@sproutboat/runtime 0.27.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @sproutboat/runtime
 
+## 0.27.1
+
+### Patch Changes
+
+- 0d2d079: Bodies of megabytes no longer take hundreds of megabytes of memory (sproutd #22). Converting bytes to text and text to bytes made one string per character, so reading a 5 MiB R2 object with `text()` peaked at about 400 MiB, and R2 multipart uploads with real (5 MiB) parts ran sproutd's workers out of memory. The conversions now run in one C pass and give exactly the same results. On a standalone build, at 5 MiB:
+  
+  | | before | after |
+  |---|---|---|
+  | `put()` of a string | 82 MiB | 16 MiB |
+  | `put()` then `get()` and `text()` | 400 MiB | 26 MiB |
+  | multipart upload, then `get()` and `text()` | 396 MiB | 21 MiB |
+  | `request.text()` of the request body | 402 MiB | 24 MiB |
+  
+  Also:
+  
+  - At every date, `uploadPart()` stores an `ArrayBuffer` or a typed array as its bytes. It stored the text `[object ArrayBuffer]`.
+  - From `2026-10-26`, `uploadPart()` takes what `put()` takes (a `ReadableStream` or a `Blob` too), and stores text as its UTF-8 bytes, as in workerd. It stored text whose characters all fit in one byte as Latin-1.
+  - From `2026-10-26`, an R2 object body's `body` stream is made when first read, and a whole-object `get()` keeps one copy of the bytes, not two.
+
 ## 0.27.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/ingress-utf8.test.js

@@ -2,17 +2,15 @@ import { expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
 const src = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
 const decoder = src.slice(src.indexOf("function __sbFromUtf8("), src.indexOf("// sproutboat #181"));
-const ingress = src.slice(
-  src.indexOf("function __sbDecodeIngress("),
-  src.indexOf("globalThis.__sbEntry ="),
-);
+const ingress = src.slice(src.indexOf("function __sbDecodeIngress("), src.indexOf("globalThis.__sbEntry ="));
 const rawBody = src.slice(src.indexOf("function __sbRawBody("), src.indexOf("function __sbHasStreamBody("));
 if (!decoder || !ingress || !rawBody) throw new Error("Ingress decoder source not found");
 // oxlint-disable-next-line no-function-constructor -- Exercise the text-only runtime prelude.
-const load = new Function(`${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`);
+const load = new Function(
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${decoder}\n${rawBody}\n${ingress}\nreturn __sbDecodeIngress;`,
+);
 const decode = load();
-const raw = (text) =>
-  Array.from(new TextEncoder().encode(text), (byte) => String.fromCharCode(byte)).join("");
+const raw = (text) => Array.from(new TextEncoder().encode(text), (byte) => String.fromCharCode(byte)).join("");
 
 test("native ingress text and JSON decode Unicode without changing raw bytes", async () => {
   const body = raw('{"id":"caffè-🚤"}');

package/src/native-fetch-prelude.js

@@ -3034,7 +3034,10 @@ if (globalThis.clearInterval == null) globalThis.clearInterval = clearInterval;
 // these express the same spec-mandated checks and are verified under Porffor
 // alpha-10 by examples/kitchen-sink/harness.ts).
 function __sbIsStr(v) {
-  return Object(v) !== v && v === String(v);
+  // sproutd #22: not `Object(v) !== v`, which wraps (copies) a string in Porffor: two such
+  // checks on a 5 MiB part took 20 MiB.
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- the one check that does not copy its argument
+  return typeof v === "string";
 }
 function __sbIsFn(v) {
   return v instanceof Function;
@@ -3936,6 +3939,9 @@ const __SB_BYTES_WINDOW = 512;
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
+  // sproutd #22: one C pass when the input allows it (see __sbToBytesNative).
+  const native = __sbToBytesNative(input);
+  if (native !== "") return native;
   // Windowed accumulation (#180, then #181). Plain `s +=` in a loop is O(n^2)
   // here, since Porffor's strings have no rope/cons optimization and every
   // append copies the whole accumulated string -- that's #180, a 43KB body
@@ -4015,6 +4021,9 @@ function __sbBufFrom(latin1) {
 // regardless of whether it holds real Latin-1 text or raw bytes, so this
 // decode is only safe where the caller already knows which one it has.
 function __sbFromUtf8(bytes) {
+  // sproutd #22: one C pass for a string of bytes (see __sbFromUtf8Native).
+  const native = __sbFromUtf8Native(bytes);
+  if (native !== "") return native;
   // Collected into an array and joined once at the end, not built with
   // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
   // `+=` in a loop copies the whole accumulated string on every append,
@@ -4672,8 +4681,167 @@ static int sb_os_random(unsigned char* buf, size_t n) {
   return 0;
 }
 
