@scriptc/compiler 0.0.0 → 0.0.2

package/dist/backend/cc.js

@@ -0,0 +1,897 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { chmod, copyFile, mkdir, mkdtemp, readdir, readFile, rename, rm, stat, unlink, utimes, writeFile } from "node:fs/promises";
+import { availableParallelism, tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const RUNTIME_SOURCES = ["scr_number.c", "scr_string.c", "scr_array.c", "scr_bytes.c", "scr_bytes_io.c", "scr_map.c", "scr_closure.c", "scr_object.c", "scr_union.c", "scr_exception.c", "scr_error.c", "scr_console.c", "scr_lib.c", "scr_path.c", "scr_url.c", "scr_json.c", "scr_async.c", "scr_child.c", "scr_cycle.c"];
+/** The pinned quickjs-ng snapshot under packages/runtime/vendor/quickjs-ng
+ * (see vendor/README.md — update both together). Keys the archive cache so
+ * a vendor bump can never reuse a stale engine build. */
+const QJS_COMMIT = "3c8f3d68953955950074c41c6e4d999562ae82a7";
+/** The pinned mbedTLS snapshot under packages/runtime/vendor/mbedtls (see
+ * vendor/README.md — update both together). Keys the archive cache so a
+ * vendor bump can never reuse a stale TLS build, and joins the runtime
+ * fingerprint so cached binaries re-key too. */
+const MBEDTLS_VERSION = "3.6.7";
+/** The pinned zlib snapshot under packages/runtime/vendor/zlib (see
+ * vendor/README.md — update both together). Keys the per-target object
+ * cache and joins the runtime fingerprint. Host builds never compile it —
+ * they keep the historical system `-lz` link; the vendored copy exists so
+ * zlib-using programs CROSS-compile (zig has no target sysroot libz). */
+const ZLIB_VERSION = "1.3.1";
+export function runtimeSrcDir() {
+    const require = createRequire(import.meta.url);
+    return join(dirname(require.resolve("@scriptc/runtime/package.json")), "src");
+}
+export function resolveCc(env = process.env) {
+    const cc = env["SCRIPTC_CC"] ?? "";
+    const target = env["SCRIPTC_TARGET"] ?? "";
+    if (cc === "" || cc === "clang") {
+        if (target !== "") {
+            throw new Error(`SCRIPTC_TARGET=${target} requires SCRIPTC_CC=zigcc — the default clang path has no cross-target sysroots.`);
+        }
+        return { argv: ["clang"], target: null, targetArgs: [] };
+    }
+    if (cc !== "zigcc") {
+        throw new Error(`unknown SCRIPTC_CC '${cc}' (supported: clang, zigcc)`);
+    }
+    if (target === "")
+        return { argv: ["zig", "cc"], target: null, targetArgs: [] };
+    return {
+        argv: ["zig", "cc"],
+        target,
+        targetArgs: ["-target", target, ...(target.includes("linux") ? ["-D_GNU_SOURCE"] : [])],
+    };
+}
+/** The OS the produced binary runs on: the triple's OS under SCRIPTC_TARGET,
+ * the host's otherwise — so platform-conditional link flags follow the
+ * TARGET, not the machine running the compiler. Exported for compile()/
+ * analyze(): the FRONTEND consults it too (path.sep / os.EOL literals and
+ * the path-module binding follow the target — a win32 triple compiles
+ * Node-on-Windows semantics, path.win32 backing the bare module). */
+export function targetPlatform(driver) {
+    if (driver.target === null)
+        return process.platform;
+    if (driver.target.includes("linux"))
+        return "linux";
+    if (driver.target.includes("windows"))
+        return "win32";
+    return driver.target.includes("macos") || driver.target.includes("darwin") ? "darwin" : "other";
+}
+function vendorEngineDir() {
+    return join(runtimeSrcDir(), "..", "vendor", "quickjs-ng");
+}
+async function fileExists(path) {
+    return stat(path).then((s) => s.isFile(), () => false);
+}
+/** The engine archive for one flavor, built lazily on the first --dynamic
+ * compile (~10s) and cached under vendor/.cache/<commit>-<flavor>/ — unlike
+ * the runtime's own sources (recompiled every build, ~100ms), the engine is
+ * far too big to rebuild per compile. The plain flavor is ALWAYS MinSizeRel
+ * regardless of the program's optimization level: measured binary delta is
+ * ~620KB vs ~900KB at -O2, and eval-in-an-island workloads don't earn the
+ * difference. The asan flavor (Debug + QJS_ENABLE_ASAN) exists so the
+ * sanitized test lane checks engine interop under instrumentation.
+ *
+ * Concurrency: parallel first builds (e.g. test workers) each build in a
+ * private temp dir and publish with an atomic rename — first one wins,
+ * losers discard their work and use the winner's archive.
+ *
+ * SCRIPTC_TARGET adds a per-target cache flavor built WITHOUT CMake (the
+ * mbedTLS recipe): the qjs library target is just four TUs
+ * (QJS_ENGINE_SOURCES) compiled with `zig cc -target <triple>` under the
+ * same flags CMake's MinSizeRel/Debug+ASan configurations apply, packed
+ * with `zig ar`. Host builds keep the exact historical CMake recipe. */
+async function ensureEngineArchive(sanitize, driver) {
+    const flavor = `${sanitize ? "asan" : "plain"}${driver.target !== null ? `-${driver.target}` : ""}`;
+    const vendor = vendorEngineDir();
+    const cacheRoot = join(vendor, "..", ".cache");
+    const cacheDir = join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-${flavor}`);
+    const archive = join(cacheDir, "libqjs.a");
+    if (await fileExists(archive))
+        return archive;
+    if (driver.target !== null)
+        return buildEngineArchiveCross(sanitize, driver, cacheRoot, cacheDir);
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-${flavor}-`));
+    const stageDir = `${buildDir}.stage`;
+    try {
+        const configureArgs = [
+            "-S", vendor,
+            "-B", buildDir,
+            ...(sanitize
+                ? ["-DCMAKE_BUILD_TYPE=Debug", "-DQJS_ENABLE_ASAN=ON"]
+                : ["-DCMAKE_BUILD_TYPE=MinSizeRel"]),
+            "-DQJS_BUILD_EXAMPLES=OFF",
+            "-DQJS_ENABLE_INSTALL=OFF",
+        ];
+        try {
+            await execFileAsync("cmake", configureArgs);
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                throw new Error("--dynamic builds the embedded engine once with CMake, which was not found on PATH.\n" +
+                    "Install cmake (e.g. `brew install cmake`) and retry. Static builds do not need it.");
+            }
+            throw new Error(`cmake failed configuring the embedded engine (${vendor}).\n\n` +
+                `${err.stderr ?? String(err)}`);
+        }
+        await execFileAsync("cmake", [
+            "--build", buildDir,
+            "--target", "qjs",
+            `-j${availableParallelism()}`,
+        ]);
+        // Publish only the archive, atomically: rename fails if a concurrent
+        // build won the race, and the winner's archive is just as good.
+        await mkdir(stageDir);
+        await copyFile(join(buildDir, "libqjs.a"), join(stageDir, "libqjs.a"));
+        await rename(stageDir, cacheDir).catch(() => undefined);
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+        await rm(stageDir, { recursive: true, force: true });
+    }
+    return archive;
+}
+/** The qjs library target's source list (CMakeLists.txt `qjs_sources` with
+ * QJS_BUILD_LIBC off — cutils is header-only): the cross-build recipe
+ * compiles exactly these. */
+const QJS_ENGINE_SOURCES = ["dtoa.c", "libregexp.c", "libunicode.c", "quickjs.c"];
+/** The engine archive for a CROSS target, per-TU `zig cc` compiles + `zig
+ * ar` (no CMake — the mbedTLS recipe). The flags mirror what the CMake
+ * configurations apply to the qjs library target: gnu11 (CMAKE_C_EXTENSIONS
+ * ON), hidden visibility, -funsigned-char, -DQUICKJS_NG_BUILD and
+ * -D_GNU_SOURCE (qjs_defines; linux targetArgs already carry the latter),
+ * then MinSizeRel (-Os -DNDEBUG) for plain or Debug+QJS_ENABLE_ASAN
+ * (-O0 -ggdb -fno-omit-frame-pointer -fsanitize=address
+ * -fno-sanitize-recover=all) for asan. Same atomic-rename publish as every
+ * vendor cache. */
+async function buildEngineArchiveCross(sanitize, driver, cacheRoot, cacheDir) {
+    const vendor = vendorEngineDir();
+    const archive = join(cacheDir, "libqjs.a");
+    const arArgv = [...driver.argv.slice(0, 1), "ar"];
+    const cflags = [
+        "-std=gnu11",
+        ...driver.targetArgs,
+        "-fvisibility=hidden",
+        "-funsigned-char",
+        "-DQUICKJS_NG_BUILD",
+        "-D_GNU_SOURCE",
+        // CMake's qjs_defines on WIN32 (quickjs.c's own _WIN32 arms cover the
+        // rest — timezoneapi, intrin, cutils.h's _msize usable-size probe).
+        ...(targetPlatform(driver) === "win32" ? ["-DWIN32_LEAN_AND_MEAN", "-D_WIN32_WINNT=0x0601"] : []),
+        ...(sanitize
+            ? ["-O0", "-ggdb", "-fno-omit-frame-pointer", "-fsanitize=address", "-fno-sanitize-recover=all", "-DQJS_ENABLE_ASAN"]
+            : ["-Os", "-DNDEBUG"]),
+        "-I", vendor,
+    ];
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-qjs-${driver.target ?? "host"}-`));
+    try {
+        const width = Math.min(QJS_ENGINE_SOURCES.length, availableParallelism());
+        for (let i = 0; i < QJS_ENGINE_SOURCES.length; i += width) {
+            await Promise.all(QJS_ENGINE_SOURCES.slice(i, i + width).map((src) => execFileAsync(driver.argv[0] ?? "clang", [...driver.argv.slice(1), ...cflags, "-c", join(vendor, src), "-o", join(buildDir, `${basename(src, ".c")}.o`)], { cwd: buildDir })));
+        }
+        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libqjs.a"), ...QJS_ENGINE_SOURCES.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
+        // Atomic publish: rename fails if a concurrent build won the race, and
+        // the winner's archive is just as good.
+        const stageDir = `${buildDir}.stage`;
+        await mkdir(stageDir);
+        await copyFile(join(buildDir, "libqjs.a"), join(stageDir, "libqjs.a"));
+        await rename(stageDir, cacheDir).catch(async () => {
+            await rm(stageDir, { recursive: true, force: true });
+        });
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+    }
+    return archive;
+}
+/** The vendor sources behind static-build regex support: quickjs-ng's
+ * libregexp and its unicode tables (cutils is header-only). Deliberately
+ * NOT the engine — a regex-using static binary links ~110KB of matcher,
+ * never the ~620KB island. */
+const LRE_SOURCES = ["libregexp.c", "libunicode.c"];
+/** The libregexp objects for one flavor, compiled lazily on the first
+ * regex-using static build (~1s) and cached like the engine archive —
+ * vendor/.cache/<commit>-lre-<flavor>/*.o — with the same atomic-rename
+ * publish (parallel first builds race safely; losers discard their work).
+ * Plain is -Os (size class matters: the regex fence pins regex-using
+ * binaries well under the engine class); asan matches the final link so
+ * the sanitized lane instruments the matcher too. Cross targets get their
+ * own flavor directory, compiled with the SCRIPTC_CC driver and its target
+ * args — libregexp/libunicode are plain C11, so the cross story is exactly
+ * the runtime sources' (no host-built inputs); vendored SOURCES are
+ * untouched, only the build wiring knows about targets. */
+async function ensureLreObjects(sanitize, driver) {
+    // The flavor keys the DRIVER as well as the target: a zig-cc-built object
+    // set must never be handed to a clang link (or vice versa) off a shared
+    // cache directory — the historical `lre-plain`/`lre-asan` names stay
+    // clang's alone.
+    const flavor = (sanitize ? "asan" : "plain") +
+        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
+        (driver.target !== null ? `-${driver.target}` : "");
+    const vendor = vendorEngineDir();
+    const cacheRoot = join(vendor, "..", ".cache");
+    const cacheDir = join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-lre-${flavor}`);
+    const objects = LRE_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
+    if ((await Promise.all(objects.map(fileExists))).every(Boolean))
+        return objects;
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-lre-${flavor}-`));
+    try {
+        // One -c per invocation: zig's COFF driver rejects multiple -c inputs
+        // in a single command ("coff does not support linking multiple
+        // objects"); per-file compiles produce the identical objects on every
+        // target.
+        for (const f of LRE_SOURCES) {
+            await execFileAsync(driver.argv[0] ?? "clang", [
+                ...driver.argv.slice(1),
+                "-std=c11",
+                ...driver.targetArgs,
+                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
+                "-I", vendor,
+                "-c", join(vendor, f),
+                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
+            ], { cwd: buildDir });
+        }
+        // Atomic publish: rename fails if a concurrent build won the race, and
+        // the winner's objects are just as good.
+        await rename(buildDir, cacheDir).catch(() => undefined);
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+    }
+    return objects;
+}
+function vendorZlibDir() {
+    return join(runtimeSrcDir(), "..", "vendor", "zlib");
+}
+/** The vendored zlib TUs behind CROSS-target zlib support: every root *.c
+ * except the gzFile file-I/O units (gz*.c — nothing in scr_zlib.c
+ * references the gzFile API, and those TUs alone want unistd/io headers).
+ * Host builds never touch this list — they link the system libz. */
+const ZLIB_SOURCES = ["adler32.c", "compress.c", "crc32.c", "deflate.c", "infback.c", "inffast.c", "inflate.c", "inftrees.c", "trees.c", "uncompr.c", "zutil.c"];
+/** The zlib objects for one flavor, compiled lazily on the first zlib-using
+ * CROSS build (~1s) and cached like the lre objects —
+ * vendor/.cache/zlib-<version>-<flavor>/*.o — with the same atomic-rename
+ * publish (parallel first builds race safely; losers discard their work).
+ * Plain is -Os, asan matches the final link so the sanitized lane
+ * instruments the codec too. The flavor keys the driver and target exactly
+ * like the lre flavor: only cross builds call this today, but the keying
+ * must never hand a zig-built object set to a clang link off a shared
+ * directory. */
+async function ensureZlibObjects(sanitize, driver) {
+    const flavor = (sanitize ? "asan" : "plain") +
+        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
+        (driver.target !== null ? `-${driver.target}` : "");
+    const vendor = vendorZlibDir();
+    const cacheRoot = join(vendor, "..", ".cache");
+    const cacheDir = join(cacheRoot, `zlib-${ZLIB_VERSION}-${flavor}`);
+    const objects = ZLIB_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
+    if ((await Promise.all(objects.map(fileExists))).every(Boolean))
+        return objects;
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-zlib-${flavor}-`));
+    try {
+        // One -c per invocation, the lre recipe (zig's COFF driver rejects
+        // multiple -c inputs in a single command).
+        for (const f of ZLIB_SOURCES) {
+            await execFileAsync(driver.argv[0] ?? "clang", [
+                ...driver.argv.slice(1),
+                "-std=c11",
+                ...driver.targetArgs,
+                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
+                "-I", vendor,
+                "-c", join(vendor, f),
+                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
+            ], { cwd: buildDir });
+        }
+        // Atomic publish: rename fails if a concurrent build won the race, and
+        // the winner's objects are just as good.
+        await rename(buildDir, cacheDir).catch(() => undefined);
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+    }
+    return objects;
+}
+function vendorCurlDir() {
+    return join(runtimeSrcDir(), "..", "vendor", "curl");
+}
+/** Every libcurl function scr_fetch_curl.c references — the generated import
+ * stub defines exactly these. A new curl call in scr_fetch_curl.c that is
+ * missing here fails the CROSS link immediately with the symbol's name
+ * (host builds resolve it from the real system libcurl and never look). */
+const CURL_STUB_SYMBOLS = [
+    "curl_easy_cleanup", "curl_easy_getinfo", "curl_easy_init", "curl_easy_setopt", "curl_easy_strerror",
+    "curl_free", "curl_global_cleanup", "curl_global_init",
+    "curl_multi_add_handle", "curl_multi_cleanup", "curl_multi_info_read", "curl_multi_init",
+    "curl_multi_perform", "curl_multi_poll", "curl_multi_remove_handle",
+    "curl_slist_append", "curl_slist_free_all",
+    "curl_url", "curl_url_cleanup", "curl_url_get", "curl_url_set",
+];
+/** The libcurl import stub for one CROSS target, generated lazily on the
+ * first fetch-using cross build and cached like the zlib objects —
+ * vendor/.cache/curl-stub-<target>/libcurl.so, atomic-rename publish. The
+ * stub is empty definitions of CURL_STUB_SYMBOLS compiled `-shared` with
+ * `-soname libcurl.so.4`: linking against it satisfies scr_fetch_curl.c's
+ * references and records a plain `DT_NEEDED libcurl.so.4`, which the
+ * TARGET system's real libcurl satisfies at load time (curl's unversioned
+ * exports make the classic import-stub technique sound here — nothing
+ * from the stub's bodies ever ships in the binary). One stub per target,
+ * no sanitize flavor: the stub's code is never executed or instrumented,
+ * and asan links against plain shared libraries freely. */
+async function ensureCurlStub(driver) {
+    const cacheRoot = join(vendorCurlDir(), "..", ".cache");
+    const cacheDir = join(cacheRoot, `curl-stub-${driver.target}`);
+    const lib = join(cacheDir, "libcurl.so");
+    if (await fileExists(lib))
+        return cacheDir;
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-curl-stub-`));
+    try {
+        const src = join(buildDir, "stub.c");
+        await writeFile(src, CURL_STUB_SYMBOLS.map((s) => `void ${s}(void) {}\n`).join(""));
+        await execFileAsync(driver.argv[0] ?? "clang", [
+            ...driver.argv.slice(1),
+            ...driver.targetArgs,
+            "-shared", "-fPIC",
+            "-Wl,-soname,libcurl.so.4",
+            src,
+            "-o", join(buildDir, "libcurl.so"),
+        ]);
+        // Atomic publish: rename fails if a concurrent build won the race, and
+        // the winner's stub is just as good.
+        const stageDir = `${buildDir}.stage`;
+        await mkdir(stageDir);
+        await copyFile(join(buildDir, "libcurl.so"), join(stageDir, "libcurl.so"));
+        await rename(stageDir, cacheDir).catch(async () => {
+            await rm(stageDir, { recursive: true, force: true });
+        });
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+    }
+    return cacheDir;
+}
+function vendorTlsDir() {
+    return join(runtimeSrcDir(), "..", "vendor", "mbedtls");
+}
+/** The mbedTLS archive for one flavor, compiled lazily on the first
+ * TLS-using build (~15s over ~110 TUs, parallelized) and cached like the
+ * engine archive — vendor/.cache/mbedtls-<version>-<flavor>/libmbedtls.a —
+ * with the same atomic-rename publish (parallel first builds race safely;
+ * losers discard their work). Plain is -Os (the TLS stack is link-gated
+ * but still wants its size class small); asan matches the final link so
+ * the sanitized lane instruments every TLS path too. No CMake: the stock
+ * config builds every library/*.c standalone with clang, so the recipe is
+ * per-TU `-c` compiles plus one `ar rcs` — vendored-build machinery the
+ * lre-objects cache already established.
+ *
+ * SCRIPTC_TARGET adds a per-target cache flavor (the lre-objects story):
+ * TUs compile with `zig cc -target <triple>` and the archive is packed
+ * with `zig ar` (llvm-ar — the host BSD ar has no business indexing ELF
+ * objects). Host builds keep the exact historical clang + ar recipe. */
+async function ensureTlsArchive(sanitize, driver) {
+    const flavor = `${sanitize ? "asan" : "plain"}${driver.target !== null ? `-${driver.target}` : ""}`;
+    const compileArgv = driver.target !== null ? driver.argv : ["clang"];
+    const arArgv = driver.target !== null ? [...driver.argv.slice(0, 1), "ar"] : ["ar"];
+    const vendor = vendorTlsDir();
+    const cacheRoot = join(vendor, "..", ".cache");
+    const cacheDir = join(cacheRoot, `mbedtls-${MBEDTLS_VERSION}-${flavor}`);
+    const archive = join(cacheDir, "libmbedtls.a");
+    if (await fileExists(archive))
+        return archive;
+    await mkdir(cacheRoot, { recursive: true });
+    const buildDir = await mkdtemp(join(cacheRoot, `build-mbedtls-${flavor}-`));
+    try {
+        const sources = (await readdir(join(vendor, "library"))).filter((n) => n.endsWith(".c")).sort();
+        const cflags = [
+            "-std=c11",
+            ...driver.targetArgs, // ALWAYS empty on host builds
+            ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
+            "-I", join(vendor, "include"),
+            "-I", join(vendor, "library"),
+        ];
+        const width = availableParallelism();
+        for (let i = 0; i < sources.length; i += width) {
+            await Promise.all(sources.slice(i, i + width).map((src) => execFileAsync(compileArgv[0] ?? "clang", [...compileArgv.slice(1), ...cflags, "-c", join(vendor, "library", src), "-o", join(buildDir, `${basename(src, ".c")}.o`)])));
+        }
+        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libmbedtls.a"), ...sources.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
+        // Atomic publish: rename fails if a concurrent build won the race, and
+        // the winner's archive is just as good.
+        const stageDir = `${buildDir}.stage`;
+        await mkdir(stageDir);
+        await copyFile(join(buildDir, "libmbedtls.a"), join(stageDir, "libmbedtls.a"));
+        await rename(stageDir, cacheDir).catch(async () => {
+            await rm(stageDir, { recursive: true, force: true });
+        });
+    }
+    finally {
+        await rm(buildDir, { recursive: true, force: true });
+    }
+    return archive;
+}
+/* ------------------- build cache (opt-in via SCRIPTC_CACHE_DIR) ----------------
+ * Content-addressed caches that let repeat builds of unchanged programs skip
+ * clang entirely — the test lanes' dominant cost. Two keyspaces under the
+ * cache root:
+ *
+ *   bin/<key>       — whole program binaries. key = sha256(clang version,
+ *                     runtime fingerprint (every .c/.h in the runtime src dir
+ *                     plus the vendor pin QJS_COMMIT), the FULL normalized
+ *                     command line, the emitted C bytes). Emitted C is
+ *                     byte-stable by project invariant, so unchanged programs
+ *                     hit; any flag difference — e.g. the sanitized lane's
+ *                     -O1/-fsanitize=address/-DSCR_RC_AUDIT — lands in a
+ *                     naturally distinct key. On a hit the cached binary is
+ *                     copied and atomically renamed onto outPath (never an
+ *                     in-place overwrite — see the hit path) and clang never
+ *                     runs; the binary is still EXECUTED live by whoever
+ *                     asked for it, so no comparison or sanitizer coverage
+ *                     is ever skipped.
+ *
+ *   obj/<set>/<f>.o — per-flavor runtime objects for cache-miss builds. The
+ *                     historical single invocation recompiles every runtime
+ *                     TU per program (~1.3s at -O2); with cached objects a
+ *                     miss compiles ONLY the program's C and links (~0.15s).
+ *                     The clang driver hands every input the same option set,
+ *                     so per-TU `-c` compiles with those options plus a final
+ *                     link reproduce the single invocation exactly. Object
+ *                     compiles go through ccache when it is installed (silent
+ *                     fallback when not).
+ *
+ * Escape hatches, honored in BOTH directions (no reads, no writes): leave
+ * SCRIPTC_CACHE_DIR unset (the production default — the CLI never caches unless
+ * asked; vitest.config.ts sets it for the test lanes) or set SCRIPTC_NO_CACHE=1.
+ * Either way compileC issues the exact historical command line.
+ *
+ * Eviction: size-capped LRU over the whole cache root (SCRIPTC_CACHE_MAX_MB,
+ * default 4096) swept at most once per process after a write; reads bump
+ * mtimes. The harness's oracle cache lives under the same root and is swept
+ * by the same pass. Cache trouble is never a build failure — every cache
+ * error falls back to a real compile. */
+function cacheRootDir() {
+    if (process.env["SCRIPTC_NO_CACHE"] === "1")
+        return null;
+    const dir = process.env["SCRIPTC_CACHE_DIR"];
+    return dir !== undefined && dir !== "" ? dir : null;
+}
+const ccVersionMemos = new Map();
+function ccVersionOnce(argv) {
+    const key = argv.join("\x1f");
+    let memo = ccVersionMemos.get(key);
+    if (memo === undefined) {
+        // cwd: the version probe must not touch the caller's directory —
+        // `zig cc --version` (zig 0.16) drops an empty a.o wherever it runs.
+        memo = execFileAsync(argv[0] ?? "clang", [...argv.slice(1), "--version"], { cwd: tmpdir() }).then((r) => r.stdout.split("\n", 1)[0] ?? "");
+        ccVersionMemos.set(key, memo);
+    }
+    return memo;
+}
+let ccacheMemo = null;
+function ccacheAvailable() {
+    ccacheMemo ??= execFileAsync("ccache", ["--version"]).then(() => true, () => false);
+    return ccacheMemo;
+}
+/** Content hash of every .c/.h in the runtime src dir plus the vendor pin —
+ * everything a binary links that the emitted C bytes don't already cover
+ * (npm-embedded C rides inside the emitted C; the engine archive and lre
+ * objects are pinned by QJS_COMMIT, the same trust their own caches use).
+ * Memoized behind a stat signature so watch-mode edits re-hash. */
+let rtFingerprintMemo = null;
+async function runtimeFingerprint(rtDir) {
+    const names = (await readdir(rtDir)).filter((n) => n.endsWith(".c") || n.endsWith(".h")).sort();
+    const stats = await Promise.all(names.map((n) => stat(join(rtDir, n))));
+    const sig = stats.map((s, i) => `${names[i] ?? ""}:${s.size}:${s.mtimeMs}`).join("|");
+    if (rtFingerprintMemo !== null && rtFingerprintMemo.sig === sig)
+        return rtFingerprintMemo.hash;
+    const h = createHash("sha256").update(QJS_COMMIT).update(MBEDTLS_VERSION).update(ZLIB_VERSION);
+    for (const n of names)
+        h.update(n).update("\0").update(await readFile(join(rtDir, n))).update("\0");
+    const hash = h.digest("hex");
+    rtFingerprintMemo = { sig, hash };
+    return hash;
+}
+/** The cached .o set for one flag flavor, compiled on first need. Concurrent
+ * first builds (parallel test workers on a cold cache) may duplicate work;
+ * per-file atomic renames make every winner equivalent. */
+async function ensureRuntimeObjects(root, ccArgv, cflags, sources, keyPrefix) {
+    const setKey = createHash("sha256")
+        .update(keyPrefix)
+        .update(cflags.join("\x1f"))
+        .digest("hex")
+        .slice(0, 24);
+    const objDir = join(root, "obj", setKey);
+    const objOf = (src) => join(objDir, `${basename(src, ".c")}.o`);
+    const present = await Promise.all(sources.map((s) => fileExists(objOf(s))));
+    const missing = sources.filter((_, i) => !present[i]);
+    if (missing.length > 0) {
+        // ccache wraps only the default clang driver — multi-word drivers
+        // (`zig cc`) run bare; their object sets are keyed apart anyway.
+        const useCcache = ccArgv.length === 1 && ccArgv[0] === "clang" && (await ccacheAvailable());
+        await mkdir(objDir, { recursive: true });
+        const tmpDir = await mkdtemp(join(root, "obj", "build-"));
+        try {
+            // Modest parallelism: a flavor's objects build once, but several cold
+            // workers can race here — keep each build's CPU footprint small.
+            const width = 4;
+            for (let i = 0; i < missing.length; i += width) {
+                await Promise.all(missing.slice(i, i + width).map(async (src) => {
+                    const tmpObj = join(tmpDir, `${basename(src, ".c")}.o`);
+                    const argv = [...(useCcache ? ["ccache"] : []), ...ccArgv, ...cflags, "-c", src, "-o", tmpObj];
+                    await execFileAsync(argv[0] ?? "clang", argv.slice(1));
+                    await rename(tmpObj, objOf(src));
+                }));
+            }
+        }
+        finally {
+            await rm(tmpDir, { recursive: true, force: true });
+        }
+    }
+    return new Map(sources.map((s) => [s, objOf(s)]));
+}
+/** Size-capped LRU sweep of the whole cache root, at most once per process
+ * and only after a write. Oldest-mtime files go first until the tree is back
+ * under 75% of the cap; read hits bump mtimes so hot entries survive. */
+let pruneDone = false;
+async function pruneCache(root) {
+    if (pruneDone)
+        return;
+    pruneDone = true;
+    const capBytes = Number(process.env["SCRIPTC_CACHE_MAX_MB"] ?? "4096") * 1024 * 1024;
+    if (!Number.isFinite(capBytes) || capBytes <= 0)
+        return;
+    const files = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+        for (const ent of entries) {
+            const p = join(dir, ent.name);
+            if (ent.isDirectory())
+                await walk(p);
+            else if (ent.isFile()) {
+                const s = await stat(p).catch(() => null);
+                if (s !== null)
+                    files.push({ path: p, size: s.size, mtimeMs: s.mtimeMs });
+            }
+        }
+    };
+    await walk(root);
+    let total = files.reduce((n, f) => n + f.size, 0);
+    if (total <= capBytes)
+        return;
+    files.sort((a, b) => a.mtimeMs - b.mtimeMs);
+    const recent = Date.now() - 60 * 60 * 1000; // never evict anything a live run may be using
+    for (const f of files) {
+        if (total <= capBytes * 0.75 || f.mtimeMs > recent)
+            break;
+        await unlink(f.path).catch(() => undefined);
+        total -= f.size;
+    }
+}
+/** Compiles one C program together with the runtime sources.
+ * Without a cache dir (the production default), the runtime (a dozen small
+ * files) is recompiled on every build in one historical clang invocation —
+ * no cached-archive staleness bugs. --dynamic additionally compiles
+ * scr_island.c under SCR_DYNAMIC and links the cached engine archive (built
+ * lazily, see above); regex-using programs additionally compile scr_regex.c
+ * and link libregexp (the cached objects, or the archive's own copy under
+ * --dynamic). Without either, the command line is exactly the historical
+ * one — regex-free static builds must stay byte-identical.
+ *
+ * With SCRIPTC_CACHE_DIR set (the test lanes; see the cache block above),
+ * unchanged programs skip clang via the binary cache, and misses link the
+ * program's own TU against cached per-flavor runtime objects. */
+export async function compileC(opts) {
+    const rtDir = runtimeSrcDir();
+    const dynamic = opts.dynamic ?? false;
+    const regex = opts.regex ?? false;
+    // fetch's implementation switch: the default is the NATIVE bridge
+    // (scr_fetch.c over scr_net + scr_tls + scr_http's client parser +
+    // zlib — no libcurl anywhere), which implies the socket units into the
+    // link. SCRIPTC_FETCH_CURL=1 keeps the retired curl reference
+    // (scr_fetch_curl.c + system libcurl / the linux soname stub)
+    // compilable for one release as the flip's reference.
+    const fetchOn = opts.fetch ?? false;
+    const curlFetch = fetchOn && process.env["SCRIPTC_FETCH_CURL"] === "1";
+    const nativeFetch = fetchOn && !curlFetch;
+    // The island's node:http/https client bridge: embedded graphs that
+    // import those builtins get working clients over the same socket units
+    // (native-fetch builds always carry it — scr_fetch_install registers it).
+    const netIsland = dynamic && ((opts.netIsland ?? false) || nativeFetch);
+    const net = (opts.net ?? false) || nativeFetch || netIsland;
+    const http = (opts.http ?? false) || nativeFetch || netIsland;
+    const tls = (opts.tls ?? false) || nativeFetch || netIsland;
+    const driver = resolveCc();
+    if (driver.target !== null) {
+        // See the resolveCc block: these inputs are built on and for the HOST
+        // (vendored archives, system libs). Regex, zlib, and the engine archive
+        // are NOT here: their vendored sources are plain C that ensureLreObjects
+        // / ensureZlibObjects / buildEngineArchiveCross compile per target with
+        // the driver itself — win32 included (the Windows lane runs the
+        // @dynamic corpus and the zlib program against the box's Node). The
+        // NATIVE fetch rides the socket units and cross-compiles with them —
+        // no gate; only the retired curl REFERENCE (SCRIPTC_FETCH_CURL=1)
+        // keeps a linux-only arm (the vendored curl headers + the generated
+        // soname stub, ensureCurlStub — win32 has no system libcurl contract
+        // to bind at load time). The event-loop units, tls, and dgram cross-compile to Linux
+        // AND Windows (scr_platform.h poller + per-target mbedTLS; the
+        // loop's win32 arm is WSAPoll, scr_loop_wsapoll.c, and the socket
+        // units' win32 arms respell winsock behind POSIX-errno wrappers —
+        // scr_net.c/scr_dgram.c/scr_tls.c). The events unit cross-compiles
+        // everywhere: its win32 arm is CRT signal() +
+        // PeekNamedPipe/WaitForSingleObject probes (scr_events.c), served by
+        // the loop's capped win32 idle sleep (scr_async.c).
+        const unsupported = [
+            // The NATIVE fetch cross-compiles wherever the socket units do
+            // (linux and win32 both); only the retired curl reference keeps
+            // its linux-only soname-stub arm.
+            ["fetch (SCRIPTC_FETCH_CURL)", curlFetch && targetPlatform(driver) !== "linux"],
+        ]
+            .filter(([, on]) => on)
+            .map(([name]) => name);
+        if (unsupported.length > 0) {
+            throw new Error(`SCRIPTC_TARGET=${driver.target}: ${unsupported.join(", ")} not supported under a cross target yet ` +
+                `(host-built vendor archives / system libs — see docs/linux-port.md).`);
+        }
+    }
+    const engineArchive = dynamic ? await ensureEngineArchive(opts.sanitize ?? false, driver) : null;
+    const tlsArchive = tls ? await ensureTlsArchive(opts.sanitize ?? false, driver) : null;
+    // --dynamic + regex shares the archive's libregexp (its host hooks and
+    // ours would collide; see scr_regex.c) — the standalone objects are for
+    // static builds only.
+    const lreObjects = regex && !dynamic ? await ensureLreObjects(opts.sanitize ?? false, driver) : [];
+    // Vendored zlib is the CROSS story only — host builds keep the exact
+    // historical `-lz` system link (see CcOptions.zlib). The native fetch's
+    // gzip decoder rides the same objects/link.
+    const zlibObjects = ((opts.zlib ?? false) || nativeFetch) && driver.target !== null
+        ? await ensureZlibObjects(opts.sanitize ?? false, driver)
+        : [];
+    // The libcurl import stub is likewise CROSS-only — host builds keep the
+    // exact historical system `-lcurl` link (see CcOptions.fetch). Curl
+    // reference builds only.
+    const curlStubDir = curlFetch && driver.target !== null ? await ensureCurlStub(driver) : null;
+    // rt() maps each runtime source's path on the command line: identity for
+    // the historical single invocation, cached-.o substitution on cache misses.
+    const buildArgs = (rt) => [
+        "-std=c11",
+        ...driver.targetArgs, // ALWAYS empty on the default clang path
+        ...(opts.sanitize
+            ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
+            : ["-O2"]),
+        "-fno-math-errno",
+        "-Wno-deprecated-declarations", // ucontext fibers (scr_async.c)
+        "-I", rtDir,
+        ...RUNTIME_SOURCES.map((f) => rt(join(rtDir, f))),
+        // win32 targets compile the libc-shim TU (stpcpy, arc4random_buf,
+        // gmtime_r, strcasestr — the _WIN32 block in scr_runtime.h declares
+        // them) and link advapi32 (the CSPRNG RtlGenRandom/SystemFunction036,
+        // GetUserNameA), iphlpapi (GetAdaptersAddresses behind
+        // os.networkInterfaces), and ws2_32 (inet_ntop there; the socket
+        // units ride the same import). Never present on the default path, so
+        // the historical line cannot change.
+        ...(targetPlatform(driver) === "win32"
+            ? [rt(join(rtDir, "scr_win.c")), "-ladvapi32", "-liphlpapi", "-lws2_32"]
+            : []),
+        ...(regex
+            ? ["-I", vendorEngineDir(), rt(join(rtDir, "scr_regex.c")), ...lreObjects]
+            : []),
+        ...(opts.assert || regex || opts.symbol ? [rt(join(rtDir, "scr_assert.c"))] : []),
+        ...(opts.inspect ? [rt(join(rtDir, "scr_inspect.c"))] : []),
+        ...(opts.dynInvoke ? [rt(join(rtDir, "scr_dyn_invoke.c"))] : []),
+        ...(opts.dc ? [rt(join(rtDir, "scr_dc.c"))] : []),
+        ...(opts.dynAsync || opts.dynInvoke || opts.dc ? [rt(join(rtDir, "scr_async_dyn.c"))] : []),
+        // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
+        // libz on hosts, the vendored per-target objects on cross builds)
+        // also serves the native fetch's gzip decoder — spread exactly once.
+        ...(opts.zlib
+            ? driver.target !== null
+                ? ["-I", vendorZlibDir(), rt(join(rtDir, "scr_zlib.c")), ...zlibObjects]
+                : [rt(join(rtDir, "scr_zlib.c")), "-lz"]
+            : nativeFetch
+                ? driver.target !== null
+                    ? ["-I", vendorZlibDir(), ...zlibObjects]
+                    : ["-lz"]
+                : []),
+        // The zlib ↔ island bridge: only when BOTH halves are in the build
+        // (the scr_inspect_island.c pattern) — the emitted main calls its
+        // installer exactly then.
+        ...(opts.zlib && opts.dynamic ? [rt(join(rtDir, "scr_zlib_island.c"))] : []),
+        ...(opts.events ? [rt(join(rtDir, "scr_events.c")), rt(join(rtDir, "scr_readline.c"))] : []),
+        ...(opts.emitter ? [rt(join(rtDir, "scr_events_emitter.c"))] : []),
+        // The checked-dynamic HANDLE support unit (listener gate + runtime
+        // adapter closures): every referencing unit is one of the emitter or
+        // net families (http implies net), so handle-free binaries keep
+        // their exact size class.
+        ...(opts.emitter || net ? [rt(join(rtDir, "scr_dyn_handle.c"))] : []),
+        ...(opts.symbol ? [rt(join(rtDir, "scr_symbol.c"))] : []),
+        ...(opts.searchParams ? [rt(join(rtDir, "scr_url_params.c"))] : []),
+        ...(opts.stream ? [rt(join(rtDir, "scr_stream.c"))] : []),
+        // The readiness-poller backends (scr_platform.h): kqueue on macOS/BSD,
+        // epoll on Linux, WSAPoll on Windows — each TU is empty off its
+        // platform, so all three link whenever a poller-using unit does and
+        // the others cost nothing (ws2_32 rides the unconditional win32 libs
+        // above).
+        ...(net || opts.dgram
+            ? [
+                rt(join(rtDir, "scr_loop_kqueue.c")),
+                rt(join(rtDir, "scr_loop_epoll.c")),
+                rt(join(rtDir, "scr_loop_wsapoll.c")),
+            ]
+            : []),
+        ...(net ? [rt(join(rtDir, "scr_net.c"))] : []),
+        ...(http ? [rt(join(rtDir, "scr_http.c"))] : []),
+        ...(opts.http2 ?? false ? [rt(join(rtDir, "scr_http2.c"))] : []),
+        ...(opts.dgram ? [rt(join(rtDir, "scr_dgram.c"))] : []),
+        ...(opts.watch ? [rt(join(rtDir, "scr_watch.c"))] : []),
+        ...(opts.nodeTest ? [rt(join(rtDir, "scr_test.c"))] : []),
+        ...(tlsArchive
+            ? [
+                "-I", join(vendorTlsDir(), "include"),
+                rt(join(rtDir, "scr_tls.c")),
+                tlsArchive,
+                // mbedTLS's win32 entropy poll is BCryptGenRandom (bcrypt.h) —
+                // an import the unconditional win32 libs above don't carry.
+                // Never present on the default path, so the historical TLS
+                // link line cannot change.
+                ...(targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
+            ]
+            : []),
+        ...(engineArchive
+            ? [
+                "-DSCR_DYNAMIC",
+                "-I", vendorEngineDir(),
+                rt(join(rtDir, "scr_island.c")),
+                rt(join(rtDir, "scr_web.c")),
+                // The one unit referencing BOTH the island and the inspect
+                // engine (insp.jsval): linked exactly when both halves are.
+                ...(opts.inspect ? [rt(join(rtDir, "scr_inspect_island.c"))] : []),
+                // fetch: the NATIVE bridge by default (its socket/tls/zlib
+                // dependencies joined the link above); the curl REFERENCE
+                // (SCRIPTC_FETCH_CURL=1) keeps the historical system -lcurl /
+                // linux soname-stub arms for one release.
+                ...(nativeFetch ? [rt(join(rtDir, "scr_fetch.c"))] : []),
+                // The island's node:http/https CLIENT bridge (scr_net_island.c):
+                // the one TU referencing both the socket units and the engine —
+                // compiled beside the native fetch (scr_fetch_install registers
+                // it) and whenever the embedded graph imports node:http/https
+                // (the emitted main calls scr_net_island_install exactly then).
+                ...(netIsland ? [rt(join(rtDir, "scr_net_island.c"))] : []),
+                ...(curlFetch
+                    ? curlStubDir !== null
+                        ? ["-I", join(vendorCurlDir(), "include"), rt(join(rtDir, "scr_fetch_curl.c")), `-L${curlStubDir}`, "-lcurl"]
+                        : [rt(join(rtDir, "scr_fetch_curl.c")), "-lcurl"]
+                    : []),
+                engineArchive,
+                "-lm",
+                // ld64 dead-stripping claws back a chunk of the engine archive;
+                // harmless elsewhere but only spelled this way on macOS. Keyed on
+                // the TARGET platform (= the host on the default path, where this
+                // expression is byte-identical to the historical one).
+                ...(targetPlatform(driver) === "darwin" ? ["-Wl,-dead_strip"] : []),
+                // The PE stack reserve, pinned to the 8MB POSIX main-stack
+                // geometry ISL_MAIN_STACK_BUDGET is sized against (4MB engine
+                // budget + 4MB excursion margin) — quickjs-ng's own CMake makes
+                // the same 8MB choice on Windows. Not left to the driver:
+                // classic mingw ld defaults to 2MB (which the budget would blow
+                // straight past); zig's lld happens to default to 16MB today,
+                // but that is nobody's contract.
+                ...(targetPlatform(driver) === "win32" ? ["-Wl,--stack,8388608"] : []),
+            ]
+            : []),
+        // A .ll program TU (the LLVM backend) deliberately carries no target
+        // triple (byte-stable output; clang supplies the host/SCRIPTC_TARGET
+        // triple exactly as it does for .c) — silence the -Woverride-module
+        // note about that. Never present for .c inputs, so the historical C
+        // command line cannot change by a byte.
+        ...(opts.cPath.endsWith(".ll") ? ["-Wno-override-module"] : []),
+        opts.cPath,
+        "-o", opts.outPath,
+    ];
+    const ccName = driver.argv.join(" ");
+    const runClang = async (args) => {
+        try {
+            await execFileAsync(driver.argv[0] ?? "clang", [...driver.argv.slice(1), ...args]);
+        }
+        catch (err) {
+            const stderr = err.stderr ?? String(err);
+            throw new Error(`${ccName} failed compiling ${opts.cPath}.\n` +
+                `This is a scriptc bug (generated C should always compile) unless ` +
+                `${ccName} itself is missing/broken.\n\n${stderr}`);
+        }
+    };
+    const root = cacheRootDir();
+    if (root === null) {
+        // The exact historical command line, byte for byte.
+        await runClang(buildArgs((p) => p));
+        return;
+    }
+    const [cv, fingerprint, cBytes] = await Promise.all([
+        ccVersionOnce(driver.argv),
+        runtimeFingerprint(rtDir),
+        readFile(opts.cPath),
+    ]);
+    // The key sees the full command line with the two program-specific paths
+    // normalized out (their CONTENT is what matters: the C bytes are hashed,
+    // the out path is where the result lands). Runtime and vendor paths stay
+    // verbatim — their contents are covered by the fingerprint and the pin.
+    const identityArgs = buildArgs((p) => p).map((a) => a === opts.cPath ? "<program.c>" : a === opts.outPath ? "<out>" : a);
+    const key = createHash("sha256")
+        .update("bin-v1\0")
+        // The driver spelling joins the version string: `zig cc --version`
+        // reports the clang underneath and could otherwise collide with a
+        // same-version host clang.
+        .update(ccName).update("\0")
+        .update(cv).update("\0")
+        .update(fingerprint).update("\0")
+        .update(identityArgs.join("\x1f")).update("\0")
+        .update(cBytes)
+        .digest("hex");
+    const binDir = join(root, "bin");
+    const cachedBin = join(binDir, key);
+    try {
+        // NEVER copy over outPath in place: overwriting an already-executed
+        // signed binary invalidates the kernel's per-vnode code-signature cache
+        // on macOS and the next exec dies with SIGKILL. Copy to a fresh inode
+        // and rename it into place instead.
+        const tmpOut = `${opts.outPath}.hit-${process.pid}-${Math.random().toString(36).slice(2)}`;
+        await copyFile(cachedBin, tmpOut);
+        await chmod(tmpOut, 0o755);
+        await rename(tmpOut, opts.outPath);
+        const now = new Date();
+        await utimes(cachedBin, now, now).catch(() => undefined); // LRU bump
+        return; // hit: clang skipped entirely
+    }
+    catch {
+        /* miss — build below, then publish */
+    }
+    // Miss: link the program's own TU against cached per-flavor runtime
+    // objects. cflags reproduces exactly the option set every TU sees in the
+    // single invocation (the clang driver applies all options to all inputs).
+    const cflags = [
+        "-std=c11",
+        ...driver.targetArgs,
+        ...(opts.sanitize
+            ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
+            : ["-O2"]),
+        "-fno-math-errno",
+        "-Wno-deprecated-declarations",
+        "-I", rtDir,
+        ...(regex || dynamic ? ["-I", vendorEngineDir()] : []),
+        ...(zlibObjects.length > 0 ? ["-I", vendorZlibDir()] : []),
+        ...(curlStubDir !== null ? ["-I", join(vendorCurlDir(), "include")] : []),
+        ...(tlsArchive !== null ? ["-I", join(vendorTlsDir(), "include")] : []),
+        ...(dynamic ? ["-DSCR_DYNAMIC"] : []),
+    ];
+    // Collect the runtime sources this build actually compiles (the same
+    // conditionals as the command line, by construction).
+    const rtInputs = [];
+    buildArgs((p) => {
+        rtInputs.push(p);
+        return p;
+    });
+    let objects = null;
+    try {
+        objects = await ensureRuntimeObjects(root, driver.argv, cflags, rtInputs, `obj-v1\0${ccName}\0${cv}\0${fingerprint}\0`);
+    }
+    catch {
+        objects = null; // cache trouble is never a build failure
+    }
+    await runClang(buildArgs((p) => objects?.get(p) ?? p));
+    try {
+        await mkdir(binDir, { recursive: true });
+        const tmp = join(binDir, `.tmp-${key.slice(0, 8)}-${process.pid}-${Math.random().toString(36).slice(2)}`);
+        await copyFile(opts.outPath, tmp);
+        await chmod(tmp, 0o755);
+        await rename(tmp, cachedBin);
+        await pruneCache(root);
+    }
+    catch {
+        /* publishing is best-effort */
+    }
+}
+//# sourceMappingURL=cc.js.map