@scriptc/compiler 0.0.35 → 0.1.1

package/dist/backend/{cc.js → native-toolchain.js}

@@ -1,16 +1,25 @@
+import { InternalCompilerError } from "../errors.js";
 import { execFile, spawnSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { constants as fsConstants, existsSync, readdirSync } from "node:fs";
 import { createRequire } from "node:module";
-import { access, chmod, copyFile, link, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat, unlink, utimes, writeFile } from "node:fs/promises";
+import { access, chmod, copyFile, link, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { localizeElfObject, mergeAndLocalizeCoffObjects } from "./object-localize.js";
+import { createVendorArchives, MBEDTLS_VERSION, QJS_COMMIT, ZLIB_VERSION, } from "./vendor-archives.js";
+import { cacheDigestPath, cacheRootDir, copyValidCachedFile, ensurePrivateCacheRoot, fileDigest, fileExists, installArtifact, privateSiblingPath, protectCachedArtifact, pruneCache, publishCachedFile, validCachedFile, } from "./build-cache.js";
+export { buildCacheRoot, prepareBuildCacheRoot, pruneBuildCache, resolveBuildCacheRoot, } from "./build-cache.js";
 const execFileAsync = promisify(execFile);
-const CC_IMPLEMENTATION_PATH = fileURLToPath(import.meta.url);
+const NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH = fileURLToPath(import.meta.url);
+const NATIVE_RECIPE_IMPLEMENTATION_PATHS = [
+    NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH,
+    join(dirname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH), `build-cache${extname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH)}`),
+    join(dirname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH), `vendor-archives${extname(NATIVE_TOOLCHAIN_IMPLEMENTATION_PATH)}`),
+];
 /** Test lanes run against one immutable checkout and one immutable toolchain
  * for the lifetime of each Vitest worker. Production deliberately rediscovers
  * compiler/linker inputs on every invocation, but doing that thousands of
@@ -35,22 +44,43 @@ function stableTestMemo(cache, key, probe) {
     });
     return pending;
 }
-const RUNTIME_SOURCES = ["scr_number.c", "scr_string.c", "scr_array.c", "scr_bytes.c", "scr_bytes_io.c", "scr_map.c", "scr_closure.c", "scr_ffi.c", "scr_object.c", "scr_union.c", "scr_exception.c", "scr_error.c", "scr_console.c", "scr_lib.c", "scr_path.c", "scr_url.c", "scr_json.c", "scr_async.c", "scr_child.c", "scr_cycle.c"];
-/** The pinned quickjs-ng snapshot under packages/runtime/vendor/quickjs-ng
- * (see vendor/README.md — update both together). Keys the archive cache so
- * a vendor bump can never reuse a stale engine build. */
-const QJS_COMMIT = "3c8f3d68953955950074c41c6e4d999562ae82a7";
-/** The pinned mbedTLS snapshot under packages/runtime/vendor/mbedtls (see
- * vendor/README.md — update both together). Keys the archive cache so a
- * vendor bump can never reuse a stale TLS build, and joins the runtime
- * fingerprint so cached binaries re-key too. */
-const MBEDTLS_VERSION = "3.6.7";
-/** The pinned zlib snapshot under packages/runtime/vendor/zlib (see
- * vendor/README.md — update both together). Keys the per-target object
- * cache and joins the runtime fingerprint. Host builds never compile it —
- * they keep the historical system `-lz` link; the vendored copy exists so
- * zlib-using programs CROSS-compile (zig has no target sysroot libz). */
-const ZLIB_VERSION = "1.3.1";
+export const EXECUTABLE_RUNTIME_SOURCES = ["scr_number.c", "scr_string.c", "scr_array.c", "scr_bytes.c", "scr_bytes_io.c", "scr_map.c", "scr_closure.c", "scr_ffi.c", "scr_object.c", "scr_union.c", "scr_exception.c", "scr_error.c", "scr_console.c", "scr_lib.c", "scr_path.c", "scr_url.c", "scr_json.c", "scr_async.c", "scr_child.c", "scr_cycle.c"];
+/**
+ * Per-executable section-elimination recipe. This belongs beside the native
+ * driver rather than a particular build path: one-shot compilation, cached
+ * runtime objects, external object recipes, and runtime packs must all agree
+ * on what their final executable linker is allowed to discard.
+ *
+ * Archives and compile-only object/library recipes deliberately do not use
+ * the link half. In particular, `--lib` preserves its established object and
+ * archive contract; section GC is an executable-link optimization only.
+ */
+export function executableSectionEliminationFlags(platform) {
+    switch (platform) {
+        case "darwin":
+            // ld64's symbol subsections make this sufficient for ordinary C/LLVM
+            // objects. Do not attach it only to --dynamic: static programs have the
+            // same unreachable runtime sections.
+            return { compile: [], link: ["-Wl,-dead_strip"] };
+        case "linux":
+            return {
+                compile: ["-ffunction-sections", "-fdata-sections"],
+                link: ["-Wl,--gc-sections"],
+            };
+        case "win32":
+            // clang's MinGW driver forwards this to GNU-flavor ld/lld. A direct
+            // local lld-link invocation instead uses /OPT:REF, but scriptc only
+            // drives the compiler's GNU-flavor route here.
+            return {
+                compile: ["-ffunction-sections", "-fdata-sections"],
+                link: ["-Wl,--gc-sections"],
+            };
+        // WASI has a distinct linker/runtime contract. Keep its existing object
+        // layout until its linker invocation is validated separately.
+        default:
+            return { compile: [], link: [] };
+    }
+}
 /** Environment variables consumed by clang, its linker/subtools, or the
  * platform SDK selection. They are implicit command-line inputs: changing one
  * must never reuse an artifact produced under the old toolchain posture. */
@@ -227,6 +257,12 @@ export function runtimeSrcDir() {
     const require = createRequire(import.meta.url);
     return join(dirname(require.resolve("@scriptc/runtime/package.json")), "src");
 }
+/** Whether the selected compiler driver is Zig. This is deliberately based on
+ * the executable prefix rather than target presence: targetless Zig is still
+ * a Zig build, while target presence is only the platform/target contract. */
+export function isZigDriver(driver) {
+    return driver.argv[0] === "zig";
+}
 /* ── mobile targets (library mode) ─────────────────────────────────────────
  * Three mobile triples are admitted, and only for LIBRARY-MODE archive
  * builds — the consuming pattern is an embedding app linking the archive,
@@ -424,9 +460,9 @@ export function resolveCc(env = process.env, hostPlatform = process.platform) {
     }
     if (target === "")
         return { argv: ["zig", "cc"], target: null, zigTarget: null, ...hostArgs };
-    if (target.includes("wasi") && target !== "wasm32-wasi") {
-        throw new Error(`unsupported WASI target '${target}' (supported: wasm32-wasi)`);
-    }
+    // Validate the target spelling before any SDK/sysroot discovery. Source
+    // emission uses the same pure classifier without resolving this driver.
