@sproutboat/runtime 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @sproutboat/runtime
 
+## 0.6.3
+
+### Patch Changes
+
+- Fix two compounding performance regressions in the `#181` fix, caught after
+  it went live and made sproutboat.com's homepage take 2.6-2.8s per request:
+  
+  1. `__sbRawBodyResponse` decoded eagerly at construction, paying the cost of
+     `__sbFromUtf8` on every asset/proxied response regardless of whether the
+     handler ever called `.text()`/`.json()` on it (the common case is a
+     response handed straight back to the client, never read as text). Now
+     decodes lazily on first call and memoizes.
+  
+  2. `__sbFromUtf8` built its result with repeated `out +=`. Porffor's strings
+     have no rope/cons optimization, so `+=` in a loop copies the whole
+     accumulated string on every append, making a large decode `O(n^2)`.
+     Measured directly against the real broker-sourced 43KB homepage body,
+     each successive 8000-character chunk took visibly longer than the last.
+     Now builds into an array and joins once.
+  
+  Together these took the homepage from ~2.7s to ~25ms (measured via the
+  runtime's own `x-sb-cpu-ms` header, confirming real CPU time, not I/O wait).
+  Every other route was already unaffected by fix 1 alone, since they never
+  call `.text()`. Verified against a real compiled `porf native` binary with
+  the actual page content, and end to end on sproutboat-site's own deployment.
+
+## 0.6.2
+
+### Patch Changes
+
+- bd06ce7: Fix (baronunread/sproutboat#181): a handler calling `.text()`/`.json()` on a
+  Response built from raw wire bytes — the assets binding, outbound `fetch()`,
+  or a service-binding `fetch()`, the three places that set the `x-sb-raw-body`
+  marker for #176 — got the bytes back undecoded instead of as real text. Those
+  Response bodies are Porffor `bytestring`s (one raw byte per code unit), and
+  `Response.prototype.text()` returns that verbatim rather than UTF-8-decoding
+  it, so any multi-byte UTF-8 sequence came back as multiple wrong Latin-1
+  characters. A handler that transforms and re-emits that text (sproutboat-
+  site's homepage does this to inline its live counter into the fetched
+  `index.html`) then re-encodes the corruption as ordinary UTF-8 on the way
+  out — this is what turned `·` into `·` live on sproutboat.com.
+  
+  Fixed at the sproutboat glue layer, not in Porffor: the three `x-sb-raw-body`
+  producers in `native-fetch-prelude.js` now build their Response through a new
+  `__sbRawBodyResponse()`, which overrides `.text()`/`.json()` on just that
+  instance with a proper UTF-8 decode (`__sbFromUtf8`, validates each
+  continuation byte before consuming it). This is deliberately *not* a patch to
+  Porffor's generic `Response`/`Request` classes — Porffor represents any
+  string whose characters are all <= 0xFF as this same `bytestring` shape,
+  whether it's opaque bytes or a handler's own Latin-1-range text (e.g.
+  `"café"`), and the type alone can't tell those apart. Decoding generically
+  would corrupt the second case; scoping the fix to the three call sites that
+  know for certain their body is bytes avoids that entirely (verified: a
+  genuine `"héllo"`/`"café"` string passes through `__sbFromUtf8` unchanged).
+  
+  Verified against a real compiled native-fetch binary (`porf native`, not just
+  plain Bun): the override pattern works as expected, the decode round-trips
+  real multi-byte and 4-byte UTF-8 correctly, and genuine Latin-1 text is left
+  alone. Also verified end to end on sproutboat-site's own deployment.
+
 ## 0.6.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/native-fetch-prelude.js

@@ -326,6 +326,104 @@ function __sbBufFrom(latin1) {
   for (let i = 0; i < latin1.length; i++) b[i] = latin1.charCodeAt(i) & 0xff;
   return b.buffer;
 }
+// The reverse of __sbToBytes: a latin1 string holding raw UTF-8 bytes (one
+// byte per char) -> a real JS string, decoding multi-byte sequences into
+// single characters. Validates each continuation byte (10xxxxxx) before
+// consuming it, so a lead byte with no valid continuation -- the common case
+// for genuine Latin-1 text, e.g. a lone "é" -- passes through unchanged
+// rather than swallowing following characters into a garbage code point.
+// Used only where sproutboat's own glue knows for certain the string is
+// opaque bytes off the wire (the `x-sb-raw-body` producers below), never on
+// a generic string a handler might have built -- Porffor represents any
+// string whose chars are all <= 0xff as this same "bytestring" shape
+// regardless of whether it holds real Latin-1 text or raw bytes, so this
+// decode is only safe where the caller already knows which one it has.
+function __sbFromUtf8(bytes) {
+  // Collected into an array and joined once at the end, not built with
+  // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
+  // `+=` in a loop copies the whole accumulated string on every append,
+  // making the naive version O(n^2). Measured on the real 43KB homepage
+  // (dynamic, wire-sourced content, not a compile-time constant): each
+  // successive 8000-character chunk took visibly longer than the last, ~2.8s
+  // total -- a real, shipped performance regression on sproutboat.com.
+  // `Array.prototype.join` builds the result in one pass.
+  const out = [];
+  const len = bytes.length;
+  const cont = (j) => {
+    const b = bytes.charCodeAt(j) & 0xff;
+    return (b & 0xc0) == 0x80 ? b & 0x3f : -1;
+  };
+  for (let i = 0; i < len; i++) {
+    const b0 = bytes.charCodeAt(i) & 0xff;
+    if (b0 < 0x80) {
+      out.push(String.fromCharCode(b0));
+      continue;
+    }
+    if ((b0 & 0xe0) == 0xc0 && i + 1 < len) {
+      const c1 = cont(i + 1);
+      if (c1 >= 0) {
+        out.push(String.fromCharCode(((b0 & 0x1f) << 6) | c1));
+        i += 1;
+        continue;
+      }
+    } else if ((b0 & 0xf0) == 0xe0 && i + 2 < len) {
+      const c1 = cont(i + 1);
+      const c2 = cont(i + 2);
+      if (c1 >= 0 && c2 >= 0) {
+        out.push(String.fromCharCode(((b0 & 0x0f) << 12) | (c1 << 6) | c2));
+        i += 2;
+        continue;
+      }
+    } else if ((b0 & 0xf8) == 0xf0 && i + 3 < len) {
+      const c1 = cont(i + 1);
+      const c2 = cont(i + 2);
+      const c3 = cont(i + 3);
+      if (c1 >= 0 && c2 >= 0 && c3 >= 0) {
+        let cp = ((b0 & 0x07) << 18) | (c1 << 12) | (c2 << 6) | c3;
+        cp -= 0x10000;
+        out.push(String.fromCharCode(0xd800 + (cp >> 10), 0xdc00 + (cp & 0x3ff)));
+        i += 3;
+        continue;
+      }
+    }
+    // no lead byte matched, or its continuation bytes weren't 10xxxxxx:
+    // pass the single byte through rather than guessing
+    out.push(String.fromCharCode(b0));
+  }
+  return out.join("");
+}
+// sproutboat #181 — wrap a Response built from raw wire bytes (the assets
+// binding, outbound fetch(), service-binding fetch(): the three `x-sb-raw-
+// body` producers) so a handler calling `.text()`/`.json()` on it gets the
+// bytes properly UTF-8-decoded. The wire write path already handles the
+// C-level byte-for-byte passthrough via that same header (#176) -- this is
+// the separate, missing half: Porffor's own `Response.prototype.text()`
+// returns a `bytestring` body verbatim instead of decoding it (it can't tell
+// "opaque bytes" from "a handler's own Latin-1-range string" apart, so it
+// safely can't decode by default). Overriding just these three instances,
+// which sproutboat itself builds and knows are bytes, fixes the read side
+// without touching Porffor's generic Response/Request classes at all.
+// Decoded lazily, on first .text()/.json() call, and memoized after that --
+// most raw-body responses (a static asset, a proxied fetch()) are handed
+// straight back to the client and never read as text at all, and Porffor's
+// strings have no rope/cons optimization: `+=`-building a decoded copy costs
+// real time proportional to the body size (measured ~116ms for a 44KB
+// all-ASCII body). Decoding unconditionally at construction paid that cost
+// on every asset request regardless of whether anything used it -- this was
+// a real, shipped performance regression on sproutboat.com, caught after
+// the fact by unexpectedly slow page loads.
+function __sbRawBodyResponse(body, init) {
+  const resp = new Response(body == null ? "" : body, init);
+  if (body != null) {
+    let decoded = null;
+    resp.text = () => {
+      if (decoded === null) decoded = __sbFromUtf8(body);
+      return decoded;
+    };
+    resp.json = () => JSON.parse(resp.text());
+  }
+  return resp;
+}
 // Constant-time compare of two latin1 byte strings.
 function __sbEqCt(a, b) {
   if (a.length !== b.length) return false;
@@ -1145,7 +1243,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         // tells the C write path to pass them through untouched instead of
         // re-encoding as if this were a JS string a handler built.
         if (r.body != null) headers["x-sb-raw-body"] = "1";
-        return new Response(r.body == null ? "" : r.body, { status: r.status || (r.found ? 200 : 404), headers });
+        return __sbRawBodyResponse(r.body, { status: r.status || (r.found ? 200 : 404), headers });
       },
     };
   }
@@ -1177,7 +1275,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
         // built -- must not be re-encoded if the handler proxies it straight
         // through (see the assets binding for the same reasoning).
         if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
-        return new Response(r.body == null ? "" : r.body, { status: r.status || 502, headers: respHeaders });
+        return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
       },
     };
   }
@@ -1203,7 +1301,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
       // built -- must not be re-encoded if the handler proxies it straight
       // through (see the assets binding for the same reasoning).
       if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
-      return new Response(r.body == null ? "" : r.body, { status: r.status || 502, headers: respHeaders });
+      return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
     };
   }
 };

package/src/utf8-decode.test.js

@@ -0,0 +1,106 @@
+// sproutboat #181 — __sbFromUtf8 lives inline in native-fetch-prelude.js (the
+// prelude is prepended as text and cannot import), so this test lifts that one
+// pure-JS function out and exercises it directly. If it moves or its boundary
+// markers change, this fails loudly rather than silently testing nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const start = src.indexOf("function __sbFromUtf8(");
+const end = src.indexOf("// sproutboat #181 — wrap a Response");
+if (start === -1 || end === -1 || end < start) throw new Error("__sbFromUtf8 block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const load = new Function(`${src.slice(start, end)}\nreturn { __sbFromUtf8 };`);
+const { __sbFromUtf8 } = load();
+
+/** Build a bytestring (one char per raw byte) the way __sbToBytes/porf_native_fetch_alloc_bytestring would, from real UTF-8 bytes. */
+function toBytestring(text) {
+  const bytes = new TextEncoder().encode(text);
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
+
+test("decodes real UTF-8 bytes back to the original text", () => {
+  const text = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓";
+  expect(__sbFromUtf8(toBytestring(text))).toBe(text);
+});
+
+test("multi-byte and 4-byte (surrogate-pair) sequences round-trip", () => {
+  expect(__sbFromUtf8(toBytestring("café"))).toBe("café");
+  expect(__sbFromUtf8(toBytestring("🌱"))).toBe("🌱");
+});
+
+test("a genuine Latin-1-range string with no real UTF-8 sequences passes through unchanged", () => {
+  // "héllo" here is a real JS string (one code point per character), not
+  // re-encoded bytes -- exactly what a handler-built bytestring looks like.
+  // This must NOT be decoded, or it corrupts ordinary accented text.
+  expect(__sbFromUtf8("héllo")).toBe("héllo");
+  expect(__sbFromUtf8("café")).toBe("café");
+});
+
+test("a lead byte with an invalid or missing continuation passes through raw", () => {
+  expect(__sbFromUtf8(String.fromCharCode(0xe9))).toBe(String.fromCharCode(0xe9));
+  expect(__sbFromUtf8(String.fromCharCode(0xc2))).toBe(String.fromCharCode(0xc2)); // truncated 2-byte lead
+});
+
+test("empty and pure-ASCII strings are untouched", () => {
+  expect(__sbFromUtf8("")).toBe("");
+  expect(__sbFromUtf8("hello world")).toBe("hello world");
+});
+
+// __sbFromUtf8 builds its result via an array + one join(),
+// not repeated `out +=`. Porffor's strings have no rope/cons optimization, so
+// `+=` in a loop copies the whole accumulated string on every append,
+// making a large decode O(n^2) -- measured as a real ~2.6s stall decoding a
+// 43KB page on sproutboat.com, gone after the array+join rewrite. This is a
+// correctness check (long input still round-trips exactly), not a timing
+// assertion -- CI timing thresholds are flaky; the real perf verification
+// happened against a real compiled binary, documented in the fix commit.
+test("a long, multi-chunk body round-trips exactly", () => {
+  const chunk = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓ café 🌱 ";
+  const text = chunk.repeat(800); // ~46KB, comparable to the real homepage
+  expect(__sbFromUtf8(toBytestring(text))).toBe(text);
+});
+
+// __sbRawBodyResponse must decode lazily: eagerly decoding at construction
+// paid the cost of __sbFromUtf8 on every asset/proxied response regardless of
+// whether the handler ever reads it as text, a real perf regression shipped
+// and caught on sproutboat.com (most such responses are handed straight to
+// the client and .text()/.json() are never called).
+const rbrStart = src.indexOf("function __sbRawBodyResponse(");
+const rbrEnd = src.indexOf("// Constant-time compare of two latin1 byte strings.");
+if (rbrStart === -1 || rbrEnd === -1 || rbrEnd < rbrStart) {
+  throw new Error("__sbRawBodyResponse block not found in prelude");
+}
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const loadRbr = new Function(
+  "Response",
+  `${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
+);
+// A minimal Response stand-in: only what __sbRawBodyResponse touches (the
+// constructor call and setting .text/.json on the instance), no Porffor
+// bytestring typing involved.
+class FakeResponse {
+  constructor(body, init) {
+    this.body = body;
+    this.status = (init && init.status) || 200;
+  }
+}
+const { __sbRawBodyResponse } = loadRbr(FakeResponse);
+
+test("__sbRawBodyResponse's text()/json() decode correctly, callable more than once", () => {
+  const bytes = toBytestring("café · 🌱");
+  const resp = __sbRawBodyResponse(bytes, { status: 200 });
+  expect(resp.text()).toBe("café · 🌱");
+  expect(resp.text()).toBe("café · 🌱"); // memoized decode, not re-run per call
+  expect(resp.json).toBeInstanceOf(Function);
+});
+
+test("__sbRawBodyResponse with a null body sets no text()/json() override", () => {
+  const resp = __sbRawBodyResponse(null, { status: 404 });
+  expect(resp.text).toBeUndefined();
+  expect(resp.json).toBeUndefined();
+});