It's unfortunate that typeof x === 'function' is specced to only detect [[Call]], and not also [[Construct]]; this means that a constructor that can't be invoked does, as you indicate, have a throwing [[Call]]. It would have been much better to be able to have a function that has [[Construct]] and lacks [[Call]].

I'd be happy to change IsCallable to match the spec - ie, to be return typeof x === 'function' - if I found a way to make an IsConstructor check without relying on Proxy. Do you have any ideas?

Why not use your toString / class regex logic from is-callable to implement IsConstructor ?

It's not reliable due to many browsers not toStringing class constructors with class in them.

This looks like an interesting approach: https://stackoverflow.com/a/46759625
Relies on Reflect.construct but not Proxy

Is Reflect in any engine that lacks Proxy? If it’s not polyfillable it’s not much of an approach :-/

The current IsCallable spec only tests the presence of [[Call]] and not the value of [[IsClassConstructor]]: https://tc39.es/ecma262/#sec-iscallable.

Also, there’s a simpler IsConstructor implementation:

const isConstructorMarker = {};
const badArrayLike = {
	get length() {
		throw isConstructorMarker;
	}
};

const IsConstructor = value => {
	try {
		Reflect.construct(value, badArrayLike);
	} catch (err) {
		return err === isConstructorMarker;
	}
};

This is because Reflect.construct ( target, argumentsList [ , newTarget ] ) checks IsConstructor(target) before doing Get(argumentsList, "length"): tc39/ecma262#1798 (comment).

Although, it won’t work in environments that don’t support getters.