+    configuredTargetPlatform(env, hostPlatform);
     const mobileRefusal = mobileTargetRefusal(target, hostPlatform);
     if (mobileRefusal !== null)
         throw new Error(mobileRefusal);
@@ -497,7 +533,7 @@ export function resolveCc(env = process.env, hostPlatform = process.platform) {
 }
 /** Musl intentionally has no predefined libc macro. The explicit Zig target
  * is therefore the source of truth for selecting its small runtime shim. */
-export function isMuslTarget(driver) {
+function isMuslTarget(driver) {
     return driver.target?.includes("linux-musl") ?? false;
 }
 /** The OS the produced binary runs on: the triple's OS under SCRIPTC_TARGET,
@@ -506,21 +542,37 @@ export function isMuslTarget(driver) {
  * analyze(): the FRONTEND consults it too (path.sep / os.EOL literals and
  * the path-module binding follow the target — a win32 triple compiles
  * Node-on-Windows semantics, path.win32 backing the bare module). */
-export function targetPlatform(driver) {
-    if (driver.target === null)
-        return process.platform;
-    if (driver.target.includes("wasi"))
+export function configuredTargetPlatform(env = process.env, hostPlatform = process.platform) {
+    const target = env["SCRIPTC_TARGET"] ?? "";
+    if (target === "")
+        return hostPlatform;
+    if (target === "wasm32-wasi")
         return "wasi";
+    if (target.includes("wasi")) {
+        throw new Error(`unsupported WASI target '${target}' (supported: wasm32-wasi)`);
+    }
     // iOS is a darwin-family target: Mach-O objects, ld64 localization,
     // POSIX path/EOL semantics. Android falls to the linux arm below —
     // bionic is a linux libc and its archives are ordinary ELF.
-    if (isIosTarget(driver.target))
+    if (isIosTarget(target))
         return "darwin";
-    if (driver.target.includes("linux"))
+    if (isAndroidTarget(target))
         return "linux";
-    if (driver.target.includes("windows"))
+    if (/(?:^|-)(?:ios|tvos|watchos|visionos|android)/.test(target)) {
+        throw new Error(`unsupported mobile target '${target}' (supported: ${MOBILE_LIBRARY_TARGETS.join(", ")})`);
+    }
+    if (target.includes("linux"))
+        return "linux";
+    if (target.includes("windows"))
         return "win32";
-    return driver.target.includes("macos") || driver.target.includes("darwin") ? "darwin" : "other";
+    if (target.includes("macos") || target.includes("darwin"))
+        return "darwin";
+    throw new Error(`unsupported target '${target}' (supported OS families: linux, windows, macos/darwin, wasm32-wasi)`);
+}
+export function targetPlatform(driver) {
+    if (driver.target === null)
+        return process.platform;
+    return configuredTargetPlatform({ SCRIPTC_TARGET: driver.target });
 }
 /** Architecture identity for host-native cache entries. Explicit cross targets
  * already name their complete target triple; native builds need the process
@@ -529,472 +581,6 @@ export function targetPlatform(driver) {
 export function cacheTargetIdentity(driver, hostPlatform = process.platform, hostArch = process.arch) {
     return driver.target === null ? `native:${hostPlatform}:${hostArch}` : `cross:${driver.target}`;
 }
-function vendorEngineDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "quickjs-ng");
-}
-/** Vendor prerequisites follow the per-user build root when persistent cache
- * validation succeeds. Keeping generated objects out of node_modules makes
- * npm installations, read-only package stores, and explicit cache warming all
- * share one writable cache. The test-only override remains the first choice;
- * callers without a validated root retain the historical package-local
- * default (ordinary builds give those callers a private transient root). */
-function vendorBuildCacheRoot(buildRoot) {
-    const testRoot = process.env["SCRIPTC_TEST_VENDOR_CACHE_DIR"];
-    if (testRoot !== undefined)
-        return resolve(testRoot);
-    return buildRoot === undefined
-        ? join(runtimeSrcDir(), "..", "vendor", ".cache")
-        : join(buildRoot, "vendor");
-}
-/** Cross targets already carry their architecture in the explicit triple.
- * Host-native prerequisites need the same separation: a checkout/package can
- * be used by both arm64 Node and Rosetta/x64 Node on macOS. */
-export function vendorCacheTargetFlavor(driver, hostPlatform = process.platform, hostArch = process.arch) {
-    return driver.target === null ? `native-${hostPlatform}-${hostArch}` : driver.target;
-}
-/** Vendor prerequisites live outside the content-addressed build root, so
- * their directory name must carry the environment, resolved compiler, owned
- * source bytes, and build-recipe identity of the artifacts that consume them.
- * The short digest keeps the cache path readable while preventing build-order
- * and cross-installation contamination. */
-export function vendorCacheBuildIdentity(environmentFingerprint, compilerIdentity, nativeSourceIdentity) {
-    return createHash("sha256")
-        .update("vendor-toolchain-v2\0")
-        .update(environmentFingerprint)
-        .update("\0")
-        .update(compilerIdentity)
-        .update("\0")
-        .update(nativeSourceIdentity)
-        .digest("hex")
-        .slice(0, 20);
-}
-const vendorCompilerIdentityFallbacks = new Map();
-async function currentVendorCacheBuildIdentity(driver, environmentFingerprint) {
-    // Native vendor recipes additionally use bare clang/ar; cross
-    // recipes use the zig driver for compilation and `zig ar`. Include every
-    // executable that can affect the cached prerequisite, not just the
-    // final program's driver.
-    const commands = [
-        driver.argv[0] ?? "clang",
-        ...(driver.target === null ? ["clang", "ar"] : []),
-    ].filter((command, index, all) => all.indexOf(command) === index);
-    const identities = await Promise.all(commands.map(async (command) => {
-        const spellingKey = `${environmentFingerprint}\0${command}`;
-        const resolved = await resolvedToolIdentity(command);
-        if (resolved !== null)
-            vendorCompilerIdentityFallbacks.set(spellingKey, resolved);
-        return [
-            command,
-            resolved ??
-                vendorCompilerIdentityFallbacks.get(spellingKey) ??
-                `<unresolved>\0${command}`,
-        ].join("\0");
-    }));
-    return vendorCacheBuildIdentity(environmentFingerprint, identities.join("\x1f"), await runtimeFingerprint(runtimeSrcDir()));
-}
-function engineArchivePath(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    return join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-${flavor}`, "libqjs.a");
-}
-async function fileExists(path) {
-    return stat(path).then((s) => s.isFile(), () => false);
-}
-/** Vendor prerequisites are shared persistent cache entries, so they carry
- * the same adjacent content digest as runtime objects and complete artifacts.
- * Missing/invalid pairs are rebuilt. Do not remove them during validation: a
- * concurrent publisher installs data before its digest, and that temporary
- * invalid window must not let a reader unlink the publisher's data. */
-async function validVendorArtifact(path) {
-    return validCachedFile(path);
-}
-function protectCachedArtifact(paths, path) {
-    paths?.add(path);
-    paths?.add(cacheDigestPath(path));
-}
-function privateSiblingPath(destination, label) {
-    // Keep the temporary component independent of the caller's basename. A
-    // destination can validly consume the filesystem's entire NAME_MAX budget;
-    // appending or prepending that basename would make the atomic install fail.
-    return join(dirname(destination), `.scriptc-${label}-${process.pid}-${Math.random().toString(36).slice(2)}`);
-}
-/** Copy an artifact through a private sibling name, then atomically install it.