+// sproutd #22: text and bytes converted in one C pass. The JS loops in
+// __sbFromUtf8 and __sbToBytes made one string per character, so a 5 MiB R2
+// object read with text() took about 400 MiB of heap before the next collection.
+u32 porf_native_fetch_alloc(u32 bytes, u32 type);
+
+// Lenient UTF-8 decode, exactly as __sbFromUtf8's JS: a lead byte whose
+// continuation bytes are not all 10xxxxxx passes through as its own unit.
+// OUT has room for LEN units. Returns the unit count; *WIDE is set when a unit
+// is above 0xff (the result then needs a UTF-16 string).
+static size_t sb_utf8_decode_units(const unsigned char* b, size_t len, uint16_t* out, int* wide) {
+  size_t k = 0;
+  *wide = 0;
+  for (size_t i = 0; i < len; i++) {
+    const unsigned b0 = b[i];
+    if (b0 >= 0x80) {
+      if ((b0 & 0xe0) == 0xc0 && i + 1 < len && (b[i + 1] & 0xc0) == 0x80) {
+        out[k] = (uint16_t)(((b0 & 0x1f) << 6) | (b[i + 1] & 0x3f));
+        if (out[k] > 0xff) *wide = 1;
+        k++; i += 1; continue;
+      }
+      if ((b0 & 0xf0) == 0xe0 && i + 2 < len && (b[i + 1] & 0xc0) == 0x80 && (b[i + 2] & 0xc0) == 0x80) {
+        out[k] = (uint16_t)(((b0 & 0x0f) << 12) | ((b[i + 1] & 0x3f) << 6) | (b[i + 2] & 0x3f));
+        if (out[k] > 0xff) *wide = 1;
+        k++; i += 2; continue;
+      }
+      if ((b0 & 0xf8) == 0xf0 && i + 3 < len && (b[i + 1] & 0xc0) == 0x80 && (b[i + 2] & 0xc0) == 0x80 && (b[i + 3] & 0xc0) == 0x80) {
+        int32_t cp = (int32_t)(((b0 & 0x07) << 18) | ((b[i + 1] & 0x3f) << 12) | ((b[i + 2] & 0x3f) << 6) | (b[i + 3] & 0x3f));
+        cp -= 0x10000;
+        out[k++] = (uint16_t)(0xd800 + (cp >> 10));
+        out[k++] = (uint16_t)(0xdc00 + (cp & 0x3ff));
+        *wide = 1;
+        i += 3; continue;
+      }
+    }
+    out[k++] = (uint16_t)b0;
+  }
+  return k;
+}
+
+// UTF-8 encode, exactly as __sbToBytes's JS: a high surrogate takes the next
+// unit as its pair. OUT has room for 3 bytes per unit. Returns the byte count.
+static size_t sb_utf8_encode_units(const uint16_t* s, size_t len, unsigned char* out) {
+  size_t k = 0;
+  for (size_t i = 0; i < len; i++) {
+    const uint32_t c = s[i];
+    if (c < 0x80) out[k++] = (unsigned char)c;
+    else if (c < 0x800) { out[k++] = (unsigned char)(0xc0 | (c >> 6)); out[k++] = (unsigned char)(0x80 | (c & 0x3f)); }
+    else if (c >= 0xd800 && c < 0xdc00 && i + 1 < len) {
+      const int32_t cp = 0x10000 + (int32_t)((c - 0xd800) << 10) + ((int32_t)s[++i] - 0xdc00);
+      out[k++] = (unsigned char)(0xf0 | ((cp >> 18) & 0xff));
+      out[k++] = (unsigned char)(0x80 | ((cp >> 12) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | ((cp >> 6) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | (cp & 0x3f));
+    } else {
+      out[k++] = (unsigned char)(0xe0 | ((c >> 12) & 0xff));
+      out[k++] = (unsigned char)(0x80 | ((c >> 6) & 0x3f));
+      out[k++] = (unsigned char)(0x80 | (c & 0x3f));
+    }
+  }
+  return k;
+}
+
 `;
 
+// sproutd #22: __sbFromUtf8 for a string of bytes (one byte per unit), in C.
+// Returns "" when it cannot (not a string, or out of memory), so the caller
+// falls back to the JS loop. All-ASCII byte strings are already their text.
+// oxlint-disable-next-line no-unused-vars -- `bytes` is read inside the RawC block below, not by JS.
+function __sbFromUtf8Native(bytes) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    if (bytes.type == 195 || bytes.type == 67) {
+      const u32 __p = (u32)bytes.val;
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      int __ascii = bytes.type == 195;
+      if (__ascii) {
+        const unsigned char* __s = (const unsigned char*)(MEM + __p + 4);
+        for (size_t __i = 0; __i < __n; __i++) if (__s[__i] >= 0x80) { __ascii = 0; break; }
+      }
+      if (__ascii) out = bytes;
+      else {
+        unsigned char* __b = (unsigned char*)malloc(__n + 1);
+        uint16_t* __u = (uint16_t*)malloc(__n * 2 + 2);
+        if (__b && __u) {
+          if (bytes.type == 195) memcpy(__b, MEM + __p + 4, __n);
+          else { const uint16_t* __w = (const uint16_t*)(MEM + __p + 4); for (size_t __i = 0; __i < __n; __i++) __b[__i] = (unsigned char)(__w[__i] & 0xff); }
+          int __wide = 0;
+          const size_t __k = sb_utf8_decode_units(__b, __n, __u, &__wide);
+          if (__wide) {
+            const u32 __s = porf_native_fetch_alloc((u32)(4 + __k * 2), 67);
+            *(u32*)(MEM + __s) = (u32)__k;
+            memcpy(MEM + __s + 4, __u, __k * 2);
+            out = porf_box((f64)__s, 67);
+          } else {
+            for (size_t __i = 0; __i < __k; __i++) __b[__i] = (unsigned char)__u[__i];
+            out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__b, __k), 195);
+          }
+        }
+        free(__b); free(__u);
+      }
+    }
+  `;
+  return out;
+}
+
+// sproutd #22: __sbToBytes for a string, a Uint8Array or an ArrayBuffer, in C.
+// Returns "" when it cannot (another type, a length-tracking view, out of
+// memory), so the caller falls back to the JS loop.
+// oxlint-disable-next-line no-unused-vars -- `input` is read inside the RawC block below, not by JS.
+function __sbToBytesNative(input) {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const u32 __p = (u32)input.val;
+    if (input.type == 195) {
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      const unsigned char* __s = (const unsigned char*)(MEM + __p + 4);
+      size_t __high = 0;
+      for (size_t __i = 0; __i < __n; __i++) if (__s[__i] >= 0x80) __high++;
+      if (!__high) out = input;
+      else {
+        unsigned char* __o = (unsigned char*)malloc(__n + __high + 1);
+        if (__o) {
+          const unsigned char* __src = (const unsigned char*)(MEM + __p + 4);
+          size_t __k = 0;
+          for (size_t __i = 0; __i < __n; __i++) {
+            const unsigned char __c = __src[__i];
+            if (__c < 0x80) __o[__k++] = __c;
+            else { __o[__k++] = (unsigned char)(0xc0 | (__c >> 6)); __o[__k++] = (unsigned char)(0x80 | (__c & 0x3f)); }
+          }
+          out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, __k), 195);
+          free(__o);
+        }
+      }
+    } else if (input.type == 67) {
+      const size_t __n = (size_t)*(u32*)(MEM + __p);
+      uint16_t* __w = (uint16_t*)malloc(__n * 2 + 2);
+      unsigned char* __o = (unsigned char*)malloc(__n * 3 + 1);
+      if (__w && __o) {
+        memcpy(__w, MEM + __p + 4, __n * 2);
+        const size_t __k = sb_utf8_encode_units(__w, __n, __o);
+        out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, __k), 195);
+      }
+      free(__w); free(__o);
+    } else if (input.type == 13 || input.type == 81) {
+      const int32_t __len = *(int32_t*)(MEM + __p);
+      if (__len > 0) {
+        const u32 __data = input.type == 13 ? __p + 8 : *(u32*)(MEM + __p + 4) + 4;
+        unsigned char* __o = (unsigned char*)malloc((size_t)__len);
+        if (__o) {
+          memcpy(__o, MEM + __data, (size_t)__len);
+          out = porf_box((f64)porf_native_fetch_alloc_bytestring((const char*)__o, (size_t)__len), 195);
+          free(__o);
+        }
+      }
+    }
+  `;
+  return out;
+}
+
 // TRANSPORT: wrap.ts splices one of transport-broker.js / transport-embedded.js here.
 
 // `nStr` is the decimal byte count as a string (same string-param pattern as
@@ -5218,6 +5386,15 @@ function __sbR2Object(meta, body) {
   return obj;
 }
 
+// A part's value for the transport: an ArrayBuffer or a view as its bytes (String() of one
+// stored "[object ArrayBuffer]", at every date), anything else as text, as before.
+function __sbR2PartValue(value) {
+  value = __sbUnwrapBody(value);
+  if (value == null) return "";
+  if (!__sbIsStr(value) && value.byteLength !== undefined)
+    return __sbToBytes(value.buffer !== undefined ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value));
+  return String(value);
+}
 function __sbR2Multipart(bucket, key, uploadId) {
   return {
     key,
@@ -5226,7 +5403,7 @@ function __sbR2Multipart(bucket, key, uploadId) {
       const number = Number(partNumber);
       if (!Number.isInteger(number) || number < 1 || number > 10000)
         throw new TypeError("partNumber must be an integer between 1 and 10000");
-      return __sbR2MultipartPut(bucket, key, uploadId, number, value == null ? "" : String(value)).part;
+      return __sbR2MultipartPut(bucket, key, uploadId, number, __sbR2PartValue(value)).part;
     },
     complete(parts) {
       const r = __sbRpc("r2.multipart.complete", { bucket, key, uploadId, parts: parts || [] });
@@ -5361,7 +5538,16 @@ function __sbR2StrictObject(meta, bytes, range, include) {
     used = true;
     return bytes;
   };
-  obj.body = new Response(__sbBufFrom(bytes)).body;
+  // The stream is made when first asked for: text() and friends read the bytes directly,
+  // so an object read as text never holds a second copy (sproutd #22).
+  let stream = null;
+  Object.defineProperty(obj, "body", {
+    get: () => {
+      if (stream === null) stream = new Response(__sbBufFrom(bytes)).body;
+      return stream;
+    },
+    enumerable: true,
+  });
   Object.defineProperty(obj, "bodyUsed", { get: () => used, enumerable: true });
   obj.text = async () => __sbFromUtf8(take());
   obj.json = async () => JSON.parse(__sbFromUtf8(take()));
@@ -5392,7 +5578,13 @@ function __sbMakeR2(name) {
     return {
       key,
       uploadId,
-      uploadPart: (partNumber, value) => attempt(() => inner.uploadPart(partNumber, value)),
+      // A part is any value put() takes; text is stored as its UTF-8 bytes, as in workerd.
+      uploadPart: async (partNumber, value) => {
+        value = __sbUnwrapBody(value);
+        if (value instanceof Blob) value = await value.arrayBuffer();
+        else if (value != null && __sbIsFn(value.getReader)) value = await new Response(value).arrayBuffer();
+        return inner.uploadPart(partNumber, __sbIsStr(value) ? __sbToBytes(value) : value);
+      },
       // ponytail: a multipart object's etag stays the transport's sha256; workerd's is
       // MD5-of-part-MD5s-N. Add when an app compares multipart etags.
       complete: (parts) => attempt(() => __sbR2StrictObject(__sbRpc("r2.multipart.complete", { bucket: name, key, uploadId, parts: parts || [] }).object, null)),
@@ -5415,7 +5607,8 @@ function __sbMakeR2(name) {
         if (!__sbR2OnlyIf(o.onlyIf, meta.md5 || meta.etag, meta.uploaded)) return __sbR2StrictObject(meta, null, { offset: 0, length: meta.size });
         const bytes = r.body == null ? "" : r.body;
         const range = o.range == null ? { offset: 0, length: meta.size } : __sbR2Range(o.range, meta.size);
-        return __sbR2StrictObject(meta, bytes.slice(range.offset, range.offset + range.length), range);
+        const whole = range.offset === 0 && range.length >= bytes.length;
+        return __sbR2StrictObject(meta, whole ? bytes : bytes.slice(range.offset, range.offset + range.length), range);
       });
     },
     async put(key, value, options) {

package/src/r2-object.test.js

@@ -18,6 +18,9 @@ const rawStart = src.indexOf("function __sbRawBodyResponse(");
 const utf8End = rawStart;
 const rawEnd = src.indexOf("function __sbEqCt(");
 const r2Start = src.indexOf("function __sbR2Object(");
+const isStrStart = src.indexOf("function __sbIsStr(");
+const isStrEnd = src.indexOf("function __sbIsFn(");
+const bytesStart = src.indexOf("const __SB_BYTES_WINDOW");
 const r2End = src.indexOf("// Installed only when the project declares bindings.");
 if (utf8Start === -1 || utf8End === -1) throw new Error("__sbFromUtf8 block not found in prelude");
 if (rawStart === -1 || rawEnd === -1) throw new Error("__sbRawBodyResponse block not found in prelude");
@@ -27,7 +30,8 @@ if (r2Start === -1 || r2End === -1 || r2End < r2Start) throw new Error("__sbR2Ob
 const load = new Function(
   "__sbRpc",
   "__sbR2MultipartPut",
-  `${src.slice(utf8Start, utf8End)}\n${src.slice(rawStart, rawEnd)}\n${src.slice(r2Start, r2End)}\nreturn { __sbR2Object, __sbR2Multipart };`,
+  // __sbIsStr and __sbToBytes (for uploadPart's values), with the C fast paths stubbed out.
+  `function __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(isStrStart, isStrEnd)}\n${src.slice(bytesStart, utf8Start)}\n${src.slice(utf8Start, utf8End)}\n${src.slice(rawStart, rawEnd)}\n${src.slice(r2Start, r2End)}\nreturn { __sbR2Object, __sbR2Multipart };`,
 );
 const calls = [];
 const rpc = (op, value) => {
@@ -70,7 +74,7 @@ test("toResponse() lets caller-supplied headers/status override the defaults", (
   expect(resp.headers.get("content-type")).toBe("application/octet-stream");
 });
 
-test("toResponse() on an empty body still returns bytes, not the string \"\"", async () => {
+test('toResponse() on an empty body still returns bytes, not the string ""', async () => {
   const obj = __sbR2Object(meta, "");
   const resp = obj.toResponse();
   const buf = new Uint8Array(await resp.arrayBuffer());
@@ -84,9 +88,14 @@ test("multipart uploads expose the Cloudflare-shaped uploadPart, complete, and a
   expect(upload.uploadPart(1, "first")).toEqual({ partNumber: 1, etag: "part-1" });
   expect(upload.complete([{ partNumber: 1, etag: "part-1" }])).toMatchObject(meta);
   upload.abort();
-  expect(calls.map((call) => call.op)).toEqual([
-    "r2.multipart.put",
-    "r2.multipart.complete",
-    "r2.multipart.abort",
-  ]);
+  expect(calls.map((call) => call.op)).toEqual(["r2.multipart.put", "r2.multipart.complete", "r2.multipart.abort"]);
+});
+
+test("uploadPart stores an ArrayBuffer or a view as its bytes, not as [object ArrayBuffer]", () => {
+  calls.length = 0;
+  const upload = __sbR2Multipart("FILES", "archive.bin", "upload-1");
+  upload.uploadPart(1, new Uint8Array([0, 255, 65]).buffer);
+  upload.uploadPart(2, new Uint8Array([9, 8, 7, 6]).subarray(1, 3));
+  upload.uploadPart(3, "text");
+  expect(calls.map((call) => call.value.body)).toEqual(["\u0000ÿA", "\u0008\u0007", "text"]);
 });

package/src/to-bytes.test.js

@@ -22,7 +22,7 @@ if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sb
 
 // oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
 const load = new Function(
-  `${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
 );
 const { __sbToBytes, __sbHexOrBytes } = load();
 

package/src/utf8-decode.test.js

@@ -12,7 +12,9 @@ const end = src.indexOf("// sproutboat #181 — wrap a Response");
 if (start === -1 || end === -1 || end < start) throw new Error("__sbFromUtf8 block not found in prelude");
 
 // oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
-const load = new Function(`${src.slice(start, end)}\nreturn { __sbFromUtf8 };`);
+const load = new Function(
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(start, end)}\nreturn { __sbFromUtf8 };`,
+);
 const { __sbFromUtf8 } = load();
 
 /** Build a bytestring (one char per raw byte) the way __sbToBytes/porf_native_fetch_alloc_bytestring would, from real UTF-8 bytes. */
@@ -78,7 +80,7 @@ if (rbrStart === -1 || rbrEnd === -1 || rbrEnd < rbrStart) {
 // oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
 const loadRbr = new Function(
   "Response",
-  `${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
+  `// The C fast paths (Porffor.c) cannot run here: the stubs make the JS fallback run.\nfunction __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
 );
 // A minimal Response stand-in: only what __sbRawBodyResponse touches (the
 // constructor call and setting .text/.json on the instance), no Porffor

package/test/native-byte-text.ts

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { ensurePorffor } from "../../toolchain/src/acquire";
+import { preludePath, TRANSPORT_MARKER, transportPath, wrapNativeFetchHandler } from "../src/wrap";
+
+// sproutd #22: __sbFromUtf8 and __sbToBytes run in C (__sbFromUtf8Native, __sbToBytesNative).
+// They must give exactly what the JS loops gave, and a body of megabytes must not take
+// hundreds of megabytes of heap (the JS made one string per character: a 5 MiB R2 object
+// read with text() took about 400 MiB).
+const handler = `const bytes = (list) => { let s = ""; for (const b of list) s += String.fromCharCode(b); return s; };
+const codes = (s) => { const out = []; for (let i = 0; i < s.length; i++) out.push(s.charCodeAt(i)); return out; };
+export default {fetch(request) {
+  if (new URL(request.url).pathname === "/big") {
+    const text = __sbFromUtf8("\\u00c3\\u00a9".repeat(4 * 1024 * 1024));
+    const utf8 = __sbToBytes("\\u2713".repeat(1024 * 1024));
+    const ascii = __sbToBytes("a".repeat(8 * 1024 * 1024));
+    return new Response(JSON.stringify([text.length, text.charCodeAt(0), utf8.length, utf8.charCodeAt(2), ascii.length]));
+  }
+  const decode = [
+    "hello", bytes([0x63, 0x61, 0x66, 0xc3, 0xa9, 0x20, 0xf0, 0x9f, 0x8c, 0xb1, 0x20, 0xe2, 0x9c, 0x93]),
+    bytes([0xc2]), bytes([0xe9, 0x41]), bytes([0xf0, 0x9f, 0x8c]), bytes([0xe2, 0x28, 0xa1]), bytes([0xc0, 0x80]),
+    bytes([0xf8, 0x88, 0x80, 0x80, 0x80]), bytes([0xed, 0xa0, 0x80]), bytes([0xf4, 0x90, 0x80, 0x80]), bytes([0xff, 0xfe, 0x00]),
+    JSON.parse('"caf\\\\u00c3\\\\u00a9 \\\\u0100"'), JSON.parse('"\\\\u00e2\\\\u009c\\\\u0093"'), "",
+  ];
+  const encode = [
+    "hello", "caf\\u00e9", "\\u2713 \\ud83c\\udf31", "\\ud800x", "\\udc00", "a\\ud800", "\\u0100\\u07ff\\u0800\\uffff", "",
+    new Uint8Array([0, 255, 128]), new Uint8Array([1, 2, 3]).buffer, new Uint8Array(new Uint8Array([9, 8, 7, 6]).buffer, 1, 2), new Uint8Array(0),
+  ];
+  return new Response(JSON.stringify({ decode: decode.map((s) => codes(__sbFromUtf8(s))), encode: encode.map((v) => codes(__sbToBytes(v))) }));
+}};`;
+
+// The JS the C replaces, lifted from the prelude with the C stubbed out, as the reference.
+const core = await readFile(preludePath, "utf8");
+const lift = (from: string, to: string) => {
+  const start = core.indexOf(from);
+  const end = core.indexOf(to, start);
+  assert(start >= 0 && end > start, `${from} block not found in prelude`);
+  return core.slice(start, end);
+};
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for the reference
+const reference = new Function(
+  `function __sbFromUtf8Native() { return ""; }\nfunction __sbToBytesNative() { return ""; }\n` +
+    lift("function __sbIsStr(", "function __sbIsFn(") +
+    lift("const __SB_BYTES_WINDOW", "function __sbBufFrom(") +
+    lift("function __sbFromUtf8(", "// sproutboat #181") +
+    "return { __sbFromUtf8, __sbToBytes };",
+)();
+const bytes = (list: number[]) => String.fromCharCode(...list);
+const codes = (s: string) => [...s].flatMap((c) => [...Array(c.length).keys()].map((i) => c.charCodeAt(i)));
+const want = {
+  decode: [
+    "hello",
+    bytes([0x63, 0x61, 0x66, 0xc3, 0xa9, 0x20, 0xf0, 0x9f, 0x8c, 0xb1, 0x20, 0xe2, 0x9c, 0x93]),
+    bytes([0xc2]),
+    bytes([0xe9, 0x41]),
+    bytes([0xf0, 0x9f, 0x8c]),
+    bytes([0xe2, 0x28, 0xa1]),
+    bytes([0xc0, 0x80]),
+    bytes([0xf8, 0x88, 0x80, 0x80, 0x80]),
+    bytes([0xed, 0xa0, 0x80]),
+    bytes([0xf4, 0x90, 0x80, 0x80]),
+    bytes([0xff, 0xfe, 0x00]),
+    "café Ā",
+    "â\u009c\u0093",
+    "",
+  ].map((s) => codes(reference.__sbFromUtf8(s))),
+  encode: [
+    "hello",
+    "café",
+    "✓ 🌱",
+    "\ud800x",
+    "\udc00",
+    "a\ud800",
+    "Ā߿ࠀ￿",
+    "",
+    new Uint8Array([0, 255, 128]),
+    new Uint8Array([1, 2, 3]).buffer,
+    new Uint8Array(new Uint8Array([9, 8, 7, 6]).buffer, 1, 2),
+    new Uint8Array(0),
+  ].map((v) => codes(reference.__sbToBytes(v))),
+};
+
+function freePort(): number {
+  const listener = Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } });
+  const port = listener.port;
+  listener.stop(true);
+  return port;
+}
+
+const workdir = await mkdtemp(join(tmpdir(), "sb-native-byte-text-"));
+let server: ReturnType<typeof Bun.spawn> | undefined;
+try {
+  const porffor = await ensurePorffor();
+  const node = Bun.which("node");
+  if (!node) throw new Error("native byte-text test needs node on PATH");
+  const broker = await readFile(transportPath("broker"), "utf8");
+  assert(core.includes(TRANSPORT_MARKER), "runtime prelude is missing its transport marker");
+  const generated = join(workdir, "bytes.generated.js");
+  const binary = join(workdir, "bytes-native");
+  await writeFile(generated, wrapNativeFetchHandler(handler, core.replace(TRANSPORT_MARKER, broker)));
+  const compile = Bun.spawn(
+    [node, resolve(porffor, "runtime/index.js"), "native", generated, "-o", binary, "-s", "-O0"],
+    {
+      cwd: workdir,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+  );
+  const [exitCode, stdout, stderr] = await Promise.all([
+    compile.exited,
+    new Response(compile.stdout).text(),
+    new Response(compile.stderr).text(),
+  ]);
+  assert.equal(exitCode, 0, `Porffor native compile failed:\n${stderr}\n${stdout}`);
+
+  const port = freePort();
+  // Peak RSS: /proc's high-water mark on Linux, time(1) on macOS.
+  const linux = process.platform === "linux";
+  server = Bun.spawn(linux ? [binary] : ["/usr/bin/time", "-l", binary], {
+    cwd: workdir,
+    env: { ...process.env, PORT: String(port) },
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  let ready = false;
+  for (let attempt = 0; attempt < 50 && !ready; attempt++) {
+    try {
+      await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(500) });
+      ready = true;
+    } catch {
+      if (server.exitCode !== null) break;
+      await Bun.sleep(100);
+    }
+  }
+  assert(ready, "compiled handler did not start");
+  const got = await (await fetch(`http://127.0.0.1:${port}/`)).json();
+  assert.deepEqual(got.decode, want.decode, "__sbFromUtf8 in C decodes as the JS did");
+  assert.deepEqual(got.encode, want.encode, "__sbToBytes in C encodes as the JS did");
+  console.log("C byte/text conversions match the JS ones");
+
+  const big = await (await fetch(`http://127.0.0.1:${port}/big`)).json();
+  assert.deepEqual(big, [4 * 1024 * 1024, 0xe9, 3 * 1024 * 1024, 0x93, 8 * 1024 * 1024]);
+  let peak = 0;
+  if (linux) {
+    const status = await readFile(`/proc/${server.pid}/status`, "utf8");
+    peak = Number(/VmHWM:\s+(\d+) kB/.exec(status)?.[1] ?? 0) * 1024;
+  }
+  server.kill("SIGINT");
+  const timing = linux ? "" : await new Response(server.stderr).text();
+  await server.exited;
+  server = undefined;
+  if (!linux) peak = Number(/(\d+)\s+maximum resident set size/.exec(timing)?.[1] ?? 0);
+  assert(peak > 0, "peak RSS was measured");
+  // The JS took over 600 MiB for these; the C needs the strings plus one scratch copy.
+  assert(peak < 96 * 1024 * 1024, `8 MiB conversions peaked at ${(peak / 1048576).toFixed(1)} MiB`);
+  console.log(`8 MiB conversions peak at ${(peak / 1048576).toFixed(1)} MiB RSS`);
+} finally {
+  if (server) {
+    server.kill(9);
+    await server.exited;
+  }
+  await rm(workdir, { recursive: true, force: true });
+}