@sproutboat/runtime 0.6.2 → 0.6.4

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # @sproutboat/runtime
 
+## 0.6.4
+
+### Patch Changes
+
+- 8ef3148: Fix (baronunread/sproutboat#180): `__sbToBytes` built its result with repeated
+  `s +=` in a loop, the same `O(n^2)` bug class the `__sbFromUtf8` fix in 0.6.3
+  addressed, just on the encode side. Porffor's strings have no rope/cons
+  optimization, so `+=` in a loop copies the whole accumulated string on every
+  append. Both of its branches were affected: the UTF-8 encode loop over string
+  input, and the byte-for-byte copy out of an ArrayBuffer or typed array.
+  
+  This one matters because `__sbToBytes` sits behind every `crypto.subtle` call a
+  handler makes: `digest`, `importKey`, `sign`, `verify` and the PBKDF2/scrypt
+  path all funnel their data, keys, salts and signatures through it. Hashing a
+  request body was quadratic in the body's size.
+  
+  `__sbHexOrBytes` had the same shape on a third crypto path (it decodes the
+  `expected` side of an HMAC verify) and was worse than a plain `+=` loop: on odd
+  iterations it rewrote the last character with `out = out.slice(0, -1) + ...`,
+  copying the accumulated string a second time per byte. It now holds the high
+  nibble in a local until its pair arrives and pushes one character per byte.
+  
+  Three further accumulators converted to the same array-and-join idiom for
+  consistency. These are bounded by header count, id length or parameter count
+  rather than by handler input, so they are hygiene rather than a fix:
+  `__SproutboatURLSearchParams.prototype.toString()` in the prelude, and `__sbHex`
+  plus the outbound-fetch header builder in `transport-embedded.js`.
+  
+  Covered by a new `to-bytes.test.js`, following the `utf8-decode.test.js`
+  convention of lifting the pure functions out of the text-only prelude: ASCII,
+  2-byte, 3-byte and surrogate-pair encodes checked byte-identical against
+  `TextEncoder`, the existing unpaired-surrogate behaviour pinned, typed-array and
+  ArrayBuffer input with high bytes, hex decode in both cases with its non-hex and
+  odd-length fallbacks, and long inputs (46KB string, 50,000-byte array, 20,000-byte
+  hex) for correctness at the size the quadratic version hurt.
+
+## 0.6.3
+
+### Patch Changes
+
+- Fix two compounding performance regressions in the `#181` fix, caught after
+  it went live and made sproutboat.com's homepage take 2.6-2.8s per request:
+  
+  1. `__sbRawBodyResponse` decoded eagerly at construction, paying the cost of
+     `__sbFromUtf8` on every asset/proxied response regardless of whether the
+     handler ever called `.text()`/`.json()` on it (the common case is a
+     response handed straight back to the client, never read as text). Now
+     decodes lazily on first call and memoizes.
+  
+  2. `__sbFromUtf8` built its result with repeated `out +=`. Porffor's strings
+     have no rope/cons optimization, so `+=` in a loop copies the whole
+     accumulated string on every append, making a large decode `O(n^2)`.
+     Measured directly against the real broker-sourced 43KB homepage body,
+     each successive 8000-character chunk took visibly longer than the last.
+     Now builds into an array and joins once.
+  
+  Together these took the homepage from ~2.7s to ~25ms (measured via the
+  runtime's own `x-sb-cpu-ms` header, confirming real CPU time, not I/O wait).
+  Every other route was already unaffected by fix 1 alone, since they never
+  call `.text()`. Verified against a real compiled `porf native` binary with
+  the actual page content, and end to end on sproutboat-site's own deployment.
+
 ## 0.6.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/native-fetch-prelude.js

@@ -171,12 +171,14 @@ class __SproutboatURLSearchParams {
     return this._keys.length;
   }
   toString() {
-    let out = "";
+    // Array + one join("&"), not `out +=` in a loop: see __sbToBytes. A query
+    // string is usually short, but a params object built from a large form or
+    // a paginated cursor list is not, and the fix costs nothing.
+    const out = [];
     for (let i = 0; i < this._keys.length; i++) {
-      if (i > 0) out += "&";
-      out += encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]);
+      out.push(encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]));
     }
-    return out;
+    return out.join("&");
   }
 }
 
@@ -295,31 +297,38 @@ function __sbHashBits(algo) {
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
+  // Collected into an array and joined once at the end, not built with
+  // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
+  // `+=` in a loop copies the whole accumulated string on every append,
+  // making the naive version O(n^2). Same fix as __sbFromUtf8 above, on the
+  // encode side (sits behind every crypto.subtle call).
   if (__sbIsStr(input)) {
-    let s = "";
+    const out = [];
     for (let i = 0; i < input.length; i++) {
       const c = input.charCodeAt(i);
-      if (c < 0x80) s += String.fromCharCode(c);
-      else if (c < 0x800) s += String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f));
+      if (c < 0x80) out.push(String.fromCharCode(c));
+      else if (c < 0x800) out.push(String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f)));
       else if (c >= 0xd800 && c < 0xdc00 && i + 1 < input.length) {
         const cp = 0x10000 + ((c - 0xd800) << 10) + (input.charCodeAt(++i) - 0xdc00);
-        s +=
+        out.push(
           String.fromCharCode(0xf0 | (cp >> 18)) +
-          String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
-          String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
-          String.fromCharCode(0x80 | (cp & 0x3f));
+            String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
+            String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
+            String.fromCharCode(0x80 | (cp & 0x3f))
+        );
       } else
-        s +=
+        out.push(
           String.fromCharCode(0xe0 | (c >> 12)) +
-          String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
-          String.fromCharCode(0x80 | (c & 0x3f));
+            String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
+            String.fromCharCode(0x80 | (c & 0x3f))
+        );
     }
-    return s;
+    return out.join("");
   }
   const view = input.length !== undefined && input.buffer !== undefined ? input : new Uint8Array(input);
-  let s = "";
-  for (let i = 0; i < view.length; i++) s += String.fromCharCode(view[i] & 0xff);
-  return s;
+  const out = [];
+  for (let i = 0; i < view.length; i++) out.push(String.fromCharCode(view[i] & 0xff));
+  return out.join("");
 }
 function __sbBufFrom(latin1) {
   const b = new Uint8Array(latin1.length);
@@ -339,7 +348,15 @@ function __sbBufFrom(latin1) {
 // regardless of whether it holds real Latin-1 text or raw bytes, so this
 // decode is only safe where the caller already knows which one it has.
 function __sbFromUtf8(bytes) {
-  let out = "";
+  // Collected into an array and joined once at the end, not built with
+  // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
+  // `+=` in a loop copies the whole accumulated string on every append,
+  // making the naive version O(n^2). Measured on the real 43KB homepage
+  // (dynamic, wire-sourced content, not a compile-time constant): each
+  // successive 8000-character chunk took visibly longer than the last, ~2.8s
+  // total -- a real, shipped performance regression on sproutboat.com.
+  // `Array.prototype.join` builds the result in one pass.
+  const out = [];
   const len = bytes.length;
   const cont = (j) => {
     const b = bytes.charCodeAt(j) & 0xff;
@@ -348,13 +365,13 @@ function __sbFromUtf8(bytes) {
   for (let i = 0; i < len; i++) {
     const b0 = bytes.charCodeAt(i) & 0xff;
     if (b0 < 0x80) {
-      out += String.fromCharCode(b0);
+      out.push(String.fromCharCode(b0));
       continue;
     }
     if ((b0 & 0xe0) == 0xc0 && i + 1 < len) {
       const c1 = cont(i + 1);
       if (c1 >= 0) {
-        out += String.fromCharCode(((b0 & 0x1f) << 6) | c1);
+        out.push(String.fromCharCode(((b0 & 0x1f) << 6) | c1));
