@sproutboat/toolchain 0.4.15 → 0.4.16

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @sproutboat/toolchain
 
+## 0.4.16
+
+### Patch Changes
+
+- 7bab275: Pin and vendor Porffor alpha-13 (`547c781`). Alpha-11 to alpha-13 bring array, typed array and module codegen fixes, a basic `RegExp` search, a `String.prototype.normalize` stub and lowercase JSON hex escapes. Every Sproutboat patch applies unchanged, uWebSockets stays on the same commit, and the compatibility suite is unchanged at 30/32.
+
 ## 0.4.15
 
 ### Patch Changes

package/PORFFOR_ALPHA13.md

@@ -0,0 +1,9 @@
+# Porffor alpha-13 upgrade audit
+
+The source pin moves from alpha-10 (`08ac7ee`) to the [alpha-13 release](https://github.com/CanadaHonk/porffor/releases/tag/alpha-13), commit `547c7815125b6f02474591950f8b0dd7031a03f0`, published September 30, 2026. The vendored codeload archive has SHA-256 `d0ff4bf7778f85445ff99bb8f6b2e07f2b83a33a109612f9eba6f2e5cba291b5`.
+
+Alpha-11 brings array and typed array fast paths (merge sort, `shift`, same-type `set`) and codegen fixes for closures in loops and function literals. Alpha-12 fixes module handling (reassigned exports, strict-mode analysis, module-init closures). Alpha-13 adds a basic `RegExp` search, a `String.prototype.normalize` stub, more reserved C keywords and lowercase JSON hex escapes. Its `compiler/uwebsockets.js` still pins `360c276d609d59af56ae6932adb95154ace9f15f`, so the CLI's vendored uWebSockets archive does not change. All 28 Sproutboat patches apply without changing their anchors or markers. `PORF_CORO_STACK_SIZE` is still 256 KiB upstream, so the #178 patch still applies and still matters.
+
+The native package suite passed 152 tests, plus the native crypto vectors. Linked to this toolchain, the CLI passed 103 tests (`SURFACE.md` only needs the new provenance stamp), 28 broker checks, 30 standalone checks and all 21 examples. The platform's 32-handler comparison compiled all 32 and matched Bun on 30, unchanged from alpha-10. The remaining two failures are non-ISO date parsing in `15-date-iso.js` and `16-date-parts.js`. See [the scorecard](PORFFOR_SCORECARD.md) for the exact results.
+
+The open runtime bugs reproduce unchanged: baronunread/sproutboat#168 (an async chain using `new Date().toISOString()` flips to permanent 500s after 5 to 12 requests) and the read half of #189 (non-ASCII D1 and KV values come back as Latin-1 bytes).

package/PORFFOR_SCORECARD.md

@@ -1,29 +1,29 @@
 # Porffor pin scorecard
 
-Pin: alpha-10 (08ac7ee1077c05da2bec18dcca15197051e87b62). Compatibility report: 2026-09-28T07:08:44.821Z.
+Pin: alpha-13 (547c7815125b6f02474591950f8b0dd7031a03f0). Compatibility report: 2026-10-01T10:57:31.463Z.
 
 | Measure | Result |
 | --- | ---: |
 | Fixtures compiled | 32/32 |
 | Behavior matches | 30/32 |
-| Median / p95 compile, ms | 4468 / 7436 |
-| Median / p95 binary, bytes | 983392 / 1016464 |
-| Patch markers | 27 |
+| Median / p95 compile, ms | 3212 / 4703 |
+| Median / p95 binary, bytes | 966864 / 999936 |
+| Patch markers | 28 |
 | Upstream files written | 6 |
 | Fresh patch application | pass |
 
-Previous snapshot: alpha-9-de4eb58.json. Matches 30/32 to 30/32; patch markers 27 to 27.
+Previous snapshot: alpha-10-08ac7ee.json. Matches 30/32 to 30/32; patch markers 27 to 28.
 
 ## Patch inventory
 
-- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
+- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER, CORO_STACK_MARKER
 - `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER
 - `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER
 - `compiler/builtins/date.ts`: DATE_PARSER_MARKER
 - `compiler/uwebsockets.js`: BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
 - `compiler/builtins_precompiled.js`: regenerated builtin table
 
-Patch source SHA-256: `edf60b7104e2d0b8efb64e38459fd2d5616ccdf24995ad1d4ca07fa232db4eaf`.
+Patch source SHA-256: `6f607ac6b66fc4a51c2bf9e9525d0ab7f4e9b9dd3f942a820bbad46b7e3dbf56`.
 
 ## Known behavior gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.15",
+  "version": "0.4.16",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-13-547c781.json

@@ -0,0 +1,59 @@
+{
+  "pin": "alpha-13 (547c7815125b6f02474591950f8b0dd7031a03f0)",
+  "reportGeneratedAt": "2026-10-01T10:57:31.463Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 3212,
+  "p95CompileMs": 4703,
+  "medianBinaryBytes": 966864,
+  "p95BinaryBytes": 999936,
+  "patchSourceSha256": "6f607ac6b66fc4a51c2bf9e9525d0ab7f4e9b9dd3f942a820bbad46b7e3dbf56",
+  "patchMarkerCount": 28,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER",
+      "CORO_STACK_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER"
+    ],
+    "compiler/builtins/typedarray.js": [
+      "TYPED_ARRAY_FROM_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-08ac7ee.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-547c781.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/patch.ts

@@ -133,10 +133,11 @@ const READ_RAW_MARKER = "porf_native_fetch_read_raw_bytes(jsval value";
 
 /**
  * baronunread/sproutboat#178: every async function runs on its own fiber
- * stack, and alpha-10 fixes those at 256 KiB. A large handler compiled at -O0
- * (what `sproutboat dev` builds) spends ~40 KiB of stack per call into the
- * biggest generated functions, so a few nested awaits run off the end into
- * the guard page and the sprout dies with SIGBUS on its first request, no log.
+ * stack, and Porffor (alpha-10 through alpha-13) fixes those at 256 KiB. A
+ * large handler compiled at -O0 (what `sproutboat dev` builds) spends ~40 KiB
+ * of stack per call into the biggest generated functions, so a few nested
+ * awaits run off the end into the guard page and the sprout dies with SIGBUS
+ * on its first request, no log.
  * -O3 frames are smaller, which only raises the threshold: a deep enough
  * async chain hits it in a release build too.
  *

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-10";
-export const PORFFOR_COMMIT_FULL = "08ac7ee1077c05da2bec18dcca15197051e87b62";
+export const PORFFOR_CHANNEL = "alpha-13";
+export const PORFFOR_COMMIT_FULL = "547c7815125b6f02474591950f8b0dd7031a03f0";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "d49ce6724efde555b4cdeea0d2610baddd4310153956c79b352d86ba9cf0f60f";
+  "d0ff4bf7778f85445ff99bb8f6b2e07f2b83a33a109612f9eba6f2e5cba291b5";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-10 (08ac7ee)`). */
+/** A compact identity string for a manifest / report (`alpha-13 (547c781)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }