@sproutboat/toolchain 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @sproutboat/toolchain
 
+## 0.7.0
+
+### Minor Changes
+
+- 14546a0: Upgrade the verified vendored Porffor pin to Alpha 17, including correct Math.round ties and signed zero, native number parsing and formatting, full console number precision, and class-field capture fixes. Keep downstream compatibility patches until equivalent upstream changes ship.
+
+### Patch Changes
+
+- 14546a0: Register direct-only local function expressions in their lexical scope so type inference does not borrow an unrelated same-named function's return type. Fixes Better Auth's model-name resolver incorrectly treating an existing user schema as missing.
+
+  Correct Uint8Array base64 option string tags and complete-chunk truncation, unblocking base64url signatures and fixing padding and decoding.
+
+## 0.6.0
+
+### Minor Changes
+
+- Pin and vendor Porffor alpha-16 (43087d4). Enable Proxy and revocable Proxy in handler validation, add native regression coverage for traps and iterators, and drop three typed-array patches now implemented upstream. See PORFFOR_ALPHA16.md for the complete change audit and remaining package compatibility limits.
+
 ## 0.5.0
 
 ### Minor Changes

package/PORFFOR_ALPHA16.md

@@ -0,0 +1,67 @@
+# Porffor alpha-16 upgrade audit
+
+Source: [alpha-16](https://github.com/CanadaHonk/porffor/releases/tag/alpha-16), published October 10, 2026, commit `43087d42f0b90d14f04f3cddac034822560aefad`. The vendored codeload archive has SHA-256 `84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032`. The [complete alpha-15 comparison](https://github.com/CanadaHonk/porffor/compare/alpha-15...alpha-16) contains 32 commits. uWebSockets stays at `360c276d609d59af56ae6932adb95154ace9f15f`.
+
+## Supported changes
+
+The runtime accepts `new Proxy` and `Proxy.revocable`. Native output matches Bun for get/set/has/deleteProperty, ownKeys/getOwnPropertyDescriptor through Object.keys, apply, construct, revocation, and a frozen-property invariant. This is regression coverage for these operations, not certification of all Proxy invariants or exotic targets.
+
+Array and Map iterators and lazy matchAll now expose next/done, and Set spread works. Sproutboat's URLSearchParams and FormData shims now provide live, self-iterable keys/values/entries and default iteration. Appending after creating an iterator is observed on its next step, duplicate fields remain intact, and FormData filenames do not become iterator values.
+
+Three local patches are removed because the shared typed-array implementation handles array-like from(), an omitted set() offset and join()/toString(). Builtin precompilation remains necessary for the date, promise, replaceAll and Unicode patches. Existing typed-array bounds and class self-name patches still apply. New native regressions cover clamped ties-to-even, class static this, null-prototype __proto__, binary evaluation order and Unicode console output.
+
+## Package probes and opportunities
+
+Native standalone HTTP probes on macOS arm64, pinned dependencies:
+
+| Package | Operation | Result |
+| --- | --- | --- |
+| qs 6.16.0 | Nested parse and stringify, including array parameters | Passed |
+| @trpc/server 11.19.0 | initTRPC, router and createCaller().hello() | Passed; HTTP adapters, clients, middleware and subscriptions untested |
+| itty-router 5.0.24 Router | Parameter route, POST and fallback handler | Compiler error: labelled break crossing iterator cleanup (`target.brk`) |
+| itty-router 5.0.24 IttyRouter | Parameter route, POST and fallback handler | Passed GET parameters, Unicode POST and 404 fallback after adding live Web API iterators |
+
+Proxy-based object facades, method dispatch and server callers are now practical candidates. tRPC's basic caller path is verified, so a fetch-adapter and middleware matrix is a useful next step. Reactive stores and schema libraries must be tested on their own inputs before being listed as supported. Better Auth still needs a separate crypto and framework compatibility evaluation; Proxy alone does not establish auth support. Streams and WebSockets remain separate host API gaps.
+
+String iteration still splits astral characters into UTF-16 halves: Array.from("🚤x") produces two surrogate entries and x rather than one emoji and x. Unicode console output itself works. Standard itty-router Router also remains blocked by a separate compiler control-flow bug. No upstream issue was filed.
+
+## Complete change review
+
+| Commit | Upstream change | Sproutboat impact |
+| --- | --- | --- |
+| [c730268](https://github.com/CanadaHonk/porffor/commit/c730268d087766a87502de0045eb08b1f966d7d2) | codegen: evaluate binary lhs before rhs statements | Fixes operand side-effect order; native regression. |
+| [d24dc0a](https://github.com/CanadaHonk/porffor/commit/d24dc0ad569bfd73a2dd6e3627c0cc21619bffc2) | codegen: balance template literal concats | Balances concatenation trees; compiler improvement, no new API. |
+| [4598bec](https://github.com/CanadaHonk/porffor/commit/4598becfc46865d9ea18ad338a650c98f354af51) | precompile: store builtin table as arrays | Changes builtin table representation; patched builtins still precompile. |
+| [f9eb038](https://github.com/CanadaHonk/porffor/commit/f9eb038c3aa4856d861530beb2423236536beb77) | builtins: bucket auto func keys by prefix | Compiler lookup optimization; no new API. |
+| [fd8f58a](https://github.com/CanadaHonk/porffor/commit/fd8f58a8374f6adf308056b40cae8d59fc31dcb0) | builtins: check builtin existence without decoding | Compiler lookup optimization; no new API. |
+| [b7b8ba2](https://github.com/CanadaHonk/porffor/commit/b7b8ba2fdd4fd12340aba048c578ac2b5c3d3aef) | builtins: add constructor to all builtin prototypes | Builtin prototype constructor identity becomes available; do not infer subclass compatibility. |
+| [95522a4](https://github.com/CanadaHonk/porffor/commit/95522a421ddedb5b6801d4c1f7c6706fab3cebe0) | selfhost: label bench old/new with --compare | Upstream benchmark reporting only. |
+| [860485e](https://github.com/CanadaHonk/porffor/commit/860485e9821894864fb88389f7aba5750c9f09a6) | builtins/console: print strings as utf-8 | Native Unicode console strings; native regression. |
+| [2213f53](https://github.com/CanadaHonk/porffor/commit/2213f531bda917ee3ec865c1dd92b9709dfd0d27) | codegen: include String.prototype methods for bytestrings | String method dispatch on bytestrings; existing handler tests cover common methods. |
+| [3502f8a](https://github.com/CanadaHonk/porffor/commit/3502f8a213b7de2479ba8673a92fc4eb8013fe51) | codegen: generate reassigned hoisted function bodies later | Hoisted function reassignment codegen fix; no new host API. |
+| [77ee767](https://github.com/CanadaHonk/porffor/commit/77ee767b6c8c1ea59ff82e59d7b660c942b75047) | semantic: class static blocks and fields use the class as this | Static fields and blocks see the class as this; native regression. |
+| [2e28260](https://github.com/CanadaHonk/porffor/commit/2e28260bc77048324437e53406c6a7041dba12e0) | fetch: treat null response body as empty | Null Response body becomes empty; native HTTP regression. |
+| [641cd59](https://github.com/CanadaHonk/porffor/commit/641cd5911142d65d7f00d70f39360139349f707c) | builtins: call builtin Symbol directly for well-known symbols | Well-known symbol identity; enables iterator protocols. |
+| [e684407](https://github.com/CanadaHonk/porffor/commit/e68440705a35a2d5e1bee9c67586523f281e80f6) | builtins: add statics to builtin constructors used as values | Builtin constructors used as values retain static methods. |
+| [1e3428e](https://github.com/CanadaHonk/porffor/commit/1e3428e167505f969167f70d1ed0bd3c049256af) | codegen: only type computed string reads with number keys as strings | More accurate computed-string read types; no new API. |
+| [a52e55b](https://github.com/CanadaHonk/porffor/commit/a52e55b59db43170db7831905afb3450c8404d71) | builtins/console: print maps and sets from the hashtable | Console Map/Set formatting follows hashtable representation. |
+| [9579dbb](https://github.com/CanadaHonk/porffor/commit/9579dbb6379617ac8d35dc5177e035b4c6aa7127) | builtins/array: spread sets and maps directly | Map/Set spread; native Set regression. |
+| [fceed9a](https://github.com/CanadaHonk/porffor/commit/fceed9a7f84afc5619da34938f89475f05f7b63d) | builtins: return iterators from array, map, set and string iterator methods | Real collection iterators; native next/done and Map keys regressions. Astral string iteration remains incorrect. |
+| [532d8f8](https://github.com/CanadaHonk/porffor/commit/532d8f85f3961037d2673aaf06fbf008ec57ff07) | builtins/generator: add Symbol.iterator and Symbol.asyncIterator | Generator iterator protocol; infrastructure for iterable libraries. Async generator coverage remains unestablished. |
+| [872edc0](https://github.com/CanadaHonk/porffor/commit/872edc027a220f18baa82edff4166e5e38e9ded3) | builtins/regexp: make matchAll a lazy iterator | Lazy matchAll next/done; native regression. |
+| [64f5299](https://github.com/CanadaHonk/porffor/commit/64f529913c3ea39a162da9516b0371665107347e) | builtins: add Proxy | Proxy implementation; lift source ban and test object/call/construct/revocation behavior. |
+| [2056abb](https://github.com/CanadaHonk/porffor/commit/2056abb1b8c8fad65f50f0ad4b0ccf00f2799150) | repl: force new line | Upstream REPL formatting only. |
+| [905b193](https://github.com/CanadaHonk/porffor/commit/905b193b2d5626fe796dda1290b39f176f4ba191) | builtins/hashtable: allocate the container after its arrays | Allocation ordering fix; exercise Map/Set in native regression. |
+| [1f6959b](https://github.com/CanadaHonk/porffor/commit/1f6959b82c2479a4c003be03d6ac829ccf3f9c7d) | codegen: round half to even in Uint8ClampedArray stores | Uint8ClampedArray ties-to-even stores; native regression. |
+| [8e76e7b](https://github.com/CanadaHonk/porffor/commit/8e76e7b8f0ea64a30974cc116bbe9c9671e7c9f4) | builtins: define builtin $get funcs as accessors | Builtin getters become accessors; typed-array prototype rewrite replaces old generation anchors. |
+| [05199be](https://github.com/CanadaHonk/porffor/commit/05199be91c124f5936c2e40d5164227ddb9b0fb9) | builtins: get builtin constructors via their getters | Builtin constructors are obtained through getters; source patches reviewed. |
+| [79bb578](https://github.com/CanadaHonk/porffor/commit/79bb5789b4fe9d1892ca322be6327984f2d40ca5) | builtins/typedarray: share %TypedArray% and %TypedArray%.prototype | Shared typed-array methods/prototypes; drop from, set-offset and join patches, retain behavioral regressions. |
+| [0a22e14](https://github.com/CanadaHonk/porffor/commit/0a22e1494ddf793fb3bb0c4b0b3740531931f3ef) | codegen: sort builtin proto call cases by type | Codegen case ordering optimization; no new API. |
+| [d5e95d0](https://github.com/CanadaHonk/porffor/commit/d5e95d0a7f91c9cc64b7766980109b8d862b4470) | codegen: only set prototype for plain __proto__ props in object literals | Only plain __proto__ literal keys change prototypes; dictionary semantics improve. |
+| [1b51d58](https://github.com/CanadaHonk/porffor/commit/1b51d58b859741688b87551470d2260606ab9698) | builtins/object: treat __proto__ as a normal key on null prototype objects | Null-prototype __proto__ is an ordinary key; native regression. |
+| [7a6ca5d](https://github.com/CanadaHonk/porffor/commit/7a6ca5d32f56ff7d9b1fbaaf59fafede5a496771) | parser: drop __proto__ scope slot workaround | Removes parser workaround after __proto__ fixes; class self-name patch still needed. |
+| [43087d4](https://github.com/CanadaHonk/porffor/commit/43087d42f0b90d14f04f3cddac034822560aefad) | ci: update expected test262 harness passes | Upstream conformance expectation update; does not establish Sproutboat support. |
+
+## Validation
+
+The isolated release package suite passed 174 tests, and the CLI release suite passed 103. Both release kitchen-sink harnesses passed: 35 broker checks and 38 standalone checks. All 21 small examples passed on alpha-16. Native crypto, Unicode broker round trips and live Web API iterator checks passed. All 32 compatibility fixtures compile and 30 match Bun; the two existing non-ISO date parsing mismatches remain. The full native feature regression is in src/alpha16-native.test.ts; live Web API iterator coverage is in ../runtime/test/native-iterators.ts. The scorecard ties compatibility results to this exact source pin and patch inventory.

package/PORFFOR_ALPHA17.md

@@ -0,0 +1,59 @@
+# Porffor Alpha 17 evaluation
+
+Verified on 2026-10-11. Released 2026-10-10:
+https://github.com/CanadaHonk/porffor/releases/tag/alpha-17
+
+Pinned commit: `731f1b2a150d441ed22da3d14f8b1e0daaae8ee4`.
+Vendored archive SHA256:
+`8eb65a3e77d58a23bfd2a1a60328672ad50e1ced7931f8d0ca3108e29d6cf846`.
+
+## Changes since Alpha 16
+
+- Number conversion moves to C, covering Number, parseInt, parseFloat and
+  formatting methods, including nondecimal radix conversion.
+- Math.round implements JavaScript tie behavior and preserves negative zero.
+- Console prints full number precision and signed zero.
+- Class-field initializers ignore captures local to the initializer.
+- Test262 history is updated. No new Proxy or Web Streams implementation ships.
+
+The native regression compares dynamic numeric conversion, rounding, signed
+zero, formatting and class-field captures against Bun. Existing stream,
+base64 and lexical model-resolver regressions also run on the new pin.
+
+## Downstream fixes retained
+
+Web Streams still need the embedded ponyfill and compiler adaptations.
+Better Auth's local model resolver needs lexical function registration and
+correct return-type inference. Uint8Array base64 needs option string tag and
+complete-chunk corrections. Alpha 17 does not contain these fixes.
+
+Upstream main is one commit ahead at
+`0342e06d1c893c15eb9d22c5fc2bfe2c5965c81b`:
+https://github.com/CanadaHonk/porffor/commit/0342e06d1c893c15eb9d22c5fc2bfe2c5965c81b
+It fixes TextEncoder astral and lone-surrogate encoding and encodeInto's short
+buffer behavior. This overlaps our Unicode encoder patch and may let us remove
+that patch after the change ships. Its unpatched encoder already passes our
+native Unicode, lone-surrogate and short-buffer regression in an isolated copy. We keep the released pin and our verified patch for now.
+
+## Better Auth
+
+Version 1.7.1 passes native signup, signed-cookie sessions, wrong-password
+rejection, signin, signout and session revocation using an explicit memory
+adapter and its default password hashing. Optimized credential operations take
+about 6 to 8 seconds on the development machine. The memory adapter is a probe,
+not persistent storage. Production adapters and OAuth/plugins remain untested.
+Database-free sessions select JWE and require AES, which native crypto does not
+support. See the runtime's WEB_STREAMS.md for the stream transport limits.
+
+## Verification
+
+The development branches pass 183 package tests and 114 CLI tests; broker kitchen
+sink passes 37 checks, standalone kitchen sink passes 40 checks, and all 21
+small examples pass. The isolated package release passes 177 tests. Native
+crypto, Unicode, live iterators, streams, base64,
+model resolution and global timer checks pass. Native timer functions are also
+exposed on globalThis for libraries using host-task yields.
+
+The stream ponyfill IIFE still fails with a prototype TypeError on Alpha 17;
+its module-scope adaptation remains necessary. The saved standalone auth probe
+also passes with fresh noble hashes 2.4 and zod 4.6.5 dependencies.

package/PORFFOR_SCORECARD.md

@@ -1,24 +1,23 @@
 # Porffor pin scorecard
 
-Pin: alpha-15 (72d048d73d49e217631ac8a1bc4fa9070d22fbc9). Compatibility report: 2026-10-05T00:30:02.525Z.
+Pin: alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad). Compatibility report: 2026-10-10T08:51:03.637Z.
 
 | Measure | Result |
 | --- | ---: |
 | Fixtures compiled | 32/32 |
 | Behavior matches | 30/32 |
-| Median / p95 compile, ms | 420 / 822 |
-| Median / p95 binary, bytes | 1033344 / 1049904 |
-| Patch markers | 38 |
-| Upstream files written | 10 |
+| Median / p95 compile, ms | 13266 / 33619 |
+| Median / p95 binary, bytes | 1082960 / 1099536 |
+| Patch markers | 35 |
+| Upstream files written | 9 |
 | Fresh patch application | pass |
 
-Previous snapshot: alpha-13-547c781.json. Matches 30/32 to 30/32; patch markers 28 to 38.
+Previous snapshot: alpha-15-72d048d.json. Matches 30/32 to 30/32; patch markers 38 to 35.
 
 ## Patch inventory
 
 - `compiler/render.js`: PORT_MARKER, CONSOLE_MARKER, BYTESTRING_MARKER, READ_RAW_MARKER
 - `compiler/index.js`: LINK_MARKER, CFLAGS_MARKER, FP_CONTRACT_MARKER, HTTP10_IMPORT_MARKER, HTTP10_CALL_MARKER
-- `compiler/builtins/typedarray.js`: TYPED_ARRAY_FROM_MARKER, TA_SET_OFFSET_MARKER, TA_JOIN_MARKER
 - `compiler/builtins/date.ts`: DATE_PARSER_MARKER
 - `compiler/builtins/promise.ts`: PROMISE_NULL_MARKER
 - `compiler/builtins/string.ts`: REPLACE_ALL_MARKER
@@ -27,7 +26,7 @@ Previous snapshot: alpha-13-547c781.json. Matches 30/32 to 30/32; patch markers
 - `compiler/uwebsockets.js`: HTTP10_SHIM_MARKER, BODY_MARKER, STATUS_SIG_MARKER, STATUS_303_MARKER, STATUS_DEFAULT_MARKER, HDR_SIG_MARKER, HDR_CALL_MARKER, HDR_CAP_MARKER, HDR_SKIP_MARKER, HDR_APPEND_MARKER, READ_RAW_DECL_MARKER, FORBIDDEN_HDR_MARKER, WRITE_RESPONSE_MARKER, R2_TRANSFER_MARKER, R2_TRANSFER_CALL_MARKER, R2_DOWNLOAD_CACHE_MARKER, R2_RANGE_CACHE_MARKER, R2_CONDITIONAL_CACHE_MARKER, R2_STREAMING_CACHE_MARKER, R2_RANGE_HEADER_CACHE_MARKER
 - `compiler/builtins_precompiled.js`: regenerated builtin table
 
-Patch source SHA-256: `849997ab545a760019941886780b3fc70c89b67581cc9acf2b51ca6ff8a37d17`.
+Patch source SHA-256: `65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20`.
 
 ## Known behavior gaps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/scorecards/alpha-16-43087d4.json

@@ -0,0 +1,72 @@
+{
+  "pin": "alpha-16 (43087d42f0b90d14f04f3cddac034822560aefad)",
+  "reportGeneratedAt": "2026-10-10T08:51:03.637Z",
+  "fixtures": 32,
+  "compiled": 32,
+  "matched": 30,
+  "medianCompileMs": 13266,
+  "p95CompileMs": 33619,
+  "medianBinaryBytes": 1082960,
+  "p95BinaryBytes": 1099536,
+  "patchSourceSha256": "65a48b098fb6bd355785684774be43524d31491c89be1f6b0dee17f24b9cdd20",
+  "patchMarkerCount": 35,
+  "patchTargets": {
+    "compiler/render.js": [
+      "PORT_MARKER",
+      "CONSOLE_MARKER",
+      "BYTESTRING_MARKER",
+      "READ_RAW_MARKER"
+    ],
+    "compiler/index.js": [
+      "LINK_MARKER",
+      "CFLAGS_MARKER",
+      "FP_CONTRACT_MARKER",
+      "HTTP10_IMPORT_MARKER",
+      "HTTP10_CALL_MARKER"
+    ],
+    "compiler/builtins/date.ts": [
+      "DATE_PARSER_MARKER"
+    ],
+    "compiler/builtins/promise.ts": [
+      "PROMISE_NULL_MARKER"
+    ],
+    "compiler/builtins/string.ts": [
+      "REPLACE_ALL_MARKER"
+    ],
+    "compiler/codegen.js": [
+      "TA_GET_MARKER",
+      "TA_SET_BOUNDS_MARKER"
+    ],
+    "compiler/parse.js": [
+      "CLASS_SELF_MARKER"
+    ],
+    "compiler/uwebsockets.js": [
+      "HTTP10_SHIM_MARKER",
+      "BODY_MARKER",
+      "STATUS_SIG_MARKER",
+      "STATUS_303_MARKER",
+      "STATUS_DEFAULT_MARKER",
+      "HDR_SIG_MARKER",
+      "HDR_CALL_MARKER",
+      "HDR_CAP_MARKER",
+      "HDR_SKIP_MARKER",
+      "HDR_APPEND_MARKER",
+      "READ_RAW_DECL_MARKER",
+      "FORBIDDEN_HDR_MARKER",
+      "WRITE_RESPONSE_MARKER",
+      "R2_TRANSFER_MARKER",
+      "R2_TRANSFER_CALL_MARKER",
+      "R2_DOWNLOAD_CACHE_MARKER",
+      "R2_RANGE_CACHE_MARKER",
+      "R2_CONDITIONAL_CACHE_MARKER",
+      "R2_STREAMING_CACHE_MARKER",
+      "R2_RANGE_HEADER_CACHE_MARKER"
+    ],
+    "compiler/builtins_precompiled.js": []
+  },
+  "patchApplication": "pass",
+  "mismatches": [
+    "15-date-iso.js: request 3 mismatch: expected {\"status\":200,\"body\":\"2008-03-04T23:00:00.000Z\",\"content-type\":null}, got {\"status\":200,\"body\":\"0003-05-08T00:00:00.000Z\",\"content-type\":null}",
+    "16-date-parts.js: request 3 mismatch: expected {\"status\":200,\"body\":\"{\\\"year\\\":2008,\\\"month\\\":3,\\\"day\\\":4}\",\"content-type\":\"application/json;charset=utf-8\"}, got {\"status\":200,\"body\":\"{\\\"year\\\":3,\\\"month\\\":5,\\\"day\\\":8}\",\"content-type\":\"application/json;charset=utf-8\"}"
+  ]
+}

package/src/acquire.test.ts

@@ -128,7 +128,9 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "}\n",
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
+    "compiler/builtins/uint8array_base64.ts": "let alphabet: string = 'base64';\nlet lastChunkHandling: string = 'loose';\nconst fullChunks: i32 = (len / 3) * 3;\n",
     "compiler/codegen.js":
+      "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();\n}\nconst func = resolveNamedFunction(scope, name) ?? funcByName(name);\n" +
       "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
       "  const taGet = (ctype, size, signed = true) => () => {\n" +
       "    const loaded = Load(ctype, taAddr(size), 4);\n" +
@@ -225,11 +227,11 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
   // #242: generated typed-array join/toString keep a plain-array `parts`.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    ".replaceAll('const parts: ' + name + ' =', 'const parts: any[] =')",
+    "return Porffor.callThis(__Array_prototype_join, out, sep);",
   );
   // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
-    "offset = ecma262.ToIntegerOrInfinity(offset);",
+    "const targetOffsetNum: number = ecma262.ToIntegerOrInfinity(offset);",
   );
   // #238: out-of-range typed-array reads are undefined. (The store and `~`
   // conversions #238 also patched are upstream's own code since alpha-14.)
@@ -255,7 +257,7 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   expect(await readFile(join(dir, "compiler/builtins/promise.ts"), "utf8")).toContain(
     "if (Porffor.type(value) == Porffor.TYPES.object && value != null) {",
   );
-});
+}, 60_000);
 
 test("a corrupted warm cache is replaced from the verified archive", async () => {
   const { archive, sha256 } = await fixture();

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-72d048d.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-731f1b2.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/alpha16-native.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+// Compare native output with Bun, including trap effects and iterator state.
+const program = `
+const target = { x: 1 };
+let calls = 0;
+const proxy = new Proxy(target, {
+  get(t, key, receiver) { calls++; return key === "virtual" ? 7 : Reflect.get(t, key, receiver); },
+  set(t, key, value) { t[key] = value * 2; return true; },
+  has(t, key) { return key === "virtual" || key in t; },
+  deleteProperty(t, key) { delete t[key]; return true; }
+});
+proxy.x = 3;
+console.log(proxy.x, proxy.virtual, calls, "virtual" in proxy);
+delete proxy.x;
+console.log("x" in target);
+const keys = new Proxy({ a: 1 }, {
+  ownKeys() { return ["a"]; },
+  getOwnPropertyDescriptor(t, key) { return Object.getOwnPropertyDescriptor(t, key); }
+});
+console.log(Object.keys(keys).join(","));
+const fn = new Proxy(function (x) { return x + 1; }, {
+  apply(t, self, args) { return t(args[0]) * 2; }
+});
+console.log(fn(3));
+const ctor = new Proxy(function Item(x) { this.x = x; }, {
+  construct(t, args) { return { x: args[0] * 3 }; }
+});
+console.log(new ctor(4).x);
+const revocable = Proxy.revocable({ x: 1 }, {});
+console.log(revocable.proxy.x);
+revocable.revoke();
+try { console.log(revocable.proxy.x); } catch (e) { console.log(e instanceof TypeError); }
+const frozen = Object.freeze({ x: 1 });
+try { console.log(new Proxy(frozen, { get() { return 2; } }).x); } catch (e) { console.log(e instanceof TypeError); }
+const iterator = [1, 2].values();
+console.log(iterator.next().value, iterator.next().value, iterator.next().done);
+console.log(Array.from(new Map([["a", 1], ["b", 2]]).keys()).join(","));
+console.log([...new Set([1, 2, 1])].join(","));
+console.log(Array.from("ab").join(","));
+const matches = "a1a2".matchAll(/a(\\d)/g);
+console.log(matches.next().value[1], matches.next().value[1], matches.next().done);
+console.log(Uint8Array.from({ length: 3 }, (_, i) => i + 1).join("-"));
+const bytes = new Uint8Array(3); bytes.set([4, 5]); console.log(bytes.toString());
+console.log(new Uint8ClampedArray([0.5, 1.5, 2.5, 3.5]).join(","));
+class Static { static value = this; static { this.x = 9; } }
+console.log(Static.value === Static, Static.x);
+const dict = Object.create(null); dict.__proto__ = 5;
+console.log(dict.__proto__, Object.getPrototypeOf(dict) === null);
+let order = "";
+function left() { order += "l"; return 1; }
+function right() { order += "r"; return 2; }
+console.log(left() + right(), order);
+console.log("caffè 東京 🚤");
+`;
+
+test("alpha-16: native Proxy, iterators and upstream fixes match Bun", async () => {
+  const root = await mkdtemp(resolve(tmpdir(), "sb-alpha16-native-"));
+  try {
+    const porffor = await ensurePorffor();
+    const source = resolve(root, "features.js");
+    const binary = resolve(root, "features");
+    await writeFile(source, program);
+    const reference = Bun.spawnSync(["bun", source], { stdout: "pipe", stderr: "pipe" });
+    expect(reference.exitCode).toBe(0);
+    await rm(binary, { force: true });
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", source, "-o", binary, "-s"], {
+      cwd: root, stdout: "pipe", stderr: "pipe",
+    });
+    expect(compile.exitCode, Buffer.from(compile.stderr).toString()).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe", timeout: 10_000 });
+    expect(run.exitCode, Buffer.from(run.stderr).toString()).toBe(0);
+    const ansi = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+    const output = Buffer.from(run.stdout).toString().replace(ansi, "");
+    expect(output).toBe(Buffer.from(reference.stdout).toString());
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/alpha17-native.test.ts

@@ -0,0 +1,42 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+const values = [-2.5, -1.5, -0.5, -0.1, 0, 0.5, 1.5, 2.5];
+const strings = ["", " 42 ", "0xff", "0b101", "0o17", "1.2345678901234567", "1e-7", "-0", "12junk"];
+const expected = {
+  rounded: values.map((value) => [Math.round(value), Object.is(Math.round(value), -0)]),
+  parsed: strings.map((value) => [Number(value), Object.is(Number(value), -0)]),
+  formatted: [1.2345678901234567, 1e-7, 1e21, 255].map((value) => [value.toString(), value.toString(16), value.toFixed(3)]),
+  field: [1, 2],
+};
+const source = `const values=${JSON.stringify(values)}, strings=${JSON.stringify(strings)};
+class Field { value = (() => { const data = [1,2]; return () => data; })()(); }
+console.log(JSON.stringify({
+ rounded:values.map(value=>[Math.round(value),Object.is(Math.round(value),-0)]),
+ parsed:strings.map(value=>[Number(value),Object.is(Number(value),-0)]),
+ formatted:[1.2345678901234567,1e-7,1e21,255].map(value=>[value.toString(),value.toString(16),value.toFixed(3)]),
+ field:new Field().value
+}));
+console.log(1.2345678901234567);`;
+
+test("alpha-17: dynamic number conversion, rounding, precision and class fields match Bun", async () => {
+  const dir = await mkdtemp(resolve(tmpdir(), "sb-alpha17-"));
+  try {
+    const porffor = await ensurePorffor();
+    const input = resolve(dir, "numbers.js"), binary = resolve(dir, "numbers");
+    await writeFile(input, source);
+    await rm(binary, { force: true });
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", input, "-o", binary, "-s", "-O0"], { stdout: "pipe", stderr: "pipe" });
+    expect(compile.exitCode, new TextDecoder().decode(compile.stderr)).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe", timeout: 10_000 });
+    expect(run.exitCode, new TextDecoder().decode(run.stderr)).toBe(0);
+    const lines = new TextDecoder().decode(run.stdout).replaceAll("\x1b[33m", "").replaceAll("\x1b[0m", "").trim().split("\n");
+    expect(JSON.parse(lines[0])).toEqual(JSON.parse(JSON.stringify(expected)));
+    expect(lines[1]).toBe("1.2345678901234567");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/patch.test.ts

@@ -3,7 +3,7 @@ import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { EMPTY_BINDINGS, wrapNativeFetchHandler } from "../../runtime/src/wrap";
-import { patchRenderJs, patchUwebsockets } from "./patch";
+import { patchLocalFunctionTypes, patchUint8ArrayBase64, patchRenderJs, patchUwebsockets } from "./patch";
 
 // The parts of Porffor's compiler/render.js the patch anchors to.
 const RENDER = `void porf_native_fetch_runtime_init(void) {
@@ -299,3 +299,40 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
     await rm(root, { recursive: true, force: true });
   }
 });
+
+
+test("local function type patch registers lexical bindings and is idempotent", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-local-functions-"));
+  try {
+    await mkdir(join(root, "compiler"));
+    const file = join(root, "compiler/codegen.js");
+    await writeFile(file, "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();\n}\nconst func = resolveNamedFunction(scope, name) ?? funcByName(name);");
+    await patchLocalFunctionTypes(root);
+    const patched = await readFile(file, "utf8");
+    expect(patched).toContain("bindNamedFunction(scope, name, func);");
+    expect(patched).not.toContain("?? funcByName(name)");
+    await patchLocalFunctionTypes(root);
+    expect(await readFile(file, "utf8")).toBe(patched);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
+test("base64 patch preserves option tags and truncates full chunks, idempotently", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-base64-patch-"));
+  try {
+    await mkdir(join(root, "compiler/builtins"), { recursive: true });
+    const file = join(root, "compiler/builtins/uint8array_base64.ts");
+    await writeFile(file, "let alphabet: string = 'base64';\nlet lastChunkHandling: string = 'loose';\nconst fullChunks: i32 = (len / 3) * 3;");
+    await patchUint8ArrayBase64(root);
+    const patched = await readFile(file, "utf8");
+    expect(patched).toContain("let alphabet: any =");
+    expect(patched).toContain("let lastChunkHandling: any =");
+    expect(patched).toContain("((len / 3) | 0) * 3");
+    await patchUint8ArrayBase64(root);
+    expect(await readFile(file, "utf8")).toBe(patched);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/patch.ts

@@ -1,7 +1,7 @@
 /**
  * Idempotent, marker-guarded in-place edits to Porffor's generated C
  * (`compiler/render.js`, `compiler/index.js`, `compiler/uwebsockets.js`,
- * `compiler/builtins/typedarray.js`, `compiler/builtins/date.ts`). Run
+ * `compiler/builtins/date.ts`). Run
  * from the build path, not a `postinstall` hook: package managers block
  * dependency lifecycle scripts by default, so a published `postinstall` would
  * silently not run.
@@ -411,50 +411,6 @@ const TA_SET_BOUNDS_INJECT =
   "      }";
 const TA_SET_BOUNDS_MARKER = "sproutboat #241: a write outside the array is ignored";
 
-// baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
-// ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
-// then copied to `base + NaN * BYTES_PER_ELEMENT`: nothing landed where it
-// should (noble's HMAC lost its key in `pad.set(key)`), and the write went
-// somewhere else in memory. ECMA-262 uses ToIntegerOrInfinity, which maps
-// undefined and NaN to 0; subarray right below already does.
-const TA_SET_OFFSET_ANCHOR = "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_INJECT =
-  "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
-const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
-
-// baronunread/sproutboat#242: typedarray.js generates each TypedArray method
-// from array.ts with `.replaceAll('any[]', name)`. That also retyped join's and
-// toString's internal `const parts: any[]` helper as e.g. a Uint8Array, so the
-// joined strings were stored into a "typed array": Uint8Array join returned
-// garbage and Uint16Array join crashed. Put `parts` back to a plain array after
-// the replacement; map/filter's intentionally typed `out` is untouched.
-const TA_JOIN_ANCHOR = ".replaceAll('Array', name).replaceAll('any[]', name) + '\\n\\n'";
-const TA_JOIN_INJECT =
-  ".replaceAll('Array', name).replaceAll('any[]', name).replaceAll('const parts: ' + name + ' =', 'const parts: any[] =') /* sproutboat #242 */ + '\\n\\n'";
-const TA_JOIN_MARKER = "sproutboat #242";
-
-// Porffor's TypedArray.from only handles iterables. An array-like input such
-// as { length: 16 } silently becomes an empty typed array, including HMAC
-// keys made with Uint8Array.from({ length: 16 }, mapFn). The compiler uses a
-// precompiled builtin table, so the edited source must be precompiled again.
-const TYPED_ARRAY_FROM_ANCHOR =
-  "    len = i;\n  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_INJECT =
-  "    len = i;\n" +
-  "  } else {\n" +
-  "    // sproutboat: TypedArray.from accepts array-like objects.\n" +
-  "    let count = ecma262.ToIntegerOrInfinity(Porffor.object.get(arg, 'length'));\n" +
-  "    if (count < 0) count = 0;\n" +
-  "    if (count > 2147483643) throw new RangeError('Invalid TypedArray length (over maximum supported length)');\n" +
-  "    if (Porffor.type(mapFn) != Porffor.TYPES.undefined && Porffor.type(mapFn) != Porffor.TYPES.function)\n" +
-  "      throw new TypeError('Called TypedArray.from with a non-function mapFn');\n" +
-  "    for (let i: i32 = 0; i < count; i++) {\n" +
-  "      arr[i] = Porffor.type(mapFn) == Porffor.TYPES.undefined ? arg[i] : mapFn(arg[i], i);\n" +
-  "    }\n" +
-  "    len = count;\n" +
-  "  }\n\n  arr.length = len;\n\n  return new ${name}(arr);\n};";
-const TYPED_ARRAY_FROM_MARKER = "sproutboat: TypedArray.from accepts array-like objects";
-
 // Porffor alpha 9 treats +02:00 as two milliseconds and adds offset hours
 // instead of subtracting them. Count fields even when they contain zero, and
 // apply the signed offset after parsing the local wall-clock fields.
@@ -1249,7 +1205,7 @@ export async function patchDateParser(root: string): Promise<void> {
   await writeFile(file, src.slice(0, start) + parser.replace(DATE_PARSER_ANCHOR, DATE_PARSER_INJECT) + src.slice(end));
 }
 
-/** #168: keep a promise resolving to null out of the `then` probe. Precompiled by patchTypedArrayFrom. */
+/** #168: keep a promise resolving to null out of the `then` probe. */
 export async function patchPromiseResolveNull(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/promise.ts");
   const src = await readFile(file, "utf8");
@@ -1259,7 +1215,7 @@ export async function patchPromiseResolveNull(root: string): Promise<void> {
   await writeFile(file, src.replace(PROMISE_NULL_ANCHOR, PROMISE_NULL_INJECT));
 }
 
-/** #237: linear String.prototype.replaceAll. Precompiled by patchTypedArrayFrom. */
+/** #237: linear String.prototype.replaceAll. Precompiled by precompileBuiltins. */
 export async function patchReplaceAll(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/string.ts");
   let src = await readFile(file, "utf8");
@@ -1293,27 +1249,46 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
-export async function patchTypedArrayFrom(root: string): Promise<void> {
-  const file = resolve(root, "compiler/builtins/typedarray.js");
-  const src = await readFile(file, "utf8");
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER) && !src.includes(TYPED_ARRAY_FROM_ANCHOR)) {
-    throw new Error(`could not patch Porffor's TypedArray.from: anchor not found in ${file}`);
-  }
-  let edited = src;
-  if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
-  if (!edited.includes(TA_JOIN_MARKER)) {
-    if (!edited.includes(TA_JOIN_ANCHOR))
-      throw new Error(`could not patch Porffor's typed-array method generator: anchor not found in ${file}`);
-    edited = edited.replace(TA_JOIN_ANCHOR, TA_JOIN_INJECT);
-  }
-  if (!edited.includes(TA_SET_OFFSET_MARKER)) {
-    if (!edited.includes(TA_SET_OFFSET_ANCHOR))
-      throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);
-    edited = edited.replace(TA_SET_OFFSET_ANCHOR, TA_SET_OFFSET_INJECT);
+/** Register elided local function expressions so inference uses their lexical binding. */
+export async function patchLocalFunctionTypes(root: string): Promise<void> {
+  const file = resolve(root, "compiler/codegen.js");
+  let src = await readFile(file, "utf8");
+  const marker = "sproutboat: preserve lexical types for direct-only local functions";
+  if (src.includes(marker)) return;
+  const anchor = "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();";
+  if (!src.includes(anchor)) throw new Error(`could not patch Porffor local function types: anchor not found in ${file}`);
+  src = src.replace(anchor,
+    "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n" +
+    `        // ${marker}\n` +
+    "        bindNamedFunction(scope, name, func);\n        return valUndefined();");
+  // resolveNamedFunction already handles unambiguous global fallbacks. Falling
+  // back again can infer a type from an unrelated same-named function.
+  const fallback = "const func = resolveNamedFunction(scope, name) ?? funcByName(name);";
+  if (!src.includes(fallback)) throw new Error(`could not patch Porffor local function type fallback: anchor not found in ${file}`);
+  src = src.replace(fallback, "const func = resolveNamedFunction(scope, name);");
+  await writeFile(file, src);
+}
+
+/** Keep base64 option tags accurate and truncate the complete-chunk count. */
+export async function patchUint8ArrayBase64(root: string): Promise<void> {
+  const file = resolve(root, "compiler/builtins/uint8array_base64.ts");
+  let src = await readFile(file, "utf8");
+  const marker = "sproutboat: base64 option tags and complete chunks";
+  if (src.includes(marker)) return;
+  const edits = [
+    ["let alphabet: string =", "let alphabet: any ="],
+    ["let lastChunkHandling: string =", "let lastChunkHandling: any ="],
+    ["const fullChunks: i32 = (len / 3) * 3;", "const fullChunks: i32 = ((len / 3) | 0) * 3;"],
+  ] as const;
+  for (const [anchor, replacement] of edits) {
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor base64: anchor not found in ${file}`);
+    src = src.replaceAll(anchor, replacement);
   }
-  if (edited !== src) await writeFile(file, edited);
+  await writeFile(file, `// ${marker}\n${src}`);
+}
+
+export async function precompileBuiltins(root: string): Promise<void> {
   const table = resolve(root, "compiler/builtins_precompiled.js");
-  const before = await readFile(table);
   // Porffor only writes the table when import.meta.url matches argv[1].
   // macOS's /var -> /private/var symlink makes a noncanonical argv[1] skip it.
   const precompile = await realpath(resolve(root, "compiler/precompile.js"));
@@ -1327,9 +1302,8 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
   ]);
-  if (code !== 0) throw new Error(`could not precompile Porffor's TypedArray.from: ${stderr || stdout}`);
-  if (edited !== src && before.equals(await readFile(table)))
-    throw new Error(`Porffor precompile did not update ${table}`);
+  if (code !== 0) throw new Error(`could not precompile Porffor's patched builtins: ${stderr || stdout}`);
+  if ((await readFile(table)).length === 0) throw new Error(`Porffor precompile produced an empty ${table}`);
 }
 
 /** The native-fetch server source: $PORT support + the #165 console sink. Exported for tests. */
@@ -1383,9 +1357,11 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchPromiseResolveNull(root);
   await patchReplaceAll(root);
   await patchTypedArrayStore(root);
+  await patchLocalFunctionTypes(root);
+  await patchUint8ArrayBase64(root);
   // Last of the builtin edits: its precompile picks up the date, promise and
   // replaceAll patches above too.
-  await patchTypedArrayFrom(root);
+  await precompileBuiltins(root);
   await patchUnicode(root);
   done.add(root);
 }

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-15";
-export const PORFFOR_COMMIT_FULL = "72d048d73d49e217631ac8a1bc4fa9070d22fbc9";
+export const PORFFOR_CHANNEL = "alpha-17";
+export const PORFFOR_COMMIT_FULL = "731f1b2a150d441ed22da3d14f8b1e0daaae8ee4";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "1e12be943b29691ad84bb25baecffa810655dcf7d9a490b8399352509da7a1d5";
+  "8eb65a3e77d58a23bfd2a1a60328672ad50e1ced7931f8d0ca3108e29d6cf846";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-15 (72d048d)`). */
+/** A compact identity string for a manifest / report (`alpha-17 (731f1b2)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }