RDBC-1083: a few remarks addressed

Author: Scooletz

scripts/addWorkerCondition.mjs

@@ -57,6 +57,17 @@ for (const [subpath, entry] of Object.entries(pkg.exports)) {
     patched++;
 }
 
+// Fail the build loudly if nothing was patched. tshy rewrites the whole "exports"
+// map on every build, so if its output shape ever changes (e.g. the "import"
+// condition is renamed or nested differently) this script would silently produce a
+// package.json without the workerd/worker conditions and ship a broken package.
+if (patched === 0) {
+    throw new Error(
+        "addWorkerCondition: patched 0 export entries -- no entry exposed an 'import' condition to mirror. "
+        + "tshy's 'exports' shape likely changed; the workerd/worker conditions were NOT injected. "
+        + "Refusing to leave package.json without them.");
+}
+
 writeFileSync(PKG_PATH, JSON.stringify(pkg, null, 2) + "\n");
 // Log to stderr so it never pollutes stdout of `npm pack --silent` (which is
 // parsed to obtain the tarball filename in CI).

src/Http/RavenCommand.ts

@@ -151,7 +151,10 @@ export abstract class RavenCommand<TResult> {
     public async send(agent: Dispatcher,
         requestOptions: HttpRequestParameters): Promise<{ response: HttpResponse, bodyStream: Readable }> {
 
-        const { body, uri, fetcher, ...restOptions } = requestOptions;
+        // `dispatcher` is pulled out here so it never leaks into `restOptions`: the
+        // normal path re-adds it explicitly (see below), while the Bun and workerd
+        // paths must not carry an undici dispatcher into their fetch init.
+        const { body, uri, fetcher, dispatcher, ...restOptions } = requestOptions;
 
         log.info(`Send command ${this.constructor.name} to ${uri}${body ? " with body " + body : ""}.`);
 
@@ -167,8 +170,8 @@ export abstract class RavenCommand<TResult> {
             // dispatcher here is meaningless and can confuse the runtime.
             optionsToUse = { body: bodyToUse, ...restOptions } as RequestInit;
         } else {
-            if (requestOptions.dispatcher) { // support for fiddler
-                agent = requestOptions.dispatcher;
+            if (dispatcher) { // support for fiddler
+                agent = dispatcher;
             }
             optionsToUse = { body: bodyToUse, ...restOptions, dispatcher: agent } as RequestInit;
         }
@@ -184,13 +187,20 @@ export abstract class RavenCommand<TResult> {
         const fetchFn = fetcher ?? fetch; // support for custom fetcher
         const response = await fetchFn(uri, optionsToUse);
 
-        const effectiveStream: Stream =
-            response.body
-                ? Readable.fromWeb(response.body)
-                : new Stream();
+        // `Readable.fromWeb` / `new Stream()` / `.pipe` are all `node:stream` APIs,
+        // so an incomplete edge polyfill (Nitro/unenv) can throw here just like
+        // `new PassThrough()` above. Guard them so the actionable error is raised.
+        try {
+            const effectiveStream: Stream =
+                response.body
+                    ? Readable.fromWeb(response.body)
+                    : new Stream();
 
-        effectiveStream
-            .pipe(passthrough);
+            effectiveStream
+                .pipe(passthrough);
+        } catch (err) {
+            throw RavenCommand._maybeNodeStreamUnavailableError(err as Error);
+        }
 
         return {
             response,

src/Http/RequestExecutor.ts

@@ -347,6 +347,16 @@ export class RequestExecutor implements IDisposable {
         if (RuntimeUtil.isWorkerd()) {
             // Cloudflare Workers has no undici Agent / Node https agent.
             // mTLS is provided via conventions.customFetch (an mtls_certificate binding).
+            // If a certificate was configured (the Node way) but no customFetch was set
+            // (checked above), the cert can never be presented -- fail fast with an
+            // actionable message instead of silently issuing an uncertified request.
+            if (this._certificate) {
+                throwError("InvalidOperationException",
+                    "A client certificate was configured via authOptions, but Cloudflare Workers has no Node "
+                    + "https agent to present it. On workerd, X.509 mTLS must be provided through a Cloudflare "
+                    + "mtls_certificate binding wired into conventions.customFetch (see the \"Cloudflare Workers\" "
+                    + "section of the README). Remove the certificate from authOptions and set conventions.customFetch.");
+            }
             return null;
         }
 

src/Utility/RuntimeUtil.ts

@@ -18,13 +18,17 @@ export class RuntimeUtil {
     /**
      * Detects if the code is running in the Cloudflare Workers (workerd) runtime.
      *
-     * workerd exposes the Web `navigator.userAgent` as the fixed string
+     * workerd exposes the Web `navigator.userAgent` as the string
      * "Cloudflare-Workers", which is the officially documented way to detect it.
+     * We match by prefix so a future version suffix (e.g. "Cloudflare-Workers/1")
+     * still resolves to workerd instead of failing closed into the Node path
+     * (which would then crash trying to build an undici agent that workerd lacks).
      */
     public static isWorkerd(): boolean {
         if (this._isWorkerd === null) {
             const nav = (globalThis as unknown as { navigator?: { userAgent?: string } }).navigator;
-            this._isWorkerd = !!nav && nav.userAgent === "Cloudflare-Workers";
+            this._isWorkerd = !!nav && typeof nav.userAgent === "string"
+                && nav.userAgent.startsWith("Cloudflare-Workers");
         }
         return this._isWorkerd;
     }