- * The source can live on another filesystem (cache/temp roots commonly do), so
- * a direct rename is not portable. */
-async function installArtifact(source, destination, mode) {
-    await mkdir(dirname(destination), { recursive: true });
-    const tmp = privateSiblingPath(destination, "install");
-    try {
-        await copyFile(source, tmp);
-        if (mode !== undefined)
-            await chmod(tmp, mode);
-        await rename(tmp, destination);
-    }
-    finally {
-        await rm(tmp, { force: true }).catch(() => undefined);
-    }
-}
-/** Publish one finished vendor prerequisite from disposable build scratch.
- * The shared data and digest use the ordinary atomic cache publisher.
- * Concurrent builders produce equivalent bytes; on platforms where rename
- * cannot replace the winner, accept only a checksum-verified winner. */
-async function publishVendorArtifact(source, destination) {
-    for (let attempt = 0; attempt < 2; attempt++) {
-        try {
-            await publishCachedFile(source, destination);
-        }
-        catch (error) {
-            // A concurrent equivalent publisher may have won on a platform where
-            // rename cannot replace an existing file. Accept only its verified pair.
-            if (await validCachedFile(destination))
-                return;
-            if (attempt > 0)
-                throw error;
-            // Otherwise the existing pair is genuinely stale/corrupt and blocked
-            // replacement (notably on Windows). Remove it only after a complete
-            // replacement is ready in private scratch, then retry once.
-            await Promise.all([
-                rm(destination, { force: true }).catch(() => undefined),
-                rm(cacheDigestPath(destination), { force: true }).catch(() => undefined),
-            ]);
-            continue;
-        }
-        // Close publication races where another writer replaced only one member
-        // of the pair between this publisher's two atomic renames.
-        if (await validCachedFile(destination))
-            return;
-    }
-    throw new Error(`vendor cache publication failed integrity validation: ${destination}`);
-}
-/** Pin cache-backed vendor inputs under an invocation-private directory before
- * linking/archiving. The shared LRU may unlink their cache names at any time;
- * hard links (or copies where links are unavailable) keep active inputs alive.
- * A sweep can race the initial pin, so rematerialize and retry once. */
-async function stageVendorInputs(materialize, stageDir) {
-    let lastError = new Error("vendor cache input disappeared while staging");
-    for (let attempt = 0; attempt < 2; attempt++) {
-        await rm(stageDir, { recursive: true, force: true }).catch(() => undefined);
-        await mkdir(stageDir, { recursive: true });
-        const sources = await materialize();
-        try {
-            const now = new Date();
-            return await Promise.all(sources.map(async (source) => {
-                const destination = join(stageDir, basename(source));
-                try {
-                    await link(source, destination);
-                }
-                catch {
-                    await copyFile(source, destination);
-                }
-                // Vendor prerequisites share the cache root's mtime-based LRU. A
-                // successful stage is a cache read, so promote the shared source name
-                // best-effort (it may have raced an eviction after the hard link).
-                await utimes(source, now, now).catch(() => undefined);
-                return destination;
-            }));
-        }
-        catch (error) {
-            lastError = error;
-        }
-    }
-    throw lastError;
-}
-/** The engine archive for one flavor, built lazily on the first --dynamic
- * compile and cached under <build-cache>/vendor/<commit>-<flavor>-<target>-<toolchain>/ — unlike
- * the runtime's own sources (recompiled every build, ~100ms), the engine is
- * far too big to rebuild per compile. The plain flavor is ALWAYS MinSizeRel
- * regardless of the program's optimization level: measured binary delta is
- * ~620KB vs ~900KB at -O2, and eval-in-an-island workloads don't earn the
- * difference. The asan flavor (Debug + QJS_ENABLE_ASAN) exists so the
- * sanitized test lane checks engine interop under instrumentation.
- *
- * Concurrency: parallel first builds (e.g. test workers) each build in a
- * private temp dir and publish with an atomic rename — first one wins,
- * losers discard their work and use the winner's archive.
- *
- * The qjs library target is just four TUs (QJS_ENGINE_SOURCES), so both host
- * and cross builds use the same direct per-TU recipe. This removes CMake from
- * the runtime dependency set and lets cache warming compile exactly the
- * archive a later program consumes. Host builds use clang + ar; cross builds
- * use the selected zig driver + zig ar. */
-async function ensureEngineArchive(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const archive = engineArchivePath(sanitize, driver, buildIdentity, cacheRoot);
-    const cacheDir = dirname(archive);
-    if (await validVendorArtifact(archive))
-        return archive;
-    return buildEngineArchiveDirect(sanitize, driver, cacheRoot, cacheDir);
-}
-/** The qjs library target's source list (CMakeLists.txt `qjs_sources` with
- * QJS_BUILD_LIBC off — cutils is header-only): the cross-build recipe
- * compiles exactly these. */
-const QJS_ENGINE_SOURCES = ["dtoa.c", "libregexp.c", "libunicode.c", "quickjs.c"];
-/** The engine archive for one target, per-TU compiler invocations plus ar.
- * The flags mirror what the former CMake
- * configurations apply to the qjs library target: gnu11 (CMAKE_C_EXTENSIONS
- * ON), hidden visibility, -funsigned-char, -DQUICKJS_NG_BUILD and
- * -D_GNU_SOURCE (qjs_defines; linux targetArgs already carry the latter),
- * then MinSizeRel (-Os -DNDEBUG) for plain or Debug+QJS_ENABLE_ASAN
- * (-O0 -ggdb -fno-omit-frame-pointer -fsanitize=address
- * -fno-sanitize-recover=all) for asan. Same atomic-rename publish as every
- * vendor cache. */
-async function buildEngineArchiveDirect(sanitize, driver, cacheRoot, cacheDir) {
-    const vendor = vendorEngineDir();
-    const archive = join(cacheDir, "libqjs.a");
-    const compileArgv = driver.target === null ? ["clang"] : driver.argv;
-    const arArgv = driver.target === null ? ["ar"] : [...driver.argv.slice(0, 1), "ar"];
-    const cflags = [
-        "-std=gnu11",
-        ...driver.targetArgs,
-        "-fvisibility=hidden",
-        "-funsigned-char",
-        "-DQUICKJS_NG_BUILD",
-        "-D_GNU_SOURCE",
-        // CMake's qjs_defines on WIN32 (quickjs.c's own _WIN32 arms cover the
-        // rest — timezoneapi, intrin, cutils.h's _msize usable-size probe).
