@scriptc/compiler 0.0.31 → 0.0.32

package/ambient/scriptc-node-fallback.d.ts

@@ -2378,7 +2378,7 @@ declare module "tls" {
   /** The CA-store introspection surface (scr_tls_ca.c): per-type cached
    * PEM string arrays. The host bundle stands in for Node's compiled-in
    * Mozilla roots ('bundled', and rootCertificates) AND the platform
-   * store ('system') — the /etc/ssl/cert.pem stance, documented;
+   * store ('system') — the Windows certificate stores or POSIX bundle probe;
    * 'extra' reads NODE_EXTRA_CA_CERTS. An unknown type string throws
    * Node's ERR_INVALID_ARG_VALUE TypeError. */
   export function getCACertificates(type?: string): string[];

package/dist/backend/cc.d.ts

@@ -186,11 +186,11 @@ export interface CcOptions {
     tls?: boolean;
     /** The program uses the CA-store introspection surface (moduleUsesTlsCa
      * on the IR — getCACertificates / rootCertificates /
-     * setDefaultCACertificates): compiles scr_tls_ca.c, plain PEM-block
-     * bookkeeping with NO mbedTLS dependency, so an introspection-only
-     * binary never builds the archive. The unit also compiles whenever
-     * `tls` does — scr_tls.c consults its default-set override for the
-     * client trust anchors. */
+     * setDefaultCACertificates): compiles scr_tls_ca.c, PEM-block bookkeeping
+     * plus the platform certificate-store reader on Windows, with NO mbedTLS
+     * dependency, so an introspection-only binary never builds the archive.
+     * The unit also compiles whenever `tls` does — scr_tls.c consults its
+     * default-set override and shared Windows-certificate enumerator. */
     tlsCa?: boolean;
 }
 /** Structured compiler-driver failure. Most callers still let this surface
@@ -202,6 +202,12 @@ export declare class CcCompileError extends Error {
     readonly stderr: string;
     constructor(driver: string, stderr: string, message: string);
 }
+/** Preserve the useful output from a failed compiler/tool invocation. Node's
+ * execFile error exposes stderr and stdout independently, but either stream
+ * may be present as an empty string. Prefer compiler diagnostics, retain a
+ * non-standard stdout diagnostic when that is all the tool emitted, and only
+ * then fall back to the process error itself. */
+export declare function subprocessFailureDetail(err: unknown): string;
 export declare function runtimeSrcDir(): string;
 export interface CcDriver {
     /** The compiler argv prefix: ["clang"] (default) or ["zig", "cc"]. */

package/dist/backend/cc.js

@@ -169,6 +169,30 @@ export class CcCompileError extends Error {
         this.name = "CcCompileError";
     }
 }
+/** Preserve the useful output from a failed compiler/tool invocation. Node's
+ * execFile error exposes stderr and stdout independently, but either stream
+ * may be present as an empty string. Prefer compiler diagnostics, retain a
+ * non-standard stdout diagnostic when that is all the tool emitted, and only
+ * then fall back to the process error itself. */
+export function subprocessFailureDetail(err) {
+    const failure = err;
+    const output = (value) => {
+        const text = Buffer.isBuffer(value) ? value.toString("utf8") : value ?? "";
+        return text.trim().length > 0 ? text.trimEnd() : "";
+    };
+    const stderr = output(failure.stderr);
+    const stdout = output(failure.stdout);
+    if (stderr !== "" && stdout !== "")
+        return `${stderr}\n\ncompiler stdout:\n${stdout}`;
+    if (stderr !== "")
+        return stderr;
+    if (stdout !== "")
+        return `compiler stdout:\n${stdout}`;
+    if (typeof failure.message === "string" && failure.message.trim() !== "") {
+        return failure.message;
+    }
+    return String(err);
+}
 export function runtimeSrcDir() {
     const testRoot = process.env["SCRIPTC_TEST_RUNTIME_SRC_DIR"];
     if (testRoot !== undefined)
@@ -611,7 +635,7 @@ async function ensureEngineArchive(sanitize, driver, buildIdentity, cacheRoot =
                     "Install cmake (e.g. `brew install cmake`) and retry. Static builds do not need it.");
             }
             throw new Error(`cmake failed configuring the embedded engine (${vendor}).\n\n` +
-                `${err.stderr ?? String(err)}`);
+                subprocessFailureDetail(err));
         }
         await execFileAsync("cmake", [
             "--build", buildDir,
@@ -1161,7 +1185,7 @@ export async function compileLibArchive(opts) {
                     await execFileAsync(driver.argv[0] ?? "clang", args);
                 }
                 catch (err) {
-                    const stderr = err.stderr ?? String(err);
+                    const stderr = subprocessFailureDetail(err);
                     throw new Error(`${driver.argv.join(" ")} failed compiling ${src} for the library archive.\n` +
                         `This is a scriptc bug (generated/runtime C should always compile) unless the compiler itself is missing/broken.\n\n${stderr}`);
                 }
@@ -1343,7 +1367,7 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, programObject, s
             await execFileAsync(argv[0], [...argv.slice(1)]);
         }
         catch (err) {
-            const stderr = err.stderr ?? String(err);
+            const stderr = subprocessFailureDetail(err);
             throw new Error(`${argv[0]} failed while localizing the library archive's runtime symbols (abi.localize_runtime).\n` +
                 `Runtime symbol localization needs the ${platform === "darwin" ? "host toolchain's ld" : driver.target === null ? "host toolchain's ld and objcopy" : "cross driver's relocatable link"} beside the C compiler.\n\n${stderr}`);
         }
@@ -2562,6 +2586,7 @@ export async function compileC(opts) {
     const net = (opts.net ?? false) || nativeFetch || netIsland;
     const http = (opts.http ?? false) || nativeFetch || netIsland;
     const tls = (opts.tls ?? false) || nativeFetch || netIsland;
+    const tlsCa = (opts.tlsCa ?? false) || tls;
     const driver = resolveCc();
     // Mobile triples produce library archives, never standalone executables:
     // the executable-lane runtime (event loop, sockets, child processes) is
@@ -2795,19 +2820,23 @@ export async function compileC(opts) {
         ...(opts.nodeTest ? [rt(join(rtDir, "scr_test.c"))] : []),
         // The CA-store unit rides its own gate OR the tls one: scr_tls.c
         // references its default-set override unconditionally.
-        ...(opts.tlsCa || tls ? [rt(join(rtDir, "scr_tls_ca.c"))] : []),
+        ...(tlsCa ? [rt(join(rtDir, "scr_tls_ca.c"))] : []),
         ...(tlsArchive
             ? [
                 "-I", join(vendorTlsDir(), "include"),
                 rt(join(rtDir, "scr_tls.c")),
                 tlsArchive,
-                // mbedTLS's win32 entropy poll is BCryptGenRandom (bcrypt.h) —
-                // an import the unconditional win32 libs above don't carry.
+                // mbedTLS's win32 entropy poll is BCryptGenRandom (bcrypt.h).
+                // The unconditional win32 libs above do not carry it.
                 // Never present on the default path, so the historical TLS
                 // link line cannot change.
                 ...(targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
             ]
             : []),
+        // scr_tls_ca.c enumerates and PEM-encodes Windows system-store entries.
+        // This is independent of the mbedTLS archive: getCACertificates-only
+        // programs need crypt32 too, while TLS programs imply the CA unit.
+        ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
         // Static fetch is the engine-free half of scr_fetch.c. Dynamic builds
         // compile the same source beside scr_island.c below, where its
         // SCR_DYNAMIC half installs the full web surface.
@@ -2917,7 +2946,7 @@ export async function compileC(opts) {
             await execFileAsync(driver.argv[0] ?? "clang", [...driver.argv.slice(1), ...args]);
         }
         catch (err) {
-            const stderr = err.stderr ?? String(err);
+            const stderr = subprocessFailureDetail(err);
             const guidance = (opts.linkInputs?.length ?? 0) > 0 ||
                 (opts.systemLibraries?.length ?? 0) > 0
                 ? "This build includes native FFI link inputs. Check that every symbol and system library exists, " +
@@ -3000,6 +3029,7 @@ export async function compileC(opts) {
             ? ["-ladvapi32", "-liphlpapi", "-lws2_32"]
             : []),
         ...(tls && targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
+        ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),
         ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null ? ["-lz"] : []),
@@ -3014,6 +3044,7 @@ export async function compileC(opts) {
             ? ["-ladvapi32", "-liphlpapi", "-lws2_32"]
             : []),
         ...(tls && targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
+        ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
         ...(curlStubDir !== null ? [`-L${curlStubDir}`] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),