@sproutboat/toolchain 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @sproutboat/toolchain
 
+## 0.6.0
+
+### Minor Changes
+
+- Pin and vendor Porffor alpha-16 (43087d4). Enable Proxy and revocable Proxy in handler validation, add native regression coverage for traps and iterators, and drop three typed-array patches now implemented upstream. See PORFFOR_ALPHA16.md for the complete change audit and remaining package compatibility limits.
+
 ## 0.5.0
 
 ### Minor Changes

package/PORFFOR_ALPHA16.md

@@ -0,0 +1,67 @@
+# Porffor alpha-16 upgrade audit
+
+Source: [alpha-16](https://github.com/CanadaHonk/porffor/releases/tag/alpha-16), published October 10, 2026, commit `43087d42f0b90d14f04f3cddac034822560aefad`. The vendored codeload archive has SHA-256 `84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032`. The [complete alpha-15 comparison](https://github.com/CanadaHonk/porffor/compare/alpha-15...alpha-16) contains 32 commits. uWebSockets stays at `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+## Supported changes
+
+The runtime accepts `new Proxy` and `Proxy.revocable`. Native output matches Bun for get/set/has/deleteProperty, ownKeys/getOwnPropertyDescriptor through Object.keys, apply, construct, revocation, and a frozen-property invariant. This is regression coverage for these operations, not certification of all Proxy invariants or exotic targets.
+
+Array and Map iterators and lazy matchAll now expose next/done, and Set spread works. Sproutboat's URLSearchParams and FormData shims now provide live, self-iterable keys/values/entries and default iteration. Appending after creating an iterator is observed on its next step, duplicate fields remain intact, and FormData filenames do not become iterator values.
+
+Three local patches are removed because the shared typed-array implementation handles array-like from(), an omitted set() offset and join()/toString(). Builtin precompilation remains necessary for the date, promise, replaceAll and Unicode patches. Existing typed-array bounds and class self-name patches still apply. New native regressions cover clamped ties-to-even, class static this, null-prototype __proto__, binary evaluation order and Unicode console output.
+
+## Package probes and opportunities
+
+Native standalone HTTP probes on macOS arm64, pinned dependencies:
+
+| Package | Operation | Result |
+| --- | --- | --- |
+| qs 6.16.0 | Nested parse and stringify, including array parameters | Passed |
+| @trpc/server 11.19.0 | initTRPC, router and createCaller().hello() | Passed; HTTP adapters, clients, middleware and subscriptions untested |
+| itty-router 5.0.24 Router | Parameter route, POST and fallback handler | Compiler error: labelled break crossing iterator cleanup (`target.brk`) |
+| itty-router 5.0.24 IttyRouter | Parameter route, POST and fallback handler | Passed GET parameters, Unicode POST and 404 fallback after adding live Web API iterators |
+
+Proxy-based object facades, method dispatch and server callers are now practical candidates. tRPC's basic caller path is verified, so a fetch-adapter and middleware matrix is a useful next step. Reactive stores and schema libraries must be tested on their own inputs before being listed as supported. Better Auth still needs a separate crypto and framework compatibility evaluation; Proxy alone does not establish auth support. Streams and WebSockets remain separate host API gaps.
+
+String iteration still splits astral characters into UTF-16 halves: Array.from("🚤x") produces two surrogate entries and x rather than one emoji and x. Unicode console output itself works. Standard itty-router Router also remains blocked by a separate compiler control-flow bug. No upstream issue was filed.
+
+## Complete change review
+
+| Commit | Upstream change | Sproutboat impact |
+| --- | --- | --- |
+| [c730268](https://github.com/CanadaHonk/porffor/commit/c730268d087766a87502de0045eb08b1f966d7d2) | codegen: evaluate binary lhs before rhs statements | Fixes operand side-effect order; native regression. |
+| [d24dc0a](https://github.com/CanadaHonk/porffor/commit/d24dc0ad569bfd73a2dd6e3627c0cc21619bffc2) | codegen: balance template literal concats | Balances concatenation trees; compiler improvement, no new API. |
+| [4598bec](https://github.com/CanadaHonk/porffor/commit/4598becfc46865d9ea18ad338a650c98f354af51) | precompile: store builtin table as arrays | Changes builtin table representation; patched builtins still precompile. |
+| [f9eb038](https://github.com/CanadaHonk/porffor/commit/f9eb038c3aa4856d861530beb2423236536beb77) | builtins: bucket auto func keys by prefix | Compiler lookup optimization; no new API. |
+| [fd8f58a](https://github.com/CanadaHonk/porffor/commit/fd8f58a8374f6adf308056b40cae8d59fc31dcb0) | builtins: check builtin existence without decoding | Compiler lookup optimization; no new API. |
+| [b7b8ba2](https://github.com/CanadaHonk/porffor/commit/b7b8ba2fdd4fd12340aba048c578ac2b5c3d3aef) | builtins: add constructor to all builtin prototypes | Builtin prototype constructor identity becomes available; do not infer subclass compatibility. |
+| [95522a4](https://github.com/CanadaHonk/porffor/commit/95522a421ddedb5b6801d4c1f7c6706fab3cebe0) | selfhost: label bench old/new with --compare | Upstream benchmark reporting only. |
+| [860485e](https://github.com/CanadaHonk/porffor/commit/860485e9821894864fb88389f7aba5750c9f09a6) | builtins/console: print strings as utf-8 | Native Unicode console strings; native regression. |
+| [2213f53](https://github.com/CanadaHonk/porffor/commit/2213f531bda917ee3ec865c1dd92b9709dfd0d27) | codegen: include String.prototype methods for bytestrings | String method dispatch on bytestrings; existing handler tests cover common methods. |
+| [3502f8a](https://github.com/CanadaHonk/porffor/commit/3502f8a213b7de2479ba8673a92fc4eb8013fe51) | codegen: generate reassigned hoisted function bodies later | Hoisted function reassignment codegen fix; no new host API. |
+| [77ee767](https://github.com/CanadaHonk/porffor/commit/77ee767b6c8c1ea59ff82e59d7b660c942b75047) | semantic: class static blocks and fields use the class as this | Static fields and blocks see the class as this; native regression. |
+| [2e28260](https://github.com/CanadaHonk/porffor/commit/2e28260bc77048324437e53406c6a7041dba12e0) | fetch: treat null response body as empty | Null Response body becomes empty; native HTTP regression. |
+| [641cd59](https://github.com/CanadaHonk/porffor/commit/641cd5911142d65d7f00d70f39360139349f707c) | builtins: call builtin Symbol directly for well-known symbols | Well-known symbol identity; enables iterator protocols. |
+| [e684407](https://github.com/CanadaHonk/porffor/commit/e68440705a35a2d5e1bee9c67586523f281e80f6) | builtins: add statics to builtin constructors used as values | Builtin constructors used as values retain static methods. |
+| [1e3428e](https://github.com/CanadaHonk/porffor/commit/1e3428e167505f969167f70d1ed0bd3c049256af) | codegen: only type computed string reads with number keys as strings | More accurate computed-string read types; no new API. |
+| [a52e55b](https://github.com/CanadaHonk/porffor/commit/a52e55b59db43170db7831905afb3450c8404d71) | builtins/console: print maps and sets from the hashtable | Console Map/Set formatting follows hashtable representation. |
+| [9579dbb](https://github.com/CanadaHonk/porffor/commit/9579dbb6379617ac8d35dc5177e035b4c6aa7127) | builtins/array: spread sets and maps directly | Map/Set spread; native Set regression. |
+| [fceed9a](https://github.com/CanadaHonk/porffor/commit/fceed9a7f84afc5619da34938f89475f05f7b63d) | builtins: return iterators from array, map, set and string iterator methods | Real collection iterators; native next/done and Map keys regressions. Astral string iteration remains incorrect. |
+| [532d8f8](https://github.com/CanadaHonk/porffor/commit/532d8f85f3961037d2673aaf06fbf008ec57ff07) | builtins/generator: add Symbol.iterator and Symbol.asyncIterator | Generator iterator protocol; infrastructure for iterable libraries. Async generator coverage remains unestablished. |
+| [872edc0](https://github.com/CanadaHonk/porffor/commit/872edc027a220f18baa82edff4166e5e38e9ded3) | builtins/regexp: make matchAll a lazy iterator | Lazy matchAll next/done; native regression. |
+| [64f5299](https://github.com/CanadaHonk/porffor/commit/64f529913c3ea39a162da9516b0371665107347e) | builtins: add Proxy | Proxy implementation; lift source ban and test object/call/construct/revocation behavior. |
+| [2056abb](https://github.com/CanadaHonk/porffor/commit/2056abb1b8c8fad65f50f0ad4b0ccf00f2799150) | repl: force new line | Upstream REPL formatting only. |
+| [905b193](https://github.com/CanadaHonk/porffor/commit/905b193b2d5626fe796dda1290b39f176f4ba191) | builtins/hashtable: allocate the container after its arrays | Allocation ordering fix; exercise Map/Set in native regression. |
+| [1f6959b](https://github.com/CanadaHonk/porffor/commit/1f6959b82c2479a4c003be03d6ac829ccf3f9c7d) | codegen: round half to even in Uint8ClampedArray stores | Uint8ClampedArray ties-to-even stores; native regression. |
+| [8e76e7b](https://github.com/CanadaHonk/porffor/commit/8e76e7b8f0ea64a30974cc116bbe9c9671e7c9f4) | builtins: define builtin $get funcs as accessors | Builtin getters become accessors; typed-array prototype rewrite replaces old generation anchors. |
+| [05199be](https://github.com/CanadaHonk/porffor/commit/05199be91c124f5936c2e40d5164227ddb9b0fb9) | builtins: get builtin constructors via their getters | Builtin constructors are obtained through getters; source patches reviewed. |
+| [79bb578](https://github.com/CanadaHonk/porffor/commit/79bb5789b4fe9d1892ca322be6327984f2d40ca5) | builtins/typedarray: share %TypedArray% and %TypedArray%.prototype | Shared typed-array methods/prototypes; drop from, set-offset and join patches, retain behavioral regressions. |
+| [0a22e14](https://github.com/CanadaHonk/porffor/commit/0a22e1494ddf793fb3bb0c4b0b3740531931f3ef) | codegen: sort builtin proto call cases by type | Codegen case ordering optimization; no new API. |
+| [d5e95d0](https://github.com/CanadaHonk/porffor/commit/d5e95d0a7f91c9cc64b7766980109b8d862b4470) | codegen: only set prototype for plain __proto__ props in object literals | Only plain __proto__ literal keys change prototypes; dictionary semantics improve. |
+| [1b51d58](https://github.com/CanadaHonk/porffor/commit/1b51d58b859741688b87551470d2260606ab9698) | builtins/object: treat __proto__ as a normal key on null prototype objects | Null-prototype __proto__ is an ordinary key; native regression. |
+| [7a6ca5d](https://github.com/CanadaHonk/porffor/commit/7a6ca5d32f56ff7d9b1fbaaf59fafede5a496771) | parser: drop __proto__ scope slot workaround | Removes parser workaround after __proto__ fixes; class self-name patch still needed. |
+| [43087d4](https://github.com/CanadaHonk/porffor/commit/43087d42f0b90d14f04f3cddac034822560aefad) | ci: update expected test262 harness passes | Upstream conformance expectation update; does not establish Sproutboat support. |
+
+## Validation
+
+The isolated release package suite passed 174 tests, and the CLI release suite passed 103. Both release kitchen-sink harnesses passed: 35 broker checks and 38 standalone checks. All 21 small examples passed on alpha-16. Native crypto, Unicode broker round trips and live Web API iterator checks passed. All 32 compatibility fixtures compile and 30 match Bun; the two existing non-ISO date parsing mismatches remain. The full native feature regression is in src/alpha16-native.test.ts; live Web API iterator coverage is in ../runtime/test/native-iterators.ts. The scorecard ties compatibility results to this exact source pin and patch inventory.