-        ...(targetPlatform(driver) === "win32" ? ["-DWIN32_LEAN_AND_MEAN", "-D_WIN32_WINNT=0x0601"] : []),
-        ...(sanitize
-            ? ["-O0", "-ggdb", "-fno-omit-frame-pointer", "-fsanitize=address", "-fno-sanitize-recover=all", "-DQJS_ENABLE_ASAN"]
-            : ["-Os", "-DNDEBUG"]),
-        "-I", vendor,
-    ];
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(tmpdir(), `scriptc-vendor-qjs-${driver.target ?? "host"}-`));
-    try {
-        const width = Math.min(QJS_ENGINE_SOURCES.length, availableParallelism());
-        for (let i = 0; i < QJS_ENGINE_SOURCES.length; i += width) {
-            await Promise.all(QJS_ENGINE_SOURCES.slice(i, i + width).map((src) => execFileAsync(compileArgv[0] ?? "clang", [...compileArgv.slice(1), ...cflags, "-c", join(vendor, src), "-o", join(buildDir, `${basename(src, ".c")}.o`)], { cwd: buildDir })));
-        }
-        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libqjs.a"), ...QJS_ENGINE_SOURCES.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
-        await publishVendorArtifact(join(buildDir, "libqjs.a"), archive);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return archive;
-}
-/** The vendor sources behind static-build regex support: quickjs-ng's
- * libregexp and its unicode tables (cutils is header-only). Deliberately
- * NOT the engine — a regex-using static binary links ~110KB of matcher,
- * never the ~620KB island. */
-const LRE_SOURCES = ["libregexp.c", "libunicode.c"];
-function lreObjectPaths(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const cacheDir = join(cacheRoot, `${QJS_COMMIT.slice(0, 12)}-lre-${flavor}`);
-    return LRE_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
-}
-/** The libregexp objects for one flavor, compiled lazily on the first
- * regex-using static build (~1s) and cached like the engine archive —
- * <build-cache>/vendor/<commit>-lre-<flavor>-<target>-<toolchain>/*.o — with the same atomic-rename
- * publish (parallel first builds race safely; losers discard their work).
- * Plain is -Os (size class matters: the regex fence pins regex-using
- * binaries well under the engine class); asan matches the final link so
- * the sanitized lane instruments the matcher too. Cross targets get their
- * own flavor directory, compiled with the SCRIPTC_CC driver and its target
- * args — libregexp/libunicode are plain C11, so the cross story is exactly
- * the runtime sources' (no host-built inputs); vendored SOURCES are
- * untouched, only the build wiring knows about targets. */
-async function ensureLreObjects(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    // The flavor keys the DRIVER as well as the target: a zig-cc-built object
-    // set must never be handed to a clang link (or vice versa) off a shared
-    // cache directory. Native targets include host platform + architecture so
-    // arm64 and Rosetta processes never exchange Mach-O objects.
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const vendor = vendorEngineDir();
-    const objects = lreObjectPaths(sanitize, driver, buildIdentity, cacheRoot);
-    if ((await Promise.all(objects.map(validVendorArtifact))).every(Boolean))
-        return objects;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(tmpdir(), `scriptc-vendor-lre-${flavor}-`));
-    try {
-        // One -c per invocation: zig's COFF driver rejects multiple -c inputs
-        // in a single command ("coff does not support linking multiple
-        // objects"); per-file compiles produce the identical objects on every
-        // target.
-        for (const f of LRE_SOURCES) {
-            await execFileAsync(driver.argv[0] ?? "clang", [
-                ...driver.argv.slice(1),
-                "-std=c11",
-                ...driver.targetArgs,
-                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-                "-I", vendor,
-                "-c", join(vendor, f),
-                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
-            ], { cwd: buildDir });
-        }
-        await Promise.all(objects.map((destination) => publishVendorArtifact(join(buildDir, basename(destination)), destination)));
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return objects;
-}
-function vendorZlibDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "zlib");
-}
-/** The vendored zlib TUs behind CROSS-target zlib support: every root *.c
- * except the gzFile file-I/O units (gz*.c — nothing in scr_zlib.c
- * references the gzFile API, and those TUs alone want unistd/io headers).
- * Host builds never touch this list — they link the system libz. */
-const ZLIB_SOURCES = ["adler32.c", "compress.c", "crc32.c", "deflate.c", "infback.c", "inffast.c", "inflate.c", "inftrees.c", "trees.c", "uncompr.c", "zutil.c"];
-function zlibObjectPaths(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const cacheDir = join(cacheRoot, `zlib-${ZLIB_VERSION}-${flavor}`);
-    return ZLIB_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
-}
-/** The zlib objects for one flavor, compiled lazily on the first zlib-using
- * CROSS build (~1s) and cached like the lre objects —
- * <build-cache>/vendor/zlib-<version>-<flavor>-<target>-<toolchain>/*.o — with the same atomic-rename
- * publish (parallel first builds race safely; losers discard their work).
- * Plain is -Os, asan matches the final link so the sanitized lane
- * instruments the codec too. The flavor keys the driver and target exactly
- * like the lre flavor: only cross builds call this today, but the keying
- * must never hand a zig-built object set to a clang link off a shared
- * directory. */
-async function ensureZlibObjects(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = (sanitize ? "asan" : "plain") +
-        (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
-        `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const vendor = vendorZlibDir();
-    const objects = zlibObjectPaths(sanitize, driver, buildIdentity, cacheRoot);
-    if ((await Promise.all(objects.map(validVendorArtifact))).every(Boolean))
-        return objects;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(tmpdir(), `scriptc-vendor-zlib-${flavor}-`));
-    try {
-        // One -c per invocation, the lre recipe (zig's COFF driver rejects
-        // multiple -c inputs in a single command).
-        for (const f of ZLIB_SOURCES) {
-            await execFileAsync(driver.argv[0] ?? "clang", [
-                ...driver.argv.slice(1),
-                "-std=c11",
-                ...driver.targetArgs,
-                ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-                "-I", vendor,
-                "-c", join(vendor, f),
-                "-o", join(buildDir, f.replace(/\.c$/, ".o")),
-            ], { cwd: buildDir });
-        }
-        await Promise.all(objects.map((destination) => publishVendorArtifact(join(buildDir, basename(destination)), destination)));
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return objects;
-}
-function vendorCurlDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "curl");
-}
-/** Every libcurl function scr_fetch_curl.c references — the generated import
- * stub defines exactly these. A new curl call in scr_fetch_curl.c that is
- * missing here fails the CROSS link immediately with the symbol's name
- * (host builds resolve it from the real system libcurl and never look). */
-const CURL_STUB_SYMBOLS = [
-    "curl_easy_cleanup", "curl_easy_getinfo", "curl_easy_init", "curl_easy_setopt", "curl_easy_strerror",
-    "curl_free", "curl_global_cleanup", "curl_global_init",
-    "curl_multi_add_handle", "curl_multi_cleanup", "curl_multi_info_read", "curl_multi_init",
-    "curl_multi_perform", "curl_multi_poll", "curl_multi_remove_handle",
-    "curl_slist_append", "curl_slist_free_all",
-    "curl_url", "curl_url_cleanup", "curl_url_get", "curl_url_set",
-];
-function curlStubDirPath(driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    return join(cacheRoot, `curl-stub-${driver.target}-${buildIdentity}`);
-}
-/** The libcurl import stub for one CROSS target, generated lazily on the
- * first fetch-using cross build and cached like the zlib objects —
- * <build-cache>/vendor/curl-stub-<target>-<toolchain>/libcurl.so, atomic-rename publish. The
- * stub is empty definitions of CURL_STUB_SYMBOLS compiled `-shared` with
- * `-soname libcurl.so.4`: linking against it satisfies scr_fetch_curl.c's
- * references and records a plain `DT_NEEDED libcurl.so.4`, which the
- * TARGET system's real libcurl satisfies at load time (curl's unversioned
- * exports make the classic import-stub technique sound here — nothing
- * from the stub's bodies ever ships in the binary). One stub per target,
- * no sanitize flavor: the stub's code is never executed or instrumented,
- * and asan links against plain shared libraries freely. */
-async function ensureCurlStub(driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const cacheDir = curlStubDirPath(driver, buildIdentity, cacheRoot);
-    const lib = join(cacheDir, "libcurl.so");
-    if (await validVendorArtifact(lib))
-        return cacheDir;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(tmpdir(), "scriptc-vendor-curl-stub-"));
-    try {
-        const src = join(buildDir, "stub.c");
-        await writeFile(src, CURL_STUB_SYMBOLS.map((s) => `void ${s}(void) {}\n`).join(""));
-        await execFileAsync(driver.argv[0] ?? "clang", [
-            ...driver.argv.slice(1),
-            ...driver.targetArgs,
-            "-shared", "-fPIC",
-            "-Wl,-soname,libcurl.so.4",
-            src,
-            "-o", join(buildDir, "libcurl.so"),
-        ]);
-        await publishVendorArtifact(join(buildDir, "libcurl.so"), lib);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return cacheDir;
-}
-function vendorTlsDir() {
-    return join(runtimeSrcDir(), "..", "vendor", "mbedtls");
-}
-function tlsArchivePath(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    return join(cacheRoot, `mbedtls-${MBEDTLS_VERSION}-${flavor}`, "libmbedtls.a");
-}
-/** The mbedTLS archive for one flavor, compiled lazily on the first
- * TLS-using build (~15s over ~110 TUs, parallelized) and cached like the
- * engine archive — <build-cache>/vendor/mbedtls-<version>-<flavor>-<target>-<toolchain>/libmbedtls.a —
- * with the same atomic-rename publish (parallel first builds race safely;
- * losers discard their work). Plain is -Os (the TLS stack is link-gated
- * but still wants its size class small); asan matches the final link so
- * the sanitized lane instruments every TLS path too. No CMake: the stock
- * config builds every library/*.c standalone with clang, so the recipe is
- * per-TU `-c` compiles plus one `ar rcs` — vendored-build machinery the
- * lre-objects cache already established.
