@sproutboat/toolchain 0.4.11 → 0.4.13

package/CHANGELOG.md

@@ -1,10 +1,26 @@
 # @sproutboat/toolchain
 
+## 0.4.13
+
+### Patch Changes
+
+- bb1b6a2: Parse ISO date timezone offsets correctly in native Porffor builds, including zero fields and fractional seconds.
+
+## 0.4.12
+
+### Patch Changes
+
+- ed9640a: Point Porffor patch diagnostics, runtime comments, and historical notes to the
+  shared upstream notes in the Sproutboat platform repository.
+- b6cc9e6: Pin Porffor alpha 9, including alpha 8's compiler and GC fixes and alpha 9's ESM module support. Adapt the native-fetch link and compile-flag patches to Porffor's split C-unit build. Preserve the published 0.4.11 `TypedArray.from` workaround, which alpha 9 still needs. Re-vendor the verified alpha 9 source archive. The uWebSockets commit is unchanged.
+
 ## 0.4.11
 
 ### Patch Changes
 
-- 6d72af7: Fix `TypedArray.from` with array-like inputs in native binaries, and regenerate Porffor's builtins table when its compiler is unpacked through a symlinked temporary path. This preserves the key bytes in repeated HMAC signing with `Uint8Array.from({ length: 16 }, mapFn)`.
+- 6d72af7: Fix `TypedArray.from` with array-like inputs in native binaries and
+  regenerate Porffor's builtin table after the source patch, including when
+  the compiler is unpacked through a symlinked temporary path.
 
 ## 0.4.10
 
@@ -87,7 +103,7 @@
   prototype and stop once the "next" pointer stops advancing, reading a
   fixed-point chain as "no `.then` found" instead of spinning. Not specific to
   `Date.prototype.toISOString()` — an earlier note wrongly correlated the bug
-  with that one call; see `sproutboat-cli/patches/UPSTREAM.md`.
+  with that one call; see `https://github.com/baronunread/sproutboat/tree/main/patches/upstream`.
 
 ## 0.4.0
 

package/PORFFOR_ALPHA9.md

@@ -0,0 +1,70 @@
+# Porffor alpha 9 upgrade audit
+
+Pin: `de4eb588264885b3a1596f75010e371a2052033f`, tagged `alpha-9` on
+2026-09-24. The vendored codeload archive has SHA-256
+`1a62187a93356b36cb6ac703ce9770c8917e4fa65545fd7c33ee8a180ae5a4c9`.
+
+## Alpha 8 changes
+
+The [alpha 8 release](https://github.com/CanadaHonk/porffor/releases/tag/alpha-8)
+contains 27 commits. Every commit falls into one of these groups:
+
+| Area | Commits | Effect on Sproutboat |
+| --- | --- | --- |
+| Language and compiler correctness | `6063154a`, `8436b386`, `d3376a2d`, `8833624c`, `b92571c4`, `dfab4235`, `65a6bb3f`, `cb26d320`, `6a47f02c`, `acf6dda0`, `c54557ba`, `50855902`, `5e5db5a4`, `6ec00849`, `61d42690` | Better default parameters, spread calls, object values, closure parameters, uninitialized and `let` bindings, optional computed keys, `finally` and exception exits; the remaining edits remove redundant IR and code generation. These improve handler correctness without replacing a local patch. |
+| GC and memory | `83cd4902`, `b5eb0b98`, `9e283dd2`, `f687ac7c`, `08bf855d`, `135d2761`, `ae4002b1`, `a110867b` | Smaller memory commitment and less GC work. `a110867b` supplies a C macro used by the renderer. No Sproutboat GC patch exists to remove. |
+| String built-ins | `f483ba7e` | Better `substring` and `substr`; no corresponding local shim. |
+| Compiler progress | `b77750b0` | Shows compile progress on a TTY; no runtime contract change. |
+| Self-hosted tools and benchmarks | `370f1f75`, `7b12abd2` | Adds `stat.isFile` and a TypeScript compiler benchmark; neither is used by Sproutboat. |
+
+## Alpha 9 and cleanup decision
+
+The [alpha 9 release](https://github.com/CanadaHonk/porffor/releases/tag/alpha-9)
+contains `de4eb588`, adding ESM imports and exports. A direct native-fetch
+fixture importing a sibling module compiled and returned its imported value.
+Porffor now compiles modules as separate cached C units. The local `SB_EXTRA_LINK`
+and `SB_EXTRA_CFLAGS` patches had to move to the new link list and shared
+compile arguments. `UWS_COMMIT` remains `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+No local patch is superseded by the alpha 8 or 9 changes. The patches provide
+Sproutboat-specific native-fetch behavior: `$PORT`, log routing, bytestring
+encoding, raw asset bodies, status and header handling, request size, R2
+transfers, and external link and include flags. The CLI still bundles before
+Porffor to validate the full dependency graph, apply its Node shims, and pass
+one controlled handler export to the runtime wrapper. Native ESM makes a future
+module-based wrapper possible, but removing Bun.build or export normalization
+now would also change capability validation and binding behavior. Porffor's
+old external esbuild requirement is gone in alpha 9, so the CLI can drop its
+esbuild dependency and bundled platform executable.
+
+A module-wrapper prototype compiled a separate handler module. Its normal
+`env.GREETING` reference returned HTTP 500; using `globalThis.env.GREETING`
+returned HTTP 200. The current export normalization keeps the existing
+unqualified `env` contract. The direct ESM import is now part of the CI native
+crypto vector, so a future pin cannot silently lose module support.
+
+Alpha 9 caches compiled C units by the absolute entry path. In one local
+`hello` handler-edit comparison, a stable path compiled in 549 ms versus
+1,505 ms with changing paths. The CLI's `dev` loop now uses a stable entry
+path per process while keeping candidate artifacts isolated. These are local
+single-run timings, not a published performance claim.
+
+The published `@sproutboat/toolchain@0.4.11` includes a `TypedArray.from`
+array-like input patch absent from this checkout's 0.4.10 base. Clean alpha 9
+still returns an empty array for `Uint8Array.from({ length: 4 }, mapFn)`. The
+0.4.11 patch was carried forward, its precompiled builtin table is regenerated,
+and a native crypto vector now exercises that array-like input.
+
+Regression evidence for this pin: toolchain tests (11), CLI tests (92), both
+kitchen-sink harnesses (27 broker checks, 29 standalone checks), and all 12 CLI
+examples passed. The direct ESM fixture returned HTTP 200 with the imported
+value. The package typecheck and lint passed.
+
+## Release order
+
+The registry's latest toolchain is 0.4.11 and still pins alpha 7. This checkout
+has been reconciled with that release's `TypedArray.from` patch; its pending
+changeset targets 0.4.12. Publish the alpha 9 toolchain first. Then update
+`sproutboat-cli`, the main `sproutboat` app, and `sproutboat-site/web` to require
+0.4.12 and refresh their lockfiles. The CLI can then ship without an esbuild
+executable. Until 0.4.12 is published, existing npm consumers still run alpha 7.

package/PORFFOR_SCORECARD.md

@@ -0,0 +1,35 @@
+# Porffor pin scorecard
+
+Pin: alpha-9 (de4eb588264885b3a1596f75010e371a2052033f). Compatibility report: 2026-09-26T00:32:42.739Z.
+
+| Measure | Result |
+| --- | ---: |
+| Fixtures compiled | 32/32 |
+| Behavior matches | 30/32 |
+| Median / p95 compile, ms | 3139 / 3472 |
+| Median / p95 binary, bytes | 983392 / 1016464 |
+| Patch markers | 27 |
+| Upstream files written | 6 |
+| Fresh patch application | pass |
+
+This is the first recorded pin. Compare the next pin against this snapshot.
+
+## Patch inventory
+
+- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
+- `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER
+- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER
+- `compiler/builtins/date.ts`: DATE_PARSER_MARKER
+- `compiler/uwebsockets.js`: BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
+- `compiler/builtins_precompiled.js`: regenerated builtin table
+
+Patch source SHA-256: `69cf5d0bcf3f4d4c05b81df0ff04b83479af622539fa19566155531bf3ee469c`.
+
+## Known behavior gaps
+
+- 15-date-iso.js: request 3 mismatch: expected {"status":200,"body":"2008-03-04T23:00:00.000Z","content-type":null}, got {"status":200,"body":"0003-05-08T00:00:00.000Z","content-type":null}
+- 16-date-parts.js: request 3 mismatch: expected {"status":200,"body":"{\"year\":2008,\"month\":3,\"day\":4}","content-type":"application/json;charset=utf-8"}, got {"status":200,"body":"{\"year\":3,\"month\":5,\"day\":8}","content-type":"application/json;charset=utf-8"}
+
+## Review
+
+Use this scorecard with the full compatibility report and issue #35's build telemetry. If behavior regresses or patch work grows, review the individual patches and measure an alternate backend with the same fixtures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-9-de4eb58.json

@@ -0,0 +1,58 @@
+{
+  "pin": "alpha-9 (de4eb588264885b3a1596f75010e371a2052033f)",
+  "reportGeneratedAt": "2026-09-26T00:32:42.739Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 3139,
+  "p95CompileMs": 3472,
+  "medianBinaryBytes": 983392,
+  "p95BinaryBytes": 1016464,
+  "patchSourceSha256": "69cf5d0bcf3f4d4c05b81df0ff04b83479af622539fa19566155531bf3ee469c",
+  "patchMarkerCount": 27,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER"
+    ],
+    "compiler/builtins/typedarray.js": [
+      "TYPED_ARRAY_FROM_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.test.ts

@@ -28,12 +28,13 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "  }\n" +
       "  return -1;\n" +
       "}\n",
-    "compiler/index.js": "          '-xc', '-', '-c',\n          uSocketsArchive,\n          '-lm'\n",
+    "compiler/index.js": "      ...darwinReleaseCompileArgs,\n        uSocketsArchive,\n        '-lm'\n",
     "compiler/precompile.js":
       "const fs = require('node:fs');\n" +
       "const path = require('node:path');\n" +
       "fs.writeFileSync(path.join(__dirname, 'builtins_precompiled.js'), fs.readFileSync(path.join(__dirname, 'builtins/typedarray.js')));\n",
     "compiler/builtins_precompiled.js": "fixture:precompiled\n",
+    "compiler/builtins/date.ts": "export const __ecma262_ParseDTSF = (string: string) => {\n  let n: number = 0;\n  let nInd: number = 0;\n\n  const len: i32 = string.length;\n  const endPtr: i32 = Porffor.IR.ptr(string) + len;\n  let ptr: i32 = Porffor.IR.ptr(string);\n\n  while (ptr <= endPtr) { // <= to include extra null byte to set last n\n    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);\n    if (Porffor.fastAnd(chr >= 48, chr <= 57)) { // 0-9\n      n *= 10;\n      n += chr - 48;\n      continue;\n    }\n\n    if (chr == 45) { // -\n      if (Porffor.fastOr(ptr == Porffor.IR.ptr(string), nInd == 7)) n = -n;\n    }\n\n    if (n > 0) {\n      if (nInd == 0) y = n;\n        else if (nInd == 1) m = n - 1;\n        else if (nInd == 2) dt = n;\n        else if (nInd == 3) h = n;\n        else if (nInd == 4) min = n;\n        else if (nInd == 5) s = n;\n        else if (nInd == 6) milli = n;\n        else if (nInd == 7) tzHour = n;\n        else if (nInd == 8) tzMin = n;\n\n      n = 0;\n      nInd++;\n    }\n  }\n\n  h += tzHour;\n  min += tzMin;\n};\n// RFC 7231 or Date.prototype.toString() parser\n",
     "compiler/builtins/typedarray.js":
       "export const __${name}_from = (arg: any, mapFn: any): ${name} => {\n" +
       "  const arr: any[] = Porffor.array.new(4);\n" +

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-8f01541.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-de4eb58.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes
@@ -38,6 +38,7 @@ const required = [
   "compiler/index.js",
   "compiler/uwebsockets.js",
   "compiler/precompile.js",
+  "compiler/builtins/date.ts",
   "compiler/builtins/typedarray.js",
   "compiler/builtins_precompiled.js",
 ];

package/src/date-native.test.ts

@@ -0,0 +1,37 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+test("native ISO dates honor signed offsets, zero fields, and fractional seconds", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-date-native-"));
+  const samples = [
+    "2024-01-02T03:04:05Z",
+    "2024-01-02T03:04:05+02:00",
+    "2024-01-02T03:04:05-05:00",
+    "2024-01-02T03:04:05.250+01:00",
+    "2024-01-02T00:00:00Z",
+    "2024-01-02T03:04:05.2+02:30",
+    "2024-01-02T03:04:05.25-00:30",
+  ];
+  try {
+    const porffor = await ensurePorffor({ cacheRoot: resolve(root, "cache") });
+    const source = resolve(root, "date.js");
+    const binary = resolve(root, "date-native");
+    await writeFile(source, `for (const value of ${JSON.stringify(samples)}) console.log(new Date(value).toISOString());\n`);
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe" });
+    expect(run.exitCode, Buffer.from(run.stderr).toString()).toBe(0);
+    expect(Buffer.from(run.stdout).toString().trim().split("\n")).toEqual(
+      samples.map((value) => new Date(value).toISOString()),
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 30_000);

package/src/patch.ts

@@ -1,14 +1,16 @@
 /**
  * Idempotent, marker-guarded in-place edits to Porffor's generated C
  * (`compiler/render.js`, `compiler/index.js`, `compiler/uwebsockets.js`,
- * `compiler/builtins/typedarray.js`). Run
+ * `compiler/builtins/typedarray.js`, `compiler/builtins/date.ts`). Run
  * from the build path, not a `postinstall` hook: package managers block
  * dependency lifecycle scripts by default, so a published `postinstall` would
  * silently not run.
  *
  * Each edit is independent and re-applied on every build; a file patched by an
  * older version of this module still receives the newer edits. All of them are
- * tracked in patches/UPSTREAM.md and go away as Porffor closes the gaps.
+ * tracked in the platform's upstream notes:
+ * https://github.com/baronunread/sproutboat/tree/main/patches/upstream
+ * They go away as Porffor closes the gaps.
  */
 import { readFile, realpath, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
@@ -152,20 +154,21 @@ const RENDER_REPLACEMENTS = [
  * a musl (deploy) build overrides it outright. This splices one spread of
  * `SB_EXTRA_LINK` before `-lm`, inert unless the variable is set.
  */
-const LINK_ANCHOR = "          uSocketsArchive,\n          '-lm'\n";
+const LINK_ANCHOR = "        uSocketsArchive,\n        '-lm'\n";
 const LINK_INJECT =
-  "          ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
+  "        ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
 const LINK_MARKER = "SB_EXTRA_LINK";
 
 /**
  * #15 — and the same for the compile step, so the prelude's inline C can
- * `#include <bearssl.h>`. The link patch alone is not enough: Porffor compiles
- * the generated C from stdin with a fixed argument list, so there is otherwise
- * no way to add an include path.
+ * `#include <bearssl.h>`. The link patch alone is not enough: Porffor's
+ * module builds compile several C units with a fixed argument list, so there
+ * is otherwise no way to add an include path. Add the flag before the cache
+ * stamp is computed so a change invalidates compiled units.
  */
-const CFLAGS_ANCHOR = "          '-xc', '-', '-c',\n";
+const CFLAGS_ANCHOR = "      ...darwinReleaseCompileArgs,\n";
 const CFLAGS_INJECT =
-  "          ...(process.env.SB_EXTRA_CFLAGS ? process.env.SB_EXTRA_CFLAGS.split(' ').filter(Boolean) : []),\n";
+  "      ...(process.env.SB_EXTRA_CFLAGS ? process.env.SB_EXTRA_CFLAGS.split(' ').filter(Boolean) : []),\n";
 const CFLAGS_MARKER = "SB_EXTRA_CFLAGS";
 
 // Porffor's TypedArray.from only handles iterables. An array-like input such
@@ -190,6 +193,93 @@ const TYPED_ARRAY_FROM_INJECT =
   "  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
 const TYPED_ARRAY_FROM_MARKER = "sproutboat: TypedArray.from accepts array-like objects";
 
+// Porffor alpha 9 treats +02:00 as two milliseconds and adds offset hours
+// instead of subtracting them. Count fields even when they contain zero, and
+// apply the signed offset after parsing the local wall-clock fields.
+const DATE_PARSER_MARKER = "sproutboat: ISO timezone offset";
+const DATE_PARSER_ANCHOR = `  let n: number = 0;
+  let nInd: number = 0;
+
+  const len: i32 = string.length;
+  const endPtr: i32 = Porffor.IR.ptr(string) + len;
+  let ptr: i32 = Porffor.IR.ptr(string);
+
+  while (ptr <= endPtr) { // <= to include extra null byte to set last n
+    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);
+    if (Porffor.fastAnd(chr >= 48, chr <= 57)) { // 0-9
+      n *= 10;
+      n += chr - 48;
+      continue;
+    }
+
+    if (chr == 45) { // -
+      if (Porffor.fastOr(ptr == Porffor.IR.ptr(string), nInd == 7)) n = -n;
+    }
+
+    if (n > 0) {
+      if (nInd == 0) y = n;
+        else if (nInd == 1) m = n - 1;
+        else if (nInd == 2) dt = n;
+        else if (nInd == 3) h = n;
+        else if (nInd == 4) min = n;
+        else if (nInd == 5) s = n;
+        else if (nInd == 6) milli = n;
+        else if (nInd == 7) tzHour = n;
+        else if (nInd == 8) tzMin = n;
+
+      n = 0;
+      nInd++;
+    }
+  }
+
+  h += tzHour;
+  min += tzMin;`;
+const DATE_PARSER_INJECT = `  // sproutboat: ISO timezone offset
+  let n: number = 0;
+  let nInd: number = 0;
+  let digits: i32 = 0;
+  let offsetSign: i32 = 0;
+
+  const len: i32 = string.length;
+  const endPtr: i32 = Porffor.IR.ptr(string) + len;
+  let ptr: i32 = Porffor.IR.ptr(string);
+
+  while (ptr <= endPtr) {
+    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);
+    if (Porffor.fastAnd(chr >= 48, chr <= 57)) {
+      n = n * 10 + chr - 48;
+      digits++;
+      continue;
+    }
+
+    if (digits > 0) {
+      if (nInd == 0) y = n;
+        else if (nInd == 1) m = n - 1;
+        else if (nInd == 2) dt = n;
+        else if (nInd == 3) h = n;
+        else if (nInd == 4) min = n;
+        else if (nInd == 5) s = n;
+        else if (nInd == 6) {
+          while (digits < 3) { n *= 10; digits++; }
+          while (digits > 3) { n = Math.trunc(n / 10); digits--; }
+          milli = n;
+        }
+        else if (nInd == 7) tzHour = n;
+        else if (nInd == 8) tzMin = n;
+      n = 0;
+      nInd++;
+      digits = 0;
+    }
+
+    if (Porffor.fastOr(chr == 43, chr == 45) && nInd >= 6) {
+      offsetSign = chr == 43 ? 1 : -1;
+      nInd = 7;
+    }
+  }
+
+  h -= offsetSign * tzHour;
+  min -= offsetSign * tzMin;`;
+
 /**
  * #56 — make the inbound request-body limit configurable.
  *
@@ -817,7 +907,7 @@ export async function patchUwebsockets(root: string): Promise<void> {
     if (!src.includes(anchor)) {
       throw new Error(
         `could not patch Porffor's ${what}: anchor not found in ${file}. ` +
-          "Porffor's uWebSockets shim changed — check patches/UPSTREAM.md.",
+          "Porffor's uWebSockets shim changed. See https://github.com/baronunread/sproutboat/tree/main/patches/upstream.",
       );
     }
     src = src.replace(anchor, inject);
@@ -839,11 +929,11 @@ async function patchCompilerArgs(root: string): Promise<void> {
     if (at === -1) {
       throw new Error(
         `could not patch Porffor for ${what}: anchor not found in ${file}. ` +
-          "Porffor's native-fetch build changed — check patches/UPSTREAM.md.",
+          "Porffor's native-fetch build changed. See https://github.com/baronunread/sproutboat/tree/main/patches/upstream.",
       );
     }
-    // After the anchor for cflags (the args follow it), before it for the link
-    // line (the object list ends with it).
+    // Add flags to compileOnlyArgs so every generated C unit sees them and
+    // Porffor's module-build cache includes them in its compiler command.
     src =
       marker === CFLAGS_MARKER
         ? src.slice(0, at + anchor.length) + inject + src.slice(at + anchor.length)
@@ -853,6 +943,19 @@ async function patchCompilerArgs(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
+export async function patchDateParser(root: string): Promise<void> {
+  const file = resolve(root, "compiler/builtins/date.ts");
+  const src = await readFile(file, "utf8");
+  if (src.includes(DATE_PARSER_MARKER)) return;
+  const start = src.indexOf("export const __ecma262_ParseDTSF");
+  const end = src.indexOf("// RFC 7231 or Date.prototype.toString() parser", start);
+  if (start < 0 || end < 0) throw new Error(`could not find Porffor's ISO date parser in ${file}`);
+  const parser = src.slice(start, end);
+  if (!parser.includes(DATE_PARSER_ANCHOR))
+    throw new Error(`could not patch Porffor's ISO date parser: anchor not found in ${file}`);
+  await writeFile(file, src.slice(0, start) + parser.replace(DATE_PARSER_ANCHOR, DATE_PARSER_INJECT) + src.slice(end));
+}
+
 export async function patchTypedArrayFrom(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/typedarray.js");
   const src = await readFile(file, "utf8");
@@ -892,7 +995,7 @@ export async function patchRenderJs(root: string): Promise<void> {
     if (at === -1) {
       throw new Error(
         `could not patch Porffor for ${what}: anchor not found in ${file}. ` +
-          "Porffor's native-fetch renderer changed — check patches/UPSTREAM.md.",
+          "Porffor's native-fetch renderer changed. See https://github.com/baronunread/sproutboat/tree/main/patches/upstream.",
       );
     }
     src = src.slice(0, at + anchor.length) + inject + src.slice(at + anchor.length);
@@ -906,7 +1009,7 @@ export async function patchRenderJs(root: string): Promise<void> {
     if (!src.includes(anchor)) {
       throw new Error(
         `could not patch Porffor for ${what}: anchor not found in ${file}. ` +
-          "Porffor's native-fetch renderer changed — check patches/UPSTREAM.md.",
+          "Porffor's native-fetch renderer changed. See https://github.com/baronunread/sproutboat/tree/main/patches/upstream.",
       );
     }
     src = src.replace(anchor, inject);
@@ -927,6 +1030,7 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchCompilerArgs(root);
   await patchUwebsockets(root);
   await patchRenderJs(root);
+  await patchDateParser(root);
   await patchTypedArrayFrom(root);
   done.add(root);
 }

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-7";
-export const PORFFOR_COMMIT_FULL = "8f01541498d6d61c0cbbf8a71be152330888be7e";
+export const PORFFOR_CHANNEL = "alpha-9";
+export const PORFFOR_COMMIT_FULL = "de4eb588264885b3a1596f75010e371a2052033f";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "fae9cfb00c0a21e20e3aa79a9a8093bd24820062039985c6bde2b23e3e8bdb8c";
+  "1a62187a93356b36cb6ac703ce9770c8917e4fa65545fd7c33ee8a180ae5a4c9";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-7 (8f01541)`). */
+/** A compact identity string for a manifest / report (`alpha-9 (de4eb58)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }