@sproutboat/toolchain 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @sproutboat/toolchain
 
+## 0.4.3
+
+### Patch Changes
+
+- 0b0a666: Add a native standalone R2 direct-upload bridge that streams transfer-ticket
+  request chunks to a temporary blob file, validates the digest, and atomically
+  publishes the object without buffering the upload in the Porffor request body.
+
+## 0.4.2
+
+### Patch Changes
+
+- fa09d90: Update the pinned Porffor compiler to alpha 6 and remove the superseded local promise-resolution workaround.
+
 ## 0.4.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/acquire.test.ts

@@ -40,6 +40,10 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "  i32 slot = 0;\n  for (auto [key, value] : *req) {\n    slot++;\n  }\n" +
       "  *((i32*)(porf_mem + headers_ptr)) = slot;\n\n  return headers_ptr;\n}\n" +
       "static void on_request(uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {\n" +
+      "  const std::string_view method = req->getCaseSensitiveMethod();\n" +
+      "  const i32 method_ptr = get_method_ptr(method);\n" +
+      "  if (method_ptr == 0) return;\n" +
+      "  __porffor_js_enter();\n  const i32 url_ptr = alloc_request_url(req);\n" +
       "  const i32 headers_ptr = collect_headers(req);\n}\n" +
       "static bool is_forbidden_response_header(std::string_view key) {\n" +
       '  return key == "connection" ||\n' +

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-1f4ae4a.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-038f415.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 
@@ -26,7 +26,12 @@ type AcquireOptions = {
   timeoutMs?: number;
 };
 
-const required = ["runtime/index.js", "compiler/render.js", "compiler/index.js", "compiler/uwebsockets.js"];
+const required = [
+  "runtime/index.js",
+  "compiler/render.js",
+  "compiler/index.js",
+  "compiler/uwebsockets.js",
+];
 async function digest(path: string): Promise<string> {
   return createHash("sha256")
     .update(await readFile(path))
@@ -42,9 +47,11 @@ async function complete(dir: string, expectedArchive = PORFFOR_ARCHIVE_SHA256):
       archiveSha256?: string;
       files?: Record<string, string>;
     };
-    if (manifest.commit !== PORFFOR_COMMIT_FULL || manifest.archiveSha256 !== expectedArchive) return false;
+    if (manifest.commit !== PORFFOR_COMMIT_FULL || manifest.archiveSha256 !== expectedArchive)
+      return false;
     for (const file of required)
-      if (!manifest.files?.[file] || (await digest(resolve(dir, file))) !== manifest.files[file]) return false;
+      if (!manifest.files?.[file] || (await digest(resolve(dir, file))) !== manifest.files[file])
+        return false;
     return true;
   } catch {
     return false;
@@ -81,10 +88,16 @@ async function extract(archive: string, stage: string): Promise<void> {
   });
   const [code, stderr] = await Promise.all([child.exited, new Response(child.stderr).text()]);
   if (code !== 0)
-    throw new PorfforToolchainError("archive", `could not extract pinned Porffor archive: ${stderr.trim()}`);
+    throw new PorfforToolchainError(
+      "archive",
+      `could not extract pinned Porffor archive: ${stderr.trim()}`,
+    );
   for (const file of required)
     if (!existsSync(resolve(stage, file)))
-      throw new PorfforToolchainError("archive", `Porffor archive is missing required file ${file}`);
+      throw new PorfforToolchainError(
+        "archive",
+        `Porffor archive is missing required file ${file}`,
+      );
 }
 
 async function waitForPublisher(dir: string, lock: string): Promise<string | null> {
@@ -113,7 +126,9 @@ export async function ensurePorffor(options: AcquireOptions = {}): Promise<strin
     return dir;
   }
   const root = resolve(
-    options.cacheRoot ?? process.env.SPROUTBOAT_TOOLCHAIN_CACHE ?? resolve(homedir(), ".cache/sproutboat"),
+    options.cacheRoot ??
+      process.env.SPROUTBOAT_TOOLCHAIN_CACHE ??
+      resolve(homedir(), ".cache/sproutboat"),
   );
   const dir = resolve(root, `porffor-${PORFFOR_COMMIT_FULL}`);
   const expected = options.expectedSha256 ?? PORFFOR_ARCHIVE_SHA256;
@@ -127,7 +142,10 @@ export async function ensurePorffor(options: AcquireOptions = {}): Promise<strin
     if (published) return published;
     return ensurePorffor(options);
   }
-  const stage = resolve(root, `.porffor-${PORFFOR_COMMIT_FULL}-${process.pid}-${crypto.randomUUID()}`);
+  const stage = resolve(
+    root,
+    `.porffor-${PORFFOR_COMMIT_FULL}-${process.pid}-${crypto.randomUUID()}`,
+  );
   try {
     if (await complete(dir, expected)) return dir;
     await rm(dir, { recursive: true, force: true });
@@ -139,9 +157,18 @@ export async function ensurePorffor(options: AcquireOptions = {}): Promise<strin
     // left stale by a pin bump (checksum below still catches a wrong file
     // rather than silently accepting it).
     const noOverride = options.url === undefined && options.expectedSha256 === undefined;
-    const vendored = noOverride && existsSync(vendoredPorfforArchive) && (await digest(vendoredPorfforArchive)) === expected;
+    const vendored =
+      noOverride &&
+      existsSync(vendoredPorfforArchive) &&
+      (await digest(vendoredPorfforArchive)) === expected;
     if (vendored) await writeFile(archive, await readFile(vendoredPorfforArchive));
-    else await download(options.url ?? PORFFOR_ARCHIVE_URL, archive, options.fetcher ?? fetch, options.timeoutMs ?? 30_000);
+    else
+      await download(
+        options.url ?? PORFFOR_ARCHIVE_URL,
+        archive,
+        options.fetcher ?? fetch,
+        options.timeoutMs ?? 30_000,
+      );
     const actual = await digest(archive);
     if (actual !== expected)
       throw new PorfforToolchainError(
@@ -152,7 +179,9 @@ export async function ensurePorffor(options: AcquireOptions = {}): Promise<strin
     await rm(archive, { force: true });
     await ensurePorfforPatched(stage);
     const files = Object.fromEntries(
-      await Promise.all(required.map(async (file) => [file, await digest(resolve(stage, file))] as const)),
+      await Promise.all(
+        required.map(async (file) => [file, await digest(resolve(stage, file))] as const),
+      ),
     );
     await writeFile(
       resolve(stage, ".sproutboat-complete"),

package/src/patch.test.ts

@@ -2,7 +2,7 @@ import { expect, test } from "bun:test";
 import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { patchPromiseTs, patchRenderJs, patchUwebsockets } from "./patch";
+import { patchRenderJs, patchUwebsockets } from "./patch";
 
 // The parts of Porffor's compiler/render.js the patch anchors to.
 const RENDER = `void porf_native_fetch_runtime_init(void) {
@@ -76,6 +76,11 @@ static i32 collect_headers(uWS::HttpRequest* req) {
 }
 
 static void on_request(uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {
+  const std::string_view method = req->getCaseSensitiveMethod();
+  const i32 method_ptr = get_method_ptr(method);
+  if (method_ptr == 0) return;
+  __porffor_js_enter();
+  const i32 url_ptr = alloc_request_url(req);
   const i32 headers_ptr = collect_headers(req);
 }
 
@@ -159,10 +164,17 @@ test("#156: status-line fallback synthesizes a line for unlisted codes, idempote
     expect(once.match(/case 302: return "302 Found";/g)).toHaveLength(1);
     // Body-limit edit still rides along.
     expect(once).toContain("sb_request_body_max");
+    // #195: a valid transfer ticket is intercepted before JS request roots and
+    // the ordinary PendingRequest body allocation path.
+    expect(once).toContain("sb_r2_transfer_open");
+    expect(once).toContain("sb_r2_transfer_write");
+    expect(once).toContain("try_handle_r2_transfer(res, req, method)");
 
