen-sink's full conformance suite, 24/24 standalone + 27/27 broker) and with new unit tests for file-backed persistence, the `:memory:` fallback, and a real binary round-trip over the v1 wire protocol.
+  
+  **Known limitation found while verifying this, not fixed here:** a binary `put()` body (bytes ≥ 0x80) is corrupted on the way *in*, before it ever reaches storage — `porf_native_fetch_read_value` (the function every inline-C string read in the runtime goes through) always UTF-8-encodes a Latin-1-range string on read, which is correct for genuine text but wrong for opaque bytes coming off a raw HTTP body. This predates this change (the old SQLite-blob path had the identical corruption) and is not something the storage backend can fix — it needs an input-side counterpart to `#176`'s `x-sb-raw-body` marker, or real `ArrayBuffer`/`Uint8Array` body support (the upstream ask already filed as Draft G in `patches/UPSTREAM.md`).
+
+### Patch Changes
+
+- 188d8e4: Fix (baronunread/sproutboat#184): a `put()` body (R2, both transports) with bytes ≥ 0x80 was corrupted on the way *in*, before storage — `porf_native_fetch_read_value` (the one function every inline-C string read in the runtime funnels through) always UTF-8-encodes a Latin-1-range value, correct for genuine text, wrong for opaque bytes off a raw HTTP upload. A 256-byte binary upload landed as 384 stored bytes.
+  
+  `__sbR2PutRaw` (embedded) and `__sbCallBin` (broker, the only caller that ever passes it a real body) now try `porf_native_fetch_read_raw_bytes` first, falling back to the normal encoding path only for a genuine multi-byte JS string (which isn't a "bytestring" and so isn't eligible for the raw read anyway). This predates the #56 storage change — the old SQLite-blob `put()` called the identical `read_value`, so it was equally corrupted; the existing R2 conformance check never caught it because it only ever exercises a plain ASCII string.
+  
+  Also fixes an adjacent, independently pre-existing bug found while verifying this: `R2Object.text()`/`.json()` returned the raw stored bytes without UTF-8-decoding them, producing mojibake for any object holding real text beyond ASCII — the same gap `__sbRawBodyResponse` already closed for assets/fetch/service-binding responses. Same fix here (lazy, memoized `__sbFromUtf8` decode).
+  
+  Verified end-to-end against both transports with a real binary upload (`curl --data-binary`, not a synthetic string): stored bytes and `.body`/`.text()` now round-trip byte-for-byte/correctly for binary content, Latin-1 text, and multi-byte Unicode (CJK). Full kitchen-sink conformance stays green on both transports (24/24 standalone, 27/27 broker).
+  
+  **Known remaining gap, not fixed here:** a genuine astral-plane character (an emoji, anything outside the Basic Multilingual Plane, encoded as a UTF-16 surrogate pair) still encodes to the wrong number of UTF-8 bytes on write — confirmed identical before and after this fix, so it's a separate, deeper bug in Porffor's own UTF-16→UTF-8 encoder (the `porf_native_fetch_read_value` "string" branch), not something in sproutboat's own code. Filing separately if it recurs; out of scope for this fix.
+
+## 0.6.6
+
+### Patch Changes
+
+- c2b0359: Fix (baronunread/sproutboat#179): `__sbEntry` called `handlers.fetch()` (and
+  the `scheduled`/`queue`/`alarm` trigger paths) with no try/catch at all. Any
+  synchronous throw, or an async handler's rejected promise, propagated all the
+  way up and took down the entire process — not just the request that hit it,
+  but every other in-flight and future request on that sprout, until whatever
+  supervises it restarts the binary.
+  
+  A throw from `fetch()` now returns a 500 instead. `scheduled()` and `alarm()`
+  still reply 204 either way (they had no failure signal before this either).
+  A throw from `queue()` falls through to the existing default-ack pass, the
+  same outcome as a handler that returns without calling `ack()`/`retry()` on
+  every message.
+  
+  `entry-crash.test.js` covers the fetch path: a sync throw, an async
+  rejection, and that a throwing request doesn't stop the next one from being
+  served.
+
 ## 0.6.5
 
 ### Patch Changes

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "license": "MIT",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/baronunread/sproutboat-packages.git",
+    "directory": "packages/runtime"
+  },
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {

package/src/entry-crash.test.js

@@ -0,0 +1,63 @@
+// #179 — an uncaught handler exception must turn into a 500 (or, for
+// scheduled/queue/alarm, a swallowed failure), never a process-crashing
+// throw/rejection out of __sbEntry. Same lift-the-prelude-and-eval approach
+// as client-ip.test.js: the prelude is prepended as text and cannot import.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+
+// oxlint-disable-next-line no-function-constructor -- lifting the whole text-only prelude for test
+const load = new Function(
+  "Porffor",
+  "__envMap",
+  `${src}
+   return { __sbEntry, __sbRegisterDO };`,
+);
+// Every Porffor.c`...` block in the prelude only runs inside a function body
+// (never at load time), so a no-op tag covers all of them: __sbCpuMs and
+// __sbEnv just see an empty result, same as "native op returned nothing."
+const H = load(
+  { c: () => "" },
+  new Proxy({}, { get: () => undefined }),
+);
+
+const req = (overrides = {}) => ({
+  headers: { get: (k) => (overrides.headers && overrides.headers[k.toLowerCase()]) ?? null },
+  cf: undefined,
+  ...overrides,
+});
+
+test("a synchronously-throwing fetch handler returns 500, not a throw", async () => {
+  const handlers = {
+    fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("an async fetch handler whose promise rejects returns 500, not a rejection", async () => {
+  const handlers = {
+    async fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("a throwing fetch handler doesn't stop the next request from being served", async () => {
+  const handlers = {
+    fetch(request) {
+      if (request.boom) throw new Error("boom");
+      return new Response("ok");
+    },
+  };
+  const first = await H.__sbEntry(handlers, req({ boom: true }));
+  expect(first.status).toBe(500);
+  const second = await H.__sbEntry(handlers, req({ boom: false }));
+  expect(await second.text()).toBe("ok");
+});

package/src/native-fetch-prelude.js

@@ -1104,11 +1104,18 @@ function __sbR2Object(meta, body) {
   };
   if (body != null) {
     obj.body = body;
+    // #184 — `body` is raw bytes (a bytestring), not decoded text: `.text()`
+    // returning it verbatim produced mojibake for any object holding real
+    // UTF-8 content, the same gap __sbRawBodyResponse already closed for
+    // assets/fetch/service-binding responses. Same fix here: decode lazily,
+    // once, on first read.
+    let decoded = null;
     obj.text = function () {
-      return body;
+      if (decoded === null) decoded = __sbFromUtf8(body);
+      return decoded;
     };
     obj.json = function () {
-      return JSON.parse(body);
+      return JSON.parse(obj.text());
     };
   }
   return obj;
@@ -1703,15 +1710,31 @@ async function __sbDrainAll(pending) {
 // one *this* async function creates, not a `.then()` derived from someone
 // else's — see the note below on why that distinction matters here.
 async function __sbFetchWithDrain(res, tasks) {
-  const r = res && __sbIsFn(res.then) ? await res : res;
+  let r;
+  try {
+    r = res && __sbIsFn(res.then) ? await res : res;
+  } catch {
+    // #179 — a rejected handler promise must not take the process down with it.
+    r = __sbErrorResponse();
+  }
   await __sbDrainWaitUntil(tasks);
   return r;
 }
 
+// #179 — turn an uncaught handler exception into a 500 instead of letting it
+// propagate past __sbEntry and crash the whole server.
+function __sbErrorResponse() {
+  return new Response("Internal Server Error", { status: 500 });
+}
+
 // Shared by alarm and scheduled: both reply with an empty 204 once their
 // handler (and anything it queued via `waitUntil`) has settled.
 async function __sb204WithDrain(res, tasks) {
-  if (res && __sbIsFn(res.then)) await res;
+  try {
+    if (res && __sbIsFn(res.then)) await res;
+  } catch {
+    // #179 — same rule as fetch: a rejected scheduled/alarm promise must not crash the process.
+  }
   await __sbDrainWaitUntil(tasks);
   return new Response("", { status: 204 });
 }
@@ -1746,7 +1769,14 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __res = handlers.fetch(request, ctx);
+    let __res;
+    try {
+      __res = handlers.fetch(request, ctx);
+    } catch {
+      // #179 — a synchronous throw anywhere in the handler must not take the
+      // whole process (and every other in-flight request) down with it.
+      return __sbErrorResponse();
+    }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
     if (__sbTasks.length || (__res && __sbIsFn(__res.then))) return __sbFetchWithDrain(__res, __sbTasks);
@@ -1766,10 +1796,16 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __sres = handlers.scheduled(
-      { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
-      ctx,
-    );
+    let __sres;
+    try {
+      __sres = handlers.scheduled(
+        { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
+        ctx,
+      );
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     if (__sbTasks.length || (__sres && __sbIsFn(__sres.then))) return __sb204WithDrain(__sres, __sbTasks);
     return new Response("", { status: 204 });
   }
@@ -1797,7 +1833,13 @@ globalThis.__sbEntry = function (handlers, request) {
     const body = __sbReadJson(request);
     const inst = __sbGetDOInstance(String(body.cls || ""), String(body.id || ""));
     if (!__sbIsFn(inst.alarm)) return new Response("no alarm handler", { status: 404 });
-    const __ares = inst.alarm();
+    let __ares;
+    try {
+      __ares = inst.alarm();
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     // Was fire-and-forget before: an async `alarm()` and any `state.waitUntil()`
     // it queued were both dropped the moment 204 went out. Await both.
     if (inst.__sbTasks.length || (__ares && __sbIsFn(__ares.then))) return __sb204WithDrain(__ares, inst.__sbTasks);
@@ -1845,11 +1887,18 @@ async function __sbRunQueueBatch(handlers, body, ctx) {
       for (let i = 0; i < messages.length; i++) messages[i].retry();
     },
   };
-  const __qres = handlers.queue(batch, ctx);
-  // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
-  // the response go out) before its own `await`s did, so any ack()/retry()
-  // past the first one never counted.
-  if (__qres && __sbIsFn(__qres.then)) await __qres;
+  try {
+    const __qres = handlers.queue(batch, ctx);
+    // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
+    // the response go out) before its own `await`s did, so any ack()/retry()
+    // past the first one never counted.
+    if (__qres && __sbIsFn(__qres.then)) await __qres;
+  } catch {
+    // #179 — a throw here must not crash the process. Whatever ack()/retry()
+    // calls the handler made before throwing still count; anything it never
+    // touched falls through to the default-ack pass below, same as a handler
+    // that returns without calling ack()/retry() on every message.
+  }
   // default: any message neither acked nor retried is treated as acked
   for (let i = 0; i < messages.length; i++) {
     if (acked.indexOf(messages[i].id) === -1 && retried.indexOf(messages[i].id) === -1) acked.push(messages[i].id);

package/src/transport-broker.js

@@ -19,6 +19,13 @@
 
 // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
 Porffor.c`
+// baronunread/sproutboat#176 — defined in render.js, alongside
+// porf_native_fetch_read_value (which every inline-C block below already
+// calls with no forward declaration of its own — that one gets one from
+// Porffor's own generated prototypes, this one doesn't, since it's a local
+// patch addition, not something Porffor knows to prototype early).
+extern int porf_native_fetch_read_raw_bytes(jsval value, const char** out_buf, size_t* out_len);
+
 static int sb_io_all(int fd, unsigned char* buf, size_t len, int writing) {
   size_t done = 0;
   while (done < len) {
@@ -237,8 +244,15 @@ function __sbCallBin(reqJson, body) {
   Porffor.c`
     const char* __j; size_t __jl; char* __jo = 0;
     porf_native_fetch_read_value(reqJson, &__j, &__jl, &__jo);
+    // baronunread/sproutboat#184 -- the only real (non-empty) body this ever
+    // carries today is an R2 put(); read raw, not through read_value's
+    // bytestring branch, which always UTF-8-encodes (right for text, wrong
+    // for opaque bytes off a raw HTTP upload). A genuine multi-byte JS string
+    // isn't a bytestring, so it falls back to the encoding path unaffected.
     const char* __b; size_t __bl; char* __bo = 0;
-    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    if (porf_native_fetch_read_raw_bytes(body, &__b, &__bl) != 0) {
+      porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    }
     char* __resp = 0; size_t __resplen = 0;
     int __rc = sb_broker_roundtrip_v1(__j, __jl, __b, __bl, &__resp, &__resplen);
     if (__jo) free(__jo);

package/src/transport-embedded.js

@@ -53,6 +53,13 @@ extern int64_t sqlite3_last_insert_rowid(sqlite3*);
 extern const char* sqlite3_errmsg(sqlite3*);
 extern int sqlite3_close(sqlite3*);
 
+// baronunread/sproutboat#176 — defined in render.js, alongside
+// porf_native_fetch_read_value (which every inline-C block below already
+// calls with no forward declaration of its own — that one gets one from
+// Porffor's own generated prototypes, this one doesn't, since it's a local
+// patch addition, not something Porffor knows to prototype early).
+extern int porf_native_fetch_read_raw_bytes(jsval value, const char** out_buf, size_t* out_len);
+
 #define SB_SQLITE_ROW 100
 #define SB_SQLITE_DONE 101
 #define SB_SQLITE_TRANSIENT ((void*)-1)
@@ -240,11 +247,14 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
   return 0;
 }
 
-// --- R2 bodies, without the JSON detour -------------------------------------
-// An object's bytes never enter a JSON frame: they arrive as their own string
-// parameter and go straight into a BLOB column. That matters for size as much
-// as correctness — escaping a binary body inflates it several times over, and
-// the arena grows to fit the biggest thing it ever had to hold.
+// --- R2 bodies, without the JSON detour or the SQLite detour ----------------
+// An object's bytes never enter a JSON frame (they arrive as their own string
+// parameter) and never enter SQLite either (baronunread/sproutboat#56): they
+// go straight to their own file under "<data-dir>/r2-blobs/", named by a hash
+// of bucket+key so unicode keys and directory traversal are both non-issues.
+// Doubling every object through SQLite's own page cache on top of the buffer
+// it already arrived in was the real cost behind #56's "large uploads make
+// memory skyrocket" complaint, not just the JSON-escaping #63 already fixed.
 
 static void sb_hex32(const unsigned char* in, char* out) {
   static const char* d = "0123456789abcdef";
@@ -269,7 +279,24 @@ static void sb_iso_now(char* out, size_t cap) {
   strftime(out, cap, "%Y-%m-%dT%H:%M:%S.000Z", &g);
 }
 
-// Returns malloc'd JSON metadata; the body itself is never serialised.
+// "<dir-of-store_path>/r2-blobs/<sha256(bucket 0x1e key)>.blob" — deterministic,
+// so no extra column is needed to find an object's file back.
+static void sb_r2_blob_path(char* out, size_t cap, const char* store_path, const char* bucket, const char* key) {
+  const char* slash = strrchr(store_path, '/');
+  int dirlen = slash ? (int)(slash - store_path) : 0;
+  br_sha256_context ctx;
+  br_sha256_init(&ctx);
+  br_sha256_update(&ctx, bucket, strlen(bucket));
+  br_sha256_update(&ctx, "\x1e", 1); // separator: a bucket/key split never collides across it
+  br_sha256_update(&ctx, key, strlen(key));
+  unsigned char digest[32];
+  br_sha256_out(&ctx, digest);
+  char hex[65];
+  sb_hex32(digest, hex);
+  snprintf(out, cap, "%.*s/r2-blobs/%s.blob", dirlen, store_path, hex);
+}
+
+// Returns malloc'd JSON metadata; the body itself is never serialised into it.
 static char* sb_r2_put_c(const char* path, const char* bucket, const char* key, const char* body, size_t bodylen,
                          const char* http_json, const char* custom_json) {
   sb_buf out = { 0, 0, 0 };
@@ -282,10 +309,19 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   char uploaded[40];
   sb_iso_now(uploaded, sizeof(uploaded));
 
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  sb_mkdirs(blobpath);
+  FILE* f = fopen(blobpath, "wb");
+  if (!f) { sb_puts(&out, "{\"ok\":false,\"error\":\"cannot write object\"}"); return out.p; }
+  size_t written = bodylen ? fwrite(body, 1, bodylen, f) : 0;
+  fclose(f);
+  if (written != bodylen) { sb_puts(&out, "{\"ok\":false,\"error\":\"short write\"}"); return out.p; }
+
   sqlite3_stmt* st = 0;
   const char* sql =
-    "INSERT INTO r2 (bucket, key, body, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7,?8) "
-    "ON CONFLICT (bucket, key) DO UPDATE SET body=?3, size=?4, etag=?5, uploaded=?6, http_json=?7, custom_json=?8";
+    "INSERT INTO r2 (bucket, key, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7) "
+    "ON CONFLICT (bucket, key) DO UPDATE SET size=?3, etag=?4, uploaded=?5, http_json=?6, custom_json=?7";
   if (sqlite3_prepare_v2(db, sql, -1, &st, 0) != 0 || !st) {
     sb_puts(&out, "{\"ok\":false,\"error\":");
     const char* m = sqlite3_errmsg(db);
@@ -295,12 +331,11 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   }
   sqlite3_bind_text(st, 1, bucket, -1, SB_SQLITE_TRANSIENT);
   sqlite3_bind_text(st, 2, key, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_blob(st, 3, body, (int)bodylen, SB_SQLITE_STATIC);
-  sqlite3_bind_int64(st, 4, (int64_t)bodylen);
-  sqlite3_bind_text(st, 5, etag, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 6, uploaded, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 7, http_json && *http_json ? http_json : "{}", -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 8, custom_json && *custom_json ? custom_json : "{}", -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_int64(st, 3, (int64_t)bodylen);
+  sqlite3_bind_text(st, 4, etag, -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 5, uploaded, -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 6, http_json && *http_json ? http_json : "{}", -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 7, custom_json && *custom_json ? custom_json : "{}", -1, SB_SQLITE_TRANSIENT);
   int rc = sqlite3_step(st);
   sqlite3_finalize(st);
   if (rc != SB_SQLITE_DONE) { sb_puts(&out, "{\"ok\":false,\"error\":\"r2 put failed\"}"); return out.p; }
@@ -311,30 +346,50 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   return out.p;
 }
 
-// Body bytes straight into a Porffor bytestring.
-//
-// The allocation happens while the statement is still open, so sqlite's own
-// buffer is the source and there is no intermediate copy: one 8 MB object means
-// one 8 MB allocation, not two. Returns the bytestring pointer, or 0.
+// Reads the object's file into a Porffor bytestring. One malloc (the file
+// read) plus the bytestring's own allocation — no SQLite page-cache copy on
+// top, and no growing single database file holding every object ever put.
+// Returns the bytestring pointer, or 0.
 static u32 sb_r2_get_c(const char* path, const char* bucket, const char* key, int* found) {
   *found = 0;
   int idx = sb_db_for(path);
   if (idx < 0) return 0;
   sqlite3_stmt* st = 0;
-  if (sqlite3_prepare_v2(sb_dbs[idx], "SELECT body FROM r2 WHERE bucket = ? AND key = ?", -1, &st, 0) != 0 || !st) return 0;
+  if (sqlite3_prepare_v2(sb_dbs[idx], "SELECT 1 FROM r2 WHERE bucket = ? AND key = ?", -1, &st, 0) != 0 || !st) return 0;
   sqlite3_bind_text(st, 1, bucket, -1, SB_SQLITE_TRANSIENT);
   sqlite3_bind_text(st, 2, key, -1, SB_SQLITE_TRANSIENT);
-  u32 out = 0;
-  if (sqlite3_step(st) == SB_SQLITE_ROW) {
-    int n = sqlite3_column_bytes(st, 0);
-    const void* blob = sqlite3_column_blob(st, 0);
-    out = porf_native_fetch_alloc_bytestring((const char*)(blob ? blob : ""), (size_t)(n > 0 ? n : 0));
-    *found = 1;
-  }
+  int has_row = sqlite3_step(st) == SB_SQLITE_ROW;
   sqlite3_finalize(st);
+  if (!has_row) return 0;
+
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  FILE* f = fopen(blobpath, "rb");
+  // A metadata row with no blob file (deleted out from under it, disk issue)
+  // reads as not-found rather than crashing.
+  if (!f) return 0;
+  fseek(f, 0, SEEK_END);
+  long size = ftell(f);
+  rewind(f);
+  if (size < 0) { fclose(f); return 0; }
+  char* buf = (char*)malloc((size_t)size > 0 ? (size_t)size : 1);
+  size_t rd = size > 0 ? fread(buf, 1, (size_t)size, f) : 0;
+  fclose(f);
+  if (!buf || rd != (size_t)size) { free(buf); return 0; }
+  u32 out = porf_native_fetch_alloc_bytestring(buf, (size_t)size);
+  free(buf);
+  *found = 1;
   return out;
 }
 
+// Best-effort: a metadata row deleted with no blob file (or vice versa) is
+// still a correct end state, so a missing file here is not an error.
+static void sb_r2_delete_blob(const char* path, const char* bucket, const char* key) {
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  unlink(blobpath);
+}
+
 // Run a script: one or more statements separated by semicolons. sqlite3_exec
 // handles the whole string, which prepare/step does not — it compiles the first
 // statement and silently ignores the rest, so a schema built from one exec call
@@ -929,10 +984,18 @@ function __sbR2PutRaw(path, bucket, key, body, httpJson, customJson) {
     char* __custom = (char*)malloc(__cl + 1); memcpy(__custom, __c, __cl); __custom[__cl] = 0;
     if (__co) free(__co);
 
-    // The body is read in place and handed straight to sqlite3_bind_blob: no
-    // copy beyond what the binding needs, and no escaping at all.
+    // baronunread/sproutboat#184 -- read raw, not through porf_native_fetch_
+    // read_value's bytestring branch, which always UTF-8-encodes (correct for
+    // genuine text, wrong for opaque bytes -- request.body off a raw HTTP
+    // upload is exactly that). R2 is object storage: put()/get() need to be
+    // byte-preserving, not text-preserving. Only a bytestring-typed value can
+    // be read raw; a genuine multi-byte JS string (real Unicode, "string" type
+    // rather than "bytestring") isn't one, so it falls back to the normal
+    // encoding path, which already handles that type correctly.
     const char* __b; size_t __bl; char* __bo = 0;
-    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    if (porf_native_fetch_read_raw_bytes(body, &__b, &__bl) != 0) {
+      porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    }
     char* __out = sb_r2_put_c(__path, __bucket, __key, __b, __bl, __http, __custom);
     if (__bo) free(__bo);
 
@@ -974,6 +1037,32 @@ function __sbR2GetRaw(path, bucket, key) {
   return res;
 }
 
+// R2 delete: also removes the object's own file, not just the metadata row
+// (#56 — sb_r2_delete_blob is best-effort, a missing file is not an error).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbR2DeleteRaw(path, bucket, key) {
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+
+    const char* __bk; size_t __bkl; char* __bko = 0;
+    porf_native_fetch_read_value(bucket, &__bk, &__bkl, &__bko);
+    char* __bucket = (char*)malloc(__bkl + 1); memcpy(__bucket, __bk, __bkl); __bucket[__bkl] = 0;
+    if (__bko) free(__bko);
+
+    const char* __k; size_t __kl; char* __ko = 0;
+    porf_native_fetch_read_value(key, &__k, &__kl, &__ko);
+    char* __key = (char*)malloc(__kl + 1); memcpy(__key, __k, __kl); __key[__kl] = 0;
+    if (__ko) free(__ko);
+
+    sb_r2_delete_blob(__path, __bucket, __key);
+    free(__path); free(__bucket); free(__key);
+  `;
+}
+
 // Multi-statement exec. Same string-param pattern as __sbSqlRaw.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbSqlScriptRaw(path, sql) {
@@ -1158,9 +1247,11 @@ function __sbEnsureSchema() {
     s,
     "CREATE TABLE IF NOT EXISTS kv (ns TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (ns, key))",
   );
+  // #56 — no `body` column: an object's bytes live in their own file under
+  // "<data-dir>/r2-blobs/" (sb_r2_put_c/sb_r2_get_c), never in the sqlite row.
   __sbSql(
     s,
-    "CREATE TABLE IF NOT EXISTS r2 (bucket TEXT NOT NULL, key TEXT NOT NULL, body TEXT NOT NULL, size INTEGER NOT NULL, " +
+    "CREATE TABLE IF NOT EXISTS r2 (bucket TEXT NOT NULL, key TEXT NOT NULL, size INTEGER NOT NULL, " +
       "etag TEXT NOT NULL, uploaded TEXT NOT NULL, http_json TEXT NOT NULL DEFAULT '{}', custom_json TEXT NOT NULL DEFAULT '{}', " +
       "PRIMARY KEY (bucket, key))",
   );
@@ -1350,38 +1441,33 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, path: dest, bytes: reply.bytes };
   }
 
+  // r2.put/get route through the same raw C path (__sbR2PutRaw/__sbR2GetRaw,
+  // sb_r2_put_c/sb_r2_get_c) the R2 binding's own put()/get() use — reachable
+  // separately only via a raw `__sbCall(op:"r2.put"/"r2.get")`, which nothing
+  // in this codebase does today, but broker.ts's dispatch() answers the same
+  // two ops, so the contract stays identical on both backends either way
+  // (#56: neither one keeps object bytes in SQLite any more).
   if (op === "r2.put") {
-    const body = String(msg.body == null ? "" : msg.body);
-    const etag = __sbHex(16);
-    __sbSql(
-      store,
-      "INSERT INTO r2 (bucket, key, body, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7,?8) " +
-        "ON CONFLICT (bucket, key) DO UPDATE SET body=?3, size=?4, etag=?5, uploaded=?6, http_json=?7, custom_json=?8",
-      [
-        msg.bucket,
-        msg.key,
-        body,
-        body.length,
-        etag,
-        new Date().toISOString(),
+    const reply = JSON.parse(
+      __sbR2PutRaw(
+        store,
+        String(msg.bucket),
+        String(msg.key),
+        String(msg.body == null ? "" : msg.body),
         JSON.stringify(msg.httpMetadata || {}),
         JSON.stringify(msg.customMetadata || {}),
-      ],
+      ),
     );
-    return {
-      ok: true,
-      object: { key: msg.key, size: body.length, etag, uploaded: new Date().toISOString() },
-    };
+    if (reply.ok === false) throw new Error("r2 put: " + reply.error);
+    return { ok: true, object: { key: msg.key, size: reply.size, etag: reply.etag, uploaded: reply.uploaded } };
   }
   if (op === "r2.get" || op === "r2.head") {
-    // head must not select `body`: reading an 8 MB blob only to drop it costs
-    // the read, the text conversion, and a full JSON escape of the row.
+    // head must not read the blob file: reading an 8 MB object only to drop
+    // it costs the read and a full JSON escape for nothing.
     const wantsBody = op === "r2.get";
     const r = __sbSql(
       store,
-      wantsBody
-        ? "SELECT body, size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?"
-        : "SELECT '', size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?",
+      "SELECT size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?",
       [msg.bucket, msg.key],
     );
     if (!r.rows.length) return { ok: true, found: false };
@@ -1392,17 +1478,18 @@ function __sbEmbeddedDispatch(msg) {
       found: true,
       object: {
         key: msg.key,
-        size: Number(row[1]),
-        etag: row[2],
-        uploaded: row[3],
-        httpMetadata: JSON.parse(row[4] || "{}"),
-        customMetadata: JSON.parse(row[5] || "{}"),
+        size: Number(row[0]),
+        etag: row[1],
+        uploaded: row[2],
+        httpMetadata: JSON.parse(row[3] || "{}"),
+        customMetadata: JSON.parse(row[4] || "{}"),
       },
-      body: wantsBody ? row[0] : undefined,
+      body: wantsBody ? __sbR2GetRaw(store, String(msg.bucket), String(msg.key)) : undefined,
     };
   }
   if (op === "r2.delete") {
     __sbSql(store, "DELETE FROM r2 WHERE bucket = ? AND key = ?", [msg.bucket, msg.key]);
+    __sbR2DeleteRaw(store, String(msg.bucket), String(msg.key));
     return { ok: true };
   }
   if (op === "r2.list") {