feat(js-sdk): run the template test suite on Deno (#1595)

## What

Extends the Deno vitest run (#1585) with the `template` project and
fixes the real runtime bug the suite surfaced. Split out of #1594 (Bun
counterpart: #1596).

```jsonc
// packages/js-sdk/package.json
"test:deno": "deno run -A npm:vitest run --project unit --project connectionConfig --project template",
```

## Bug — Deno: template uploads used chunked transfer encoding

Deno's native `fetch` ignores an explicit `Content-Length` header on
stream bodies and falls back to `Transfer-Encoding: chunked` — exactly
the failure #1243 fixed for Node, since S3-compatible presigned PUT URLs
reject chunked uploads with 501.

`uploadFile` now streams the spooled archive through **undici's
`fetch`** (via the existing `loadUndici()` helper — undici 8 where it
imports, undici 7 on Bun, global `fetch` where undici isn't resolvable,
e.g. bundled apps), which honors the `Content-Length` header on stream
bodies on every runtime. One upload path, no runtime sniffing.

Approaches rejected along the way, all verified empirically with 1GB
uploads + RSS sampling:

- **File-backed `Blob` body (`fs.openAsBlob`)** — lazy on Node/Bun, but
Deno's shim reads the whole file into memory eagerly
(denoland/deno#32316), and Bun infers an unstrippable MIME type from the
extension whose `Content-Type` breaks presigned signatures (403 against
production storage).
- **`node:http(s)` on Deno** — works (and is memory-bounded), but can't
be unified: Bun's `node:http` ignores abort signals, and it's a second
code path.

Known caveat: Deno's `Readable.toWeb` shim has no backpressure, so the
archive is buffered in memory during upload on Deno (Node and Bun stream
in lockstep with the socket). Filed upstream as denoland/deno#36275 —
accepted as Deno's to fix rather than worked around here.

As part of this, `tarFileStream` became `spoolTarArchive`, returning `{
path, size, cleanup }` with caller-owned cleanup instead of a
self-deleting read stream. `tests/template/uploadFile.test.ts` also
asserts no `Content-Type` header is sent.

## Python SDK parity

Intentionally none: `upload_file` already sends a sized file body via
httpx.

## Testing

- Real template builds (`tests/template/build.test.ts`, against prod S3
presigned URLs) green under **Node, Deno, and Bun**
- `uploadFile` + `spoolTarArchive` suites green under Node, Deno, and
Bun
- `tests/template/abortSignal.test.ts` green under Deno
- `pnpm build`, `lint`, `typecheck`, `prettier --check` clean

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mishushakov

.changeset/deno-template-uploads.md

@@ -0,0 +1,5 @@
+---
+'e2b': patch
+---
+
+Fix template file uploads under Deno. Deno's native `fetch` ignores a `Content-Length` header on stream bodies and fell back to `Transfer-Encoding: chunked`, which S3-compatible presigned upload URLs reject (see #1243). `Template.build` uploads now stream the spooled archive through undici's `fetch`, which honors the header on every runtime, falling back to the global `fetch` where undici isn't resolvable.

.github/workflows/js_sdk_tests.yml

@@ -29,9 +29,9 @@ jobs:
     strategy:
       fail-fast: false
       # With node-only (set by staging callers) the matrix collapses to the
-      # Node legs: Bun/Deno only run API-free unit suites and the Cloudflare
-      # legs add sandbox load without extra backend signal, so the other
-      # runtimes are exercised against production only.
+      # Node legs: the Bun/Deno/Cloudflare legs re-run suites the Node legs
+      # already cover and add sandbox/build load without extra backend
+      # signal, so the other runtimes are exercised against production only.
       matrix:
         include: >-
           ${{ inputs.node-only

packages/js-sdk/package.json

@@ -39,7 +39,7 @@
     "test:bun": "bunx --bun vitest run --project unit --project connectionConfig",
     "test:cf": "vitest run --config tests/runtimes/cloudflare/vitest.config.mts",
     "test:cf:deploy": "vitest run --config tests/runtimes/cloudflare-deploy/vitest.config.mts",
-    "test:deno": "deno run -A npm:vitest run --project unit --project connectionConfig",
+    "test:deno": "deno run -A npm:vitest run --project unit --project connectionConfig --project template",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint --config ../../.oxlintrc.json src tests",
     "format": "prettier --write src/ tests/ example.mts"

packages/js-sdk/src/template/buildApi.ts

@@ -1,11 +1,13 @@
-import type { Readable } from 'node:stream'
+import fs from 'node:fs'
+import stream from 'node:stream'
+
 import { ApiClient, handleApiError, components } from '../api'
 import { buildRequestSignal } from '../connectionConfig'
-import { dynamicImport } from '../utils'
+import { loadUndici } from '../undici'
 import { BuildError, FileUploadError, TemplateError } from '../errors'
 import { FILE_UPLOAD_TIMEOUT_MS } from './consts'
 import { LogEntry } from './logger'
-import { getBuildStepIndex, tarFileStream } from './utils'
+import { getBuildStepIndex, spoolTarArchive } from './utils'
 import {
   BuildStatusReason,
   TemplateBuildStatus,
@@ -130,40 +132,27 @@ export async function uploadFile(
     gzip,
   } = options
   // Spool the archive to a temporary file and stream it from disk instead of
-  // buffering in memory. S3 presigned PUT URLs reject Transfer-Encoding:
+  // buffering it in memory. S3 presigned PUT URLs reject Transfer-Encoding:
   // chunked with 501 NotImplemented (see e2b-dev/e2b#1243), so the upload
-  // sends an explicit Content-Length, which fetch honors for stream bodies.
-  // The spooled file deletes itself once the stream is consumed, so there is
-  // no cleanup to manage here. The Python SDK takes the same approach
-  // (build_api.py:upload_file).
-  let uploadStream: Readable | undefined
+  // must carry an exact Content-Length. The Python SDK takes the same
+  // approach (build_api.py:upload_file).
+  let cleanup: (() => Promise<void>) | undefined
   try {
-    // Dynamically import so the browser bundle doesn't pull in node:stream.
-    const { Readable } =
-      await dynamicImport<typeof import('node:stream')>('node:stream')
-
-    const tar = await tarFileStream(
+    const tar = await spoolTarArchive(
       fileName,
       fileContextPath,
       ignorePatterns,
       resolveSymlinks,
       gzip
     )
-    uploadStream = tar.stream
+    cleanup = tar.cleanup
 
-    const res = await fetch(url, {
-      method: 'PUT',
-      body: Readable.toWeb(uploadStream) as ReadableStream<Uint8Array>,
-      headers: {
-        'Content-Length': tar.size.toString(),
-      },
-      // Streaming request bodies require half-duplex mode.
-      duplex: 'half',
-      signal: buildRequestSignal(
-        abortOpts?.requestTimeoutMs ?? FILE_UPLOAD_TIMEOUT_MS,
-        abortOpts?.signal
-      ),
-    } as RequestInit)
+    const signal = buildRequestSignal(
+      abortOpts?.requestTimeoutMs ?? FILE_UPLOAD_TIMEOUT_MS,
+      abortOpts?.signal
+    )
+
+    const res = await putFileStream(url, tar.path, tar.size, signal)
 
     if (!res.ok) {
       throw new FileUploadError(
@@ -172,17 +161,44 @@ export async function uploadFile(
       )
     }
   } catch (error) {
-    // Ensure the spooled archive is removed even if fetch never consumed the
-    // stream (e.g. it threw before reading the body). Destroying the stream
-    // fires its `close` handler, which deletes the temp file.
-    uploadStream?.destroy()
     if (error instanceof FileUploadError) {
       throw error
     }
     throw new FileUploadError(`Failed to upload file: ${error}`, stackTrace)
+  } finally {
+    await cleanup?.()
   }
 }
 
+async function putFileStream(
+  url: string,
+  filePath: string,
+  size: number,
+  signal: AbortSignal | undefined
+): Promise<{ ok: boolean; statusText: string }> {
+  // Prefer undici's fetch: it honors the explicit Content-Length on stream
+  // bodies on every runtime, while Deno's native fetch ignores the header and
+  // falls back to chunked. Where undici isn't resolvable (e.g. bundled apps),
+  // fall back to the global fetch — Node's and Bun's native fetch also honor
+  // Content-Length on stream bodies. loadUndici tries undici 8 first and
+  // falls back to undici 7 where 8 doesn't import (Bun).
+  const undici = await loadUndici()
+  const fetchImpl = (undici?.fetch as typeof fetch | undefined) ?? fetch
+
+  return await fetchImpl(url, {
+    method: 'PUT',
+    body: stream.Readable.toWeb(
+      fs.createReadStream(filePath)
+    ) as ReadableStream,
+    headers: {
+      'Content-Length': size.toString(),
+    },
+    // Streaming request bodies require half-duplex mode.
+    duplex: 'half',
+    signal,
+  } as RequestInit)
+}
+
 export async function triggerBuild(
   client: ApiClient,
   { templateID, buildID, template }: TriggerBuildInput,

packages/js-sdk/src/template/utils.ts

@@ -6,7 +6,6 @@ import url from 'node:url'
 import { dynamicImport } from '../utils'
 import { TemplateError } from '../errors'
 import { BASE_STEP_NAME, FINALIZE_STEP_NAME } from './consts'
-import type { Readable } from 'node:stream'
 import type { Path } from 'glob'
 import type { BuildOptions } from './types'
 
@@ -353,35 +352,31 @@ export function padOctal(mode: number): string {
 }
 
 /**
- * Create a gzipped tar archive of files matching a pattern and return a
- * readable stream over it.
+ * Create a gzipped tar archive of files matching a pattern, spooled to a
+ * temporary file on disk.
  *
- * The archive is spooled to a temporary file on disk so it can be uploaded as
- * a stream with a known `Content-Length` instead of being buffered in memory.
- * The temporary file is removed automatically once the returned stream is
- * closed — whether it was fully read, errored, or destroyed. This mirrors the
- * Python SDK's `tar_file_stream`, where closing the temp-file handle deletes
- * it (Node has no portable delete-on-close, so cleanup is tied to the stream's
- * `close` event instead).
+ * Spooling instead of buffering keeps memory bounded and gives the archive a
+ * known size, so the upload can send an exact `Content-Length`. The caller
+ * owns the archive's lifetime and must invoke `cleanup` once done with it.
+ * This mirrors the Python SDK's `tar_file_stream`.
  *
  * @param fileName Glob pattern for files to include
  * @param fileContextPath Base directory for resolving file paths
  * @param ignorePatterns Ignore patterns to exclude from the archive
  * @param resolveSymlinks Whether to follow symbolic links
  * @param gzip Whether to gzip the archive
- * @returns The readable stream and the archive size in bytes
+ * @returns The archive path, its size in bytes, and a cleanup callback that
+ *   removes the spooled archive. Cleanup is best-effort so it can never mask
+ *   the upload result — a leaked temp dir is non-fatal, the OS reclaims it.
  */
-export async function tarFileStream(
+export async function spoolTarArchive(
   fileName: string,
   fileContextPath: string,
   ignorePatterns: string[],
   resolveSymlinks: boolean,
   gzip: boolean
-): Promise<{ stream: Readable; size: number }> {
+): Promise<{ path: string; size: number; cleanup: () => Promise<void> }> {
   const { create } = await dynamicImport<typeof import('tar')>('tar')
-  // Dynamically import so the browser bundle doesn't pull in node:fs.
-  const { createReadStream } =
-    await dynamicImport<typeof import('node:fs')>('node:fs')
 
   const allFiles = await getAllFilesInPath(
     fileName,
@@ -396,9 +391,7 @@ export async function tarFileStream(
     path.join(os.tmpdir(), 'e2b-template-')
   )
   const tarPath = path.join(tmpDir, 'context.tar.gz')
-  // Best-effort removal so it can never mask the archive-creation error or the
-  // upload result. A leaked temp dir is non-fatal — the OS reclaims it.
-  const removeTmpDir = () =>
+  const cleanup = () =>
     fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {})
 
   try {
@@ -414,14 +407,9 @@ export async function tarFileStream(
     )
 
     const { size } = await fs.promises.stat(tarPath)
-
-    const stream = createReadStream(tarPath)
-    // Remove the spooled archive once the stream is done — `close` fires after
-    // the fd is released on every path (end, error, or destroy).
-    stream.once('close', removeTmpDir)
-    return { stream, size }
+    return { path: tarPath, size, cleanup }
   } catch (err) {
-    await removeTmpDir()
+    await cleanup()
     throw err
   }
 }

packages/js-sdk/tests/template/uploadFile.test.ts

@@ -10,7 +10,9 @@ import { uploadFile } from '../../src/template/buildApi'
 // Readable directly to fetch, which made undici fall back to
 // Transfer-Encoding: chunked. S3 presigned PUT URLs reject that with 501
 // NotImplemented. The fix spools the archive to a temporary file and streams
-// it from disk with an explicit Content-Length.
+// it from disk with an explicit Content-Length via undici's fetch, which
+// honors the header on stream bodies on every runtime (Deno's native fetch
+// ignores it and chunks). This suite runs under both Node and Deno.
 describe('uploadFile transfer encoding', () => {
   let testDir: string
   let server: Server
@@ -66,5 +68,10 @@ describe('uploadFile transfer encoding', () => {
     if (transferEncoding !== undefined) {
       expect(transferEncoding.toLowerCase()).not.toContain('chunked')
     }
+
+    // Presigned upload URLs sign the request headers, so an implicit
+    // Content-Type (e.g. inferred from the archive's file extension) makes
+    // the storage backend reject the upload with 403 Forbidden.
+    expect(capturedHeaders['content-type']).toBeUndefined()
   })
 })