Engine differences and status
Sites run on one of three engines, all QuickJS: Wasm (QuickJS compiled to WebAssembly, run by Wasmtime; the default), native (QuickJS in the server process; trusted sites only), and Linux (a QuickJS worker process in a Linux sandbox). The site's engine is chosen by site policy, an operator decision; the manifest cannot choose it, an untrusted site cannot be given the native engine, and the native engine is off unless the platform allows it for trusted sites (engines.allow_native_for_trusted). The portable contract is the SDK, not engine details. State as of 2026-10-25; the shared SDK implementation is under active change, so recheck anything marked partial.
Feature matrix
| Feature | Wasm | Native | Linux | Notes |
|---|---|---|---|---|
Handler contract, Request, Response, Headers, URL, TextEncoder/TextDecoder, crypto.getRandomValues, console |
yes | yes | yes | One shared source, sdk-js/runtime/v1/sdk.js; covered by the conformance suite. |
Repeated Set-Cookie kept separate |
yes | yes | yes | Shared SDK; the edge appends each value. |
| Static imports, import rules, no dynamic import | yes | yes | yes | Conformance scenarios. |
ctx.db |
yes | yes | yes | Same broker, per-call grant check. |
ctx.storage, ctx.env |
yes | yes | yes | Same brokers; storage conformance is partial, env not covered. |
ctx.mail |
yes | yes | yes | Outbox accepts; delivered over the platform SMTP server (see below). Not in conformance. |
fetch |
yes | yes | yes | In-process egress broker; proven end to end on all three engines against a local TLS peer; not in conformance. |
microhost/sql |
yes | yes | yes | Shared source. No conformance scenario. |
microhost/db (and db) |
yes | yes | yes | Shared source; table objects need the release's schema snapshot. No conformance scenario. |
microhost/auth |
yes | yes | yes | Conformance scenarios for hash and verify. |
microhost/session |
yes | yes | yes | Implemented once in the shared SDK layer for every engine. Verified end to end on Wasm (dev VM, 2026-10-25); native and Linux load the same module and dispatch, but a full cycle against real SQLite is not yet tested there. |
ctx.dbs (workspace databases) |
yes | yes | yes | Unverified integration; not in the type declarations. |
Admin extension private calls (verifyAdminRequest) |
yes | yes | yes | Conformance scenarios for verify. |
Manifest build for microhost.config.js |
n/a | n/a | n/a | Always runs in a separate Wasm build guest, whatever the site's engine. |
Other differences you can observe:
Math.random()is served from host randomness on the Wasm engine; this is documented for Wasm only. Usecrypto.getRandomValuesfor anything security relevant on every engine.- Memory, interrupt and timeout mechanics differ internally (Wasmtime store limits and epochs; in-process interrupts; killing a worker), but the visible behaviour is the same: HTTP 504 on timeout, HTTP 500 on memory exhaustion, no
catchorfinallyafter termination. - Fuel metering exists in the Wasm engine but is not enabled in the production composition. Wall time is the CPU bound.
- Host-call timeouts and per-operation limits are defined in the Wasm host and being converged into one shared table for native and Linux (Limits and errors). A Linux worker frame is capped at 16 MiB.
- Engine admission: an engine is admitted for use only after it passes the shared conformance suite (48 scenario files in
crates/engine-api/conformance); Linux additionally needs a host where the worker sandbox probe passes.
What is partial, unverified or not implemented
| Area | Status |
|---|---|
microhost/session full cycle on native and Linux |
Same shared code; not yet tested end to end against real SQLite there. |
| Conformance coverage | No scenarios for microhost/sql, microhost/db, microhost/session, fetch, mail or ctx.dbs; those behaviours rest on unit tests and the shared source. |
static.root and static.spaFallback |
Accepted and recorded; not applied when serving (Manifest). |
fetch |
Works through the in-process HTTPS broker. The separate egress process and firewall enforcement are not implemented. Proven end to end on all three engines against a local TLS peer; not run against a real public host. Only a Super Admin can grant hosts. |
| Mail delivery | The outbox delivers over the platform SMTP server. Without configured SMTP a site cannot be granted mail. |
ctx.dbs |
Runtime exists; declarations absent; integration unverified. |
| Release preview | Not implemented. No preview URL; the preview hostname answers 404. |
| Local handler execution | Not implemented. serve --dev is static only (Testing sites). |
| Automatic rollback | Off by default; a failed health probe only warns. |
db.d.ts generation |
No generator in the repository; sdk/db.d.ts is a hand-written example. |
table.stmt.insert, insertOrIgnore |
Fixed 2026-10-25 (the table name was quoted twice). |
db.all, update, delete result type |
Plain arrays at runtime; the declarations say DbRows. |
| Config builder typing | sdk/microhost.d.ts omits defineExtension, field and BuildSite.sdk. |
| Standalone deployment mode (built-in TLS and ACME) | Not available; the production CLI requires reverse-proxy mode. |
| Production composition as a whole | Implemented, but no integrated deployment has been run; see the progress log and known limitations. |
| Migrations timing | Run at deploy, not at activation, contrary to the design documents (Migrations). |
Error codes invalid_route_pattern, reserved_route_pattern, route_ambiguous |
Named in design documents, not produced by the code (Routing). |