@sproutboat/toolchain 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sproutboat/toolchain
 
+## 0.7.0
+
+### Minor Changes
+
+- 14546a0: Upgrade the verified vendored Porffor pin to Alpha 17, including correct Math.round ties and signed zero, native number parsing and formatting, full console number precision, and class-field capture fixes. Keep downstream compatibility patches until equivalent upstream changes ship.
+
+### Patch Changes
+
+- 14546a0: Register direct-only local function expressions in their lexical scope so type inference does not borrow an unrelated same-named function's return type. Fixes Better Auth's model-name resolver incorrectly treating an existing user schema as missing.
+
+  Correct Uint8Array base64 option string tags and complete-chunk truncation, unblocking base64url signatures and fixing padding and decoding.
+
 ## 0.6.0
 
 ### Minor Changes

package/PORFFOR_ALPHA17.md

@@ -0,0 +1,59 @@
+# Porffor Alpha 17 evaluation
+
+Verified on 2026-10-11. Released 2026-10-10:
+https://github.com/CanadaHonk/porffor/releases/tag/alpha-17
+
+Pinned commit: `731f1b2a150d441ed22da3d14f8b1e0daaae8ee4`.
+Vendored archive SHA256:
+`8eb65a3e77d58a23bfd2a1a60328672ad50e1ced7931f8d0ca3108e29d6cf846`.
+
+## Changes since Alpha 16
+
+- Number conversion moves to C, covering Number, parseInt, parseFloat and
+  formatting methods, including nondecimal radix conversion.
+- Math.round implements JavaScript tie behavior and preserves negative zero.
+- Console prints full number precision and signed zero.
+- Class-field initializers ignore captures local to the initializer.
+- Test262 history is updated. No new Proxy or Web Streams implementation ships.
+
+The native regression compares dynamic numeric conversion, rounding, signed
+zero, formatting and class-field captures against Bun. Existing stream,
+base64 and lexical model-resolver regressions also run on the new pin.
+
+## Downstream fixes retained
+
+Web Streams still need the embedded ponyfill and compiler adaptations.
+Better Auth's local model resolver needs lexical function registration and
+correct return-type inference. Uint8Array base64 needs option string tag and
+complete-chunk corrections. Alpha 17 does not contain these fixes.
+
+Upstream main is one commit ahead at
+`0342e06d1c893c15eb9d22c5fc2bfe2c5965c81b`:
+https://github.com/CanadaHonk/porffor/commit/0342e06d1c893c15eb9d22c5fc2bfe2c5965c81b
+It fixes TextEncoder astral and lone-surrogate encoding and encodeInto's short
+buffer behavior. This overlaps our Unicode encoder patch and may let us remove
+that patch after the change ships. Its unpatched encoder already passes our
+native Unicode, lone-surrogate and short-buffer regression in an isolated copy. We keep the released pin and our verified patch for now.
+
+## Better Auth
+
+Version 1.7.1 passes native signup, signed-cookie sessions, wrong-password
+rejection, signin, signout and session revocation using an explicit memory
+adapter and its default password hashing. Optimized credential operations take
+about 6 to 8 seconds on the development machine. The memory adapter is a probe,
+not persistent storage. Production adapters and OAuth/plugins remain untested.
+Database-free sessions select JWE and require AES, which native crypto does not
+support. See the runtime's WEB_STREAMS.md for the stream transport limits.
+
+## Verification
+
+The development branches pass 183 package tests and 114 CLI tests; broker kitchen
+sink passes 37 checks, standalone kitchen sink passes 40 checks, and all 21
+small examples pass. The isolated package release passes 177 tests. Native
+crypto, Unicode, live iterators, streams, base64,
+model resolution and global timer checks pass. Native timer functions are also
+exposed on globalThis for libraries using host-task yields.
+
+The stream ponyfill IIFE still fails with a prototype TypeError on Alpha 17;
+its module-scope adaptation remains necessary. The saved standalone auth probe
+also passes with fresh noble hashes 2.4 and zod 4.6.5 dependencies.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/acquire.test.ts

@@ -128,7 +128,9 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "}\n",
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
+    "compiler/builtins/uint8array_base64.ts": "let alphabet: string = 'base64';\nlet lastChunkHandling: string = 'loose';\nconst fullChunks: i32 = (len / 3) * 3;\n",
     "compiler/codegen.js":
+      "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();\n}\nconst func = resolveNamedFunction(scope, name) ?? funcByName(name);\n" +
       "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : toUint32(scope, f)));\n" +
       "  const taGet = (ctype, size, signed = true) => () => {\n" +
       "    const loaded = Load(ctype, taAddr(size), 4);\n" +

package/src/acquire.ts

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 // @ts-expect-error Bun's file loader supplies a path; see the pinned-commit
 // check below for why this is safe to trust unconditionally.
-import vendoredPorfforArchive from "../vendor/porffor-43087d4.tar.gz" with { type: "file" };
+import vendoredPorfforArchive from "../vendor/porffor-731f1b2.tar.gz" with { type: "file" };
 import { ensurePorfforPatched } from "./patch";
 import { PORFFOR_ARCHIVE_SHA256, PORFFOR_ARCHIVE_URL, PORFFOR_COMMIT_FULL } from "./pin";
 // Folded into the cache manifest below so a toolchain release that changes

package/src/alpha17-native.test.ts

@@ -0,0 +1,42 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { ensurePorffor } from "./acquire";
+
+const values = [-2.5, -1.5, -0.5, -0.1, 0, 0.5, 1.5, 2.5];
+const strings = ["", " 42 ", "0xff", "0b101", "0o17", "1.2345678901234567", "1e-7", "-0", "12junk"];
+const expected = {
+  rounded: values.map((value) => [Math.round(value), Object.is(Math.round(value), -0)]),
+  parsed: strings.map((value) => [Number(value), Object.is(Number(value), -0)]),
+  formatted: [1.2345678901234567, 1e-7, 1e21, 255].map((value) => [value.toString(), value.toString(16), value.toFixed(3)]),
+  field: [1, 2],
+};
+const source = `const values=${JSON.stringify(values)}, strings=${JSON.stringify(strings)};
+class Field { value = (() => { const data = [1,2]; return () => data; })()(); }
+console.log(JSON.stringify({
+ rounded:values.map(value=>[Math.round(value),Object.is(Math.round(value),-0)]),
+ parsed:strings.map(value=>[Number(value),Object.is(Number(value),-0)]),
+ formatted:[1.2345678901234567,1e-7,1e21,255].map(value=>[value.toString(),value.toString(16),value.toFixed(3)]),
+ field:new Field().value
+}));
+console.log(1.2345678901234567);`;
+
+test("alpha-17: dynamic number conversion, rounding, precision and class fields match Bun", async () => {
+  const dir = await mkdtemp(resolve(tmpdir(), "sb-alpha17-"));
+  try {
+    const porffor = await ensurePorffor();
+    const input = resolve(dir, "numbers.js"), binary = resolve(dir, "numbers");
+    await writeFile(input, source);
+    await rm(binary, { force: true });
+    const compile = Bun.spawnSync(["bun", resolve(porffor, "runtime/index.js"), "native", input, "-o", binary, "-s", "-O0"], { stdout: "pipe", stderr: "pipe" });
+    expect(compile.exitCode, new TextDecoder().decode(compile.stderr)).toBe(0);
+    const run = Bun.spawnSync([binary], { stdout: "pipe", stderr: "pipe", timeout: 10_000 });
+    expect(run.exitCode, new TextDecoder().decode(run.stderr)).toBe(0);
+    const lines = new TextDecoder().decode(run.stdout).replaceAll("\x1b[33m", "").replaceAll("\x1b[0m", "").trim().split("\n");
+    expect(JSON.parse(lines[0])).toEqual(JSON.parse(JSON.stringify(expected)));
+    expect(lines[1]).toBe("1.2345678901234567");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}, 60_000);

package/src/patch.test.ts

@@ -3,7 +3,7 @@ import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { EMPTY_BINDINGS, wrapNativeFetchHandler } from "../../runtime/src/wrap";
-import { patchRenderJs, patchUwebsockets } from "./patch";
+import { patchLocalFunctionTypes, patchUint8ArrayBase64, patchRenderJs, patchUwebsockets } from "./patch";
 
 // The parts of Porffor's compiler/render.js the patch anchors to.
 const RENDER = `void porf_native_fetch_runtime_init(void) {
@@ -299,3 +299,40 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
     await rm(root, { recursive: true, force: true });
   }
 });
+
+
+test("local function type patch registers lexical bindings and is idempotent", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-local-functions-"));
+  try {
+    await mkdir(join(root, "compiler"));
+    const file = join(root, "compiler/codegen.js");
+    await writeFile(file, "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();\n}\nconst func = resolveNamedFunction(scope, name) ?? funcByName(name);");
+    await patchLocalFunctionTypes(root);
+    const patched = await readFile(file, "utf8");
+    expect(patched).toContain("bindNamedFunction(scope, name, func);");
+    expect(patched).not.toContain("?? funcByName(name)");
+    await patchLocalFunctionTypes(root);
+    expect(await readFile(file, "utf8")).toBe(patched);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+
+test("base64 patch preserves option tags and truncates full chunks, idempotently", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-base64-patch-"));
+  try {
+    await mkdir(join(root, "compiler/builtins"), { recursive: true });
+    const file = join(root, "compiler/builtins/uint8array_base64.ts");
+    await writeFile(file, "let alphabet: string = 'base64';\nlet lastChunkHandling: string = 'loose';\nconst fullChunks: i32 = (len / 3) * 3;");
+    await patchUint8ArrayBase64(root);
+    const patched = await readFile(file, "utf8");
+    expect(patched).toContain("let alphabet: any =");
+    expect(patched).toContain("let lastChunkHandling: any =");
+    expect(patched).toContain("((len / 3) | 0) * 3");
+    await patchUint8ArrayBase64(root);
+    expect(await readFile(file, "utf8")).toBe(patched);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/patch.ts

@@ -1249,6 +1249,44 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
   if (changed) await writeFile(file, src);
 }
 
+/** Register elided local function expressions so inference uses their lexical binding. */
+export async function patchLocalFunctionTypes(root: string): Promise<void> {
+  const file = resolve(root, "compiler/codegen.js");
+  let src = await readFile(file, "utf8");
+  const marker = "sproutboat: preserve lexical types for direct-only local functions";
+  if (src.includes(marker)) return;
+  const anchor = "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n        return valUndefined();";
+  if (!src.includes(anchor)) throw new Error(`could not patch Porffor local function types: anchor not found in ${file}`);
+  src = src.replace(anchor,
+    "if (!hoistRead && directCallOnlyFunctionBinding(scope, kind, name, pattern, func)) {\n" +
+    `        // ${marker}\n` +
+    "        bindNamedFunction(scope, name, func);\n        return valUndefined();");
+  // resolveNamedFunction already handles unambiguous global fallbacks. Falling
+  // back again can infer a type from an unrelated same-named function.
+  const fallback = "const func = resolveNamedFunction(scope, name) ?? funcByName(name);";
+  if (!src.includes(fallback)) throw new Error(`could not patch Porffor local function type fallback: anchor not found in ${file}`);
+  src = src.replace(fallback, "const func = resolveNamedFunction(scope, name);");
+  await writeFile(file, src);
+}
+
+/** Keep base64 option tags accurate and truncate the complete-chunk count. */
+export async function patchUint8ArrayBase64(root: string): Promise<void> {
+  const file = resolve(root, "compiler/builtins/uint8array_base64.ts");
+  let src = await readFile(file, "utf8");
+  const marker = "sproutboat: base64 option tags and complete chunks";
+  if (src.includes(marker)) return;
+  const edits = [
+    ["let alphabet: string =", "let alphabet: any ="],
+    ["let lastChunkHandling: string =", "let lastChunkHandling: any ="],
+    ["const fullChunks: i32 = (len / 3) * 3;", "const fullChunks: i32 = ((len / 3) | 0) * 3;"],
+  ] as const;
+  for (const [anchor, replacement] of edits) {
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor base64: anchor not found in ${file}`);
+    src = src.replaceAll(anchor, replacement);
+  }
+  await writeFile(file, `// ${marker}\n${src}`);
+}
+
 export async function precompileBuiltins(root: string): Promise<void> {
   const table = resolve(root, "compiler/builtins_precompiled.js");
   // Porffor only writes the table when import.meta.url matches argv[1].
@@ -1319,6 +1357,8 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchPromiseResolveNull(root);
   await patchReplaceAll(root);
   await patchTypedArrayStore(root);
+  await patchLocalFunctionTypes(root);
+  await patchUint8ArrayBase64(root);
   // Last of the builtin edits: its precompile picks up the date, promise and
   // replaceAll patches above too.
   await precompileBuiltins(root);

package/src/pin.ts

@@ -11,14 +11,14 @@
  * uWebSockets archive in `sproutboat-cli/vendor/` — then run both repos'
  * test + conformance suites. See sproutboat-cli/MIGRATION.md.
  */
-export const PORFFOR_CHANNEL = "alpha-16";
-export const PORFFOR_COMMIT_FULL = "43087d42f0b90d14f04f3cddac034822560aefad";
+export const PORFFOR_CHANNEL = "alpha-17";
+export const PORFFOR_COMMIT_FULL = "731f1b2a150d441ed22da3d14f8b1e0daaae8ee4";
 export const PORFFOR_COMMIT = PORFFOR_COMMIT_FULL.slice(0, 7);
 export const PORFFOR_ARCHIVE_SHA256 =
-  "84398fd214183801d252a78e69a44fac1baeba7cafc7dbbcfd5c6ec3b0372032";
+  "8eb65a3e77d58a23bfd2a1a60328672ad50e1ced7931f8d0ca3108e29d6cf846";
 export const PORFFOR_ARCHIVE_URL = `https://codeload.github.com/CanadaHonk/porffor/tar.gz/${PORFFOR_COMMIT_FULL}`;
 
-/** A compact identity string for a manifest / report (`alpha-16 (43087d4)`). */
+/** A compact identity string for a manifest / report (`alpha-17 (731f1b2)`). */
 export function porfforVersion(): string {
   return process.env.PORFFOR_VERSION || `${PORFFOR_CHANNEL} (${PORFFOR_COMMIT})`;
 }