- *
- * SCRIPTC_TARGET adds a per-target cache flavor (the lre-objects story):
- * TUs compile with `zig cc -target <triple>` and the archive is packed
- * with `zig ar` (llvm-ar — the host BSD ar has no business indexing ELF
- * objects). Host builds keep the exact historical clang + ar recipe. */
-async function ensureTlsArchive(sanitize, driver, buildIdentity, cacheRoot = vendorBuildCacheRoot()) {
-    const flavor = `${sanitize ? "asan" : "plain"}-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
-    const compileArgv = driver.target !== null ? driver.argv : ["clang"];
-    const arArgv = driver.target !== null ? [...driver.argv.slice(0, 1), "ar"] : ["ar"];
-    const vendor = vendorTlsDir();
-    const archive = tlsArchivePath(sanitize, driver, buildIdentity, cacheRoot);
-    if (await validVendorArtifact(archive))
-        return archive;
-    await mkdir(cacheRoot, { recursive: true });
-    const buildDir = await mkdtemp(join(tmpdir(), `scriptc-vendor-mbedtls-${flavor}-`));
-    try {
-        const sources = (await readdir(join(vendor, "library")))
-            .filter((name) => !name.startsWith(".") && name.endsWith(".c"))
-            .sort();
-        const cflags = [
-            "-std=c11",
-            ...driver.targetArgs,
-            ...(sanitize ? ["-O1", "-fsanitize=address"] : ["-Os"]),
-            "-I", join(vendor, "include"),
-            "-I", join(vendor, "library"),
-        ];
-        const width = availableParallelism();
-        for (let i = 0; i < sources.length; i += width) {
-            await Promise.all(sources.slice(i, i + width).map((src) => execFileAsync(compileArgv[0] ?? "clang", [...compileArgv.slice(1), ...cflags, "-c", join(vendor, "library", src), "-o", join(buildDir, `${basename(src, ".c")}.o`)])));
-        }
-        await execFileAsync(arArgv[0] ?? "ar", [...arArgv.slice(1), "rcs", join(buildDir, "libmbedtls.a"), ...sources.map((s) => join(buildDir, `${basename(s, ".c")}.o`))]);
-        await publishVendorArtifact(join(buildDir, "libmbedtls.a"), archive);
-    }
-    finally {
-        await rm(buildDir, { recursive: true, force: true });
-    }
-    return archive;
-}
 /* ── library mode: the static-archive artifact ────────────────────────────
  * One `scriptc build --lib` invocation produces <name>.lib.a: the program TU
  * object plus exactly the runtime objects the program's IR gates in, every
@@ -1023,7 +609,7 @@ async function ensureTlsArchive(sanitize, driver, buildIdentity, cacheRoot = ven
 /** The library base: the executable lane's unconditional sources minus the
  * fiber/loop and child-process units, plus the library-mode TU. */
 const LIB_RUNTIME_SOURCES = [
-    ...RUNTIME_SOURCES.filter((f) => f !== "scr_async.c" && f !== "scr_child.c" && f !== "scr_ffi.c"),
+    ...EXECUTABLE_RUNTIME_SOURCES.filter((f) => f !== "scr_async.c" && f !== "scr_child.c" && f !== "scr_ffi.c"),
     "scr_library.c",
 ];
 function updateProgramShardCacheIdentity(hash, shards, publicSymbols, mergeIdentity) {
@@ -1094,6 +680,7 @@ async function resolveProgramShardMergeIdentity(driver) {
     return null;
 }
 export async function compileLibArchive(opts) {
+    clearCcCaches();
     const rtDir = runtimeSrcDir();
     const driver = resolveCc();
     const shardNames = new Set();
@@ -1160,7 +747,7 @@ export async function compileLibArchive(opts) {
         ? [...cflags, "-Wno-override-module"]
         : cflags;
     const programSourceExtension = opts.cPath.endsWith(".ll") ? ".ll" : ".c";
-    const arArgv = driver.argv[0] === "zig" ? [driver.argv[0], "ar"] : ["ar"];
+    const arArgv = isZigDriver(driver) ? [driver.argv[0], "ar"] : ["ar"];
     const cachePolicy = toolchainEnvironmentCachePolicy();
     const configuredCacheRoot = cacheRootDir();
     const toolchainEnv = toolchainEnvironmentFingerprint();
@@ -1171,15 +758,16 @@ export async function compileLibArchive(opts) {
     // search variables cannot affect it, but any mutable compilation input or
     // opaque compiler wrapper makes every persistent tier unsafe to reuse. An
     // opaque archiver narrows only the completed-archive tier below.
-    let root = opts.cacheIdentity === undefined || !persistentDriverCache
+    const cacheIdentity = opts.cacheIdentity;
+    let persistentCache = cacheIdentity === undefined || configuredCacheRoot === null || !persistentDriverCache
         ? null
-        : configuredCacheRoot;
-    if (root !== null) {
+        : { root: configuredCacheRoot, identity: cacheIdentity };
+    if (persistentCache !== null) {
         try {
-            await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
+            await ensurePrivateCacheRoot(persistentCache.root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
         }
         catch {
-            root = null;
+            persistentCache = null;
         }
     }
     let implicitToolchain = null;
@@ -1195,10 +783,10 @@ export async function compileLibArchive(opts) {
         catch {
             // An identity probe is cache machinery, never a reason a valid native
             // compile should fail. Disable every persistent tier for this invocation.
-            root = null;
+            persistentCache = null;
         }
     }
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             runtimeCompilerInvocation = await effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags);
             programCompilerInvocation = programSourceExtension === ".ll"
@@ -1208,7 +796,7 @@ export async function compileLibArchive(opts) {
         catch {
             // A wrapper that cannot expose its effective invocation can still build,
             // but its outputs cannot safely participate in a persistent cache.
-            root = null;
+            persistentCache = null;
         }
     }
     const vendorBuildIdentity = await currentVendorCacheBuildIdentity(driver, `${toolchainEnv}\0${implicitToolchain ?? "<uncached>"}`);
@@ -1218,7 +806,7 @@ export async function compileLibArchive(opts) {
     // fingerprint. The runtime-object tier still serves them (localization
     // consumes the same per-flavor objects).
     const cacheCompleteArchive = opts.localizeSymbols === undefined &&
-        root !== null && await archiverSupportsPersistentCache(arArgv, driver);
+        persistentCache !== null && await archiverSupportsPersistentCache(arArgv, driver);
     let cachedArchive = null;
     let compilerVersion = "";
     let archiverVersion = "";
@@ -1230,10 +818,10 @@ export async function compileLibArchive(opts) {
     const identityBytes = opts.identityCSource === undefined
         ? null
         : Buffer.from(opts.identityCSource, "utf8");
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             const [cv, fingerprint, programBytes] = await Promise.all([
-                ccVersionOnce(driver.argv, toolchainEnv, true),
+                ccVersion(driver.argv, toolchainEnv, true),
                 runtimeFingerprint(rtDir),
                 cachedProgramBytes === null ? readFile(opts.cPath) : Promise.resolve(cachedProgramBytes),
             ]);
@@ -1256,7 +844,7 @@ export async function compileLibArchive(opts) {
                     .update(runtimeCompilerInvocation).update("\0")
                     .update(programCompilerInvocation).update("\0")
                     .update(programDependencyHash).update("\0")
-                    .update(opts.cacheIdentity).update("\0")
+                    .update(persistentCache.identity).update("\0")
                     .update(driver.argv.join("\x1f")).update("\0")
                     .update(cv).update("\0")
                     .update(fingerprint).update("\0")
@@ -1276,7 +864,7 @@ export async function compileLibArchive(opts) {
                     .update(identityBytes === null ? "<none>" : "<generated>").update("\0")
                     .update(identityBytes ?? Buffer.alloc(0))
                     .digest("hex");
-                cachedArchive = join(root, "lib", keyHex);
+                cachedArchive = join(persistentCache.root, "lib", keyHex);
                 const tmpOut = privateSiblingPath(opts.outPath, "lib-hit");
                 try {
                     await mkdir(dirname(opts.outPath), { recursive: true });
@@ -1301,10 +889,10 @@ export async function compileLibArchive(opts) {
             cachedArchive = null;
         }
     }
-    const transientVendorRoot = root !== null && implicitToolchain !== null
+    const transientVendorRoot = persistentCache !== null && implicitToolchain !== null
         ? null
         : join(tmpdir(), `scriptc-lib-vendor-${process.pid}-${Math.random().toString(36).slice(2)}`);
-    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(root ?? undefined);
+    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(persistentCache?.root);
     try {
         const buildDir = await mkdtemp(join(tmpdir(), "scriptc-lib-"));
         try {
@@ -1348,7 +936,7 @@ export async function compileLibArchive(opts) {
                 await writeFile(programSource, cachedProgramBytes);
             }
             let cachedProgramObject = null;
-            if (root !== null && cachedProgramBytes !== null && compilerVersion !== "" &&
+            if (persistentCache !== null && cachedProgramBytes !== null && compilerVersion !== "" &&
                 implicitToolchain !== null && programCompilerInvocation !== null) {
                 const programKey = createHash("sha256")
                     .update("lib-program-obj-v3\0")
@@ -1356,7 +944,7 @@ export async function compileLibArchive(opts) {
                     .update(toolchainEnv).update("\0")
                     .update(implicitToolchain).update("\0")
                     .update(programCompilerInvocation).update("\0")
-                    .update(opts.cacheIdentity).update("\0")
+                    .update(persistentCache.identity).update("\0")
                     .update(driver.argv.join("\x1f")).update("\0")
                     .update(compilerVersion).update("\0")
                     .update(runtimeHash).update("\0")
@@ -1367,7 +955,7 @@ export async function compileLibArchive(opts) {
                     .update(cachedProgramBytes);
                 updateProgramShardCacheIdentity(programKey, programShards ?? undefined, programPublicSymbols, programShardMergeIdentity ?? undefined);
                 const programKeyHex = programKey.digest("hex");
-                cachedProgramObject = join(root, "program-obj", programKeyHex);
+                cachedProgramObject = join(persistentCache.root, "program-obj", programKeyHex);
             }
             const stagedProgramObject = join(buildDir, `${stem}.program.o`);
             let programObject;
@@ -1382,8 +970,8 @@ export async function compileLibArchive(opts) {
                         const sourcePath = join(buildDir, shard.name);
                         const staged = join(buildDir, `${stem}.program-${index.toString().padStart(3, "0")}.o`);
                         let cachePath = null;
-                        if (root !== null && compilerVersion !== "" && implicitCompileToolchain !== null &&
-                            programCompilerInvocation !== null) {
+                        if (persistentCache !== null && compilerVersion !== "" &&
+                            implicitCompileToolchain !== null && programCompilerInvocation !== null) {
                             const key = createHash("sha256")
                                 // v2 removes the broad implicit-toolchain fingerprint: it
                                 // includes the linker selected by the driver, but raw shard
@@ -1397,7 +985,7 @@ export async function compileLibArchive(opts) {
                                 .update(toolchainEnv).update("\0")
                                 .update(implicitCompileToolchain).update("\0")
                                 .update(programCompilerInvocation).update("\0")
-                                .update(opts.cacheIdentity).update("\0")
+                                .update(persistentCache.identity).update("\0")
                                 .update(driver.argv.join("\x1f")).update("\0")
                                 .update(compilerVersion).update("\0")
                                 .update(runtimeHash).update("\0")
@@ -1408,7 +996,7 @@ export async function compileLibArchive(opts) {
                                 .update(shard.name).update("\0")
                                 .update(shard.source)
                                 .digest("hex");
-                            cachePath = join(root, "program-shard", key);
+                            cachePath = join(persistentCache.root, "program-shard", key);
                         }
                         return { ...shard, sourcePath, staged, cachePath, missed: false };
                     });
@@ -1436,7 +1024,7 @@ export async function compileLibArchive(opts) {
                                 runtimeFingerprint(rtDir),
                                 effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension),
                                 translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv),
-                                ccVersionOnce(driver.argv, toolchainEnv, true),
+                                ccVersion(driver.argv, toolchainEnv, true),
                             ]);
                             const shardInputsStillMatch = currentRuntime === runtimeHash &&
                                 currentInvocation === programCompilerInvocation &&
@@ -1487,7 +1075,7 @@ export async function compileLibArchive(opts) {
                             implicitToolchainFingerprint(driver, toolchainEnv),
                             effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension),
                             translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv),
-                            ccVersionOnce(driver.argv, toolchainEnv, true),
+                            ccVersion(driver.argv, toolchainEnv, true),
                         ]);
                         if (currentRuntime === runtimeHash &&
                             currentImplicit === implicitToolchain &&
@@ -1520,10 +1108,10 @@ export async function compileLibArchive(opts) {
                     currentInvocation === runtimeCompilerInvocation, () => false);
                 return objectImplicitVerification;
             };
-            if (root !== null && compilerVersion !== "" && runtimeHash !== "") {
+            if (persistentCache !== null && compilerVersion !== "" && runtimeHash !== "") {
                 try {
                     const sourcePaths = sources.map((f) => join(rtDir, f));
-                    const cached = await ensureRuntimeObjects(root, driver.argv, cflags, sourcePaths, `lib-obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${driver.argv.join(" ")}\0${compilerVersion}\0${runtimeHash}\0`, async () => (await runtimeFingerprint(rtDir)) === runtimeHash &&
+                    const cached = await ensureRuntimeObjects(persistentCache.root, driver.argv, cflags, sourcePaths, `lib-obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${driver.argv.join(" ")}\0${compilerVersion}\0${runtimeHash}\0`, async () => (await runtimeFingerprint(rtDir)) === runtimeHash &&
                         (await objectImplicitToolchainStillMatches()));
                     const staged = await stageRuntimeObjects(cached, join(buildDir, "cached-runtime"));
                     runtimeObjects = sourcePaths.map((path) => staged.get(path));
@@ -1570,7 +1158,7 @@ export async function compileLibArchive(opts) {
                 await installArtifact(archiveOutput, opts.outPath);
             let runtimeStillMatchesKey = false;
             if (cachedArchive !== null &&
-                root !== null &&
+                persistentCache !== null &&
                 runtimeHash !== "" &&
                 programDependencyHash !== "" &&
                 compilerVersion !== "" &&
@@ -1581,7 +1169,7 @@ export async function compileLibArchive(opts) {
                     effectiveCompilerInvocationFingerprint(driver, toolchainEnv, cflags).catch(() => null),
                     effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension).catch(() => null),
                     translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cachedProgramBytes, toolchainEnv).catch(() => null),
-                    ccVersionOnce(driver.argv, toolchainEnv, true).catch(() => null),
+                    ccVersion(driver.argv, toolchainEnv, true).catch(() => null),
                     toolVersionOnce(arArgv, toolchainEnv, true).catch(() => null),
                     programShards === null
                         ? Promise.resolve(null)
@@ -1599,7 +1187,7 @@ export async function compileLibArchive(opts) {
                         currentArchiver === archiverVersion &&
                         currentProgramShardMerge === programShardMergeIdentity;
             }
-            if (cachedArchive !== null && root !== null && runtimeStillMatchesKey) {
+            if (cachedArchive !== null && persistentCache !== null && runtimeStillMatchesKey) {
                 try {
                     await publishCachedFile(archiveOutput, cachedArchive);
                 }
@@ -1617,8 +1205,9 @@ export async function compileLibArchive(opts) {
             await rm(transientVendorRoot, { recursive: true, force: true }).catch(() => undefined);
         }
     }
-    if (root !== null)
-        await pruneCache(root).catch(() => undefined);
+    if (persistentCache !== null) {
+        await pruneCache(persistentCache.root).catch(() => undefined);
+    }
 }
 /* Multi-instance library mode's localization step: combine the program
  * object with exactly the runtime/vendor members it reaches into ONE
@@ -1743,7 +1332,7 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
         }
     }
     else {
-        throw new Error(`runtime symbol localization (abi.localize_runtime) has no ${platform} arm; compileLibrary admits darwin, linux, and win32 builds only`);
+        throw new InternalCompilerError(`runtime symbol localization (abi.localize_runtime) has no ${platform} arm; compileLibrary admits darwin, linux, and win32 builds only`);
     }
     return combined;
 }
@@ -1829,80 +1418,6 @@ async function localizeLibraryObjects(driver, arArgv, buildDir, rootObjects, sup
  * oracle cache lives under the same root and is swept by the same pass. Cache
  * trouble is never a build failure — every cache error falls back to a real
  * compile. */
-/** Resolve the build cache without touching the filesystem. Exported from this
- * internal module so its platform and override behavior can be pinned directly. */
-export function resolveBuildCacheRoot(env = process.env, platform = process.platform, userHome = homedir()) {
-    if (env["SCRIPTC_NO_CACHE"] === "1")
-        return null;
-    const configured = env["SCRIPTC_CACHE_DIR"];
-    if (configured !== undefined)
-        return configured === "" ? null : resolve(configured);
-    const xdg = env["XDG_CACHE_HOME"];
-    if (xdg !== undefined && xdg !== "")
-        return resolve(xdg, "scriptc", "build");
-    if (platform === "win32") {
-        const local = env["LOCALAPPDATA"];
-        if (local !== undefined && local !== "")
-            return resolve(local, "scriptc", "cache", "build");
-    }
-    return platform === "darwin"
-        ? resolve(userHome, "Library", "Caches", "scriptc", "build")
-        : resolve(userHome, ".cache", "scriptc", "build");
-}
-/** Shared persistent-cache root for compiler-level tiers.  The early library
- * cache deliberately follows the native cache's activation and hard-disable
- * contract, while native compilation retains ownership of toolchain safety. */
-export function buildCacheRoot() {
-    return resolveBuildCacheRoot();
-}
-/** Harden/create a compiler-level cache root using the same privacy policy as
- * the artifact caches.  Failure disables only the optional caller's tier. */
-export async function prepareBuildCacheRoot(root) {
-    if (root === null)
-        return null;
-    try {
-        await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
-        return root;
-    }
-    catch {
-        return null;
-    }
-}
-/** Register a successful compiler-level cache write with the shared bounded
- * LRU policy. */
-export async function pruneBuildCache(root) {
-    if (root !== null)
-        await pruneCache(root).catch(() => undefined);
-}
-function cacheRootDir() {
-    return resolveBuildCacheRoot();
-}
-/** The production cache can contain complete user executables/archives with
- * embedded source literals or comptime values. Its root is therefore private
- * regardless of the caller's ordinary output umask. Windows inherits the
- * per-user LOCALAPPDATA ACL. POSIX platform-default roots are hardened for
- * upgrades; an arbitrary existing SCRIPTC_CACHE_DIR override is never chmod'd
- * and participates only when its caller-provided mode is already private. */
-async function ensurePrivateCacheRoot(root, hardenExisting) {
-    const existing = await stat(root).then((info) => info, (error) => {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    });
-    if (existing !== null && !existing.isDirectory()) {
-        throw new Error("native cache root is not a directory");
-    }
-    if (process.platform !== "win32" &&
-        existing !== null &&
-        !hardenExisting &&
-        (existing.mode & 0o077) !== 0) {
-        throw new Error("existing native cache override is not private");
-    }
-    await mkdir(root, { recursive: true, mode: 0o700 });
-    if (process.platform !== "win32" && (existing === null || hardenExisting)) {
-        await chmod(root, 0o700);
-    }
-}
 const ccVersionMemos = new Map();
 /** Identity of the compiler implementation and configuration selected by a
  * fresh driver invocation. In particular, Darwin's stable /usr/bin/clang shim
@@ -2029,7 +1544,7 @@ function isAppleSystemClangHandoff(driver, effectiveCompiler) {
  * can safely represent that behavior. Accept direct Clang/Zig drivers (plus
  * Apple's system shim) and conservatively keep wrapper-driven builds on the
  * uncached path. */
-async function compilerDriverSupportsPersistentCache(driver, environmentFingerprint) {
+export async function compilerDriverSupportsPersistentCache(driver, environmentFingerprint) {
     // Cache-race tests exercise publication below an intentionally instrumented
     // wrapper. This is deliberately undocumented and test-scoped.