     // #163: collect_headers takes res, drops a client-sent x-sb-remote-addr, and
     // appends the real peer; the call site passes res through.
-    expect(once).toContain("static i32 collect_headers(uWS::HttpRequest* req, uWS::HttpResponse<false>* res) {");
+    expect(once).toContain(
+      "static i32 collect_headers(uWS::HttpRequest* req, uWS::HttpResponse<false>* res) {",
+    );
     expect(once).toContain("const i32 headers_ptr = collect_headers(req, res);");
     expect(once).toContain('if (key == "x-sb-remote-addr") continue;');
     expect(once).toContain("res->getRemoteAddressAsText()");
@@ -179,12 +191,22 @@ test("#156: status-line fallback synthesizes a line for unlisted codes, idempote
     );
     expect(once).toContain('key == "x-sb-raw-body"');
     expect(once).toContain("bool raw_body = false;");
-    expect(once).toContain('if (std::string_view(scan_buf, scan_bytes) == "x-sb-raw-body") raw_body = true;');
-    expect(once).toContain("if (raw_body) porf_native_fetch_read_raw_bytes(body_value, &body_buf, &body_len);");
-    expect(once).toContain("else porf_native_fetch_read_value(body_value, &body_buf, &body_len, &body_owned);");
+    expect(once).toContain(
+      'if (std::string_view(scan_buf, scan_bytes) == "x-sb-raw-body") raw_body = true;',
+    );
+    expect(once).toContain(
+      "if (raw_body) porf_native_fetch_read_raw_bytes(body_value, &body_buf, &body_len);",
+    );
+    expect(once).toContain(
+      "else porf_native_fetch_read_value(body_value, &body_buf, &body_len, &body_owned);",
+    );
     // Header reads are the original 4-arg call, unchanged.
-    expect(once).toContain("porf_native_fetch_read_value(name_value, &name_buf, &name_len, &name_owned);");
-    expect(once).toContain("porf_native_fetch_read_value(value_value, &value_buf, &value_len, &value_owned);");
+    expect(once).toContain(
+      "porf_native_fetch_read_value(name_value, &name_buf, &name_len, &name_owned);",
+    );
+    expect(once).toContain(
+      "porf_native_fetch_read_value(value_value, &value_buf, &value_len, &value_owned);",
+    );
 
     await patchUwebsockets(root);
     expect(await readFile(join(root, "compiler/uwebsockets.js"), "utf8")).toBe(once);
@@ -240,60 +262,3 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
     await rm(root, { recursive: true, force: true });
   }
 });
-
-// The part of Porffor's compiler/builtins/promise.ts the #168 patch anchors to.
-const PROMISE_TS = `export const __Porffor_promise_resolve = (value: any, promise: any): void => {
-  if (Porffor.type(value) == Porffor.TYPES.object) {
-    // cheap prototype-chain probe for 'then' before the expensive Get below, does not invoke getters
-    const thenHash: i32 = __Porffor_object_hash('then');
-    let probe: any = value;
-    while (Porffor.type(probe) == Porffor.TYPES.object) {
-      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) break;
-      probe = __Porffor_object_getPrototype(probe);
-    }
-    if (Porffor.type(probe) != Porffor.TYPES.object) {
-      __ecma262_FulfillPromise(promise, value);
-      return;
-    }
-  }
-};
-`;
-
-test("#168: promise-resolve's then-probe gets a fixed-point guard, idempotently", async () => {
-  const root = await mkdtemp(join(tmpdir(), "sb-patch-promise-"));
-  try {
-    await mkdir(join(root, "compiler/builtins"), { recursive: true });
-    await writeFile(join(root, "compiler/builtins/promise.ts"), PROMISE_TS);
-    await patchPromiseTs(root);
-    const once = await readFile(join(root, "compiler/builtins/promise.ts"), "utf8");
-
-    expect(once).toContain("sproutboat #168");
-    expect(once).toContain("let probeFound: boolean = false;");
-    expect(once).toContain("if (Porffor.object.lookup(probe, 'then', thenHash) != 0) { probeFound = true; break; }");
-    // The fixed-point guard mirrors _internal_object.ts's lastProto idiom.
-    expect(once).toContain("Porffor.fastOr(probe == null, Porffor.IR.ptr(probe) == Porffor.IR.ptr(lastProto))");
-    expect(once).toContain("if (!probeFound) {");
-    // Belt-and-suspenders: a hard iteration cap terminates the loop even if
-    // some other corruption shape (a drifting pointer, a longer cycle) defeats
-    // the fixed-point check above.
-    expect(once).toContain("if (probeSteps > 64) break;");
-    // The old type-check-only exit condition is gone.
-    expect(once).not.toContain("if (Porffor.type(probe) != Porffor.TYPES.object) {");
-
-    await patchPromiseTs(root);
-    expect(await readFile(join(root, "compiler/builtins/promise.ts"), "utf8")).toBe(once);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});
-
-test("#168: a drifted promise builtin fails loudly instead of silently no-op'ing", async () => {
-  const root = await mkdtemp(join(tmpdir(), "sb-patch-promise-drift-"));
-  try {
-    await mkdir(join(root, "compiler/builtins"), { recursive: true });
-    await writeFile(join(root, "compiler/builtins/promise.ts"), "// nothing the patch recognizes\n");
-    await expect(patchPromiseTs(root)).rejects.toThrow(/anchor not found/);
-  } finally {
-    await rm(root, { recursive: true, force: true });
-  }
-});

