sproutboat 0.38.0 → 0.40.0

package/CHANGELOG.md

@@ -10,6 +10,40 @@ maintained going forward by the `release` skill.
 
 ## Unreleased
 
+## [0.40.0] - 2026-10-28
+
+Built on `@sproutboat/runtime` 0.34.4, `@sproutboat/toolchain` 0.19.4 and
+`@sproutboat/wire` 0.20.2.
+
+### Performance
+
+- **A standalone binary collects garbage every 8 requests**, and once it has been quiet for about 50 ms,
+  instead of after every response. On the API-challenge mix at 900 req/s the CPU per request goes from about
+  550 to about 470 us, and the feed endpoint from 940 to 750 us, for about 2 MiB more resident memory.
+  `SB_GC_EVERY=<n>` sets the interval (`1` restores a collection after each request). A request that needs
+  more heap than is free still collects when it allocates. sproutd's collector and density are untouched.
+- **JWT verification costs less CPU.** `atob` decodes in C for the usual input and falls back to the
+  existing code for everything else, `TextEncoder.encode` sizes and fills the array in two C passes, the
+  `ArrayBuffer` returned by `crypto.subtle.sign` and `digest` is copied with one `memcpy`, and the
+  constant-time compare behind `verify` runs in C. A typical `authenticate()` goes from 21.5 to 7 us on an
+  M-series host. What throws, and what it throws, is unchanged.
+
+## [0.39.0] - 2026-10-27
+
+Built on `@sproutboat/runtime` 0.34.3, `@sproutboat/toolchain` 0.19.3 and
+`@sproutboat/wire` 0.20.2.
+
+### Performance
+
+- **D1 queries cost less CPU in standalone builds.** A D1 call no longer goes through `JSON.stringify` and
+  `JSON.parse` on both sides of the in-process dispatch, and from compatibility date 2026-10-24 the rows of a
+  strict D1 result are built as JS arrays in C straight from the SQLite cells instead of being written as JSON
+  and parsed again. Same results and error messages.
+- **`atob` is faster.** Each character is looked up in a 128-entry table, and the same pass validates, so a JWT
+  check (three base64url decodes) costs less. Same output and same `InvalidCharacterError` cases.
+- **`JSON.stringify` of strings is faster.** Each character is read straight from the string and stored when it
+  needs no escape. The output is byte-identical.
+
 ## [0.38.0] - 2026-10-27
 
 Built on `@sproutboat/runtime` 0.34.2, `@sproutboat/toolchain` 0.19.2 and

package/SURFACE.md

@@ -3,7 +3,7 @@
 > Generated by `src/surface.test.ts` from `src/surface.ts` + the pinned
 > toolchain constants. Do not edit by hand — run `UPDATE_SURFACE=1 bun test`.
 
-**Package:** `sproutboat` 0.38.0
+**Package:** `sproutboat` 0.40.0
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutboat",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "Wrangler-shaped CLI for Sproutboat. Deploys workers to any control plane via --api-url / SPROUTBOAT_API_URL.",
   "keywords": [
     "cli",
@@ -64,8 +64,8 @@
     "@sproutboat/artifact": "^0.3.0",
     "@sproutboat/assets": "^0.3.0",
     "@sproutboat/config": "^0.6.0",
-    "@sproutboat/runtime": "^0.34.2",
-    "@sproutboat/toolchain": "^0.19.2",
+    "@sproutboat/runtime": "^0.34.4",
+    "@sproutboat/toolchain": "^0.19.4",
     "@sproutboat/wire": "^0.20.2"
   },
   "devDependencies": {
@@ -78,10 +78,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@sproutboat/cli-darwin-arm64": "0.38.0",
-    "@sproutboat/cli-darwin-x64": "0.38.0",
-    "@sproutboat/cli-linux-arm64": "0.38.0",
-    "@sproutboat/cli-linux-x64": "0.38.0"
+    "@sproutboat/cli-darwin-arm64": "0.40.0",
+    "@sproutboat/cli-darwin-x64": "0.40.0",
+    "@sproutboat/cli-linux-arm64": "0.40.0",
+    "@sproutboat/cli-linux-x64": "0.40.0"
   },
   "engines": {
     "node": ">=18"