@sproutboat/runtime 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # @sproutboat/runtime
 
+## 0.6.2
+
+### Patch Changes
+
+- bd06ce7: Fix (baronunread/sproutboat#181): a handler calling `.text()`/`.json()` on a
+  Response built from raw wire bytes — the assets binding, outbound `fetch()`,
+  or a service-binding `fetch()`, the three places that set the `x-sb-raw-body`
+  marker for #176 — got the bytes back undecoded instead of as real text. Those
+  Response bodies are Porffor `bytestring`s (one raw byte per code unit), and
+  `Response.prototype.text()` returns that verbatim rather than UTF-8-decoding
+  it, so any multi-byte UTF-8 sequence came back as multiple wrong Latin-1
+  characters. A handler that transforms and re-emits that text (sproutboat-
+  site's homepage does this to inline its live counter into the fetched
+  `index.html`) then re-encodes the corruption as ordinary UTF-8 on the way
+  out — this is what turned `·` into `·` live on sproutboat.com.
+  
+  Fixed at the sproutboat glue layer, not in Porffor: the three `x-sb-raw-body`
+  producers in `native-fetch-prelude.js` now build their Response through a new
+  `__sbRawBodyResponse()`, which overrides `.text()`/`.json()` on just that
+  instance with a proper UTF-8 decode (`__sbFromUtf8`, validates each
+  continuation byte before consuming it). This is deliberately *not* a patch to
+  Porffor's generic `Response`/`Request` classes — Porffor represents any
+  string whose characters are all <= 0xFF as this same `bytestring` shape,
+  whether it's opaque bytes or a handler's own Latin-1-range text (e.g.
+  `"café"`), and the type alone can't tell those apart. Decoding generically
+  would corrupt the second case; scoping the fix to the three call sites that
+  know for certain their body is bytes avoids that entirely (verified: a
+  genuine `"héllo"`/`"café"` string passes through `__sbFromUtf8` unchanged).
+  
+  Verified against a real compiled native-fetch binary (`porf native`, not just
+  plain Bun): the override pattern works as expected, the decode round-trips
+  real multi-byte and 4-byte UTF-8 correctly, and genuine Latin-1 text is left
+  alone. Also verified end to end on sproutboat-site's own deployment.
+
+## 0.6.1
+
+### Patch Changes
+
+- 806c21e: Fix (baronunread/sproutboat#176): #172's bytestring UTF-8 encoding fix broke
+  the assets binding, which reads a file's bytes off disk into a `bytestring`
+  specifically so they pass through the wire untouched — a `bytestring`
+  carrying real text a handler built and one carrying opaque file bytes are the
+  same type with no way to tell them apart, so #172's blanket encoding also
+  re-encoded already-finished bytes, corrupting any binary asset (and any
+  proxied `fetch()`/service-binding response body).
+  
+  Adds a second, dedicated `porf_native_fetch_read_raw_bytes` (zero-copy,
+  bytestring-only, no encoding, ever) alongside the untouched original —
+  `porf_native_fetch_read_value` is called from ~30 places across sproutboat's
+  own inline C, all genuine text, so its signature and behavior stay exactly as
+  #172 left them. `write_response_value` picks between the two based on a new
+  reserved `x-sb-raw-body` response header (same pattern as #163's
+  `x-sb-remote-addr`), which the assets binding, outbound `fetch()`, and
+  service-binding `fetch()` now set — the three places sproutboat's own
+  prelude constructs a Response from wire bytes rather than a string a handler
+  built. Verified end-to-end: a 256-byte all-values fixture now round-trips
+  byte-for-byte through a real standalone build's assets binding, and #172's
+  original UTF-8 fix still holds for genuine text.
+  
+  Not fixed here: `env.<R2>.get()`'s `.body` is exposed directly to handler
+  code, which then constructs its own `new Response(obj.body)` — no
+  sproutboat-owned call site to attach the marker to, so R2 binary objects
+  served this way carry the same corruption. Needs either a real binary body
+  type upstream in Porffor or a different API shape; tracked as a known gap on
+  #176, not resolved by this fix.
+
 ## 0.6.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/native-fetch-prelude.js

@@ -326,6 +326,84 @@ function __sbBufFrom(latin1) {
   for (let i = 0; i < latin1.length; i++) b[i] = latin1.charCodeAt(i) & 0xff;
   return b.buffer;
 }
+// The reverse of __sbToBytes: a latin1 string holding raw UTF-8 bytes (one
+// byte per char) -> a real JS string, decoding multi-byte sequences into
+// single characters. Validates each continuation byte (10xxxxxx) before
+// consuming it, so a lead byte with no valid continuation -- the common case
+// for genuine Latin-1 text, e.g. a lone "é" -- passes through unchanged
+// rather than swallowing following characters into a garbage code point.
+// Used only where sproutboat's own glue knows for certain the string is
+// opaque bytes off the wire (the `x-sb-raw-body` producers below), never on
+// a generic string a handler might have built -- Porffor represents any
+// string whose chars are all <= 0xff as this same "bytestring" shape
+// regardless of whether it holds real Latin-1 text or raw bytes, so this
+// decode is only safe where the caller already knows which one it has.
+function __sbFromUtf8(bytes) {
+  let out = "";
+  const len = bytes.length;
+  const cont = (j) => {
+    const b = bytes.charCodeAt(j) & 0xff;
+    return (b & 0xc0) == 0x80 ? b & 0x3f : -1;
+  };
+  for (let i = 0; i < len; i++) {
+    const b0 = bytes.charCodeAt(i) & 0xff;
+    if (b0 < 0x80) {
+      out += String.fromCharCode(b0);
+      continue;
+    }
+    if ((b0 & 0xe0) == 0xc0 && i + 1 < len) {
+      const c1 = cont(i + 1);
+      if (c1 >= 0) {
+        out += String.fromCharCode(((b0 & 0x1f) << 6) | c1);
+        i += 1;
+        continue;
+      }
+    } else if ((b0 & 0xf0) == 0xe0 && i + 2 < len) {
+      const c1 = cont(i + 1);
+      const c2 = cont(i + 2);
+      if (c1 >= 0 && c2 >= 0) {
+        out += String.fromCharCode(((b0 & 0x0f) << 12) | (c1 << 6) | c2);
+        i += 2;
+        continue;
+      }
+    } else if ((b0 & 0xf8) == 0xf0 && i + 3 < len) {
+      const c1 = cont(i + 1);
+      const c2 = cont(i + 2);
+      const c3 = cont(i + 3);
+      if (c1 >= 0 && c2 >= 0 && c3 >= 0) {
+        let cp = ((b0 & 0x07) << 18) | (c1 << 12) | (c2 << 6) | c3;
+        cp -= 0x10000;
+        out += String.fromCharCode(0xd800 + (cp >> 10), 0xdc00 + (cp & 0x3ff));
+        i += 3;
+        continue;
+      }
+    }
+    // no lead byte matched, or its continuation bytes weren't 10xxxxxx:
+    // pass the single byte through rather than guessing
+    out += String.fromCharCode(b0);
+  }
+  return out;
+}
+// sproutboat #181 — wrap a Response built from raw wire bytes (the assets
+// binding, outbound fetch(), service-binding fetch(): the three `x-sb-raw-
+// body` producers) so a handler calling `.text()`/`.json()` on it gets the
+// bytes properly UTF-8-decoded. The wire write path already handles the
+// C-level byte-for-byte passthrough via that same header (#176) -- this is
+// the separate, missing half: Porffor's own `Response.prototype.text()`
+// returns a `bytestring` body verbatim instead of decoding it (it can't tell
+// "opaque bytes" from "a handler's own Latin-1-range string" apart, so it
+// safely can't decode by default). Overriding just these three instances,
+// which sproutboat itself builds and knows are bytes, fixes the read side
+// without touching Porffor's generic Response/Request classes at all.
+function __sbRawBodyResponse(body, init) {
+  const resp = new Response(body == null ? "" : body, init);
+  if (body != null) {
+    const decoded = __sbFromUtf8(body);
+    resp.text = () => decoded;
+    resp.json = () => JSON.parse(decoded);
+  }
+  return resp;
+}
 // Constant-time compare of two latin1 byte strings.
 function __sbEqCt(a, b) {
   if (a.length !== b.length) return false;
@@ -1140,7 +1218,12 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         const headers = {};
         if (r.type) headers["content-type"] = r.type;
         if (r.found) headers["etag"] = '"' + r.hash + '"';
-        return new Response(r.body == null ? "" : r.body, { status: r.status || (r.found ? 200 : 404), headers });
+        // #176: these bytes came off disk already-finished (UTF-8 text or
+        // binary, doesn't matter which) -- the reserved x-sb-raw-body header
+        // tells the C write path to pass them through untouched instead of
+        // re-encoding as if this were a JS string a handler built.
+        if (r.body != null) headers["x-sb-raw-body"] = "1";
+        return __sbRawBodyResponse(r.body, { status: r.status || (r.found ? 200 : 404), headers });
       },
     };
   }
@@ -1168,7 +1251,11 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         });
         const respHeaders = new Headers();
         for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
-        return new Response(r.body == null ? "" : r.body, { status: r.status || 502, headers: respHeaders });
+        // #176: wire bytes from another deployment, not a string this handler
+        // built -- must not be re-encoded if the handler proxies it straight
+        // through (see the assets binding for the same reasoning).
+        if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
+        return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
       },
     };
   }
@@ -1190,7 +1277,11 @@ globalThis.__sbInstallBindings = function (target, bindings) {
       });
       const respHeaders = new Headers();
       for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
-      return new Response(r.body == null ? "" : r.body, { status: r.status || 502, headers: respHeaders });
+      // #176: bytes from an outbound HTTP response, not a string this handler
+      // built -- must not be re-encoded if the handler proxies it straight
+      // through (see the assets binding for the same reasoning).
+      if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
+      return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
     };
   }
 };

package/src/utf8-decode.test.js

@@ -0,0 +1,52 @@
+// sproutboat #181 — __sbFromUtf8 lives inline in native-fetch-prelude.js (the
+// prelude is prepended as text and cannot import), so this test lifts that one
+// pure-JS function out and exercises it directly. If it moves or its boundary
+// markers change, this fails loudly rather than silently testing nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const start = src.indexOf("function __sbFromUtf8(");
+const end = src.indexOf("// sproutboat #181 — wrap a Response");
+if (start === -1 || end === -1 || end < start) throw new Error("__sbFromUtf8 block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const load = new Function(`${src.slice(start, end)}\nreturn { __sbFromUtf8 };`);
+const { __sbFromUtf8 } = load();
+
+/** Build a bytestring (one char per raw byte) the way __sbToBytes/porf_native_fetch_alloc_bytestring would, from real UTF-8 bytes. */
+function toBytestring(text) {
+  const bytes = new TextEncoder().encode(text);
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
+
+test("decodes real UTF-8 bytes back to the original text", () => {
+  const text = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓";
+  expect(__sbFromUtf8(toBytestring(text))).toBe(text);
+});
+
+test("multi-byte and 4-byte (surrogate-pair) sequences round-trip", () => {
+  expect(__sbFromUtf8(toBytestring("café"))).toBe("café");
+  expect(__sbFromUtf8(toBytestring("🌱"))).toBe("🌱");
+});
+
+test("a genuine Latin-1-range string with no real UTF-8 sequences passes through unchanged", () => {
+  // "héllo" here is a real JS string (one code point per character), not
+  // re-encoded bytes -- exactly what a handler-built bytestring looks like.
+  // This must NOT be decoded, or it corrupts ordinary accented text.
+  expect(__sbFromUtf8("héllo")).toBe("héllo");
+  expect(__sbFromUtf8("café")).toBe("café");
+});
+
+test("a lead byte with an invalid or missing continuation passes through raw", () => {
+  expect(__sbFromUtf8(String.fromCharCode(0xe9))).toBe(String.fromCharCode(0xe9));
+  expect(__sbFromUtf8(String.fromCharCode(0xc2))).toBe(String.fromCharCode(0xc2)); // truncated 2-byte lead
+});
+
+test("empty and pure-ASCII strings are untouched", () => {
+  expect(__sbFromUtf8("")).toBe("");
+  expect(__sbFromUtf8("hello world")).toBe("hello world");
+});