@sproutboat/runtime 0.6.4 → 0.6.6

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @sproutboat/runtime
 
+## 0.6.6
+
+### Patch Changes
+
+- c2b0359: Fix (baronunread/sproutboat#179): `__sbEntry` called `handlers.fetch()` (and
+  the `scheduled`/`queue`/`alarm` trigger paths) with no try/catch at all. Any
+  synchronous throw, or an async handler's rejected promise, propagated all the
+  way up and took down the entire process — not just the request that hit it,
+  but every other in-flight and future request on that sprout, until whatever
+  supervises it restarts the binary.
+  
+  A throw from `fetch()` now returns a 500 instead. `scheduled()` and `alarm()`
+  still reply 204 either way (they had no failure signal before this either).
+  A throw from `queue()` falls through to the existing default-ack pass, the
+  same outcome as a handler that returns without calling `ack()`/`retry()` on
+  every message.
+  
+  `entry-crash.test.js` covers the fetch path: a sync throw, an async
+  rejection, and that a throwing request doesn't stop the next one from being
+  served.
+
+## 0.6.5
+
+### Patch Changes
+
+- d798206: Fix (baronunread/sproutboat#181): 0.6.4's `__sbToBytes` rewrite fixed the large
+  input it targeted and badly regressed the small one. An app hashing ~150-byte
+  values through `crypto.subtle.digest` on every request lost **64% of its
+  throughput** (4,700 to 1,680 req/s), tripled its p50 (4.6ms to 13.4ms) and grew
+  41% in RSS (66.5 to 93.8 MB). 0.6.4 replaced a `s +=` loop with an
+  array-push-then-join unconditionally, and below about 512 bytes the array is
+  pure overhead: one boxed element per input byte, allocated and joined, where
+  the string append had nothing to allocate at all.
+  
+  `__sbToBytes` now accumulates into a window and only creates an array once a
+  window fills. An input under 512 bytes touches no array and runs exactly like
+  the pre-0.6.4 code; a larger one caps the quadratic copy at one window and
+  joins the windows once, keeping the #180 fix (a 43KB body encodes in ~3ms
+  instead of ~52ms). Both branches flush only on a complete character, so a
+  surrogate pair can never be split across a window boundary. 512 is where the
+  two costs cross on a `porf native` build, and the curve is flat either side, so
+  it is a plateau rather than a tuned constant.
+  
+  Measured end to end on the reporter's real workload, not just a microbench
+  (which under-predicted the regression by two orders of magnitude and would have
+  shipped the wrong fix): 4,690 req/s, p50 4.62ms, RSS 66.4 MB, matching the
+  pre-regression baseline on every axis.
+  
+  Three other 0.6.4 changes are reverted to byte-identical 0.6.3, since they were
+  made for consistency rather than against a measured problem, and #181 is
+  evidence that array allocation at small sizes is the wrong trade in this
+  runtime: `__sbHex` and the outbound-fetch header builder in
+  `transport-embedded.js`, and `__SproutboatURLSearchParams.prototype.toString()`.
+  `__sbHexOrBytes` keeps its nibble fix, which drops a `slice(0, -1)` rewrite that
+  copied the accumulator twice per byte, but goes back to `+=`: it decodes an HMAC
+  signature, which is tens of bytes.
+  
+  `to-bytes.test.js` gains the small-input coverage this needed: sizes either side
+  of the window boundary (0, 1, 150, 511, 512, 513, 1024, 1025) on both branches,
+  and a surrogate pair walked across the boundary.
+
 ## 0.6.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "license": "MIT",
   "type": "module",
   "main": "./src/index.ts",

package/src/entry-crash.test.js

@@ -0,0 +1,63 @@
+// #179 — an uncaught handler exception must turn into a 500 (or, for
+// scheduled/queue/alarm, a swallowed failure), never a process-crashing
+// throw/rejection out of __sbEntry. Same lift-the-prelude-and-eval approach
+// as client-ip.test.js: the prelude is prepended as text and cannot import.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+
+// oxlint-disable-next-line no-function-constructor -- lifting the whole text-only prelude for test
+const load = new Function(
+  "Porffor",
+  "__envMap",
+  `${src}
+   return { __sbEntry, __sbRegisterDO };`,
+);
+// Every Porffor.c`...` block in the prelude only runs inside a function body
+// (never at load time), so a no-op tag covers all of them: __sbCpuMs and
+// __sbEnv just see an empty result, same as "native op returned nothing."
+const H = load(
+  { c: () => "" },
+  new Proxy({}, { get: () => undefined }),
+);
+
+const req = (overrides = {}) => ({
+  headers: { get: (k) => (overrides.headers && overrides.headers[k.toLowerCase()]) ?? null },
+  cf: undefined,
+  ...overrides,
+});
+
+test("a synchronously-throwing fetch handler returns 500, not a throw", async () => {
+  const handlers = {
+    fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("an async fetch handler whose promise rejects returns 500, not a rejection", async () => {
+  const handlers = {
+    async fetch() {
+      throw new Error("boom");
+    },
+  };
+  const res = await H.__sbEntry(handlers, req());
+  expect(res.status).toBe(500);
+});
+
+test("a throwing fetch handler doesn't stop the next request from being served", async () => {
+  const handlers = {
+    fetch(request) {
+      if (request.boom) throw new Error("boom");
+      return new Response("ok");
+    },
+  };
+  const first = await H.__sbEntry(handlers, req({ boom: true }));
+  expect(first.status).toBe(500);
+  const second = await H.__sbEntry(handlers, req({ boom: false }));
+  expect(await second.text()).toBe("ok");
+});

package/src/native-fetch-prelude.js

@@ -171,14 +171,12 @@ class __SproutboatURLSearchParams {
     return this._keys.length;
   }
   toString() {
-    // Array + one join("&"), not `out +=` in a loop: see __sbToBytes. A query
-    // string is usually short, but a params object built from a large form or
-    // a paginated cursor list is not, and the fix costs nothing.
-    const out = [];
+    let out = "";
     for (let i = 0; i < this._keys.length; i++) {
-      out.push(encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]));
+      if (i > 0) out += "&";
+      out += encodeURIComponent(this._keys[i]) + "=" + encodeURIComponent(this._vals[i]);
     }
-    return out.join("&");
+    return out;
   }
 }
 
@@ -293,41 +291,73 @@ function __sbHashBits(algo) {
   if (n === "SHA-512" || n === "SHA512") return "512";
   return "";
 }
+// Where __sbToBytes stops growing one string and starts a new window. 512 is
+// where the two costs cross on a `porf native` build; the curve is flat either
+// side of it, so this is a plateau, not a tuned constant.
+const __SB_BYTES_WINDOW = 512;
 // -> a latin1 string, one char per byte. Strings are UTF-8 encoded (matching
 // TextEncoder); ArrayBuffer / typed-array input is copied byte for byte.
 function __sbToBytes(input) {
   if (input == null) return "";
-  // Collected into an array and joined once at the end, not built with
-  // repeated `out +=` -- Porffor's strings have no rope/cons optimization, so
-  // `+=` in a loop copies the whole accumulated string on every append,
-  // making the naive version O(n^2). Same fix as __sbFromUtf8 above, on the
-  // encode side (sits behind every crypto.subtle call).
+  // Windowed accumulation (#180, then #181). Plain `s +=` in a loop is O(n^2)
+  // here, since Porffor's strings have no rope/cons optimization and every
+  // append copies the whole accumulated string -- that's #180, a 43KB body
+  // taking ~52ms to encode. But 0.6.4's unconditional array-push-then-join
+  // regressed the common case badly: a real app hashing ~150-byte inputs per
+  // request lost 64% of its throughput and gained 41% RSS (#181), far more
+  // than the per-call cost of the array ops measures in isolation.
+  //
+  // So: append into a window, and only once a window fills does an array come
+  // into existence to hold it. An input below __SB_BYTES_WINDOW allocates no
+  // array at all and runs exactly like the pre-#180 code; a large one caps the
+  // quadratic copy at one window and joins the windows once. Measured on a
+  // `porf native` build, this ties `+=` at 100-512 bytes and ties array+join
+  // at 8-43KB, with no threshold branch to keep in sync.
+  //
+  // Both branches flush only on a complete character, never mid-sequence, so a
+  // surrogate pair can't be split across two windows.
   if (__sbIsStr(input)) {
-    const out = [];
+    let out = null;
+    let s = "";
     for (let i = 0; i < input.length; i++) {
       const c = input.charCodeAt(i);
-      if (c < 0x80) out.push(String.fromCharCode(c));
-      else if (c < 0x800) out.push(String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f)));
+      if (c < 0x80) s += String.fromCharCode(c);
+      else if (c < 0x800) s += String.fromCharCode(0xc0 | (c >> 6)) + String.fromCharCode(0x80 | (c & 0x3f));
       else if (c >= 0xd800 && c < 0xdc00 && i + 1 < input.length) {
         const cp = 0x10000 + ((c - 0xd800) << 10) + (input.charCodeAt(++i) - 0xdc00);
-        out.push(
+        s +=
           String.fromCharCode(0xf0 | (cp >> 18)) +
-            String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
-            String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
-            String.fromCharCode(0x80 | (cp & 0x3f))
-        );
+          String.fromCharCode(0x80 | ((cp >> 12) & 0x3f)) +
+          String.fromCharCode(0x80 | ((cp >> 6) & 0x3f)) +
+          String.fromCharCode(0x80 | (cp & 0x3f));
       } else
-        out.push(
+        s +=
           String.fromCharCode(0xe0 | (c >> 12)) +
-            String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
-            String.fromCharCode(0x80 | (c & 0x3f))
-        );
+          String.fromCharCode(0x80 | ((c >> 6) & 0x3f)) +
+          String.fromCharCode(0x80 | (c & 0x3f));
+      if (s.length >= __SB_BYTES_WINDOW) {
+        if (out === null) out = [];
+        out.push(s);
+        s = "";
+      }
     }
+    if (out === null) return s;
+    if (s.length > 0) out.push(s);
     return out.join("");
   }
   const view = input.length !== undefined && input.buffer !== undefined ? input : new Uint8Array(input);
-  const out = [];
-  for (let i = 0; i < view.length; i++) out.push(String.fromCharCode(view[i] & 0xff));
+  let out = null;
+  let s = "";
+  for (let i = 0; i < view.length; i++) {
+    s += String.fromCharCode(view[i] & 0xff);
+    if (s.length >= __SB_BYTES_WINDOW) {
+      if (out === null) out = [];
+      out.push(s);
+      s = "";
+    }
+  }
+  if (out === null) return s;
+  if (s.length > 0) out.push(s);
   return out.join("");
 }
 function __sbBufFrom(latin1) {
@@ -443,20 +473,23 @@ function __sbEqCt(a, b) {
 // An even-length all-hex string -> its bytes; anything else -> its raw bytes.
 function __sbHexOrBytes(value) {
   if (__sbIsStr(value) && value.length > 0 && value.length % 2 === 0) {
-    // Array-and-join for the same reason as __sbToBytes above; the old version
-    // was worse than a plain `+=` loop, since rewriting the last char with
-    // `out.slice(0, -1) + ...` copied the whole string a second time per byte.
-    // The high nibble is held in a local until its pair arrives instead.
-    const out = [];
+    // The high nibble waits in a local until its pair arrives, instead of the
+    // old `out = out.slice(0, -1) + ...` rewrite, which copied the whole
+    // accumulated string a second time per byte. Deliberately still `+=` and
+    // not __sbToBytes' windowing: this decodes an HMAC signature, which is
+    // tens of bytes, and #181 showed array allocation is the expensive part at
+    // that size. ponytail: O(n^2) above a few KB, window it like __sbToBytes
+    // if a caller ever passes something that big.
+    let out = "";
     let hi = 0;
     for (let i = 0; i < value.length; i++) {
       const c = value.charCodeAt(i);
       const d = c >= 48 && c <= 57 ? c - 48 : c >= 97 && c <= 102 ? c - 87 : c >= 65 && c <= 70 ? c - 55 : -1;
       if (d < 0) return __sbToBytes(value);
       if (i % 2 === 0) hi = d << 4;
-      else out.push(String.fromCharCode(hi | d));
+      else out += String.fromCharCode(hi | d);
     }
-    return out.join("");
+    return out;
   }
   return __sbToBytes(value);
 }
@@ -1670,15 +1703,31 @@ async function __sbDrainAll(pending) {
 // one *this* async function creates, not a `.then()` derived from someone
 // else's — see the note below on why that distinction matters here.
 async function __sbFetchWithDrain(res, tasks) {
-  const r = res && __sbIsFn(res.then) ? await res : res;
+  let r;
+  try {
+    r = res && __sbIsFn(res.then) ? await res : res;
+  } catch {
+    // #179 — a rejected handler promise must not take the process down with it.
+    r = __sbErrorResponse();
+  }
   await __sbDrainWaitUntil(tasks);
   return r;
 }
 
+// #179 — turn an uncaught handler exception into a 500 instead of letting it
+// propagate past __sbEntry and crash the whole server.
+function __sbErrorResponse() {
+  return new Response("Internal Server Error", { status: 500 });
+}
+
 // Shared by alarm and scheduled: both reply with an empty 204 once their
 // handler (and anything it queued via `waitUntil`) has settled.
 async function __sb204WithDrain(res, tasks) {
-  if (res && __sbIsFn(res.then)) await res;
+  try {
+    if (res && __sbIsFn(res.then)) await res;
+  } catch {
+    // #179 — same rule as fetch: a rejected scheduled/alarm promise must not crash the process.
+  }
   await __sbDrainWaitUntil(tasks);
   return new Response("", { status: 204 });
 }
@@ -1713,7 +1762,14 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __res = handlers.fetch(request, ctx);
+    let __res;
+    try {
+      __res = handlers.fetch(request, ctx);
+    } catch {
+      // #179 — a synchronous throw anywhere in the handler must not take the
+      // whole process (and every other in-flight request) down with it.
+      return __sbErrorResponse();
+    }
     // Same promise-identity rule as above applies to `__sbFetchWithDrain`'s
     // own return, which is why it's tail-called rather than chained on here.
     if (__sbTasks.length || (__res && __sbIsFn(__res.then))) return __sbFetchWithDrain(__res, __sbTasks);
@@ -1733,10 +1789,16 @@ globalThis.__sbEntry = function (handlers, request) {
         if (p && __sbIsFn(p.then)) __sbTasks.push(p);
       },
     };
-    const __sres = handlers.scheduled(
-      { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
-      ctx,
-    );
+    let __sres;
+    try {
+      __sres = handlers.scheduled(
+        { cron: body.cron || "", scheduledTime: body.scheduledTime || Date.now(), noRetry() {} },
+        ctx,
+      );
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     if (__sbTasks.length || (__sres && __sbIsFn(__sres.then))) return __sb204WithDrain(__sres, __sbTasks);
     return new Response("", { status: 204 });
   }
@@ -1764,7 +1826,13 @@ globalThis.__sbEntry = function (handlers, request) {
     const body = __sbReadJson(request);
     const inst = __sbGetDOInstance(String(body.cls || ""), String(body.id || ""));
     if (!__sbIsFn(inst.alarm)) return new Response("no alarm handler", { status: 404 });
-    const __ares = inst.alarm();
+    let __ares;
+    try {
+      __ares = inst.alarm();
+    } catch {
+      // #179 — same rule as fetch: don't let a throw here crash the process.
+      return new Response("", { status: 204 });
+    }
     // Was fire-and-forget before: an async `alarm()` and any `state.waitUntil()`
     // it queued were both dropped the moment 204 went out. Await both.
     if (inst.__sbTasks.length || (__ares && __sbIsFn(__ares.then))) return __sb204WithDrain(__ares, inst.__sbTasks);
@@ -1812,11 +1880,18 @@ async function __sbRunQueueBatch(handlers, body, ctx) {
       for (let i = 0; i < messages.length; i++) messages[i].retry();
     },
   };
-  const __qres = handlers.queue(batch, ctx);
-  // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
-  // the response go out) before its own `await`s did, so any ack()/retry()
-  // past the first one never counted.
-  if (__qres && __sbIsFn(__qres.then)) await __qres;
+  try {
+    const __qres = handlers.queue(batch, ctx);
+    // Was fire-and-forget: an async `queue()` had this default-ack pass run (and
+    // the response go out) before its own `await`s did, so any ack()/retry()
+    // past the first one never counted.
+    if (__qres && __sbIsFn(__qres.then)) await __qres;
+  } catch {
+    // #179 — a throw here must not crash the process. Whatever ack()/retry()
+    // calls the handler made before throwing still count; anything it never
+    // touched falls through to the default-ack pass below, same as a handler
+    // that returns without calling ack()/retry() on every message.
+  }
   // default: any message neither acked nor retried is treated as acked
   for (let i = 0; i < messages.length; i++) {
     if (acked.indexOf(messages[i].id) === -1 && retried.indexOf(messages[i].id) === -1) acked.push(messages[i].id);

package/src/to-bytes.test.js

@@ -10,12 +10,13 @@ import { fileURLToPath } from "node:url";
 const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
 const isStrStart = src.indexOf("function __sbIsStr(");
 const isStrEnd = src.indexOf("function __sbIsFn(");
-const start = src.indexOf("function __sbToBytes(");
+// Starts at the window constant, not the function: __sbToBytes closes over it.
+const start = src.indexOf("const __SB_BYTES_WINDOW");
 const end = src.indexOf("function __sbBufFrom(");
 const hexStart = src.indexOf("function __sbHexOrBytes(");
 const hexEnd = src.indexOf("\nif (globalThis.crypto.subtle");
 if (isStrStart === -1 || isStrEnd === -1 || start === -1 || end === -1 || end < start) {
-  throw new Error("__sbToBytes (or __sbIsStr) block not found in prelude");
+  throw new Error("__sbToBytes (or __sbIsStr / __SB_BYTES_WINDOW) block not found in prelude");
 }
 if (hexStart === -1 || hexEnd === -1 || hexEnd < hexStart) throw new Error("__sbHexOrBytes block not found in prelude");
 
@@ -90,6 +91,31 @@ test("a long high-byte typed array round-trips byte for byte", () => {
   expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
 });
 
+// sproutboat#181: 0.6.4 encoded every size through one array-push-then-join
+// path, which cost a real app 64% of its throughput on the ~150-byte inputs
+// crypto.subtle sees per request. The encoder now only reaches for an array
+// once a 512-byte window fills, so these sizes exercise both sides of that
+// boundary and the seam between them. Correctness only; the performance claim
+// lives in the benchmark, not here.
+test("inputs either side of the window boundary encode byte-identically", () => {
+  for (const n of [0, 1, 150, 511, 512, 513, 1024, 1025]) {
+    const text = "a".repeat(n);
+    expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+    const bytes = new Uint8Array(n);
+    for (let i = 0; i < n; i++) bytes[i] = (i * 37 + 0x80) & 0xff;
+    expect(bytesOf(__sbToBytes(bytes))).toEqual([...bytes]);
+  }
+});
+
+test("a surrogate pair straddling the window boundary is not split", () => {
+  // Land the 4-byte sequence so its bytes would cross a 512-byte flush if the
+  // encoder ever flushed mid-character.
+  for (let pad = 508; pad <= 515; pad++) {
+    const text = "a".repeat(pad) + "🌱" + "b".repeat(4);
+    expect(bytesOf(__sbToBytes(text))).toEqual([...new TextEncoder().encode(text)]);
+  }
+});
+
 // __sbHexOrBytes had the same O(n^2) shape on a third path (it backs the
 // `expected` side of the HMAC verify), plus a `slice(0, -1) + ...` rewrite that
 // copied the accumulated string a second time per byte. Same array+join fix.

package/src/transport-embedded.js

@@ -1191,13 +1191,13 @@ function __sbEnsureSchema() {
 }
 
 function __sbHex(n) {
-  const out = [];
+  let out = "";
   const bytes = __sbRandomBytes(String(n));
   for (let i = 0; i < bytes.length; i++) {
     const h = bytes.charCodeAt(i).toString(16);
-    out.push(h.length === 1 ? "0" + h : h);
+    out += h.length === 1 ? "0" + h : h;
   }
-  return out.join("");
+  return out;
 }
 
 function __sbEmbeddedDispatch(msg) {
@@ -1279,15 +1279,14 @@ function __sbEmbeddedDispatch(msg) {
     if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
     const allow = bindingsOutbound();
     if (allow.indexOf(url.host) === -1) throw new Error("host not in outbound allowlist: " + url.host);
-    const headerParts = [];
+    let headerText = "";
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {
       const key = String(pairs[i][0]).toLowerCase();
       // Host, Connection and Content-Length are ours to set.
       if (key === "host" || key === "connection" || key === "content-length") continue;
-      headerParts.push(pairs[i][0] + ": " + pairs[i][1] + "\r\n");
+      headerText += pairs[i][0] + ": " + pairs[i][1] + "\r\n";
     }
-    const headerText = headerParts.join("");
     const port = url.port ? url.port : tls ? "443" : "80";
     const reply = JSON.parse(
       __sbHttpRaw(