@amritk/nish-x86_64-linux 0.26.0 → 0.28.0

package/INSTALL.md

@@ -254,7 +254,8 @@ routes are
   # on the musl host, with its own clang and the runtime from this repository
   clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
     runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-    runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-term.c runtime/runtime-bytes.c -lm -o app
+    runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-term.c \
+    runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c -lm -o app
   ```
 
   `--link`ing inside the container is the mistake to avoid: it shells out to the
@@ -390,7 +391,7 @@ it into `build/seed/`; `NISH_BOOTSTRAP=<path>` names one you already have and
 skips the download. §2a has what the build does with it.
 
 The published package ships `bin/` (the `nish` command, which is a launcher),
-`runtime/` (the C runtime — ten translation units, the wasm subset and their
+`runtime/` (the C runtime — thirteen translation units, the wasm subset and their
 header — and `runtime/sqlite/`, SQLite's vendored source),
 `scripts/build.sh` (the link pipeline), `std/` (the standard library) and
 `docs/AI.md` (the rules card). The
@@ -403,12 +404,13 @@ working directory — and the binary runs from inside its own platform package
 for exactly that reason.
 
 Building the IR yourself rather than through `--link` means naming the runtime
-on the `clang` line, and it is ten files:
+on the `clang` line, and it is thirteen files:
 
 ```bash
 clang app.ll runtime/runtime.c runtime/runtime-os.c runtime/runtime-parallel.c \
   runtime/runtime-cross.c runtime/runtime-host.c runtime/runtime-net.c \
-  runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-term.c runtime/runtime-bytes.c -lm -o app
+  runtime/runtime-simd.c runtime/runtime-aes.c runtime/runtime-sha256.c runtime/runtime-term.c \
+  runtime/runtime-bytes.c runtime/runtime-checksum.c runtime/runtime-sandbox.c -lm -o app
 ```
 
 `runtime.c` is the part every program touches — the arena, strings, arrays,
@@ -421,14 +423,17 @@ the strings and arrays a task answers, a channel sends or a `Mutex` keeps out
 of the arena they were made in, `runtime-host.c` holds the wall clock,
 entropy, file times and signals, `runtime-net.c` the sockets of `nish:net`,
 `runtime-simd.c` and `runtime-aes.c` the vector text search and AES-GCM,
-`runtime-term.c` the stdin reads and terminal calls of `nish:term`, and
+`runtime-sha256.c` the SHA-256 block kernel `nish/crypto/sha256` hands its
+blocks to on a CPU with the SHA instructions (`NISH_SHA256=soft` keeps the
+portable path), `runtime-term.c` the stdin reads and terminal calls of `nish:term`,
 `runtime-bytes.c` the byte-class runs of `nish/bytes`, which `nish/json` steps
-over.
+over, `runtime-checksum.c` the CRC-32 kernels of `nish/compress/checksum`,
+and `runtime-sandbox.c` the confinement a `--sandbox` build applies.
 They are separate so that each carries its own measured size ceiling
 ([docs/wp7-runtime.md](wp7-runtime.md)); nothing in the core calls into the
 others, so a line that names only `runtime.c` and `runtime-os.c` still links a
-program that uses none of the other eight. `scripts/build.sh` compiles the other
-eight beside any
+program that uses none of the other nine. `scripts/build.sh` compiles the other
+nine beside any
 `runtime.c` it is handed, so a build that goes through it — every `--link`,
 and every `--profile` recipe in these documents — needs to name only the one.
 

package/docs/AI.md

@@ -2181,8 +2181,9 @@ also watches the signal fd. None of `spawn`, `kill`, `waitPid` may be called in
 a task or a parallel body; the two host facts may. `availableParallelism()` (`i32`, at least 1, no `--threads` needed) and
 `totalMemory()` (`i64` bytes, or `-1`) size a program to the machine. None of
 the five exists on a wasm target, and `spawn` and `waitPid` throw under Node.
-`setNice(n)` sets the nice value (clamped to -20..19; lowering it unprivileged
-is `-13`) and `setIdlePriority()` moves the program to Linux's `SCHED_IDLE`
+`setNice(n)` sets the nice value, and it is lower-only even as root: `n` takes
+0..19 (`-22` outside it) and a value below the current one is `-13`, with no
+system call either way. `setIdlePriority()` moves the program to Linux's `SCHED_IDLE`
 (`-95` on Darwin); each answers 0 or a negative errno. Call them at the top of
 `main`, never in a task. An unprivileged process can never leave `SCHED_IDLE`
 and an idle one can starve on a saturated machine, so keep a normal-priority
@@ -2201,6 +2202,10 @@ wait for it to be writable, then `connectResult(fd)` is 0 or the failure. Buffer
 are `u8[]` only; an address is 18 bytes of one (IPv4 as `::ffff:a.b.c.d`, then
 the port big-endian); hosts are numeric literals; to reach a name, resolve it first with
 `nish/net/dns` (`DnsClient` on your loop, or the blocking `resolveHost`).
+To fetch a URL from a CLI, skip all of this: `nish/net/http-client`'s
+`httpFetch(new HttpRequest("GET", url), new HttpOptions())` blocks until the
+response's head is in and answers it with `body.readAll(limit)`, or null on a
+failure (an `HttpClient` keeps the connection and says why in `error`).
 `netRead` / `netWrite` panic on a range outside the buffer.
 `tcpListenFlags(host, port, backlog, flags)` is `tcpListen` with flag 1
 `SO_REUSEPORT`, so several listeners, in one process or many, share a port (Linux
@@ -2614,7 +2619,8 @@ negative `DEFLATE_ERR_*` / `GZIP_ERR_*` code for any malformed stream, so test
 it before reading `out`. `GzipWriter` and `GzipReader` stream. On HTTP/1.1,
 `conn.respondEncoded(status, names, values, body, off, len, enc,
 conn.acceptEncoding())` with an `HttpCompressor` from `nish/net/http-compress`
-negotiates, compresses and sets the fields. Do not compress a secret beside
+negotiates, compresses when it pays (`minLength`, `minSavingPercent`,
+`segmentMode`; `enc.decision` says why not) and sets the fields. Do not compress a secret beside
 text the client chose (BREACH). (No block, as for `nish/text`;
 `tests/link/std_compress` is its program, and the user guide's
 [compression page](guide/using-nish/compression.md) its walk-through.)
@@ -2654,13 +2660,13 @@ a `PgBatcher` built from a `PgBatchConfig` (`name`, `select` reading the key as
 queue is full, or for a text key too long for `maxBytes`, with no room left in
 `queueBytes`, with a NUL or not UTF-8 — and `take(conn)`
 binds the waiting ones, each key once, as one execution of its `sql` over
-`unnest($1) with ordinality`, answering a run handle or -1. Hand that
+`unnest($1) with ordinality`, answering a run handle or -1. Set `binary` in the `PgBatchConfig` and each batch comes in binary: `take` opens its bind with `bindStartBinary`, and `row` reads the routing ordinal with `binaryInt` (`binary.failed` is saved and restored, so the caller's own decoding is untouched). Hand that
 execution's `PG_ROW` to `row(run, conn)`, `PG_COMPLETE` to `end(run)`, an error
 or `PG_LOST` to `fail(run)` (on a spent handle these do nothing and count in
 `stray`), and after each call `next(run)` until
 `PG_BATCH_NONE`: `PG_BATCH_ROW` (the connection's row answers request `tag`),
 then one of `PG_BATCH_DONE`, `PG_BATCH_MISSING` or `PG_BATCH_FAILED` per
-request. It reads no clock: when to take is the loop's choice. (No block;
+request. It reads no clock: when to take is the loop's choice, or a `PgBatchClock`'s (`PgBatchClockConfig`: `minCount`, `factor` × the moving average of batch sizes, `maxWaitUs`, the idle bypass `lightCount`; defaults are a fixed window), which `takeDue(conn, clock, nowUs, pool.inFlight())` consults after `clock.arrived(nowUs)` per add; `PgBatchTurns` wakes one collecting connection only when its batch is due. (No block;
 `tests/postgres/live`'s `batch` scenario runs it against a server, and the user
 guide's [PostgreSQL page](guide/using-nish/postgres.md#batching-keyed-reads)
 its walk-through.)
@@ -2817,6 +2823,22 @@ const settings = (): string => readFileSync("settings.txt");
 export const main = (): i32 => settings().length;
 ```
 
+The policy judges the source; `--sandbox` (Linux, `--link` and `nish run`)
+makes the kernel hold the running binary to the same set. Before any C
+constructor runs, it withholds every file, process and socket operation `main`
+does not reach, C code it links included. A file operation it refuses fails
+like a missing permission; a refused process or socket call ends the program
+with `SIGSYS` (status 159); a kernel that cannot apply it exits 126 before
+`main` unless built with `--sandbox=best-effort`. A darwin target, a library
+with no `main` and `--emit-napi` refuse the flag
+([LANGUAGE.md](LANGUAGE.md#the-sandbox)). Only under `--sandbox` may an
+`--allow` list scope `fs.read` or `fs.write` to a directory
+(`--allow fs.read=/srv/data`): the directory must exist at build time, and
+the kernel grants the capability beneath it alone — except that a `main`
+reaching `process.spawn` can still read every file beneath `/`, so that
+`exec` can load a program. Any other scope, a scope
+in `--deny` and a scope without `--sandbox` are usage errors, exit 2.
+
 ## Before you say it compiles
 
 Run it. `nish file.ts --json` is one command and it is the only proof.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amritk/nish-x86_64-linux",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "The nish native compiler for Linux on x86_64",
   "license": "MIT",
   "os": [

package/runtime/core.d.ts

@@ -7,3 +7,50 @@ export * from "./core/host.js";
 export * from "./core/numbers.js";
 export * from "./core/result.js";
 export * from "./core/strings.js";
+
+// `nish:simd`: what `--emit-ts` writes for a program's `import ... from "nish:simd"`.
+import type { f32, f64, i32, u16, u32, u8 } from "./core/numbers.js";
+
+/**
+ * A sixteen-byte vector of lanes. Opaque: TypeScript refuses `+` on one, as
+ * `nish` does, but lets `===` and `<` through, which `nish` refuses. Under
+ * Node it is a typed array made once and never written after.
+ */
+export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8 }
+export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16 }
+export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32 }
+export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32 }
+export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32 }
+export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64 }
+/** Any of the six. */
+export type SimdVector = u8x16 | u16x8 | i32x4 | u32x4 | f32x4 | f64x2;
+/** One value per lane, lane 0 first. */
+export declare function u8x16(
+  a0: u8, a1: u8, a2: u8, a3: u8, a4: u8, a5: u8, a6: u8, a7: u8,
+  a8: u8, a9: u8, a10: u8, a11: u8, a12: u8, a13: u8, a14: u8, a15: u8
+): u8x16;
+export declare function u16x8(a0: u16, a1: u16, a2: u16, a3: u16, a4: u16, a5: u16, a6: u16, a7: u16): u16x8;
+export declare function i32x4(a0: i32, a1: i32, a2: i32, a3: i32): i32x4;
+export declare function u32x4(a0: u32, a1: u32, a2: u32, a3: u32): u32x4;
+export declare function f32x4(a0: f32, a1: f32, a2: f32, a3: f32): f32x4;
+export declare function f64x2(a0: f64, a1: f64): f64x2;
+/** `x` in every lane. */
+export declare function splatU8x16(x: u8): u8x16;
+export declare function splatU16x8(x: u16): u16x8;
+export declare function splatI32x4(x: i32): i32x4;
+export declare function splatU32x4(x: u32): u32x4;
+export declare function splatF32x4(x: f32): f32x4;
+export declare function splatF64x2(x: f64): f64x2;
+/** `xs[i]` to `xs[i + N - 1]`, bounds-checked once for the whole vector. */
+export declare function loadU8x16(xs: readonly u8[], i: i32): u8x16;
+export declare function loadU16x8(xs: readonly u16[], i: i32): u16x8;
+export declare function loadI32x4(xs: readonly i32[], i: i32): i32x4;
+export declare function loadU32x4(xs: readonly u32[], i: i32): u32x4;
+export declare function loadF32x4(xs: readonly f32[], i: i32): f32x4;
+export declare function loadF64x2(xs: readonly f64[], i: i32): f64x2;
+/** The lanes of `v` into `xs[i]` to `xs[i + N - 1]`, checked once. */
+export declare function store<V extends SimdVector>(v: V, xs: V["__lane"][], i: i32): void;
+/** Lane `k`, an integer literal in range. */
+export declare function extract<V extends SimdVector>(v: V, k: i32): V["__lane"];
+/** A new vector: `v` with lane `k` set to `x`. */
+export declare function replace<V extends SimdVector>(v: V, k: i32, x: V["__lane"]): V;

package/runtime/core.mjs

@@ -48,8 +48,75 @@
  *
  * The rewrite rules that call these helpers are listed in docs/wp13-differential.md.
  */
+import { panicIndex, toIndex } from "./core/checks.mjs";
+
 export * from "./core/arrays.mjs";
 export * from "./core/host.mjs";
 export * from "./core/numbers.mjs";
 export * from "./core/result.mjs";
 export * from "./core/strings.mjs";
+
+// ---- `nish:simd` ------------------------------------------------------------
+// A vector is a fresh typed array of its lanes, made once and never written
+// after: `replace` copies, so a vector held in two places stays one value, as
+// the native `<N x T>` register is. The array type does the lane arithmetic a
+// native lane does: a `u8` lane wraps through `Uint8Array`, an `f32` lane rounds
+// through `Float32Array`. `load…` and `store` check the whole vector once, and
+// panic with the native words: the first index, and the array's length.
+
+const simdMake = (Lanes) => (...lanes) => new Lanes(lanes);
+const simdSplat = (Lanes) => (x) => new Lanes(16 / Lanes.BYTES_PER_ELEMENT).fill(x);
+// The first index of `count` lanes at `i` in `xs`, or the native panic naming
+// a lane that is out of range: the first when it is, else the last. A negative
+// index prints as the unsigned 64-bit number the native compare saw.
+const simdAt = (xs, i, count) => {
+  const k = toIndex(i);
+  if (k < 0) panicIndex(BigInt.asUintN(64, BigInt(k)), xs.length);
+  if (k >= xs.length) panicIndex(k, xs.length);
+  if (k + count > xs.length) panicIndex(k + count - 1, xs.length);
+  return k;
+};
+const simdLoad = (Lanes) => (xs, i) => {
+  const count = 16 / Lanes.BYTES_PER_ELEMENT;
+  const k = simdAt(xs, i, count);
+  const out = new Lanes(count);
+  for (let j = 0; j < count; j++) out[j] = xs[k + j];
+  return out;
+};
+
+export const u8x16 = simdMake(Uint8Array);
+export const u16x8 = simdMake(Uint16Array);
+export const i32x4 = simdMake(Int32Array);
+export const u32x4 = simdMake(Uint32Array);
+export const f32x4 = simdMake(Float32Array);
+export const f64x2 = simdMake(Float64Array);
+export const splatU8x16 = simdSplat(Uint8Array);
+export const splatU16x8 = simdSplat(Uint16Array);
+export const splatI32x4 = simdSplat(Int32Array);
+export const splatU32x4 = simdSplat(Uint32Array);
+export const splatF32x4 = simdSplat(Float32Array);
+export const splatF64x2 = simdSplat(Float64Array);
+export const loadU8x16 = simdLoad(Uint8Array);
+export const loadU16x8 = simdLoad(Uint16Array);
+export const loadI32x4 = simdLoad(Int32Array);
+export const loadU32x4 = simdLoad(Uint32Array);
+export const loadF32x4 = simdLoad(Float32Array);
+export const loadF64x2 = simdLoad(Float64Array);
+
+/** `store(v, xs, i)`: the lanes into `xs[i]` to `xs[i + N - 1]`, checked once. */
+export function store(v, xs, i) {
+  const k = simdAt(xs, i, v.length);
+  for (let j = 0; j < v.length; j++) xs[k + j] = v[j];
+}
+
+/** `extract(v, k)`: lane `k`, a constant the checker held in range. */
+export function extract(v, k) {
+  return v[k];
+}
+
+/** `replace(v, k, x)`: a new vector, `v` with lane `k` set to `x`. */
+export function replace(v, k, x) {
+  const out = v.slice();
+  out[k] = x;
+  return out;
+}

package/runtime/nish.d.ts

@@ -356,10 +356,10 @@ declare function availableParallelism(): i32;
 /** Bytes of physical memory, or -1 when the host does not say. */
 declare function totalMemory(): i64;
 /**
- * Set this process's nice value to `n`: 0, or a negative errno. The kernel
- * clamps `n` to -20..19, and lowering it below the current value needs the
- * privilege to (-13 without it on Linux). Children started afterwards inherit
- * it. Throws under Node.
+ * Set this process's nice value to `n`, which must be 0..19: 0, or a negative
+ * errno. Lower-only, even as root: `n` outside 0..19 is -22 (EINVAL), and `n`
+ * below the current value is -13 (EACCES), both with no system call. Children
+ * started afterwards inherit it. Throws under Node.
  */
 declare function setNice(n: i32): i32;
 /**
@@ -588,7 +588,7 @@ declare module "nish:process" {
   export function availableParallelism(): i32;
   /** Bytes of physical memory, or -1. */
   export function totalMemory(): i64;
-  /** Set this process's nice value (clamped to -20..19): 0, or a negative errno. */
+  /** Set this process's nice value, 0..19 only: 0, -22 outside it, or -13 below the current value (lower-only, even as root). */
   export function setNice(n: i32): i32;
   /**
    * Move this process to `SCHED_IDLE`: 0, a negative errno, or -95 off Linux.
@@ -698,6 +698,55 @@ declare module "nish:unsafe" {
   export function readCString(p: CPtr): string;
 }
 
+// `nish:simd` (docs/LANGUAGE.md -> Vectors): the six sixteen-byte vector
+// types and the calls that make, load, store and take one apart. Under Node,
+// `runtime/nish.mjs` answers the import with `runtime/core.mjs`'s names.
+declare module "nish:simd" {
+  /**
+   * A sixteen-byte vector of lanes. Opaque: TypeScript refuses `+` on one, as
+   * `nish` does, but lets `===` and `<` through, which `nish` refuses. Under
+   * Node it is a typed array made once and never written after.
+   */
+  export interface u8x16 { readonly __nishSimd: "u8x16"; readonly __lane: u8 }
+  export interface u16x8 { readonly __nishSimd: "u16x8"; readonly __lane: u16 }
+  export interface i32x4 { readonly __nishSimd: "i32x4"; readonly __lane: i32 }
+  export interface u32x4 { readonly __nishSimd: "u32x4"; readonly __lane: u32 }
+  export interface f32x4 { readonly __nishSimd: "f32x4"; readonly __lane: f32 }
+  export interface f64x2 { readonly __nishSimd: "f64x2"; readonly __lane: f64 }
+  /** Any of the six. */
+  export type SimdVector = u8x16 | u16x8 | i32x4 | u32x4 | f32x4 | f64x2;
+  /** One value per lane, lane 0 first. */
+  export function u8x16(
+    a0: u8, a1: u8, a2: u8, a3: u8, a4: u8, a5: u8, a6: u8, a7: u8,
+    a8: u8, a9: u8, a10: u8, a11: u8, a12: u8, a13: u8, a14: u8, a15: u8
+  ): u8x16;
+  export function u16x8(a0: u16, a1: u16, a2: u16, a3: u16, a4: u16, a5: u16, a6: u16, a7: u16): u16x8;
+  export function i32x4(a0: i32, a1: i32, a2: i32, a3: i32): i32x4;
+  export function u32x4(a0: u32, a1: u32, a2: u32, a3: u32): u32x4;
+  export function f32x4(a0: f32, a1: f32, a2: f32, a3: f32): f32x4;
+  export function f64x2(a0: f64, a1: f64): f64x2;
+  /** `x` in every lane. */
+  export function splatU8x16(x: u8): u8x16;
+  export function splatU16x8(x: u16): u16x8;
+  export function splatI32x4(x: i32): i32x4;
+  export function splatU32x4(x: u32): u32x4;
+  export function splatF32x4(x: f32): f32x4;
+  export function splatF64x2(x: f64): f64x2;
+  /** `xs[i]` to `xs[i + N - 1]`, bounds-checked once for the whole vector. */
+  export function loadU8x16(xs: readonly u8[], i: i32): u8x16;
+  export function loadU16x8(xs: readonly u16[], i: i32): u16x8;
+  export function loadI32x4(xs: readonly i32[], i: i32): i32x4;
+  export function loadU32x4(xs: readonly u32[], i: i32): u32x4;
+  export function loadF32x4(xs: readonly f32[], i: i32): f32x4;
+  export function loadF64x2(xs: readonly f64[], i: i32): f64x2;
+  /** The lanes of `v` into `xs[i]` to `xs[i + N - 1]`, checked once. */
+  export function store<V extends SimdVector>(v: V, xs: V["__lane"][], i: i32): void;
+  /** Lane `k`, an integer literal in range. */
+  export function extract<V extends SimdVector>(v: V, k: i32): V["__lane"];
+  /** A new vector: `v` with lane `k` set to `x`. */
+  export function replace<V extends SimdVector>(v: V, k: i32, x: V["__lane"]): V;
+}
+
 declare module "nish:io" {
   /** `s` to stdout with no trailing newline and no conversion. */
   export function write(s: string): void;

package/runtime/nish.h

@@ -9,14 +9,17 @@
  * functions, the directory and subprocess calls, `nish_getenv`, the monotonic
  * clock, `nish_platform` / `nish_arch` — and runtime-parallel.c, runtime-host.c,
  * runtime-net.c, runtime-simd.c (the byte searches that read a vector at a
- * time), runtime-aes.c (AES-GCM on the CPU's AES instructions) and
- * runtime-term.c (stdin and the terminal, `nish:term`) split off
+ * time), runtime-aes.c (AES-GCM on the CPU's AES instructions),
+ * runtime-sha256.c (SHA-256 on the CPU's SHA instructions), runtime-checksum.c
+ * (CRC-32 on its carry-less multiply or CRC instructions) and runtime-term.c
+ * (stdin and the terminal, `nish:term`) split off
  * the same way since. They are separate so that each carries its own measured
  * code-size ceiling (docs/wp7-runtime.md, "Runtime additions and budget"); a
  * host links all of them, which `scripts/build.sh` does for you when handed
- * runtime.c, runtime-aes.c included: the compiler calls its kernels from
- * std/crypto/aes.ts, so `scripts/build.sh` pairs it and `src/run-cache.ts`
- * caches it like the others. `tests/run.js` checks that every runtime function
+ * runtime.c, runtime-aes.c, runtime-sha256.c and runtime-checksum.c included: the
+ * compiler calls their kernels from std/crypto/aes.ts, std/crypto/sha256.ts and
+ * std/compress/checksum.ts, so `scripts/build.sh` pairs each of them with
+ * runtime.c and `src/run-cache.ts` caches them like the others. `tests/run.js` checks that every runtime function
  * declared in runtime.ts has a prototype in this file.
  *
  * Headers generated by `nish --emit-header` include this one, so keep
@@ -282,6 +285,20 @@ nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len);
    Variable-time: never call it on a secret. */
 int64_t nish_regex_scan(const nish_str *s, const nish_array *masks, int64_t depth, int64_t off, int64_t width,
                         int64_t from);
+/* `Math.floor`, `Math.ceil` and `Math.trunc`, and the floor `Math.round`
+   takes (#943): each answers as C's `floor`, `ceil` and `trunc` do, -0, the
+   infinities and NaN included. A module for x86-64 calls them and registers a
+   constructor in `@llvm.global_ctors` that passes `nish_round_init` libm's
+   `floor`, `ceil` and `trunc`; it asks the CPU for SSE4.1 once before `main`
+   and keeps them on a machine without it, or under `NISH_SIMD=scalar`. Each
+   is otherwise SSE4.1's `roundsd`, so the constructor must run first. The
+   runtime references no libm symbol: the module that rounds does. They live
+   in runtime/runtime-simd.c; runtime-wasm.c has the wasm32 ones for host IR
+   that `scripts/build.sh --profile wasm` links. */
+void nish_round_init(double (*floor_fn)(double), double (*ceil_fn)(double), double (*trunc_fn)(double));
+double nish_floor(double x);
+double nish_ceil(double x);
+double nish_trunc(double x);
 /* No array grows past 2^31 - 1 elements and no string past 2^31 - 1 bytes:
  * `nish_array_grow`, `nish_alloc_array` and `nish_str_concat` fail as an
  * allocation does (`nish: out of memory`, exit 1; a trap on wasm) rather than
@@ -334,6 +351,40 @@ void nish_aes_ctr(const nish_array *rk, int32_t rounds, const nish_array *j0, co
    `rk` instead, and they are the same H. 0 <= length <= data.len. */
 void nish_aes_ghash(nish_array *y, uint64_t hHi, uint64_t hLo, const nish_array *rk, const nish_array *data,
                     int32_t length);
+/* ---- SHA-256 on the CPU's SHA instructions --------------------------------
+ * runtime/runtime-sha256.c: SHA-NI on x86-64, the ARMv8 SHA-256 instructions
+ * on AArch64. The compiler calls the kernel in place of std/crypto/sha256.ts's
+ * private `sha256Compress`, behind `nish_sha256_hw`, and calls the Nish
+ * function itself when either answers 0. Constant time in the state and the
+ * block. */
+/* 1 when this process runs the kernel, 0 when it runs the Nish code. Resolved
+   on the first call and fixed from then on: `NISH_SHA256=soft` pins 0; unset,
+   `hw` or any other value is the best this machine has, read on that call from
+   CPUID (leaf 7's SHA, leaf 1's SSE4.1 and SSSE3), AArch64 Linux's AT_HWCAP
+   (SHA2) or macOS's `hw.optional.arm.FEAT_SHA256`. Always 0 on other targets,
+   wasm32 among them. */
+int32_t nish_sha256_hw(void);
+/* FIPS 180-4 §6.2.2 on the 64 bytes at src[at..at + 64) (u8[]), into the hash
+   value h[0..8) (u32[]); 1 when it ran. Answers 0 and writes nothing unless
+   h.len >= 8, w.len >= 64 and 0 <= at <= src.len - 64, `sha256Compress`'s
+   guard, so the caller's fallback panics as the Nish function does. `w` (u32[],
+   the message schedule the Nish code fills) is neither read nor written. */
+int32_t nish_sha256_compress(nish_array *h, const nish_array *w, const nish_array *src, int32_t at);
+/* ---- CRC-32 on the CPU's carry-less multiply or CRC instructions ---------
+ * runtime/runtime-checksum.c: PCLMULQDQ folding on x86-64, the ARMv8 CRC32
+ * instructions on AArch64. The compiler calls the kernel in
+ * place of std/compress/checksum.ts's private `crc32Walk`, behind
+ * `nish_crc32_hw`, and calls the Nish walker itself when that answers 0. */
+/* 1 when this process runs the kernel, 0 when it runs the Nish tables.
+   Resolved on the first call and fixed from then on: `NISH_CRC32=soft` pins 0;
+   unset or any other value is the best this machine has, read on that call
+   from CPUID leaf 1 (PCLMULQDQ, SSE4.1), AArch64's AT_HWCAP (CRC32) or
+   Darwin's hw.optional sysctls. Always 0 on other targets, wasm32 among them. */
+int32_t nish_crc32_hw(void);
+/* The CRC-32 (ISO 3309, RFC 1952) `crc` extended over buf[off..off+len)
+   (u8[]), conditioned as zlib's crc32(): 0 starts a message, and the answer
+   continues one. The caller has checked 0 <= off <= off + len <= buf.len. */
+uint32_t nish_crc32_update(uint32_t crc, const nish_array *buf, int32_t off, int32_t len);
 
 /* `secureZero(bytes)` (#385): sets every byte of `bytes` to zero through
  * `volatile` stores, out of line, so that neither `-O2` nor `-flto` can drop
@@ -480,9 +531,9 @@ nish_array *nish_wait_pid(int32_t pid, int32_t flags);
  * page size; Darwin: `hw.memsize`), or -1 where the host does not say. */
 int64_t nish_total_memory(void);
 /* `setNice(n)`: this process's nice value set to `n` (`setpriority`), 0 or a
- * negative errno. The kernel clamps `n` to -20..19; lowering it below the
- * current value without the privilege is -EACCES (or -EPERM). -ENOSYS under
- * WASI. */
+ * negative errno. Lower-only, as root too: `n` takes 0..19, and anything else
+ * is -22 (-EINVAL) with no system call; `n` below the current value is -13
+ * (-EACCES) with none either. -ENOSYS under WASI. */
 int32_t nish_set_nice(int32_t n);
 /* `setIdlePriority()`: this process moved to `SCHED_IDLE` (Linux), 0 or a
  * negative errno; -95 (Linux's EOPNOTSUPP) elsewhere, -ENOSYS under WASI. An
@@ -727,6 +778,14 @@ int64_t nish_cpu_count(void);
  * rounded up, and `NISH_NUM_THREADS` when it is set to a positive number. At
  * least 1; 1 under WASI. Read each call (runtime-os.c). */
 int64_t nish_cpu_online(void);
+/* WP37 `--sandbox` (runtime-sandbox.c): `nish_sandbox` confines the process to
+   the capability mask `caps` from `.preinit_array`, `mode` 1 strict and 2
+   best-effort, and `nish_sandbox_check` refuses to run at the top of `main`
+   when it never ran. The directory lists are a later stage's and are null.
+   `nish_cpu_prime` caches the pool's CPU count while /sys is still readable. */
+void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs);
+void nish_sandbox_check(void);
+void nish_cpu_prime(void);
 void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t grain);
 /* Keeps every later region and join on threads created and joined per call,
  * as before the pool existed, so no parked worker outlives the code it would

package/runtime/nish.mjs

@@ -314,6 +314,9 @@ provide("arena", shim.arena);
 // zero-fills it. `nish:unsafe` and `nish:term` are each answered by a module
 // that hands back the globals installed above: its functions are globals of this module either
 // way, and the import is what the compiler requires a program to write.
+// `nish:simd` is `runtime/core.mjs`, whose vectors are typed arrays made once
+// and never written after, so `--emit-ts` output and a program run as it was
+// written share one implementation.
 const UNSAFE_EXPORTS = ["uncheckedGet", "uncheckedSet", "wrappingAdd", "wrappingSub", "wrappingMul"];
 const unsafeSource = UNSAFE_EXPORTS.map((name) => `export const ${name} = globalThis.${name};`).join("\n");
 const TERM_EXPORTS = ["readStdin", "waitStdin", "isTerminal", "terminalSize", "setRawMode", "setTerminalRestore"];
@@ -326,6 +329,9 @@ registerHooks({
     if (specifier === "nish:unsafe") {
       return { url: `data:text/javascript,${encodeURIComponent(unsafeSource)}`, shortCircuit: true };
     }
+    if (specifier === "nish:simd") {
+      return next(new URL("./core.mjs", import.meta.url).href, context);
+    }
     if (specifier === "nish:term") {
       return { url: `data:text/javascript,${encodeURIComponent(termSource)}`, shortCircuit: true };
     }