         i += 1;
         continue;
       }
@@ -362,7 +379,7 @@ function __sbFromUtf8(bytes) {
       const c1 = cont(i + 1);
       const c2 = cont(i + 2);
       if (c1 >= 0 && c2 >= 0) {
-        out += String.fromCharCode(((b0 & 0x0f) << 12) | (c1 << 6) | c2);
+        out.push(String.fromCharCode(((b0 & 0x0f) << 12) | (c1 << 6) | c2));
         i += 2;
         continue;
       }
@@ -373,16 +390,16 @@ function __sbFromUtf8(bytes) {
       if (c1 >= 0 && c2 >= 0 && c3 >= 0) {
         let cp = ((b0 & 0x07) << 18) | (c1 << 12) | (c2 << 6) | c3;
         cp -= 0x10000;
-        out += String.fromCharCode(0xd800 + (cp >> 10), 0xdc00 + (cp & 0x3ff));
+        out.push(String.fromCharCode(0xd800 + (cp >> 10), 0xdc00 + (cp & 0x3ff)));
         i += 3;
         continue;
       }
     }
     // no lead byte matched, or its continuation bytes weren't 10xxxxxx:
     // pass the single byte through rather than guessing
-    out += String.fromCharCode(b0);
+    out.push(String.fromCharCode(b0));
   }
-  return out;
+  return out.join("");
 }
 // sproutboat #181 — wrap a Response built from raw wire bytes (the assets
 // binding, outbound fetch(), service-binding fetch(): the three `x-sb-raw-
@@ -395,12 +412,24 @@ function __sbFromUtf8(bytes) {
 // safely can't decode by default). Overriding just these three instances,
 // which sproutboat itself builds and knows are bytes, fixes the read side
 // without touching Porffor's generic Response/Request classes at all.
+// Decoded lazily, on first .text()/.json() call, and memoized after that --
+// most raw-body responses (a static asset, a proxied fetch()) are handed
+// straight back to the client and never read as text at all, and Porffor's
+// strings have no rope/cons optimization: `+=`-building a decoded copy costs
+// real time proportional to the body size (measured ~116ms for a 44KB
+// all-ASCII body). Decoding unconditionally at construction paid that cost
+// on every asset request regardless of whether anything used it -- this was
+// a real, shipped performance regression on sproutboat.com, caught after
+// the fact by unexpectedly slow page loads.
 function __sbRawBodyResponse(body, init) {
   const resp = new Response(body == null ? "" : body, init);
   if (body != null) {
-    const decoded = __sbFromUtf8(body);
-    resp.text = () => decoded;
-    resp.json = () => JSON.parse(decoded);
+    let decoded = null;
+    resp.text = () => {
+      if (decoded === null) decoded = __sbFromUtf8(body);
+      return decoded;
+    };
+    resp.json = () => JSON.parse(resp.text());
   }
   return resp;
 }
@@ -414,15 +443,20 @@ function __sbEqCt(a, b) {
 // An even-length all-hex string -> its bytes; anything else -> its raw bytes.
 function __sbHexOrBytes(value) {
   if (__sbIsStr(value) && value.length > 0 && value.length % 2 === 0) {
-    let out = "";
+    // Array-and-join for the same reason as __sbToBytes above; the old version
+    // was worse than a plain `+=` loop, since rewriting the last char with
+    // `out.slice(0, -1) + ...` copied the whole string a second time per byte.
+    // The high nibble is held in a local until its pair arrives instead.
+    const out = [];
+    let hi = 0;
     for (let i = 0; i < value.length; i++) {
       const c = value.charCodeAt(i);
       const d = c >= 48 && c <= 57 ? c - 48 : c >= 97 && c <= 102 ? c - 87 : c >= 65 && c <= 70 ? c - 55 : -1;
       if (d < 0) return __sbToBytes(value);
-      if (i % 2 === 0) out += String.fromCharCode(d << 4);
-      else out = out.slice(0, -1) + String.fromCharCode(out.charCodeAt(out.length - 1) | d);
+      if (i % 2 === 0) hi = d << 4;
+      else out.push(String.fromCharCode(hi | d));
     }
-    return out;
+    return out.join("");
   }
   return __sbToBytes(value);
 }

package/src/to-bytes.test.js

@@ -0,0 +1,114 @@
+// sproutboat #180 — __sbToBytes lives inline in native-fetch-prelude.js (the
+// prelude is prepended as text and cannot import), so this test lifts that one
+// pure-JS function (plus its __sbIsStr dependency) out and exercises it
+// directly. If it moves or its boundary markers change, this fails loudly
+// rather than silently testing nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const isStrStart = src.indexOf("function __sbIsStr(");
+const isStrEnd = src.indexOf("function __sbIsFn(");
+const start = src.indexOf("function __sbToBytes(");
+const end = src.indexOf("function __sbBufFrom(");
+const hexStart = src.indexOf("function __sbHexOrBytes(");
+const hexEnd = src.indexOf("\nif (globalThis.crypto.subtle");
+if (isStrStart === -1 || isStrEnd === -1 || start === -1 || end === -1 || end < start) {
+  throw new Error("__sbToBytes (or __sbIsStr) block not found in prelude");
+}
+if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sbHexOrBytes block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
+const load = new Function(
+  `${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
+);
+const { __sbToBytes, __sbHexOrBytes } = load();
+
+/** The real bytestring shape (one char per raw byte) as a normal JS array of byte values, for comparison. */
+function bytesOf(bytestring) {
+  const out = [];
+  for (let i = 0; i < bytestring.length; i++) out.push(bytestring.charCodeAt(i));
+  return out;
+}
+
+test("ASCII string encodes byte-identically to TextEncoder", () => {
+  const text = "hello world 123";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("2-byte (Latin-1 range) sequences encode byte-identically to TextEncoder", () => {
+  const text = "café";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("3-byte sequences encode byte-identically to TextEncoder", () => {
+  const text = "porffor · x86_64 ✓";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("surrogate-pair (4-byte) sequences encode byte-identically to TextEncoder", () => {
+  const text = "🌱 sprout 🌱";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a lone unpaired surrogate falls into the 3-byte branch, matching charCodeAt-based encoders", () => {
+  const lone = String.fromCharCode(0xd800); // high surrogate with no following low surrogate
+  const view = __sbToBytes(lone);
+  // WHATWG TextEncoder would replace this with U+FFFD; __sbToBytes intentionally
+  // encodes the raw code unit instead (matches the historical/legacy behavior it
+  // already had) -- this test only pins that behavior isn't disturbed by the fix.
+  expect(bytesOf(view)).toEqual([0xe0 | (0xd800 >> 12), 0x80 | ((0xd800 >> 6) & 0x3f), 0x80 | (0xd800 & 0x3f)]);
+});
+
+test("null/undefined input returns empty", () => {
+  expect(__sbToBytes(null)).toBe("");
+  expect(__sbToBytes(undefined)).toBe("");
+});
+
+test("ArrayBuffer / typed-array input is copied byte for byte, high bytes included", () => {
+  const bytes = new Uint8Array([0x00, 0x7f, 0x80, 0xff, 0x01, 0xfe]);
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+  expect(bytesOf(__sbToBytes(bytes.buffer))).toEqual([...bytes]);
+});
+
+// __sbToBytes builds its result via an array + one join(), not repeated
+// `out +=` / `s +=`. Porffor's strings have no rope/cons optimization, so `+=`
+// in a loop copies the whole accumulated string on every append, making a
+// large encode O(n^2) -- the same bug class __sbFromUtf8 was fixed for
+// (see utf8-decode.test.js). This is a correctness check (long input still
+// round-trips exactly), not a timing assertion.
+test("a long, multi-chunk mixed-width string round-trips byte-identically", () => {
+  const chunk = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓ café 🌱 ";
+  const text = chunk.repeat(800); // ~46KB, comparable to the __sbFromUtf8 regression case
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a long high-byte typed array round-trips byte for byte", () => {
+  const bytes = new Uint8Array(50000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+});
+
+// __sbHexOrBytes had the same O(n^2) shape on a third path (it backs the
+// `expected` side of the HMAC verify), plus a `slice(0, -1) + ...` rewrite that
+// copied the accumulated string a second time per byte. Same array+join fix.
+test("an even-length hex string decodes to its bytes, both cases", () => {
+  expect(bytesOf(__sbHexOrBytes("00ff107a"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("00FF107A"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("aAbB"))).toEqual([0xaa, 0xbb]);
+});
+
+test("a non-hex or odd-length string falls back to raw bytes", () => {
+  expect(__sbHexOrBytes("zz")).toBe(__sbToBytes("zz"));
+  expect(__sbHexOrBytes("abc")).toBe(__sbToBytes("abc")); // odd length
+  expect(__sbHexOrBytes("")).toBe(__sbToBytes(""));
+  expect(bytesOf(__sbHexOrBytes(new Uint8Array([0x80, 0x01])))).toEqual([0x80, 0x01]);
+});
+
+test("a long hex string decodes byte for byte", () => {
+  const bytes = new Uint8Array(20000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  expect(bytesOf(__sbHexOrBytes(hex))).toEqual([...bytes]);
+});

package/src/transport-embedded.js

@@ -1191,13 +1191,13 @@ function __sbEnsureSchema() {
 }
 
 function __sbHex(n) {
-  let out = "";
+  const out = [];
   const bytes = __sbRandomBytes(String(n));
   for (let i = 0; i < bytes.length; i++) {
     const h = bytes.charCodeAt(i).toString(16);
-    out += h.length === 1 ? "0" + h : h;
+    out.push(h.length === 1 ? "0" + h : h);
   }
-  return out;
+  return out.join("");
 }
 
 function __sbEmbeddedDispatch(msg) {
@@ -1279,14 +1279,15 @@ function __sbEmbeddedDispatch(msg) {
     if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
     const allow = bindingsOutbound();
     if (allow.indexOf(url.host) === -1) throw new Error("host not in outbound allowlist: " + url.host);
-    let headerText = "";
+    const headerParts = [];
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
       const key = String(pairs[i][0]).toLowerCase();
       // Host, Connection and Content-Length are ours to set.
       if (key === "host" || key === "connection" || key === "content-length") continue;
-      headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
+      headerParts.push(pairs[i][0] + ": " + pairs[i][1] + "\r\n");
     }
+    const headerText = headerParts.join("");
     const port = url.port ? url.port : tls ? "443" : "80";
     const reply = JSON.parse(
       __sbHttpRaw(

package/src/utf8-decode.test.js

@@ -50,3 +50,57 @@ test("empty and pure-ASCII strings are untouched", () => {
   expect(__sbFromUtf8("")).toBe("");
   expect(__sbFromUtf8("hello world")).toBe("hello world");
 });
+
+// __sbFromUtf8 builds its result via an array + one join(),
+// not repeated `out +=`. Porffor's strings have no rope/cons optimization, so
+// `+=` in a loop copies the whole accumulated string on every append,
+// making a large decode O(n^2) -- measured as a real ~2.6s stall decoding a
+// 43KB page on sproutboat.com, gone after the array+join rewrite. This is a
+// correctness check (long input still round-trips exactly), not a timing
+// assertion -- CI timing thresholds are flaky; the real perf verification
+// happened against a real compiled binary, documented in the fix commit.
+test("a long, multi-chunk body round-trips exactly", () => {
+  const chunk = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓ café 🌱 ";
+  const text = chunk.repeat(800); // ~46KB, comparable to the real homepage
+  expect(__sbFromUtf8(toBytestring(text))).toBe(text);
+});
+
+// __sbRawBodyResponse must decode lazily: eagerly decoding at construction
+// paid the cost of __sbFromUtf8 on every asset/proxied response regardless of
+// whether the handler ever reads it as text, a real perf regression shipped
+// and caught on sproutboat.com (most such responses are handed straight to
+// the client and .text()/.json() are never called).
+const rbrStart = src.indexOf("function __sbRawBodyResponse(");
+const rbrEnd = src.indexOf("// Constant-time compare of two latin1 byte strings.");
+if (rbrStart === -1 || rbrEnd === -1 || rbrEnd < rbrStart) {
+  throw new Error("__sbRawBodyResponse block not found in prelude");
+}
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const loadRbr = new Function(
+  "Response",
+  `${src.slice(start, end)}\n${src.slice(rbrStart, rbrEnd)}\nreturn { __sbRawBodyResponse };`,
+);
+// A minimal Response stand-in: only what __sbRawBodyResponse touches (the
+// constructor call and setting .text/.json on the instance), no Porffor
+// bytestring typing involved.
+class FakeResponse {
+  constructor(body, init) {
+    this.body = body;
+    this.status = (init && init.status) || 200;
+  }
+}
+const { __sbRawBodyResponse } = loadRbr(FakeResponse);
+
+test("__sbRawBodyResponse's text()/json() decode correctly, callable more than once", () => {
+  const bytes = toBytestring("café · 🌱");
+  const resp = __sbRawBodyResponse(bytes, { status: 200 });
+  expect(resp.text()).toBe("café · 🌱");
+  expect(resp.text()).toBe("café · 🌱"); // memoized decode, not re-run per call
+  expect(resp.json).toBeInstanceOf(Function);
+});
+
+test("__sbRawBodyResponse with a null body sets no text()/json() override", () => {
+  const resp = __sbRawBodyResponse(null, { status: 404 });
+  expect(resp.text).toBeUndefined();
+  expect(resp.json).toBeUndefined();
+});