sproutboat 0.11.2 → 0.11.4

package/CHANGELOG.md

@@ -10,6 +10,43 @@ maintained going forward by the `release` skill.
 
 ## [Unreleased]
 
+## [0.11.4] - 2026-09-14
+### Fixed
+- Bumped `@sproutboat/runtime` to `^0.6.5`, undoing a severe performance
+  regression that `v0.11.3` shipped (baronunread/sproutboat#181). `0.6.4`'s
+  encode fix was correct for the large inputs it targeted and badly wrong for
+  small ones: an app hashing ~150-byte values through `crypto.subtle.digest`
+  on every request lost **64% of its throughput** (4,700 to 1,680 req/s),
+  tripled its p50 (4.6ms to 13.4ms) and grew 41% in RSS. The encoder now only
+  reaches for an array once 512 bytes have accumulated, so a small input runs
+  exactly like `v0.11.2` while a large one keeps the `#180` fix.
+- Upgrading the CLI is the only way to pick this up. The runtime prelude is
+  embedded in the CLI binary when that binary is built, so a project's own
+  `@sproutboat/runtime` dependency has no effect on `--standalone` or
+  `--target host` builds. Anyone on `v0.11.3` should move to this release;
+  `v0.11.2` is the last unaffected version before it.
+
+### Changed
+- The `darwin-x64` platform package is now cross-compiled on the arm64 macOS
+  runner instead of built natively on `macos-13`. GitHub's only x64 macOS pool
+  routinely left that leg queued for 30+ minutes and blocked two releases,
+  including `v0.11.3`, where the root package published while its own
+  `optionalDependency` on `@sproutboat/cli-darwin-x64` was still waiting on it.
+  Nothing in the package needs x64 hardware to produce. `scripts/build-cli.ts`
+  gains `--target <os>-<arch>` for this.
+
+## [0.11.3] - 2026-09-14
+### Fixed
+- Bumped `@sproutboat/runtime` to `^0.6.4`, picking up the encode-side half of
+  the same `O(n^2)` string-building bug `v0.11.2` fixed on the decode side.
+  `__sbToBytes` sits behind every `crypto.subtle` call a handler makes:
+  `digest`, `importKey`, `sign`, `verify` and the PBKDF2/scrypt path all funnel
+  their data, keys, salts and signatures through it, so hashing a request body
+  was quadratic in the body's size. `__sbHexOrBytes`, which decodes the
+  `expected` side of an HMAC verify, was worse still; it rewrote its
+  accumulator's last character on every odd nibble, copying the whole string
+  twice per byte (baronunread/sproutboat#180).
+
 ## [0.11.2] - 2026-09-14
 ### Fixed
 - Bumped `@sproutboat/runtime` to `^0.6.3`. `v0.11.1` bumped it to `^0.6.2`,
@@ -470,7 +507,9 @@ its own package.
 - Renamed the package to `sproutboat` (was `@sproutboat/cli`); dropped the
   `sprout` bin alias in favour of a user-defined shell alias.
 
-[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.2...HEAD
+[Unreleased]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.4...HEAD
+[0.11.4]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.3...v0.11.4
+[0.11.3]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.2...v0.11.3
 [0.11.2]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.1...v0.11.2
 [0.11.1]: https://github.com/baronunread/sproutboat-cli/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/baronunread/sproutboat-cli/compare/v0.10.3...v0.11.0

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.11.2 · runs on Bun (use `bunx`, not `npx`)
+**Package:** `sproutboat` 0.11.4 · runs on Bun (use `bunx`, not `npx`)
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,7 +64,7 @@
     "@sproutboat/artifact": "^0.2.0",
     "@sproutboat/assets": "^0.2.0",
     "@sproutboat/config": "^0.3.0",
-    "@sproutboat/runtime": "^0.6.3",
+    "@sproutboat/runtime": "^0.6.5",
     "@sproutboat/toolchain": "^0.4.0",
     "@sproutboat/wire": "^0.5.0",
     "esbuild": "^0.28.2"
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.11.2",
-    "@sproutboat/cli-darwin-x64": "0.11.2",
-    "@sproutboat/cli-linux-arm64": "0.11.2",
-    "@sproutboat/cli-linux-x64": "0.11.2"
+    "@sproutboat/cli-darwin-arm64": "0.11.4",
+    "@sproutboat/cli-darwin-x64": "0.11.4",
+    "@sproutboat/cli-linux-arm64": "0.11.4",
+    "@sproutboat/cli-linux-x64": "0.11.4"
   },
   "engines": {
     "node": ">=18"

package/scripts/build-cli.ts

@@ -9,6 +9,11 @@
  * --compile` can target any `bun-<os>-<arch>` regardless of host — verified
  * against real Linux/macOS output, not just docs). For a maintainer building
  * every platform package locally without waiting on CI.
+ *
+ * `--target <os>-<arch>`: build exactly one named target, host or not. CI's
+ * darwin-x64 leg uses this to cross-build on an arm64 macOS runner, because
+ * GitHub's only x64 macOS image (`macos-13`) routinely sits queued for half an
+ * hour while every other leg finishes in one minute.
  */
 import { chmod, copyFile, mkdir } from "node:fs/promises";
 import { resolve } from "node:path";
@@ -113,5 +118,16 @@ async function buildOne(target: Target): Promise<void> {
   await chmod(out, 0o755);
 }
 
+function named(spec: string): Target {
+  const match = TARGETS.find((t) => `${t.platform}-${t.arch}` === spec);
+  if (!match)
+    throw new Error(
+      `unknown target ${spec}; expected one of ${TARGETS.map((t) => `${t.platform}-${t.arch}`).join(", ")}`,
+    );
+  return match;
+}
+
 const all = process.argv.includes("--all");
-for (const target of all ? TARGETS : [hostTarget()]) await buildOne(target);
+const only = process.argv[process.argv.indexOf("--target") + 1];
+const selected = all ? TARGETS : process.argv.includes("--target") ? [named(only ?? "")] : [hostTarget()];
+for (const target of selected) await buildOne(target);