package/PORFFOR_SCORECARD.md

@@ -1,24 +1,23 @@
 # Porffor pin scorecard
 
-Pin: alpha-15 (72d048d73d49e217631ac8a1bc4fa9070d22fbc9). Compatibility report: 2026-10-05T00:30:02.525Z.
+Pin: alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad). Compatibility report: 2026-10-10T08:51:03.637Z.
 
 | Measure | Result |
 | --- | ---: |
 | Fixtures compiled | 32/32 |
 | Behavior matches | 30/32 |
-| Median / p95 compile, ms | 420 / 822 |
-| Median / p95 binary, bytes | 1033344 / 1049904 |
-| Patch markers | 38 |
-| Upstream files written | 10 |
+| Median / p95 compile, ms | 13266 / 33619 |
+| Median / p95 binary, bytes | 1082960 / 1099536 |
+| Patch markers | 35 |
+| Upstream files written | 9 |
 | Fresh patch application | pass |
 
-Previous snapshot: alpha-13-547c781.json. Matches 30/32 to 30/32; patch markers 28 to 38.
+Previous snapshot: alpha-15-72d048d.json. Matches 30/32 to 30/32; patch markers 38 to 35.
 
 ## Patch inventory
 
 - `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
 - `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER, FP_CONTRACT_MARKER, HTTP10_IMPORT_MARKER, HTTP10_CALL_MARKER
-- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER, TA_SET_OFFSET_MARKER, TA_JOIN_MARKER
 - `compiler/builtins/date.ts`: DATE_PARSER_MARKER
 - `compiler/builtins/promise.ts`: PROMISE_NULL_MARKER
 - `compiler/builtins/string.ts`: REPLACE_ALL_MARKER
@@ -27,7 +26,7 @@ Previous snapshot: alpha-13-547c781.json. Matches 30/32 to 30/32; patch markers
 - `compiler/uwebsockets.js`: HTTP10_SHIM_MARKER, BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
 - `compiler/builtins_precompiled.js`: regenerated builtin table
 
-Patch source SHA-256: `849997ab545a760019941886780b3fc70c89b67581cc9acf2b51ca6ff8a37d17`.
+Patch source SHA-256: `65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20`.
 
 ## Known behavior gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-16-43087d4.json

@@ -0,0 +1,72 @@
+{
+  "pin": "alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad)",
+  "reportGeneratedAt": "2026-10-10T08:51:03.637Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 13266,
+  "p95CompileMs": 33619,
+  "medianBinaryBytes": 1082960,
+  "p95BinaryBytes": 1099536,
+  "patchSourceSha256": "65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20",
+  "patchMarkerCount": 35,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER",
+      "FP_CONTRACT_MARKER",
+      "HTTP10_IMPORT_MARKER",
+      "HTTP10_CALL_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/builtins/promise.ts": [
+      "PROMISE_NULL_MARKER"
+    ],
+    "compiler/builtins/string.ts": [
+      "REPLACE_ALL_MARKER"
+    ],
+    "compiler/codegen.js": [
+      "TA_GET_MARKER",
+      "TA_SET_BOUNDS_MARKER"
+    ],
+    "compiler/parse.js": [
+      "CLASS_SELF_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "HTTP10_SHIM_MARKER",
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.test.ts

@@ -225,11 +225,11 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
   // #242: generated typed-array join/toString keep a plain-array `parts`.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    ".replaceAll('const parts: ' + name + ' =', 'const parts: any[] =')",
+    "return Porffor.callThis(__Array_prototype_join, out, sep);",
   );
   // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    "offset = ecma262.ToIntegerOrInfinity(offset);",
+    "const targetOffsetNum: number = ecma262.ToIntegerOrInfinity(offset);",
   );
   // #238: out-of-range typed-array reads are undefined. (The store and `~`
   // conversions #238 also patched are upstream's own code since alpha-14.)
@@ -255,7 +255,7 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "compiler/builtins/promise.ts"), "utf8")).toContain(
     "if (Porffor.type(value) == Porffor.TYPES.object && value != null) {",
   );
-});
+}, 60_000);
 
 test("a corrupted warm cache is replaced from the verified archive", async () => {
   const { archive, sha256 } = await fixture();

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-72d048d.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-43087d4.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/alpha16-native.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+// Compare native output with Bun, including trap effects and iterator state.
+const program = `
+const target = { x: 1 };
+let calls = 0;
+const proxy = new Proxy(target, {
+  get(t, key, receiver) { calls++; return key === "virtual" ? 7 : Reflect.get(t, key, receiver); },
+  set(t, key, value) { t[key] = value * 2; return true; },
+  has(t, key) { return key === "virtual" || key in t; },
+  deleteProperty(t, key) { delete t[key]; return true; }
+});
+proxy.x = 3;
+console.log(proxy.x, proxy.virtual, calls, "virtual" in proxy);
+delete proxy.x;
+console.log("x" in target);
+const keys = new Proxy({ a: 1 }, {
+  ownKeys() { return ["a"]; },
+  getOwnPropertyDescriptor(t, key) { return Object.getOwnPropertyDescriptor(t, key); }
+});
+console.log(Object.keys(keys).join(","));
+const fn = new Proxy(function (x) { return x + 1; }, {
+  apply(t, self, args) { return t(args[0]) * 2; }
+});
+console.log(fn(3));
+const ctor = new Proxy(function Item(x) { this.x = x; }, {
+  construct(t, args) { return { x: args[0] * 3 }; }
+});
+console.log(new ctor(4).x);
+const revocable = Proxy.revocable({ x: 1 }, {});
+console.log(revocable.proxy.x);
+revocable.revoke();
+try { console.log(revocable.proxy.x); } catch (e) { console.log(e instanceof TypeError); }
+const frozen = Object.freeze({ x: 1 });
+try { console.log(new Proxy(frozen, { get() { return 2; } }).x); } catch (e) { console.log(e instanceof TypeError); }
+const iterator = [1, 2].values();
+console.log(iterator.next().value, iterator.next().value, iterator.next().done);
+console.log(Array.from(new Map([["a", 1], ["b", 2]]).keys()).join(","));
+console.log([...new Set([1, 2, 1])].join(","));
+console.log(Array.from("ab").join(","));
+const matches = "a1a2".matchAll(/a(\\d)/g);
+console.log(matches.next().value[1], matches.next().value[1], matches.next().done);
+console.log(Uint8Array.from({ length: 3 }, (_, i) => i + 1).join("-"));
+const bytes = new Uint8Array(3); bytes.set([4, 5]); console.log(bytes.toString());
+console.log(new Uint8ClampedArray([0.5, 1.5, 2.5, 3.5]).join(","));
+class Static { static value = this; static { this.x = 9; } }
+console.log(Static.value === Static, Static.x);
+const dict = Object.create(null); dict.__proto__ = 5;
+console.log(dict.__proto__, Object.getPrototypeOf(dict) === null);
+let order = "";
+function left() { order += "l"; return 1; }
+function right() { order += "r"; return 2; }
+console.log(left() + right(), order);
+console.log("caffè 東京 🚤");
+`;
+
+test("alpha-16: native Proxy, iterators and upstream fixes match Bun", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-alpha16-native-"));
+  try {
+    const porffor = await ensurePorffor();
+    const source = resolve(root, "features.js");
+    const binary = resolve(root, "features");
+    await writeFile(source, program);
+    const reference = Bun.spawnSync(["bun", source], { stdout: "pipe", stderr: "pipe" });
+    expect(reference.exitCode).toBe(0);
+    await rm(binary, { force: true });
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root, stdout: "pipe", stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe", timeout: 10_000 });
+    expect(run.exitCode, Buffer.from(run.stderr).toString()).toBe(0);
+    const ansi = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+    const output = Buffer.from(run.stdout).toString().replace(ansi, "");
+    expect(output).toBe(Buffer.from(reference.stdout).toString());
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/patch.ts

@@ -1,7 +1,7 @@
 /**
  * Idempotent, marker-guarded in-place edits to Porffor's generated C
  * (`compiler/render.js`, `compiler/index.js`, `compiler/uwebsockets.js`,
- * `compiler/builtins/typedarray.js`, `compiler/builtins/date.ts`). Run
+ * `compiler/builtins/date.ts`). Run
  * from the build path, not a `postinstall` hook: package managers block
  * dependency lifecycle scripts by default, so a published `postinstall` would
  * silently not run.
@@ -411,50 +411,6 @@ const TA_SET_BOUNDS_INJECT =
   "      }";
 const TA_SET_BOUNDS_MARKER = "sproutboat #241: a write outside the array is ignored";
 
-// baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
-// ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
-// then copied to `base + NaN * BYTES_PER_ELEMENT`: nothing landed where it
-// should (noble's HMAC lost its key in `pad.set(key)`), and the write went
-// somewhere else in memory. ECMA-262 uses ToIntegerOrInfinity, which maps
-// undefined and NaN to 0; subarray right below already does.
-const TA_SET_OFFSET_ANCHOR = "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_INJECT =
-  "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
-
-// baronunread/sproutboat#242: typedarray.js generates each TypedArray method
-// from array.ts with `.replaceAll('any[]', name)`. That also retyped join's and
-// toString's internal `const parts: any[]` helper as e.g. a Uint8Array, so the
-// joined strings were stored into a "typed array": Uint8Array join returned
-// garbage and Uint16Array join crashed. Put `parts` back to a plain array after
-// the replacement; map/filter's intentionally typed `out` is untouched.
-const TA_JOIN_ANCHOR = ".replaceAll('Array', name).replaceAll('any[]', name) + '\\n\\n'";
-const TA_JOIN_INJECT =
-  ".replaceAll('Array', name).replaceAll('any[]', name).replaceAll('const parts: ' + name + ' =', 'const parts: any[] =') /* sproutboat #242 */ + '\\n\\n'";
-const TA_JOIN_MARKER = "sproutboat #242";
-
-// Porffor's TypedArray.from only handles iterables. An array-like input such
-// as { length: 16 } silently becomes an empty typed array, including HMAC
-// keys made with Uint8Array.from({ length: 16 }, mapFn). The compiler uses a
-// precompiled builtin table, so the edited source must be precompiled again.
-const TYPED_ARRAY_FROM_ANCHOR =
-  "    len = i;\n  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_INJECT =
-  "    len = i;\n" +
-  "  } else {\n" +
-  "    // sproutboat: TypedArray.from accepts array-like objects.\n" +
-  "    let count = ecma262.ToIntegerOrInfinity(Porffor.object.get(arg, 'length'));\n" +
-  "    if (count < 0) count = 0;\n" +
-  "    if (count > 2147483643) throw new RangeError('Invalid TypedArray length (over maximum supported length)');\n" +
-  "    if (Porffor.type(mapFn) != Porffor.TYPES.undefined && Porffor.type(mapFn) != Porffor.TYPES.function)\n" +
-  "      throw new TypeError('Called TypedArray.from with a non-function mapFn');\n" +
-  "    for (let i: i32 = 0; i < count; i++) {\n" +
-  "      arr[i] = Porffor.type(mapFn) == Porffor.TYPES.undefined ? arg[i] : mapFn(arg[i], i);\n" +
-  "    }\n" +
-  "    len = count;\n" +
-  "  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_MARKER = "sproutboat: TypedArray.from accepts array-like objects";
-
 // Porffor alpha 9 treats +02:00 as two milliseconds and adds offset hours
 // instead of subtracting them. Count fields even when they contain zero, and
 // apply the signed offset after parsing the local wall-clock fields.
@@ -1249,7 +1205,7 @@ export async function patchDateParser(root: string): Promise<void> {
   await writeFile(file, src.slice(0, start) + parser.replace(DATE_PARSER_ANCHOR, DATE_PARSER_INJECT) + src.slice(end));
 }
 
-/** #168: keep a promise resolving to null out of the `then` probe. Precompiled by patchTypedArrayFrom. */
+/** #168: keep a promise resolving to null out of the `then` probe. */
 export async function patchPromiseResolveNull(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/promise.ts");
   const src = await readFile(file, "utf8");
@@ -1259,7 +1215,7 @@ export async function patchPromiseResolveNull(root: string): Promise<void> {
   await writeFile(file, src.replace(PROMISE_NULL_ANCHOR, PROMISE_NULL_INJECT));
 }
 
-/** #237: linear String.prototype.replaceAll. Precompiled by patchTypedArrayFrom. */
+/** #237: linear String.prototype.replaceAll. Precompiled by precompileBuiltins. */
 export async function patchReplaceAll(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/string.ts");
   let src = await readFile(file, "utf8");
@@ -1293,27 +1249,8 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
-export async function patchTypedArrayFrom(root: string): Promise<void> {
-  const file = resolve(root, "compiler/builtins/typedarray.js");
-  const src = await readFile(file, "utf8");
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER) && !src.includes(TYPED_ARRAY_FROM_ANCHOR)) {
-    throw new Error(`could not patch Porffor's TypedArray.from: anchor not found in ${file}`);
-  }
-  let edited = src;
-  if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
-  if (!edited.includes(TA_JOIN_MARKER)) {
-    if (!edited.includes(TA_JOIN_ANCHOR))
-      throw new Error(`could not patch Porffor's typed-array method generator: anchor not found in ${file}`);
-    edited = edited.replace(TA_JOIN_ANCHOR, TA_JOIN_INJECT);
-  }
-  if (!edited.includes(TA_SET_OFFSET_MARKER)) {
-    if (!edited.includes(TA_SET_OFFSET_ANCHOR))
-      throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);
-    edited = edited.replace(TA_SET_OFFSET_ANCHOR, TA_SET_OFFSET_INJECT);
-  }
-  if (edited !== src) await writeFile(file, edited);
+export async function precompileBuiltins(root: string): Promise<void> {
   const table = resolve(root, "compiler/builtins_precompiled.js");
-  const before = await readFile(table);
   // Porffor only writes the table when import.meta.url matches argv[1].
   // macOS's /var -> /private/var symlink makes a noncanonical argv[1] skip it.
   const precompile = await realpath(resolve(root, "compiler/precompile.js"));
@@ -1327,9 +1264,8 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
   ]);
-  if (code !== 0) throw new Error(`could not precompile Porffor's TypedArray.from: ${stderr || stdout}`);
-  if (edited !== src && before.equals(await readFile(table)))
-    throw new Error(`Porffor precompile did not update ${table}`);
+  if (code !== 0) throw new Error(`could not precompile Porffor's patched builtins: ${stderr || stdout}`);
+  if ((await readFile(table)).length === 0) throw new Error(`Porffor precompile produced an empty ${table}`);
 }
 
 /** The native-fetch server source: $PORT support + the #165 console sink. Exported for tests. */
@@ -1385,7 +1321,7 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchTypedArrayStore(root);
   // Last of the builtin edits: its precompile picks up the date, promise and
   // replaceAll patches above too.
-  await patchTypedArrayFrom(root);
+  await precompileBuiltins(root);
   await patchUnicode(root);
   done.add(root);
 }

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-15";
-export const PORFFOR_COMMIT_FULL = "72d048d73d49e217631ac8a1bc4fa9070d22fbc9";
+export const PORFFOR_CHANNEL = "alpha-16";
+export const PORFFOR_COMMIT_FULL = "43087d42f0b90d14f04f3cddac034822560aefad";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "1e12be943b29691ad84bb25baecffa810655dcf7d9a490b8399352509da7a1d5";
+  "84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-15 (72d048d)`). */
+/** A compact identity string for a manifest / report (`alpha-16 (43087d4)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }