@sproutboat/toolchain 0.4.24 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sproutboat/toolchain
 
+## 0.5.0
+
+### Minor Changes
+
+- 16f9b79: Pin and vendor Porffor alpha-15 (`72d048d`). Alpha-14 and alpha-15 bring stackless coroutines, iterator support, class hoisting and typed-array fixes. Three Sproutboat patches are dropped because upstream now covers them: the typed-array store and `~` conversions (#238) and the coroutine stack size (#178). The #241 write-bounds guard is re-anchored. uWebSockets stays on the same commit and the compatibility suite is unchanged at 30/32. See `PORFFOR_ALPHA15.md`.
+
+### Patch Changes
+
+- bf4ac00: Named class expressions work inside handlers again (baronunread/sproutboat#256). Inside a function, Porffor gave a class expression's own name, as seen from its methods, a new function object instead of the class, so `var R = class l { static lex() { return new l() } }` failed with "value is not a constructor". Every handler has run inside a function since #238, and bundlers emit this shape for any class whose static members refer to themselves, so marked and similar packages broke. A parse-time rewrite turns such a class into the equivalent `(() => { const l = class { ... }; return l; })()`, which Porffor handles correctly.
+  
+  The ISO date parser no longer reads one byte past the end of the string. When that byte happened to be `+` or `-`, a timezone offset's sign flipped, so `-00:30` could parse as `+00:30` depending on what sat next in memory.
+
 ## 0.4.24
 
 ### Patch Changes

package/PORFFOR_ALPHA15.md

@@ -0,0 +1,9 @@
+# Porffor alpha-15 upgrade audit
+
+The source pin moves from alpha-13 (`547c781`) to the [alpha-15 release](https://github.com/CanadaHonk/porffor/releases/tag/alpha-15), commit `72d048d73d49e217631ac8a1bc4fa9070d22fbc9`, published October 2, 2026. The vendored codeload archive has SHA-256 `1e12be943b29691ad84bb25baecffa810655dcf7d9a490b8399352509da7a1d5`.
+
+Alpha-14 and alpha-15 bring stackless coroutines (async functions compile to state machines), initial iterator support, hoisting of referenced classes, a fix for function-expression self-references, integer typed-array stores that wrap, `~` built on ToUint32, a `parseInt` length check, `Map#forEach` seeing added entries, and ANSI colour only on a TTY. `compiler/uwebsockets.js` still pins uWebSockets `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+Three patches are dropped because upstream now does the same thing: the typed-array store conversion and `~` from #238 (upstream emits the same `toUint32` code), and the coroutine stack size from #178 (there are no coroutine stacks any more). The #241 write-bounds guard is re-anchored on upstream's new store line. Two fixes ride along and also apply to alpha-13: the class self-name rewrite for #256 (alpha-15's self-reference fix covers function expressions, not class expressions), and the ISO date parser no longer reads past the end of its string, which flipped an offset's sign whenever the next byte in memory was `+` or `-`. That last bug surfaced on alpha-15 because its memory layout puts a `+` there in the date test.
+
+The package suite passed 173 tests, plus the native crypto and UTF-8 suites. Linked to this toolchain, the CLI passed 101 of 102 tests (`SURFACE.md` only needs the new provenance stamp) and both kitchen-sink harnesses: 35 broker checks and 38 standalone checks. The platform's 32-handler comparison compiled all 32 and matched Bun on 30, unchanged; the two misses are still non-ISO date parsing in `15-date-iso.js` and `16-date-parts.js`. `bench/pin-compare.ts` against alpha-13 showed equal binary size, compile time and cold start. Its throughput reading swung between runs; ten alternating runs of each binary afterwards put both at about 25,000 requests a second.

package/PORFFOR_SCORECARD.md

@@ -1,29 +1,33 @@
 # Porffor pin scorecard
 
-Pin: alpha-13 (547c7815125b6f02474591950f8b0dd7031a03f0). Compatibility report: 2026-10-01T10:57:31.463Z.
+Pin: alpha-15 (72d048d73d49e217631ac8a1bc4fa9070d22fbc9). Compatibility report: 2026-10-05T00:30:02.525Z.
 
 | Measure | Result |
 | --- | ---: |
 | Fixtures compiled | 32/32 |
 | Behavior matches | 30/32 |
-| Median / p95 compile, ms | 3212 / 4703 |
-| Median / p95 binary, bytes | 966864 / 999936 |
-| Patch markers | 28 |
-| Upstream files written | 6 |
+| Median / p95 compile, ms | 420 / 822 |
+| Median / p95 binary, bytes | 1033344 / 1049904 |
+| Patch markers | 38 |
+| Upstream files written | 10 |
 | Fresh patch application | pass |
 
-Previous snapshot: alpha-10-08ac7ee.json. Matches 30/32 to 30/32; patch markers 27 to 28.
+Previous snapshot: alpha-13-547c781.json. Matches 30/32 to 30/32; patch markers 28 to 38.
 
 ## Patch inventory
 
-- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER, CORO_STACK_MARKER
-- `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER
-- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER
+- `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
+- `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER, FP_CONTRACT_MARKER, HTTP10_IMPORT_MARKER, HTTP10_CALL_MARKER
+- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER, TA_SET_OFFSET_MARKER, TA_JOIN_MARKER
 - `compiler/builtins/date.ts`: DATE_PARSER_MARKER
-- `compiler/uwebsockets.js`: BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
+- `compiler/builtins/promise.ts`: PROMISE_NULL_MARKER
+- `compiler/builtins/string.ts`: REPLACE_ALL_MARKER
+- `compiler/codegen.js`: TA_GET_MARKER, TA_SET_BOUNDS_MARKER
+- `compiler/parse.js`: CLASS_SELF_MARKER
+- `compiler/uwebsockets.js`: HTTP10_SHIM_MARKER, BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
 - `compiler/builtins_precompiled.js`: regenerated builtin table
 
-Patch source SHA-256: `6f607ac6b66fc4a51c2bf9e9525d0ab7f4e9b9dd3f942a820bbad46b7e3dbf56`.
+Patch source SHA-256: `849997ab545a760019941886780b3fc70c89b67581cc9acf2b51ca6ff8a37d17`.
 
 ## Known behavior gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.24",
+  "version": "0.5.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-15-72d048d.json

@@ -0,0 +1,77 @@
+{
+  "pin": "alpha-15 (72d048d73d49e217631ac8a1bc4fa9070d22fbc9)",
+  "reportGeneratedAt": "2026-10-05T00:30:02.525Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 420,
+  "p95CompileMs": 822,
+  "medianBinaryBytes": 1033344,
+  "p95BinaryBytes": 1049904,
+  "patchSourceSha256": "849997ab545a760019941886780b3fc70c89b67581cc9acf2b51ca6ff8a37d17",
+  "patchMarkerCount": 38,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER",
+      "FP_CONTRACT_MARKER",
+      "HTTP10_IMPORT_MARKER",
+      "HTTP10_CALL_MARKER"
+    ],
+    "compiler/builtins/typedarray.js": [
+      "TYPED_ARRAY_FROM_MARKER",
+      "TA_SET_OFFSET_MARKER",
+      "TA_JOIN_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/builtins/promise.ts": [
+      "PROMISE_NULL_MARKER"
+    ],
+    "compiler/builtins/string.ts": [
+      "REPLACE_ALL_MARKER"
+    ],
+    "compiler/codegen.js": [
+      "TA_GET_MARKER",
+      "TA_SET_BOUNDS_MARKER"
+    ],
+    "compiler/parse.js": [
+      "CLASS_SELF_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "HTTP10_SHIM_MARKER",
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.test.ts

@@ -27,8 +27,14 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "    return 0;\n" +
       "  }\n" +
       "  return -1;\n" +
-      "}\n" +
-      "#define PORF_CORO_STACK_SIZE (256u * 1024u)\n",
+      "}\n",
+    "compiler/parse.js":
+      "import link from './modules.js';\n" +
+      "export default (input) => {\n" +
+      "  const ast = parse(input);\n" +
+      "  if (ast._ts) globalThis.typedInput = Prefs.optTypes;\n" +
+      "  return ast;\n" +
+      "};\n",
     "compiler/index.js":
       "import { hashId } from './modules.js';\n" +
       "      const uwsDir = uwebsockets.ensureUWebSockets();\n" +
@@ -123,8 +129,7 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
     "compiler/codegen.js":
-      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));\n" +
-      "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));\n" +
+      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
       "  const taGet = (ctype, size, signed = true) => () => {\n" +
       "    const loaded = Load(ctype, taAddr(size), 4);\n" +
       "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
@@ -226,16 +231,15 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
     "offset = ecma262.ToIntegerOrInfinity(offset);",
   );
-  // #238: ~ wraps (ToInt32), and out-of-range typed-array reads are undefined.
+  // #238: out-of-range typed-array reads are undefined. (The store and `~`
+  // conversions #238 also patched are upstream's own code since alpha-14.)
   const codegen = await readFile(join(dir, "compiler/codegen.js"), "utf8");
-  expect(codegen).toContain("Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED)");
   expect(codegen).toContain("Box(f, Const(T.i32, TYPES.number)), valUndefined());");
   // #241: out-of-range typed-array writes are ignored in user code.
   expect(codegen).toContain("if (globalThis.precompile) store();");
-  // #238: integer typed-array stores wrap modulo 2^n instead of saturating.
-  expect(await readFile(join(dir, "compiler/codegen.js"), "utf8")).toContain(
-    "signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)",
-  );
+  // #256: named class expressions inside functions are rewritten at parse time.
+  expect(await readFile(join(dir, "compiler/parse.js"), "utf8")).toContain("sbClassSelf(ast); // sproutboat #256");
+  expect(await readFile(join(dir, "compiler/sb-class-self.js"), "utf8")).toContain("sproutboat #256");
   // #237: replaceAll joins its pieces once instead of a strcat per match.
   expect(await readFile(join(dir, "compiler/builtins/string.ts"), "utf8")).toContain(
     "return Porffor.callThis(__Array_prototype_join, pieces, '');",

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-547c781.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-72d048d.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/class-self-native.test.ts

@@ -0,0 +1,43 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+// baronunread/sproutboat#256: inside a function, a named class expression's own
+// name must be the class itself. marked's minified Lexer has exactly this shape.
+const program = `function inner() {
+  var R = class l { constructor(o) { this.o = o || E; } static make(o) { return new l(o); } lex(s) { return s.length; } static lex(s) { return new l().lex(s); } };
+  var E = { d: 1 };
+  var C = class k extends R { lex(s) { return super.lex(s) + 1; } static make() { return new k(); } };
+  var plain = class { static make() { return 7; } };
+  return [R === new R().constructor, R.make().o.d, R.lex("abc"), C.make().lex("ab"), C.name, plain.make()].join(" ");
+}
+async function viaAwait() {
+  var A = class m { static async load() { await null; return new m(); } ok() { return "ok"; } };
+  return (await A.load()).ok();
+}
+console.log(inner());
+viaAwait().then((v) => console.log(v));
+`;
+
+test("#256: a named class expression inside a function sees itself", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-class-self-"));
+  try {
+    const porffor = await ensurePorffor();
+    const source = resolve(root, "classes.js");
+    const binary = resolve(root, "classes");
+    await writeFile(source, program);
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe" });
+    const lines = Buffer.from(run.stdout).toString().replace(/\u001b\[[0-9;]*m/g, "").trim().split("\n");
+    expect(lines).toEqual(["true 1 3 3 k 7", "ok"]);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/patch.test.ts

@@ -36,7 +36,6 @@ int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_
   return -1;
 }
 
-#define PORF_CORO_STACK_SIZE (256u * 1024u)
 #define PORF_CORO_MAX 16384
 `;
 
@@ -294,10 +293,6 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
       "int porf_native_fetch_read_value(jsval value, const char** out_buf, size_t* out_len, char** out_owned) {",
     );
 
-    // #178: fiber stacks big enough for -O0 frames in a few nested awaits.
-    expect(once).toContain("#define PORF_CORO_STACK_SIZE (8u * 1024u * 1024u)");
-    expect(once).not.toContain("(256u * 1024u)");
-
     await patchRenderJs(root);
     expect(await readFile(join(root, "compiler/render.js"), "utf8")).toBe(once);
   } finally {

package/src/patch.ts

@@ -131,24 +131,6 @@ const READ_RAW_INJECT =
   READ_RAW_ANCHOR;
 const READ_RAW_MARKER = "porf_native_fetch_read_raw_bytes(jsval value";
 
-/**
- * baronunread/sproutboat#178: every async function runs on its own fiber
- * stack, and Porffor (alpha-10 through alpha-13) fixes those at 256 KiB. A
- * large handler compiled at -O0 (what `sproutboat dev` builds) spends ~40 KiB
- * of stack per call into the biggest generated functions, so a few nested
- * awaits run off the end into the guard page and the sprout dies with SIGBUS
- * on its first request, no log.
- * -O3 frames are smaller, which only raises the threshold: a deep enough
- * async chain hits it in a release build too.
- *
- * Match a thread's usual 8 MiB. The reservation is MAP_NORESERVE with a guard
- * page, so only touched pages cost memory and a shallow handler pays nothing.
- */
-const CORO_STACK_ANCHOR = "#define PORF_CORO_STACK_SIZE (256u * 1024u)";
-const CORO_STACK_INJECT =
-  "// sproutboat #178: 256 KiB overflows -O0 frames in a few nested awaits.\n" +
-  "#define PORF_CORO_STACK_SIZE (8u * 1024u * 1024u)";
-const CORO_STACK_MARKER = "sproutboat #178";
 
 /**
  * render.js full-block replacements: `[marker, anchor, inject, what]`, each a
@@ -158,7 +140,6 @@ const CORO_STACK_MARKER = "sproutboat #178";
 const RENDER_REPLACEMENTS = [
   [BYTESTRING_MARKER, BYTESTRING_ANCHOR, BYTESTRING_INJECT, "bytestring UTF-8 encoding (#172)"],
   [READ_RAW_MARKER, READ_RAW_ANCHOR, READ_RAW_INJECT, "raw bytestring passthrough function (#176)"],
-  [CORO_STACK_MARKER, CORO_STACK_ANCHOR, CORO_STACK_INJECT, "coroutine stack size (#178)"],
 ] as const;
 
 // #15 — no `--port` flag: Porffor's native-fetch entry point calls
@@ -180,6 +161,95 @@ const LINK_INJECT =
   "        ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
 const LINK_MARKER = "SB_EXTRA_LINK";
 
+/**
+ * baronunread/sproutboat#256: inside a function, Porffor gives a named class
+ * expression's own name, as seen from its methods, a fresh function object
+ * instead of the class. So `var R = class l { static lex() { return new l() } }`
+ * builds an object with none of the class's methods ("value is not a
+ * constructor"). Top level is fine. Since #238 every handler runs inside a
+ * function, and bundlers emit exactly this shape for classes whose static
+ * members refer to themselves (marked's Lexer and Parser, esbuild's
+ * `class _X`).
+ *
+ * The rewrite keeps the meaning: the name becomes an ordinary const, which
+ * Porffor captures correctly, and `const l = class {}` still names it "l".
+ *
+ *   class l { ... }  ->  (() => { const l = class { ... }; return l; })()
+ *
+ * Only named class expressions inside a function whose body refers to the name.
+ * Skipped when `extends` or a computed key holds await/yield, which an arrow
+ * would change.
+ */
+const CLASS_SELF_HELPER = String.raw`// sproutboat #256: a named class expression's own name inside a function.
+const isFn = (n) => n.type === 'FunctionDeclaration' || n.type === 'FunctionExpression' || n.type === 'ArrowFunctionExpression';
+
+const mentions = (node, name) => {
+  if (node == null || typeof node !== 'object') return false;
+  if (Array.isArray(node)) return node.some((x) => mentions(x, name));
+  if (node.type === 'Identifier') return node.name === name;
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    if (mentions(node[key], name)) return true;
+  }
+  return false;
+};
+
+const suspends = (node) => {
+  if (node == null || typeof node !== 'object') return false;
+  if (Array.isArray(node)) return node.some(suspends);
+  if (node.type === 'AwaitExpression' || node.type === 'YieldExpression') return true;
+  if (isFn(node) || node.type === 'ClassExpression' || node.type === 'ClassDeclaration') return false;
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    if (suspends(node[key])) return true;
+  }
+  return false;
+};
+
+const rewrite = (cls) => {
+  const name = cls.id.name;
+  const at = { start: cls.start, end: cls.end };
+  const id = () => ({ type: 'Identifier', name, ...at });
+  return {
+    type: 'CallExpression', optional: false, arguments: [], ...at,
+    callee: {
+      type: 'ArrowFunctionExpression', id: null, params: [], async: false, generator: false, expression: false, ...at,
+      body: {
+        type: 'BlockStatement', ...at,
+        body: [
+          { type: 'VariableDeclaration', kind: 'const', ...at, declarations: [
+            { type: 'VariableDeclarator', id: id(), init: { ...cls, id: null }, ...at },
+          ] },
+          { type: 'ReturnStatement', argument: id(), ...at },
+        ],
+      },
+    },
+  };
+};
+
+const walk = (node, inFn) => {
+  if (node == null || typeof node !== 'object') return node;
+  if (Array.isArray(node)) {
+    for (let i = 0; i < node.length; i++) node[i] = walk(node[i], inFn);
+    return node;
+  }
+  const childInFn = inFn || isFn(node);
+  for (const key in node) {
+    if (key[0] === '_' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+    const value = node[key];
+    if (value && typeof value === 'object') node[key] = walk(value, childInFn);
+  }
+  if (
+    inFn && node.type === 'ClassExpression' && node.id?.name &&
+    mentions(node.body, node.id.name) &&
+    !suspends(node.superClass) && !node.body.body.some((m) => m.computed && suspends(m.key))
+  ) return rewrite(node);
+  return node;
+};
+
+export default (ast) => (globalThis.precompile ? ast : walk(ast, false));
+`;
+
 /**
  * #15 — and the same for the compile step, so the prelude's inline C can
  * `#include <bearssl.h>`. The link patch alone is not enough: Porffor's
@@ -291,30 +361,6 @@ const REPLACE_ALL_EDITS = [
 ] as const;
 const REPLACE_ALL_MARKER = "sproutboat #237: pieces joined once";
 
-// baronunread/sproutboat#238: an integer typed-array element store converted
-// its value with a saturating f64 -> int Convert, so a negative value stored
-// into a Uint32Array became 0 and 4e9 into an Int32Array became 2147483647.
-// ECMA-262 (IntegerIndexedElementSet -> ToUint32 / ToInt32 / ToUint16 ...) wraps
-// modulo 2^n instead. noble-hashes' SHA-256 stores `x | 0` into a Uint32Array,
-// so every negative schedule word was zeroed and the digest came out wrong.
-// Route the store through codegen's own modular toUint32 (what bitwise ops use);
-// narrower stores keep the low bits, which is exactly the modular result.
-const TA_STORE_ANCHOR =
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));";
-const TA_STORE_INJECT =
-  "      // sproutboat #238: typed-array stores wrap modulo 2^n (ToUint32), not saturate.\n" +
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
-const TA_STORE_MARKER = "sproutboat #238: typed-array stores wrap";
-// baronunread/sproutboat#238: unary `~` had the same saturating conversion, so
-// ~x for x >= 2^31 (or ~~x, the common truncation idiom) clamped to
-// +/-2147483648, and ~Infinity gave -2147483648 instead of -1. uuid's SHA-1
-// computes `x & y ^ ~x & z` on words above 2^31, so every v5 UUID was wrong.
-const BITNOT_ANCHOR =
-  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));";
-const BITNOT_INJECT =
-  "      // sproutboat #238: ~ applies ToInt32 (wrap modulo 2^32), not a saturating cast.\n" +
-  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED))), Const(T.i32, TYPES.number));";
-const BITNOT_MARKER = "sproutboat #238: ~ applies ToInt32";
 // baronunread/sproutboat#238: typed-array element reads and writes had no
 // bounds check. A read past the end returned whatever sat in the next
 // allocation instead of undefined (uuid's SHA-1 reads past its buffer, so v5
@@ -350,12 +396,13 @@ const TA_GET_MARKER = "sproutboat #238: only a valid in-range integer index read
 // whatever memory followed it (and a[-1] = x wrote a[0], via the saturating
 // index conversion). ECMA-262 ignores the write. Same check as taGet, in user
 // code only: builtins such as the constructor store elements before they set
-// the length, and they only write in bounds anyway. Applies after TA_STORE,
-// whose output line is the anchor.
+// the length, and they only write in bounds anyway. Alpha-14 fixed the store's
+// conversion upstream (ToUint32, which our #238 patch used to add); the bounds
+// check is still missing there.
 const TA_SET_BOUNDS_ANCHOR =
-  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));";
 const TA_SET_BOUNDS_INJECT =
-  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));\n" +
+  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
   "      // sproutboat #241: a write outside the array is ignored, not stored into the next allocation.\n" +
   "      if (globalThis.precompile) store();\n" +
   "      else {\n" +
@@ -459,8 +506,12 @@ const DATE_PARSER_INJECT = `  // sproutboat: ISO timezone offset
   const endPtr: i32 = Porffor.IR.ptr(string) + len;
   let ptr: i32 = Porffor.IR.ptr(string);
 
+  // Loop once past the last character to flush the final number, but read a
+  // 0 there, not the byte after the string: if that byte happened to be '+' or
+  // '-' it flipped the offset's sign.
   while (ptr <= endPtr) {
-    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);
+    const chr: i32 = ptr < endPtr ? Porffor.IR.loadU8(ptr, 4) : 0;
+    ptr++;
     if (Porffor.fastAnd(chr >= 48, chr <= 57)) {
       n = n * 10 + chr - 48;
       digits++;
@@ -1132,6 +1183,28 @@ export async function patchUwebsockets(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
+const CLASS_SELF_IMPORT_ANCHOR = "import link from './modules.js';";
+const CLASS_SELF_IMPORT_INJECT = "import link from './modules.js';\nimport sbClassSelf from './sb-class-self.js';";
+const CLASS_SELF_CALL_ANCHOR = "  if (ast._ts) globalThis.typedInput = Prefs.optTypes;";
+const CLASS_SELF_CALL_INJECT = "  sbClassSelf(ast); // sproutboat #256\n  if (ast._ts) globalThis.typedInput = Prefs.optTypes;";
+const CLASS_SELF_MARKER = "sproutboat #256";
+
+/** #256 — see CLASS_SELF_HELPER. */
+export async function patchClassSelfName(root: string): Promise<void> {
+  await writeFile(resolve(root, "compiler/sb-class-self.js"), CLASS_SELF_HELPER);
+  const file = resolve(root, "compiler/parse.js");
+  let src = await readFile(file, "utf8");
+  if (src.includes(CLASS_SELF_MARKER)) return;
+  for (const [anchor, what] of [
+    [CLASS_SELF_IMPORT_ANCHOR, "import"],
+    [CLASS_SELF_CALL_ANCHOR, "call"],
+  ] as const) {
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor's class self-name rewrite (${what}): anchor not found in ${file}`);
+  }
+  src = src.replace(CLASS_SELF_IMPORT_ANCHOR, CLASS_SELF_IMPORT_INJECT).replace(CLASS_SELF_CALL_ANCHOR, CLASS_SELF_CALL_INJECT);
+  await writeFile(file, src);
+}
+
 async function patchCompilerArgs(root: string): Promise<void> {
   await writeFile(resolve(root, "compiler/sb-http10.js"), HTTP10_HELPER);
   const file = resolve(root, "compiler/index.js");
@@ -1209,8 +1282,6 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   let src = await readFile(file, "utf8");
   let changed = false;
   for (const [marker, anchor, inject, what] of [
-    [TA_STORE_MARKER, TA_STORE_ANCHOR, TA_STORE_INJECT, "typed-array store conversion"],
-    [BITNOT_MARKER, BITNOT_ANCHOR, BITNOT_INJECT, "bitwise NOT conversion"],
     [TA_GET_MARKER, TA_GET_ANCHOR, TA_GET_INJECT, "typed-array read bounds"],
     [TA_SET_BOUNDS_MARKER, TA_SET_BOUNDS_ANCHOR, TA_SET_BOUNDS_INJECT, "typed-array write bounds"],
   ] as const) {
@@ -1305,6 +1376,7 @@ export async function patchRenderJs(root: string): Promise<void> {
 export async function ensurePorfforPatched(root: string): Promise<void> {
   if (done.has(root)) return;
   await patchCompilerArgs(root);
+  await patchClassSelfName(root);
   await patchUwebsockets(root);
   await patchRenderJs(root);
   await patchDateParser(root);

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-13";
-export const PORFFOR_COMMIT_FULL = "547c7815125b6f02474591950f8b0dd7031a03f0";
+export const PORFFOR_CHANNEL = "alpha-15";
+export const PORFFOR_COMMIT_FULL = "72d048d73d49e217631ac8a1bc4fa9070d22fbc9";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "d0ff4bf7778f85445ff99bb8f6b2e07f2b83a33a109612f9eba6f2e5cba291b5";
+  "1e12be943b29691ad84bb25baecffa810655dcf7d9a490b8399352509da7a1d5";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-13 (547c781)`). */
+/** A compact identity string for a manifest / report (`alpha-15 (72d048d)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }