@sproutboat/runtime 0.6.6 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @sproutboat/runtime
 
+## 0.7.1
+
+### Patch Changes
+
+- b0c5bbd: Fix #177: `new Response(obj.body)` on an `R2Object` UTF-8-re-encoded raw
+  bytes, corrupting any binary content (each byte 0x80-0xFF doubled on the
+  wire). Added `R2Object.toResponse(init?)`, which serves the bytes
+  unmodified via the same `x-sb-raw-body` marker `__sbRawBodyResponse` already
+  uses for assets/fetch/service-binding responses. Defaults `content-type`
+  from `httpMetadata` and `etag` from `httpEtag` when not set in `init`.
+
+## 0.7.0
+
+### Minor Changes
+
+- 6998a15: R2 object bytes no longer live inside SQLite, on either transport (baronunread/sproutboat#56). Every `put()` used to bind the whole object into a `body` column, and every `get()` read it back out — doubling the object through SQLite's own page cache/WAL machinery on top of the buffer it already arrived in, which was the real driver of #56's "large uploads make memory skyrocket" complaint (the JSON-escaping half of that was already fixed in #63).
+  
+  Objects now live in their own file under `r2-blobs/`, named by a hash of bucket+key (so unicode keys and directory traversal are non-issues):
+  
+  - **Embedded (standalone):** `<data-dir>/r2-blobs/` — `sb_r2_put_c`/`sb_r2_get_c` write/read the file directly via C `fopen`/`fwrite`/`fread`, no SQLite blob column at all. `sb_r2_delete_blob` removes the file on delete.
+  - **Broker:** colocated with whichever store file already holds that bucket's metadata — the main `db` for a bare-string binding, the resource's own file under `resourceDir` for an account-level one (#74) — so blobs persist across a redeploy exactly when that metadata does. `:memory:` stores (tests, local dev) fall back to an in-memory map.
+  
+  No migration: this is a schema change for new writes going forward, not a converter for objects already stored inline from before.
+  
+  Verified end-to-end against both transports (kitchen-sink's full conformance suite, 24/24 standalone + 27/27 broker) and with new unit tests for file-backed persistence, the `:memory:` fallback, and a real binary round-trip over the v1 wire protocol.
+  
+  **Known limitation found while verifying this, not fixed here:** a binary `put()` body (bytes ≥ 0x80) is corrupted on the way *in*, before it ever reaches storage — `porf_native_fetch_read_value` (the function every inline-C string read in the runtime goes through) always UTF-8-encodes a Latin-1-range string on read, which is correct for genuine text but wrong for opaque bytes coming off a raw HTTP body. This predates this change (the old SQLite-blob path had the identical corruption) and is not something the storage backend can fix — it needs an input-side counterpart to `#176`'s `x-sb-raw-body` marker, or real `ArrayBuffer`/`Uint8Array` body support (the upstream ask already filed as Draft G in `patches/UPSTREAM.md`).
+
+### Patch Changes
+
+- 188d8e4: Fix (baronunread/sproutboat#184): a `put()` body (R2, both transports) with bytes ≥ 0x80 was corrupted on the way *in*, before storage — `porf_native_fetch_read_value` (the one function every inline-C string read in the runtime funnels through) always UTF-8-encodes a Latin-1-range value, correct for genuine text, wrong for opaque bytes off a raw HTTP upload. A 256-byte binary upload landed as 384 stored bytes.
+  
+  `__sbR2PutRaw` (embedded) and `__sbCallBin` (broker, the only caller that ever passes it a real body) now try `porf_native_fetch_read_raw_bytes` first, falling back to the normal encoding path only for a genuine multi-byte JS string (which isn't a "bytestring" and so isn't eligible for the raw read anyway). This predates the #56 storage change — the old SQLite-blob `put()` called the identical `read_value`, so it was equally corrupted; the existing R2 conformance check never caught it because it only ever exercises a plain ASCII string.
+  
+  Also fixes an adjacent, independently pre-existing bug found while verifying this: `R2Object.text()`/`.json()` returned the raw stored bytes without UTF-8-decoding them, producing mojibake for any object holding real text beyond ASCII — the same gap `__sbRawBodyResponse` already closed for assets/fetch/service-binding responses. Same fix here (lazy, memoized `__sbFromUtf8` decode).
+  
+  Verified end-to-end against both transports with a real binary upload (`curl --data-binary`, not a synthetic string): stored bytes and `.body`/`.text()` now round-trip byte-for-byte/correctly for binary content, Latin-1 text, and multi-byte Unicode (CJK). Full kitchen-sink conformance stays green on both transports (24/24 standalone, 27/27 broker).
+  
+  **Known remaining gap, not fixed here:** a genuine astral-plane character (an emoji, anything outside the Basic Multilingual Plane, encoded as a UTF-16 surrogate pair) still encodes to the wrong number of UTF-8 bytes on write — confirmed identical before and after this fix, so it's a separate, deeper bug in Porffor's own UTF-16→UTF-8 encoder (the `porf_native_fetch_read_value` "string" branch), not something in sproutboat's own code. Filing separately if it recurs; out of scope for this fix.
+
 ## 0.6.6
 
 ### Patch Changes

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.6",
+  "version": "0.7.1",
   "license": "MIT",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/baronunread/sproutboat-packages.git",
+    "directory": "packages/runtime"
+  },
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {

package/src/native-fetch-prelude.js

@@ -1104,11 +1104,33 @@ function __sbR2Object(meta, body) {
   };
   if (body != null) {
     obj.body = body;
+    // #184 — `body` is raw bytes (a bytestring), not decoded text: `.text()`
+    // returning it verbatim produced mojibake for any object holding real
+    // UTF-8 content, the same gap __sbRawBodyResponse already closed for
+    // assets/fetch/service-binding responses. Same fix here: decode lazily,
+    // once, on first read.
+    let decoded = null;
     obj.text = function () {
-      return body;
+      if (decoded === null) decoded = __sbFromUtf8(body);
+      return decoded;
     };
     obj.json = function () {
-      return JSON.parse(body);
+      return JSON.parse(obj.text());
+    };
+    // #177 — `new Response(obj.body)` UTF-8-re-encodes the raw bytes (they're
+    // a bytestring, same ambiguity #172/#176 exist to resolve): any byte
+    // 0x80-0xFF doubles into two bytes, corrupting binary content on the way
+    // out. `toResponse()` is the fix already used for assets/fetch/service
+    // bindings (`__sbRawBodyResponse`, below) — same reserved x-sb-raw-body
+    // marker, applied here too.
+    obj.toResponse = function (init) {
+      const opts = init || {};
+      const headers = new Headers(opts.headers || {});
+      headers.set("x-sb-raw-body", "1");
+      if (!headers.has("content-type") && obj.httpMetadata.contentType)
+        headers.set("content-type", obj.httpMetadata.contentType);
+      if (!headers.has("etag")) headers.set("etag", obj.httpEtag);
+      return __sbRawBodyResponse(body, { status: opts.status, headers });
     };
   }
   return obj;

package/src/r2-object.test.js

@@ -0,0 +1,65 @@
+// sproutboat #177 — `new Response(obj.body)` UTF-8-re-encodes an R2 object's
+// raw bytes (they're a bytestring, indistinguishable from Latin-1 text at
+// that layer). `obj.toResponse()` is the fix: same reserved x-sb-raw-body
+// marker __sbRawBodyResponse already uses for assets/fetch/service bindings.
+// The prelude is prepended as text and cannot be imported, so this test lifts
+// the relevant functions out and exercises them directly, against real
+// Response/Headers (both are Bun globals). If any of these move or their
+// boundary markers change, this fails loudly rather than silently testing
+// nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const utf8Start = src.indexOf("function __sbFromUtf8(");
+const rawStart = src.indexOf("function __sbRawBodyResponse(");
+const utf8End = rawStart;
+const rawEnd = src.indexOf("function __sbEqCt(");
+const r2Start = src.indexOf("function __sbR2Object(");
+const r2End = src.indexOf("// Installed only when the project declares bindings.");
+if (utf8Start === -1 || utf8End === -1) throw new Error("__sbFromUtf8 block not found in prelude");
+if (rawStart === -1 || rawEnd === -1) throw new Error("__sbRawBodyResponse block not found in prelude");
+if (r2Start === -1 || r2End === -1 || r2End < r2Start) throw new Error("__sbR2Object block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
+const load = new Function(
+  `${src.slice(utf8Start, utf8End)}\n${src.slice(rawStart, rawEnd)}\n${src.slice(r2Start, r2End)}\nreturn { __sbR2Object };`,
+);
+const { __sbR2Object } = load();
+
+const meta = { key: "f.bin", size: 3, etag: "abc123", uploaded: "2026-09-14T00:00:00.000Z" };
+
+// The byte-for-byte round trip itself happens in the compiled runtime's
+// write_response_value (#176's C-side scan, packages/toolchain/src/patch.ts) --
+// a plain-JS Response, Bun's included, re-encodes a bytestring the same way
+// Porffor's does, so this pure-JS test can only prove toResponse() sets the
+// marker that steers that C-side read; the actual byte preservation was
+// verified manually against a real compiled standalone binary (#177).
+test("toResponse() tags the response with the runtime's raw-body marker", () => {
+  const bytes = [0x80, 0x81, 0xff].map((b) => String.fromCharCode(b)).join("");
+  const obj = __sbR2Object(meta, bytes);
+  const fixed = obj.toResponse();
+  expect(fixed.headers.get("x-sb-raw-body")).toBe("1");
+});
+
+test("toResponse() defaults content-type from httpMetadata and etag from httpEtag", () => {
+  const obj = __sbR2Object({ ...meta, httpMetadata: { contentType: "image/png" } }, "x");
+  const resp = obj.toResponse();
+  expect(resp.headers.get("content-type")).toBe("image/png");
+  expect(resp.headers.get("etag")).toBe(obj.httpEtag);
+});
+
+test("toResponse() lets caller-supplied headers/status override the defaults", () => {
+  const obj = __sbR2Object({ ...meta, httpMetadata: { contentType: "image/png" } }, "x");
+  const resp = obj.toResponse({ status: 206, headers: { "content-type": "application/octet-stream" } });
+  expect(resp.status).toBe(206);
+  expect(resp.headers.get("content-type")).toBe("application/octet-stream");
+});
+
+test("toResponse() on an empty body still returns bytes, not the string \"\"", async () => {
+  const obj = __sbR2Object(meta, "");
+  const resp = obj.toResponse();
+  const buf = new Uint8Array(await resp.arrayBuffer());
+  expect(buf.length).toBe(0);
+});

package/src/transport-broker.js

@@ -19,6 +19,13 @@
 
 // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
 Porffor.c`
+// baronunread/sproutboat#176 — defined in render.js, alongside
+// porf_native_fetch_read_value (which every inline-C block below already
+// calls with no forward declaration of its own — that one gets one from
+// Porffor's own generated prototypes, this one doesn't, since it's a local
+// patch addition, not something Porffor knows to prototype early).
+extern int porf_native_fetch_read_raw_bytes(jsval value, const char** out_buf, size_t* out_len);
+
 static int sb_io_all(int fd, unsigned char* buf, size_t len, int writing) {
   size_t done = 0;
   while (done < len) {
@@ -237,8 +244,15 @@ function __sbCallBin(reqJson, body) {
   Porffor.c`
     const char* __j; size_t __jl; char* __jo = 0;
     porf_native_fetch_read_value(reqJson, &__j, &__jl, &__jo);
+    // baronunread/sproutboat#184 -- the only real (non-empty) body this ever
+    // carries today is an R2 put(); read raw, not through read_value's
+    // bytestring branch, which always UTF-8-encodes (right for text, wrong
+    // for opaque bytes off a raw HTTP upload). A genuine multi-byte JS string
+    // isn't a bytestring, so it falls back to the encoding path unaffected.
     const char* __b; size_t __bl; char* __bo = 0;
-    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    if (porf_native_fetch_read_raw_bytes(body, &__b, &__bl) != 0) {
+      porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    }
     char* __resp = 0; size_t __resplen = 0;
     int __rc = sb_broker_roundtrip_v1(__j, __jl, __b, __bl, &__resp, &__resplen);
     if (__jo) free(__jo);

package/src/transport-embedded.js

@@ -53,6 +53,13 @@ extern int64_t sqlite3_last_insert_rowid(sqlite3*);
 extern const char* sqlite3_errmsg(sqlite3*);
 extern int sqlite3_close(sqlite3*);
 
+// baronunread/sproutboat#176 — defined in render.js, alongside
+// porf_native_fetch_read_value (which every inline-C block below already
+// calls with no forward declaration of its own — that one gets one from
+// Porffor's own generated prototypes, this one doesn't, since it's a local
+// patch addition, not something Porffor knows to prototype early).
+extern int porf_native_fetch_read_raw_bytes(jsval value, const char** out_buf, size_t* out_len);
+
 #define SB_SQLITE_ROW 100
 #define SB_SQLITE_DONE 101
 #define SB_SQLITE_TRANSIENT ((void*)-1)
@@ -240,11 +247,14 @@ static int sb_bind_params(sqlite3_stmt* st, const char* json) {
   return 0;
 }
 
-// --- R2 bodies, without the JSON detour -------------------------------------
-// An object's bytes never enter a JSON frame: they arrive as their own string
-// parameter and go straight into a BLOB column. That matters for size as much
-// as correctness — escaping a binary body inflates it several times over, and
-// the arena grows to fit the biggest thing it ever had to hold.
+// --- R2 bodies, without the JSON detour or the SQLite detour ----------------
+// An object's bytes never enter a JSON frame (they arrive as their own string
+// parameter) and never enter SQLite either (baronunread/sproutboat#56): they
+// go straight to their own file under "<data-dir>/r2-blobs/", named by a hash
+// of bucket+key so unicode keys and directory traversal are both non-issues.
+// Doubling every object through SQLite's own page cache on top of the buffer
+// it already arrived in was the real cost behind #56's "large uploads make
+// memory skyrocket" complaint, not just the JSON-escaping #63 already fixed.
 
 static void sb_hex32(const unsigned char* in, char* out) {
   static const char* d = "0123456789abcdef";
@@ -269,7 +279,24 @@ static void sb_iso_now(char* out, size_t cap) {
   strftime(out, cap, "%Y-%m-%dT%H:%M:%S.000Z", &g);
 }
 
-// Returns malloc'd JSON metadata; the body itself is never serialised.
+// "<dir-of-store_path>/r2-blobs/<sha256(bucket 0x1e key)>.blob" — deterministic,
+// so no extra column is needed to find an object's file back.
+static void sb_r2_blob_path(char* out, size_t cap, const char* store_path, const char* bucket, const char* key) {
+  const char* slash = strrchr(store_path, '/');
+  int dirlen = slash ? (int)(slash - store_path) : 0;
+  br_sha256_context ctx;
+  br_sha256_init(&ctx);
+  br_sha256_update(&ctx, bucket, strlen(bucket));
+  br_sha256_update(&ctx, "\x1e", 1); // separator: a bucket/key split never collides across it
+  br_sha256_update(&ctx, key, strlen(key));
+  unsigned char digest[32];
+  br_sha256_out(&ctx, digest);
+  char hex[65];
+  sb_hex32(digest, hex);
+  snprintf(out, cap, "%.*s/r2-blobs/%s.blob", dirlen, store_path, hex);
+}
+
+// Returns malloc'd JSON metadata; the body itself is never serialised into it.
 static char* sb_r2_put_c(const char* path, const char* bucket, const char* key, const char* body, size_t bodylen,
                          const char* http_json, const char* custom_json) {
   sb_buf out = { 0, 0, 0 };
@@ -282,10 +309,19 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   char uploaded[40];
   sb_iso_now(uploaded, sizeof(uploaded));
 
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  sb_mkdirs(blobpath);
+  FILE* f = fopen(blobpath, "wb");
+  if (!f) { sb_puts(&out, "{\"ok\":false,\"error\":\"cannot write object\"}"); return out.p; }
+  size_t written = bodylen ? fwrite(body, 1, bodylen, f) : 0;
+  fclose(f);
+  if (written != bodylen) { sb_puts(&out, "{\"ok\":false,\"error\":\"short write\"}"); return out.p; }
+
   sqlite3_stmt* st = 0;
   const char* sql =
-    "INSERT INTO r2 (bucket, key, body, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7,?8) "
-    "ON CONFLICT (bucket, key) DO UPDATE SET body=?3, size=?4, etag=?5, uploaded=?6, http_json=?7, custom_json=?8";
+    "INSERT INTO r2 (bucket, key, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7) "
+    "ON CONFLICT (bucket, key) DO UPDATE SET size=?3, etag=?4, uploaded=?5, http_json=?6, custom_json=?7";
   if (sqlite3_prepare_v2(db, sql, -1, &st, 0) != 0 || !st) {
     sb_puts(&out, "{\"ok\":false,\"error\":");
     const char* m = sqlite3_errmsg(db);
@@ -295,12 +331,11 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   }
   sqlite3_bind_text(st, 1, bucket, -1, SB_SQLITE_TRANSIENT);
   sqlite3_bind_text(st, 2, key, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_blob(st, 3, body, (int)bodylen, SB_SQLITE_STATIC);
-  sqlite3_bind_int64(st, 4, (int64_t)bodylen);
-  sqlite3_bind_text(st, 5, etag, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 6, uploaded, -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 7, http_json && *http_json ? http_json : "{}", -1, SB_SQLITE_TRANSIENT);
-  sqlite3_bind_text(st, 8, custom_json && *custom_json ? custom_json : "{}", -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_int64(st, 3, (int64_t)bodylen);
+  sqlite3_bind_text(st, 4, etag, -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 5, uploaded, -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 6, http_json && *http_json ? http_json : "{}", -1, SB_SQLITE_TRANSIENT);
+  sqlite3_bind_text(st, 7, custom_json && *custom_json ? custom_json : "{}", -1, SB_SQLITE_TRANSIENT);
   int rc = sqlite3_step(st);
   sqlite3_finalize(st);
   if (rc != SB_SQLITE_DONE) { sb_puts(&out, "{\"ok\":false,\"error\":\"r2 put failed\"}"); return out.p; }
@@ -311,30 +346,50 @@ static char* sb_r2_put_c(const char* path, const char* bucket, const char* key,
   return out.p;
 }
 
-// Body bytes straight into a Porffor bytestring.
-//
-// The allocation happens while the statement is still open, so sqlite's own
-// buffer is the source and there is no intermediate copy: one 8 MB object means
-// one 8 MB allocation, not two. Returns the bytestring pointer, or 0.
+// Reads the object's file into a Porffor bytestring. One malloc (the file
+// read) plus the bytestring's own allocation — no SQLite page-cache copy on
+// top, and no growing single database file holding every object ever put.
+// Returns the bytestring pointer, or 0.
 static u32 sb_r2_get_c(const char* path, const char* bucket, const char* key, int* found) {
   *found = 0;
   int idx = sb_db_for(path);
   if (idx < 0) return 0;
   sqlite3_stmt* st = 0;
-  if (sqlite3_prepare_v2(sb_dbs[idx], "SELECT body FROM r2 WHERE bucket = ? AND key = ?", -1, &st, 0) != 0 || !st) return 0;
+  if (sqlite3_prepare_v2(sb_dbs[idx], "SELECT 1 FROM r2 WHERE bucket = ? AND key = ?", -1, &st, 0) != 0 || !st) return 0;
   sqlite3_bind_text(st, 1, bucket, -1, SB_SQLITE_TRANSIENT);
   sqlite3_bind_text(st, 2, key, -1, SB_SQLITE_TRANSIENT);
-  u32 out = 0;
-  if (sqlite3_step(st) == SB_SQLITE_ROW) {
-    int n = sqlite3_column_bytes(st, 0);
-    const void* blob = sqlite3_column_blob(st, 0);
-    out = porf_native_fetch_alloc_bytestring((const char*)(blob ? blob : ""), (size_t)(n > 0 ? n : 0));
-    *found = 1;
-  }
+  int has_row = sqlite3_step(st) == SB_SQLITE_ROW;
   sqlite3_finalize(st);
+  if (!has_row) return 0;
+
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  FILE* f = fopen(blobpath, "rb");
+  // A metadata row with no blob file (deleted out from under it, disk issue)
+  // reads as not-found rather than crashing.
+  if (!f) return 0;
+  fseek(f, 0, SEEK_END);
+  long size = ftell(f);
+  rewind(f);
+  if (size < 0) { fclose(f); return 0; }
+  char* buf = (char*)malloc((size_t)size > 0 ? (size_t)size : 1);
+  size_t rd = size > 0 ? fread(buf, 1, (size_t)size, f) : 0;
+  fclose(f);
+  if (!buf || rd != (size_t)size) { free(buf); return 0; }
+  u32 out = porf_native_fetch_alloc_bytestring(buf, (size_t)size);
+  free(buf);
+  *found = 1;
   return out;
 }
 
+// Best-effort: a metadata row deleted with no blob file (or vice versa) is
+// still a correct end state, so a missing file here is not an error.
+static void sb_r2_delete_blob(const char* path, const char* bucket, const char* key) {
+  char blobpath[1024];
+  sb_r2_blob_path(blobpath, sizeof(blobpath), path, bucket, key);
+  unlink(blobpath);
+}
+
 // Run a script: one or more statements separated by semicolons. sqlite3_exec
 // handles the whole string, which prepare/step does not — it compiles the first
 // statement and silently ignores the rest, so a schema built from one exec call
@@ -929,10 +984,18 @@ function __sbR2PutRaw(path, bucket, key, body, httpJson, customJson) {
     char* __custom = (char*)malloc(__cl + 1); memcpy(__custom, __c, __cl); __custom[__cl] = 0;
     if (__co) free(__co);
 
-    // The body is read in place and handed straight to sqlite3_bind_blob: no
-    // copy beyond what the binding needs, and no escaping at all.
+    // baronunread/sproutboat#184 -- read raw, not through porf_native_fetch_
+    // read_value's bytestring branch, which always UTF-8-encodes (correct for
+    // genuine text, wrong for opaque bytes -- request.body off a raw HTTP
+    // upload is exactly that). R2 is object storage: put()/get() need to be
+    // byte-preserving, not text-preserving. Only a bytestring-typed value can
+    // be read raw; a genuine multi-byte JS string (real Unicode, "string" type
+    // rather than "bytestring") isn't one, so it falls back to the normal
+    // encoding path, which already handles that type correctly.
     const char* __b; size_t __bl; char* __bo = 0;
-    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    if (porf_native_fetch_read_raw_bytes(body, &__b, &__bl) != 0) {
+      porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    }
     char* __out = sb_r2_put_c(__path, __bucket, __key, __b, __bl, __http, __custom);
     if (__bo) free(__bo);
 
@@ -974,6 +1037,32 @@ function __sbR2GetRaw(path, bucket, key) {
   return res;
 }
 
+// R2 delete: also removes the object's own file, not just the metadata row
+// (#56 — sb_r2_delete_blob is best-effort, a missing file is not an error).
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbR2DeleteRaw(path, bucket, key) {
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __p; size_t __pl; char* __po = 0;
+    porf_native_fetch_read_value(path, &__p, &__pl, &__po);
+    char* __path = (char*)malloc(__pl + 1); memcpy(__path, __p, __pl); __path[__pl] = 0;
+    if (__po) free(__po);
+
+    const char* __bk; size_t __bkl; char* __bko = 0;
+    porf_native_fetch_read_value(bucket, &__bk, &__bkl, &__bko);
+    char* __bucket = (char*)malloc(__bkl + 1); memcpy(__bucket, __bk, __bkl); __bucket[__bkl] = 0;
+    if (__bko) free(__bko);
+
+    const char* __k; size_t __kl; char* __ko = 0;
+    porf_native_fetch_read_value(key, &__k, &__kl, &__ko);
+    char* __key = (char*)malloc(__kl + 1); memcpy(__key, __k, __kl); __key[__kl] = 0;
+    if (__ko) free(__ko);
+
+    sb_r2_delete_blob(__path, __bucket, __key);
+    free(__path); free(__bucket); free(__key);
+  `;
+}
+
 // Multi-statement exec. Same string-param pattern as __sbSqlRaw.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbSqlScriptRaw(path, sql) {
@@ -1158,9 +1247,11 @@ function __sbEnsureSchema() {
     s,
     "CREATE TABLE IF NOT EXISTS kv (ns TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (ns, key))",
   );
+  // #56 — no `body` column: an object's bytes live in their own file under
+  // "<data-dir>/r2-blobs/" (sb_r2_put_c/sb_r2_get_c), never in the sqlite row.
   __sbSql(
     s,
-    "CREATE TABLE IF NOT EXISTS r2 (bucket TEXT NOT NULL, key TEXT NOT NULL, body TEXT NOT NULL, size INTEGER NOT NULL, " +
+    "CREATE TABLE IF NOT EXISTS r2 (bucket TEXT NOT NULL, key TEXT NOT NULL, size INTEGER NOT NULL, " +
       "etag TEXT NOT NULL, uploaded TEXT NOT NULL, http_json TEXT NOT NULL DEFAULT '{}', custom_json TEXT NOT NULL DEFAULT '{}', " +
       "PRIMARY KEY (bucket, key))",
   );
@@ -1350,38 +1441,33 @@ function __sbEmbeddedDispatch(msg) {
     return { ok: true, path: dest, bytes: reply.bytes };
   }
 
+  // r2.put/get route through the same raw C path (__sbR2PutRaw/__sbR2GetRaw,
+  // sb_r2_put_c/sb_r2_get_c) the R2 binding's own put()/get() use — reachable
+  // separately only via a raw `__sbCall(op:"r2.put"/"r2.get")`, which nothing
+  // in this codebase does today, but broker.ts's dispatch() answers the same
+  // two ops, so the contract stays identical on both backends either way
+  // (#56: neither one keeps object bytes in SQLite any more).
   if (op === "r2.put") {
-    const body = String(msg.body == null ? "" : msg.body);
-    const etag = __sbHex(16);
-    __sbSql(
-      store,
-      "INSERT INTO r2 (bucket, key, body, size, etag, uploaded, http_json, custom_json) VALUES (?1,?2,?3,?4,?5,?6,?7,?8) " +
-        "ON CONFLICT (bucket, key) DO UPDATE SET body=?3, size=?4, etag=?5, uploaded=?6, http_json=?7, custom_json=?8",
-      [
-        msg.bucket,
-        msg.key,
-        body,
-        body.length,
-        etag,
-        new Date().toISOString(),
+    const reply = JSON.parse(
+      __sbR2PutRaw(
+        store,
+        String(msg.bucket),
+        String(msg.key),
+        String(msg.body == null ? "" : msg.body),
         JSON.stringify(msg.httpMetadata || {}),
         JSON.stringify(msg.customMetadata || {}),
-      ],
+      ),
     );
-    return {
-      ok: true,
-      object: { key: msg.key, size: body.length, etag, uploaded: new Date().toISOString() },
-    };
+    if (reply.ok === false) throw new Error("r2 put: " + reply.error);
+    return { ok: true, object: { key: msg.key, size: reply.size, etag: reply.etag, uploaded: reply.uploaded } };
   }
   if (op === "r2.get" || op === "r2.head") {
-    // head must not select `body`: reading an 8 MB blob only to drop it costs
-    // the read, the text conversion, and a full JSON escape of the row.
+    // head must not read the blob file: reading an 8 MB object only to drop
+    // it costs the read and a full JSON escape for nothing.
     const wantsBody = op === "r2.get";
     const r = __sbSql(
       store,
-      wantsBody
-        ? "SELECT body, size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?"
-        : "SELECT '', size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?",
+      "SELECT size, etag, uploaded, http_json, custom_json FROM r2 WHERE bucket = ? AND key = ?",
       [msg.bucket, msg.key],
     );
     if (!r.rows.length) return { ok: true, found: false };
@@ -1392,17 +1478,18 @@ function __sbEmbeddedDispatch(msg) {
       found: true,
       object: {
         key: msg.key,
-        size: Number(row[1]),
-        etag: row[2],
-        uploaded: row[3],
-        httpMetadata: JSON.parse(row[4] || "{}"),
-        customMetadata: JSON.parse(row[5] || "{}"),
+        size: Number(row[0]),
+        etag: row[1],
+        uploaded: row[2],
+        httpMetadata: JSON.parse(row[3] || "{}"),
+        customMetadata: JSON.parse(row[4] || "{}"),
       },
-      body: wantsBody ? row[0] : undefined,
+      body: wantsBody ? __sbR2GetRaw(store, String(msg.bucket), String(msg.key)) : undefined,
     };
   }
   if (op === "r2.delete") {
     __sbSql(store, "DELETE FROM r2 WHERE bucket = ? AND key = ?", [msg.bucket, msg.key]);
+    __sbR2DeleteRaw(store, String(msg.bucket), String(msg.key));
     return { ok: true };
   }
   if (op === "r2.list") {