package/src/patch.ts

@@ -108,7 +108,8 @@ const BYTESTRING_MARKER = "sproutboat #172";
  * below) calls it, gated on the reserved `x-sb-raw-body` response header the
  * assets binding sets. Every existing call site is untouched.
  */
-const READ_RAW_ANCHOR = "int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_len, char** out_owned) {";
+const READ_RAW_ANCHOR =
+  "int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_len, char** out_owned) {";
 const READ_RAW_INJECT =
   "// sproutboat #176: zero-copy passthrough for a bytestring that is already-\n" +
   "// finished bytes (an asset read off disk), never a string to UTF-8 encode.\n" +
@@ -208,7 +209,8 @@ const STATUS_SIG_MARKER = "static std::string lookup_status_line(i32 status) {";
 // 303 is the one this was reported for (POST-redirect-GET); give it the real
 // reason phrase. Everything else unlisted rides the synthesized fallback below.
 const STATUS_303_ANCHOR = '    case 302: return "302 Found";\n';
-const STATUS_303_INJECT = '    case 302: return "302 Found";\n    case 303: return "303 See Other";\n';
+const STATUS_303_INJECT =
+  '    case 302: return "302 Found";\n    case 303: return "303 See Other";\n';
 const STATUS_303_MARKER = 'case 303: return "303 See Other";';
 const STATUS_DEFAULT_ANCHOR = "    default: return {};";
 const STATUS_DEFAULT_INJECT = '    default: return std::to_string(status) + " Status";';
@@ -225,7 +227,8 @@ const STATUS_DEFAULT_MARKER = 'std::to_string(status) + " Status"';
  * `request.cf.clientIp` and resolves it against `SB_TRUSTED_PROXIES` if set.
  */
 const HDR_SIG_ANCHOR = "static i32 collect_headers(uWS::HttpRequest* req) {\n";
-const HDR_SIG_INJECT = "static i32 collect_headers(uWS::HttpRequest* req, uWS::HttpResponse<false>* res) {\n";
+const HDR_SIG_INJECT =
+  "static i32 collect_headers(uWS::HttpRequest* req, uWS::HttpResponse<false>* res) {\n";
 const HDR_SIG_MARKER = "collect_headers(uWS::HttpRequest* req, uWS::HttpResponse";
 
 const HDR_CALL_ANCHOR = "const i32 headers_ptr = collect_headers(req);";
@@ -361,7 +364,7 @@ const WRITE_RESPONSE_INJECT =
   "      size_t scan_bytes = 0;\n" +
   "      char* scan_owned = nullptr;\n" +
   "      porf_native_fetch_read_value(scan_name, &scan_buf, &scan_bytes, &scan_owned);\n" +
-  "      if (std::string_view(scan_buf, scan_bytes) == \"x-sb-raw-body\") raw_body = true;\n" +
+  '      if (std::string_view(scan_buf, scan_bytes) == "x-sb-raw-body") raw_body = true;\n' +
   "      if (scan_owned) free(scan_owned);\n" +
   "    }\n" +
   "  }\n" +
@@ -410,74 +413,68 @@ const WRITE_RESPONSE_INJECT =
   "}";
 const WRITE_RESPONSE_MARKER = "porf_native_fetch_read_raw_bytes(body_value";
 
-/**
- * baronunread/sproutboat#168 — `__Porffor_promise_resolve`'s duck-typing probe
- * for `.then` walks a value's prototype chain with no termination guard. Under
- * certain allocator conditions `__Porffor_object_getPrototype` returns a stale
- * "object" jsval instead of the `null`/`undefined` that should end the chain,
- * so the walk never bottoms out — a true infinite spin (100% CPU, no error, no
- * log line) that wedges the whole process, since native-fetch serves one
- * request at a time on a single event loop. Hits any handler whose `fetch`
- * resolves a promise with a plain object — the common shape for a JSON
- * response — so this is not a rare pattern; onset is nondeterministic
- * (allocator/pool reuse), typically after a handful of requests.
- *
- * `_internal_object.ts`'s own prototype-chain walks already guard against
- * exactly this failure mode: track the previous prototype and stop once the
- * "next" pointer stops advancing (a fixed point reads the same as reaching the
- * end). This probe has no such guard. Mirror the same idiom here: an explicit
- * `probeFound` flag (so a fixed-point break reads as "no `.then` found",
- * matching how a legitimate null-terminated chain is read) plus the
- * `lastProto` pointer comparison used everywhere else in the runtime.
- *
- * A hard iteration cap rides alongside the fixed-point check, not instead of
- * it: the lldb trace showed the *same* stale pointer on every sample, which
- * the fixed-point check alone catches on its very next iteration, but that's
- * one observed corruption shape, not a guarantee about every allocator state
- * that can produce this bug. A cap makes termination unconditional regardless
- * of whether some other corrupted state instead drifts (a different bad
- * pointer each time) or cycles across more than one node — real prototype
- * chains are a handful of links deep, so 64 iterations is generous headroom
- * with no risk of cutting off a legitimate lookup.
- */
-const THEN_PROBE_ANCHOR =
-  "    const thenHash: i32 = __Porffor_object_hash('then');\n" +
-  "    let probe: any = value;\n" +
-  "    while (Porffor.type(probe) == Porffor.TYPES.object) {\n" +
-  "      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) break;\n" +
-  "      probe = __Porffor_object_getPrototype(probe);\n" +
-  "    }\n" +
-  "    if (Porffor.type(probe) != Porffor.TYPES.object) {\n";
-const THEN_PROBE_INJECT =
-  "    const thenHash: i32 = __Porffor_object_hash('then');\n" +
-  "    let probe: any = value;\n" +
-  "    let lastProto: any = probe;\n" +
-  "    let probeFound: boolean = false; // sproutboat #168: fixed-point chain reads as \"not found\", not a spin\n" +
-  "    let probeSteps: i32 = 0; // sproutboat #168: hard cap, belt-and-suspenders alongside the fixed-point check\n" +
-  "    while (Porffor.type(probe) == Porffor.TYPES.object) {\n" +
-  "      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) { probeFound = true; break; }\n" +
-  "      probe = __Porffor_object_getPrototype(probe);\n" +
-  "      if (Porffor.fastOr(probe == null, Porffor.IR.ptr(probe) == Porffor.IR.ptr(lastProto))) break;\n" +
-  "      lastProto = probe;\n" +
-  "      probeSteps++;\n" +
-  "      if (probeSteps > 64) break;\n" +
-  "    }\n" +
-  "    if (!probeFound) {\n";
-const THEN_PROBE_MARKER = "sproutboat #168";
-
-/** The promise builtin: the #168 `.then`-probe livelock fix. Exported for tests. */
-export async function patchPromiseTs(root: string): Promise<void> {
-  const file = resolve(root, "compiler/builtins/promise.ts");
-  let src = await readFile(file, "utf8");
-  if (src.includes(THEN_PROBE_MARKER)) return;
-  if (!src.includes(THEN_PROBE_ANCHOR)) {
-    throw new Error(
-      "could not patch Porffor's promise-resolve then-probe (#168): anchor not found in " +
-        `${file}. Porffor's promise builtin changed — check patches/UPSTREAM.md.`,
-    );
+// #195: reserve a direct-transfer ticket before native-fetch allocates the
+// ordinary in-memory PendingRequest. uWS then gives each wire chunk directly
+// to the runtime C ABI, which owns the temporary object file.
+const R2_TRANSFER_ANCHOR = "static void on_request(uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {\n";
+const R2_TRANSFER_INJECT = `extern "C" {
+  struct sb_r2_transfer_ctx;
+  int sb_r2_transfer_open(const char*, const char*, size_t, sb_r2_transfer_ctx**);
+  int sb_r2_transfer_write(sb_r2_transfer_ctx*, const char*, size_t);
+  int sb_r2_transfer_finish(sb_r2_transfer_ctx*);
+  void sb_r2_transfer_abort(sb_r2_transfer_ctx*);
+}
+static bool sb_r2_transfer_path(std::string_view path, std::string* bucket, std::string* token) {
+  static constexpr std::string_view prefix = "/__sb/r2/transfer/";
+  if (path.size() < prefix.size() || path.substr(0, prefix.size()) != prefix) return false;
+  const std::string_view rest = path.substr(prefix.size());
+  const size_t slash = rest.find('/');
+  if (slash == std::string_view::npos || slash == 0 || slash > 255 || rest.find('/', slash + 1) != std::string_view::npos) return false;
+  const std::string_view b = rest.substr(0, slash), t = rest.substr(slash + 1);
+  if (t.size() != 24) return false;
+  for (char c : b) if (!((c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_')) return false;
+  for (char c : t) if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) return false;
+  *bucket = std::string(b); *token = std::string(t); return true;
+}
+static std::string sb_r2_transfer_status(int status) {
+  switch (status) {
+    case 201: return "201 Created"; case 404: return "404 Not Found"; case 410: return "410 Gone";
+    case 413: return "413 Payload Too Large"; case 422: return "422 Unprocessable Content";
+    case 503: return "503 Service Unavailable"; case 507: return "507 Insufficient Storage";
+    default: return "500 Internal Server Error";
   }
-  await writeFile(file, src.replace(THEN_PROBE_ANCHOR, THEN_PROBE_INJECT));
 }
+static bool try_handle_r2_transfer(uWS::HttpResponse<false>* res, uWS::HttpRequest* req, std::string_view method) {
+  std::string bucket, token;
+  if (!sb_r2_transfer_path(req->getUrl(), &bucket, &token)) return false;
+  if (method != "PUT") { respond_with_error(res, "405 Method Not Allowed", "R2 transfer requires PUT", true); return true; }
+  size_t declared = 0;
+  const std::string_view content_length = req->getHeader("content-length");
+  if (!content_length.empty() && !parse_content_length(content_length, &declared)) { respond_with_error(res, "400 Bad Request", "invalid content-length", true); return true; }
+  sb_r2_transfer_ctx* opened = nullptr;
+  const int open_status = sb_r2_transfer_open(bucket.c_str(), token.c_str(), declared, &opened);
+  if (open_status != 0 || !opened) { respond_with_error(res, sb_r2_transfer_status(open_status), "R2 transfer unavailable", true); return true; }
+  auto ctx = std::make_shared<sb_r2_transfer_ctx*>(opened);
+  res->onAborted([ctx]() { if (*ctx) { sb_r2_transfer_abort(*ctx); *ctx = nullptr; } });
+  res->onData([res, ctx](std::string_view chunk, bool is_last) {
+    if (!*ctx) return;
+    const int write_status = sb_r2_transfer_write(*ctx, chunk.data(), chunk.size());
+    if (write_status != 0) { sb_r2_transfer_abort(*ctx); *ctx = nullptr; respond_with_error(res, sb_r2_transfer_status(write_status), "R2 transfer failed", true); return; }
+    if (is_last) {
+      const int finish_status = sb_r2_transfer_finish(*ctx); *ctx = nullptr;
+      if (finish_status == 201) { res->writeStatus("201 Created"); res->end(); }
+      else respond_with_error(res, sb_r2_transfer_status(finish_status), "R2 transfer failed", true);
+    }
+  });
+  return true;
+}
+static void on_request(uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {
+`;
+const R2_TRANSFER_MARKER = "sb_r2_transfer_path(std::string_view path";
+const R2_TRANSFER_CALL_ANCHOR = "  __porffor_js_enter();\n  const i32 url_ptr = alloc_request_url(req);";
+const R2_TRANSFER_CALL_INJECT =
+  "  if (try_handle_r2_transfer(res, req, method)) return;\n" + R2_TRANSFER_CALL_ANCHOR;
+const R2_TRANSFER_CALL_MARKER = "try_handle_r2_transfer(res, req, method)";
 
 const done = new Set<string>();
 
@@ -486,15 +483,32 @@ const UWS_EDITS = [
   [BODY_MARKER, BODY_ANCHOR, BODY_INJECT, "request body limit"],
   [STATUS_SIG_MARKER, STATUS_SIG_ANCHOR, STATUS_SIG_INJECT, "status-line return type (#156)"],
   [STATUS_303_MARKER, STATUS_303_ANCHOR, STATUS_303_INJECT, "status-line 303 case (#156)"],
-  [STATUS_DEFAULT_MARKER, STATUS_DEFAULT_ANCHOR, STATUS_DEFAULT_INJECT, "status-line fallback (#156)"],
+  [
+    STATUS_DEFAULT_MARKER,
+    STATUS_DEFAULT_ANCHOR,
+    STATUS_DEFAULT_INJECT,
+    "status-line fallback (#156)",
+  ],
   [HDR_SIG_MARKER, HDR_SIG_ANCHOR, HDR_SIG_INJECT, "collect_headers res arg (#163)"],
   [HDR_CALL_MARKER, HDR_CALL_ANCHOR, HDR_CALL_INJECT, "collect_headers call site (#163)"],
   [HDR_CAP_MARKER, HDR_CAP_ANCHOR, HDR_CAP_INJECT, "remote-addr header capacity (#163)"],
   [HDR_SKIP_MARKER, HDR_SKIP_ANCHOR, HDR_SKIP_INJECT, "drop client-sent x-sb-remote-addr (#163)"],
   [HDR_APPEND_MARKER, HDR_APPEND_ANCHOR, HDR_APPEND_INJECT, "append x-sb-remote-addr (#163)"],
   [READ_RAW_DECL_MARKER, READ_RAW_DECL_ANCHOR, READ_RAW_DECL_INJECT, "read_raw_bytes decl (#176)"],
-  [FORBIDDEN_HDR_MARKER, FORBIDDEN_HDR_ANCHOR, FORBIDDEN_HDR_INJECT, "drop x-sb-raw-body from the wire (#176)"],
-  [WRITE_RESPONSE_MARKER, WRITE_RESPONSE_ANCHOR, WRITE_RESPONSE_INJECT, "detect x-sb-raw-body, steer the body read (#176)"],
+  [
+    FORBIDDEN_HDR_MARKER,
+    FORBIDDEN_HDR_ANCHOR,
+    FORBIDDEN_HDR_INJECT,
+    "drop x-sb-raw-body from the wire (#176)",
+  ],
+  [
+    WRITE_RESPONSE_MARKER,
+    WRITE_RESPONSE_ANCHOR,
+    WRITE_RESPONSE_INJECT,
+    "detect x-sb-raw-body, steer the body read (#176)",
+  ],
+  [R2_TRANSFER_MARKER, R2_TRANSFER_ANCHOR, R2_TRANSFER_INJECT, "native direct R2 transfer ingress (#195)"],
+  [R2_TRANSFER_CALL_MARKER, R2_TRANSFER_CALL_ANCHOR, R2_TRANSFER_CALL_INJECT, "direct R2 transfer dispatch (#195)"],
 ] as const;
 
 /** The uWebSockets shim source: body limit + the #156 status-line fix. Exported for tests. */
@@ -589,6 +603,5 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchCompilerArgs(root);
   await patchUwebsockets(root);
   await patchRenderJs(root);
-  await patchPromiseTs(root);
   done.add(root);
 }

package/src/pin.ts

@@ -10,13 +10,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-5";
-export const PORFFOR_COMMIT_FULL = "1f4ae4ae3e0a5f0a93b3bc084359e1a3a23391fd";
+export const PORFFOR_CHANNEL = "alpha-6";
+export const PORFFOR_COMMIT_FULL = "038f415e08efc5f87a6bfcb05a18824caa3a14f6";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
-export const PORFFOR_ARCHIVE_SHA256 = "a49a0e857574e93cb09c574dcf53b7cc049d3cb65c5b944b169755cad2a51d5d";
+export const PORFFOR_ARCHIVE_SHA256 =
+  "61f65d8fac5f94a7910f0a3f046e8929a852addb0033a032b9f7e08d0b07df5c";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-5 (1f4ae4a)`). */
+/** A compact identity string for a manifest / report (`alpha-6 (038f415)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }