@sproutboat/runtime 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # @sproutboat/runtime
 
+## 0.6.5
+
+### Patch Changes
+
+- d798206: Fix (baronunread/sproutboat#181): 0.6.4's `__sbToBytes` rewrite fixed the large
+  input it targeted and badly regressed the small one. An app hashing ~150-byte
+  values through `crypto.subtle.digest` on every request lost **64% of its
+  throughput** (4,700 to 1,680 req/s), tripled its p50 (4.6ms to 13.4ms) and grew
+  41% in RSS (66.5 to 93.8 MB). 0.6.4 replaced a `s +=` loop with an
+  array-push-then-join unconditionally, and below about 512 bytes the array is
+  pure overhead: one boxed element per input byte, allocated and joined, where
+  the string append had nothing to allocate at all.
+  
+  `__sbToBytes` now accumulates into a window and only creates an array once a
+  window fills. An input under 512 bytes touches no array and runs exactly like
+  the pre-0.6.4 code; a larger one caps the quadratic copy at one window and
+  joins the windows once, keeping the #180 fix (a 43KB body encodes in ~3ms
+  instead of ~52ms). Both branches flush only on a complete character, so a
+  surrogate pair can never be split across a window boundary. 512 is where the
+  two costs cross on a `porf native` build, and the curve is flat either side, so
+  it is a plateau rather than a tuned constant.
+  
+  Measured end to end on the reporter's real workload, not just a microbench
+  (which under-predicted the regression by two orders of magnitude and would have
+  shipped the wrong fix): 4,690 req/s, p50 4.62ms, RSS 66.4 MB, matching the
+  pre-regression baseline on every axis.
+  
+  Three other 0.6.4 changes are reverted to byte-identical 0.6.3, since they were
+  made for consistency rather than against a measured problem, and #181 is
+  evidence that array allocation at small sizes is the wrong trade in this
+  runtime: `__sbHex` and the outbound-fetch header builder in
+  `transport-embedded.js`, and `__SproutboatURLSearchParams.prototype.toString()`.
+  `__sbHexOrBytes` keeps its nibble fix, which drops a `slice(0, -1)` rewrite that
+  copied the accumulator twice per byte, but goes back to `+=`: it decodes an HMAC
+  signature, which is tens of bytes.
+  
+  `to-bytes.test.js` gains the small-input coverage this needed: sizes either side
+  of the window boundary (0, 1, 150, 511, 512, 513, 1024, 1025) on both branches,
+  and a surrogate pair walked across the boundary.
+
+## 0.6.4
+
+### Patch Changes
+
+- 8ef3148: Fix (baronunread/sproutboat#180): `__sbToBytes` built its result with repeated
+  `s +=` in a loop, the same `O(n^2)` bug class the `__sbFromUtf8` fix in 0.6.3
+  addressed, just on the encode side. Porffor's strings have no rope/cons
+  optimization, so `+=` in a loop copies the whole accumulated string on every
+  append. Both of its branches were affected: the UTF-8 encode loop over string
+  input, and the byte-for-byte copy out of an ArrayBuffer or typed array.
+  
+  This one matters because `__sbToBytes` sits behind every `crypto.subtle` call a
+  handler makes: `digest`, `importKey`, `sign`, `verify` and the PBKDF2/scrypt
+  path all funnel their data, keys, salts and signatures through it. Hashing a
+  request body was quadratic in the body's size.
+  
+  `__sbHexOrBytes` had the same shape on a third crypto path (it decodes the
+  `expected` side of an HMAC verify) and was worse than a plain `+=` loop: on odd
+  iterations it rewrote the last character with `out = out.slice(0, -1) + ...`,
+  copying the accumulated string a second time per byte. It now holds the high
+  nibble in a local until its pair arrives and pushes one character per byte.
+  
+  Three further accumulators converted to the same array-and-join idiom for
+  consistency. These are bounded by header count, id length or parameter count
+  rather than by handler input, so they are hygiene rather than a fix:
+  `__SproutboatURLSearchParams.prototype.toString()` in the prelude, and `__sbHex`
+  plus the outbound-fetch header builder in `transport-embedded.js`.
+  
+  Covered by a new `to-bytes.test.js`, following the `utf8-decode.test.js`
+  convention of lifting the pure functions out of the text-only prelude: ASCII,
+  2-byte, 3-byte and surrogate-pair encodes checked byte-identical against
+  `TextEncoder`, the existing unpaired-surrogate behaviour pinned, typed-array and
+  ArrayBuffer input with high bytes, hex decode in both cases with its non-hex and
+  odd-length fallbacks, and long inputs (46KB string, 50,000-byte array, 20,000-byte
+  hex) for correctness at the size the quadratic version hurt.
+
 ## 0.6.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/native-fetch-prelude.js

@@ -291,11 +291,33 @@ function __sbHashBits(algo) {
   if (n === "SHA-512" || n === "SHA512") return "512";
   return "";
 }
+// Where __sbToBytes stops growing one string and starts a new window. 512 is
+// where the two costs cross on a `porf native` build; the curve is flat either
+// side of it, so this is a plateau, not a tuned constant.
+const __SB_BYTES_WINDOW = 512;
 // -> a latin1 string, one char per byte. Strings are UTF-8 encoded (matching
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
+  // Windowed accumulation (#180, then #181). Plain `s +=` in a loop is O(n^2)
+  // here, since Porffor's strings have no rope/cons optimization and every
+  // append copies the whole accumulated string -- that's #180, a 43KB body
+  // taking ~52ms to encode. But 0.6.4's unconditional array-push-then-join
+  // regressed the common case badly: a real app hashing ~150-byte inputs per
+  // request lost 64% of its throughput and gained 41% RSS (#181), far more
+  // than the per-call cost of the array ops measures in isolation.
+  //
+  // So: append into a window, and only once a window fills does an array come
+  // into existence to hold it. An input below __SB_BYTES_WINDOW allocates no
+  // array at all and runs exactly like the pre-#180 code; a large one caps the
+  // quadratic copy at one window and joins the windows once. Measured on a
+  // `porf native` build, this ties `+=` at 100-512 bytes and ties array+join
+  // at 8-43KB, with no threshold branch to keep in sync.
+  //
+  // Both branches flush only on a complete character, never mid-sequence, so a
+  // surrogate pair can't be split across two windows.
   if (__sbIsStr(input)) {
+    let out = null;
     let s = "";
     for (let i = 0; i < input.length; i++) {
       const c = input.charCodeAt(i);
@@ -313,13 +335,30 @@ function __sbToBytes(input) {
           String.fromCharCode(0xe0 | (c >> 12)) +
           String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
           String.fromCharCode(0x80 | (c & 0x3f));
+      if (s.length >= __SB_BYTES_WINDOW) {
+        if (out === null) out = [];
+        out.push(s);
+        s = "";
+      }
     }
-    return s;
+    if (out === null) return s;
+    if (s.length > 0) out.push(s);
+    return out.join("");
   }
   const view = input.length !== undefined && input.buffer !== undefined ? input : new Uint8Array(input);
+  let out = null;
   let s = "";
-  for (let i = 0; i < view.length; i++) s += String.fromCharCode(view[i] & 0xff);
-  return s;
+  for (let i = 0; i < view.length; i++) {
+    s += String.fromCharCode(view[i] & 0xff);
+    if (s.length >= __SB_BYTES_WINDOW) {
+      if (out === null) out = [];
+      out.push(s);
+      s = "";
+    }
+  }
+  if (out === null) return s;
+  if (s.length > 0) out.push(s);
+  return out.join("");
 }
 function __sbBufFrom(latin1) {
   const b = new Uint8Array(latin1.length);
@@ -434,13 +473,21 @@ function __sbEqCt(a, b) {
 // An even-length all-hex string -> its bytes; anything else -> its raw bytes.
 function __sbHexOrBytes(value) {
   if (__sbIsStr(value) && value.length > 0 && value.length % 2 === 0) {
+    // The high nibble waits in a local until its pair arrives, instead of the
+    // old `out = out.slice(0, -1) + ...` rewrite, which copied the whole
+    // accumulated string a second time per byte. Deliberately still `+=` and
+    // not __sbToBytes' windowing: this decodes an HMAC signature, which is
+    // tens of bytes, and #181 showed array allocation is the expensive part at
+    // that size. ponytail: O(n^2) above a few KB, window it like __sbToBytes
+    // if a caller ever passes something that big.
     let out = "";
+    let hi = 0;
     for (let i = 0; i < value.length; i++) {
       const c = value.charCodeAt(i);
       const d = c >= 48 && c <= 57 ? c - 48 : c >= 97 && c <= 102 ? c - 87 : c >= 65 && c <= 70 ? c - 55 : -1;
       if (d < 0) return __sbToBytes(value);
-      if (i % 2 === 0) out += String.fromCharCode(d << 4);
-      else out = out.slice(0, -1) + String.fromCharCode(out.charCodeAt(out.length - 1) | d);
+      if (i % 2 === 0) hi = d << 4;
+      else out += String.fromCharCode(hi | d);
     }
     return out;
   }

package/src/to-bytes.test.js

@@ -0,0 +1,140 @@
+// sproutboat #180 — __sbToBytes lives inline in native-fetch-prelude.js (the
+// prelude is prepended as text and cannot import), so this test lifts that one
+// pure-JS function (plus its __sbIsStr dependency) out and exercises it
+// directly. If it moves or its boundary markers change, this fails loudly
+// rather than silently testing nothing.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const isStrStart = src.indexOf("function __sbIsStr(");
+const isStrEnd = src.indexOf("function __sbIsFn(");
+// Starts at the window constant, not the function: __sbToBytes closes over it.
+const start = src.indexOf("const __SB_BYTES_WINDOW");
+const end = src.indexOf("function __sbBufFrom(");
+const hexStart = src.indexOf("function __sbHexOrBytes(");
+const hexEnd = src.indexOf("\nif (globalThis.crypto.subtle");
+if (isStrStart === -1 || isStrEnd === -1 || start === -1 || end === -1 || end < start) {
+  throw new Error("__sbToBytes (or __sbIsStr / __SB_BYTES_WINDOW) block not found in prelude");
+}
+if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sbHexOrBytes block not found in prelude");
+
+// oxlint-disable-next-line no-function-constructor -- lifting pure blocks out of the text-only prelude for test
+const load = new Function(
+  `${src.slice(isStrStart, isStrEnd)}\n${src.slice(start, end)}\n${src.slice(hexStart, hexEnd)}\nreturn { __sbToBytes, __sbHexOrBytes };`,
+);
+const { __sbToBytes, __sbHexOrBytes } = load();
+
+/** The real bytestring shape (one char per raw byte) as a normal JS array of byte values, for comparison. */
+function bytesOf(bytestring) {
+  const out = [];
+  for (let i = 0; i < bytestring.length; i++) out.push(bytestring.charCodeAt(i));
+  return out;
+}
+
+test("ASCII string encodes byte-identically to TextEncoder", () => {
+  const text = "hello world 123";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("2-byte (Latin-1 range) sequences encode byte-identically to TextEncoder", () => {
+  const text = "café";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("3-byte sequences encode byte-identically to TextEncoder", () => {
+  const text = "porffor · x86_64 ✓";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("surrogate-pair (4-byte) sequences encode byte-identically to TextEncoder", () => {
+  const text = "🌱 sprout 🌱";
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a lone unpaired surrogate falls into the 3-byte branch, matching charCodeAt-based encoders", () => {
+  const lone = String.fromCharCode(0xd800); // high surrogate with no following low surrogate
+  const view = __sbToBytes(lone);
+  // WHATWG TextEncoder would replace this with U+FFFD; __sbToBytes intentionally
+  // encodes the raw code unit instead (matches the historical/legacy behavior it
+  // already had) -- this test only pins that behavior isn't disturbed by the fix.
+  expect(bytesOf(view)).toEqual([0xe0 | (0xd800 >> 12), 0x80 | ((0xd800 >> 6) & 0x3f), 0x80 | (0xd800 & 0x3f)]);
+});
+
+test("null/undefined input returns empty", () => {
+  expect(__sbToBytes(null)).toBe("");
+  expect(__sbToBytes(undefined)).toBe("");
+});
+
+test("ArrayBuffer / typed-array input is copied byte for byte, high bytes included", () => {
+  const bytes = new Uint8Array([0x00, 0x7f, 0x80, 0xff, 0x01, 0xfe]);
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+  expect(bytesOf(__sbToBytes(bytes.buffer))).toEqual([...bytes]);
+});
+
+// __sbToBytes builds its result via an array + one join(), not repeated
+// `out +=` / `s +=`. Porffor's strings have no rope/cons optimization, so `+=`
+// in a loop copies the whole accumulated string on every append, making a
+// large encode O(n^2) -- the same bug class __sbFromUtf8 was fixed for
+// (see utf8-decode.test.js). This is a correctness check (long input still
+// round-trips exactly), not a timing assertion.
+test("a long, multi-chunk mixed-width string round-trips byte-identically", () => {
+  const chunk = "porffor · src/index.js → 1.25 MB · x86_64-musl ✓ café 🌱 ";
+  const text = chunk.repeat(800); // ~46KB, comparable to the __sbFromUtf8 regression case
+  expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+});
+
+test("a long high-byte typed array round-trips byte for byte", () => {
+  const bytes = new Uint8Array(50000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+});
+
+// sproutboat#181: 0.6.4 encoded every size through one array-push-then-join
+// path, which cost a real app 64% of its throughput on the ~150-byte inputs
+// crypto.subtle sees per request. The encoder now only reaches for an array
+// once a 512-byte window fills, so these sizes exercise both sides of that
+// boundary and the seam between them. Correctness only; the performance claim
+// lives in the benchmark, not here.
+test("inputs either side of the window boundary encode byte-identically", () => {
+  for (const n of [0, 1, 150, 511, 512, 513, 1024, 1025]) {
+    const text = "a".repeat(n);
+    expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+    const bytes = new Uint8Array(n);
+    for (let i = 0; i < n; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+    expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+  }
+});
+
+test("a surrogate pair straddling the window boundary is not split", () => {
+  // Land the 4-byte sequence so its bytes would cross a 512-byte flush if the
+  // encoder ever flushed mid-character.
+  for (let pad = 508; pad <= 515; pad++) {
+    const text = "a".repeat(pad) + "🌱" + "b".repeat(4);
+    expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+  }
+});
+
+// __sbHexOrBytes had the same O(n^2) shape on a third path (it backs the
+// `expected` side of the HMAC verify), plus a `slice(0, -1) + ...` rewrite that
+// copied the accumulated string a second time per byte. Same array+join fix.
+test("an even-length hex string decodes to its bytes, both cases", () => {
+  expect(bytesOf(__sbHexOrBytes("00ff107a"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("00FF107A"))).toEqual([0x00, 0xff, 0x10, 0x7a]);
+  expect(bytesOf(__sbHexOrBytes("aAbB"))).toEqual([0xaa, 0xbb]);
+});
+
+test("a non-hex or odd-length string falls back to raw bytes", () => {
+  expect(__sbHexOrBytes("zz")).toBe(__sbToBytes("zz"));
+  expect(__sbHexOrBytes("abc")).toBe(__sbToBytes("abc")); // odd length
+  expect(__sbHexOrBytes("")).toBe(__sbToBytes(""));
+  expect(bytesOf(__sbHexOrBytes(new Uint8Array([0x80, 0x01])))).toEqual([0x80, 0x01]);
+});
+
+test("a long hex string decodes byte for byte", () => {
+  const bytes = new Uint8Array(20000);
+  for (let i = 0; i < bytes.length; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+  const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+  expect(bytesOf(__sbHexOrBytes(hex))).toEqual([...bytes]);
+});