     if (process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1")
@@ -2115,7 +1630,7 @@ async function archiverSupportsPersistentCache(arArgv, driver) {
     return process.platform === "darwin" &&
         /^\/Applications\/Xcode[^/]*\.app\/Contents\/Developer\/Toolchains\/[^/]+\.xctoolchain\/usr\/bin\/[^/]*ar$/.test(archiver.canonicalPath);
 }
-export async function ccVersionOnce(argv, environmentFingerprint = toolchainEnvironmentFingerprint(), fresh = false) {
+export async function ccVersion(argv, environmentFingerprint = toolchainEnvironmentFingerprint(), fresh = false) {
     const spellingKey = `${environmentFingerprint}\0${argv.join("\x1f")}`;
     const executableIdentity = await resolvedToolIdentity(argv[0] ?? "clang");
     const key = `${spellingKey}\0${executableIdentity ?? "<unresolved>"}`;
@@ -2838,7 +2353,21 @@ function implicitLinkerFingerprint(driver, environmentFingerprint, linkArgs, eff
     ].join("\0");
     return stableTestMemo(stableImplicitLinkerMemos, key, () => implicitLinkerFingerprintFresh(driver, environmentFingerprint, linkArgs, effectiveInvocationArgs, traceInvocationArgs));
 }
+/** Resolve the exact files consumed by one compiler-driver link invocation.
+ * Runtime packs reuse the native toolchain's strict dry-run plus real linker
+ * trace so a PATH-selected Clang carries its own linker, SDK, compiler
+ * runtime, and injected inputs into the executable cache proof. */
+export async function nativeLinkerDependencyPaths(linker, linkArgs) {
+    const fingerprint = await implicitLinkerFingerprint({ argv: [linker], targetArgs: [], target: null }, toolchainEnvironmentFingerprint(), linkArgs);
+    return fingerprintDependencyPaths(fingerprint);
+}
 let ccacheMemo = null;
+/** Reset process observations whose validity is bounded to one public native
+ * build. A long-lived caller may change PATH or install/remove ccache between
+ * invocations; the next build must probe that environment again. */
+export function clearCcCaches() {
+    ccacheMemo = null;
+}
 function ccacheAvailable() {
     ccacheMemo ??= execFileAsync("ccache", ["--version"]).then(() => true, () => false);
     return ccacheMemo;
@@ -2855,8 +2384,10 @@ async function runtimeFingerprintFresh(rtDir) {
     const h = createHash("sha256")
         .update("native-owned-inputs-v2\0")
         .update(QJS_COMMIT).update(MBEDTLS_VERSION).update(ZLIB_VERSION)
-        .update("\0backend-recipe\0")
-        .update(await readFile(CC_IMPLEMENTATION_PATH));
+        .update("\0backend-recipe\0");
+    for (const path of NATIVE_RECIPE_IMPLEMENTATION_PATHS) {
+        h.update(basename(path)).update("\0").update(await readFile(path)).update("\0");
+    }
     for (const group of groups) {
         for (const n of group.names) {
             h.update(group.label).update("/").update(n).update("\0").update(await readFile(join(group.dir, n))).update("\0");
@@ -2882,7 +2413,7 @@ async function runtimeFingerprintInputGroups(rtDir) {
 async function runtimeFingerprintInputPaths(rtDir) {
     return [
         ...(await runtimeFingerprintInputGroups(rtDir)).flatMap((group) => group.names.map((name) => join(group.dir, name))),
-        CC_IMPLEMENTATION_PATH,
+        ...NATIVE_RECIPE_IMPLEMENTATION_PATHS,
     ];
 }
 const stableRuntimeFingerprintMemos = new Map();
@@ -2890,89 +2421,20 @@ export function runtimeFingerprint(rtDir) {
     const key = resolve(rtDir);
     return stableTestMemo(stableRuntimeFingerprintMemos, key, () => runtimeFingerprintFresh(rtDir));
 }
+const { vendorEngineDir, vendorTlsDir, vendorCurlDir, vendorBuildCacheRoot, vendorCacheTargetFlavor, vendorCacheBuildIdentity, currentVendorCacheBuildIdentity, engineArchivePath, stageVendorInputs, ensureEngineArchive, lreObjectPaths, ensureLreObjects, vendorZlibDir, zlibObjectPaths, ensureZlibObjects, curlStubDirPath, ensureCurlStub, tlsArchivePath, ensureTlsArchive, QJS_ENGINE_SOURCES, LRE_SOURCES, ZLIB_SOURCES, } = createVendorArchives({
+    runtimeSrcDir,
+    targetPlatform,
+    isZigDriver,
+    resolvedToolIdentity,
+    runtimeFingerprint,
+});
+export { vendorCacheBuildIdentity, vendorCacheTargetFlavor };
 class CacheInputsChangedError extends Error {
     constructor() {
         super("runtime inputs changed while populating the native object cache");
         this.name = "CacheInputsChangedError";
     }
 }
-function cacheDigestPath(path) {
-    return `${path}.sha256`;
-}
-async function fileDigest(path) {
-    return createHash("sha256").update(await readFile(path)).digest("hex");
-}
-/** Cache entries are disposable data, not trusted compiler output. Atomic
- * rename prevents ordinary partial writes, while the adjacent digest catches
- * disk damage, manual truncation, and entries left by an interrupted/older
- * publisher before they reach clang, the linker, or `ar`. */
-async function validCachedFile(object) {
-    try {
-        const digestPath = cacheDigestPath(object);
-        const expected = (await readFile(digestPath, "utf8")).trim();
-        const valid = /^[0-9a-f]{64}$/.test(expected) && (await fileDigest(object)) === expected;
-        if (valid) {
-            const now = new Date();
-            await Promise.all([
-                utimes(object, now, now).catch(() => undefined),
-                utimes(digestPath, now, now).catch(() => undefined),
-            ]);
-        }
-        return valid;
-    }
-    catch {
-        return false;
-    }
-}
-/** Copy a cache entry and verify the private copy before it can become a
- * caller-visible artifact. Verifying after the copy closes the gap between a
- * source-side digest check and a concurrent replacement/truncation. */
-async function copyValidCachedFile(source, destination) {
-    try {
-        const digestPath = cacheDigestPath(source);
-        const expected = (await readFile(digestPath, "utf8")).trim();
-        if (!/^[0-9a-f]{64}$/.test(expected))
-            return false;
-        await copyFile(source, destination);
-        if ((await fileDigest(destination)) !== expected) {
-            await rm(destination, { force: true }).catch(() => undefined);
-            return false;
-        }
-        const now = new Date();
-        await Promise.all([
-            utimes(source, now, now).catch(() => undefined),
-            utimes(digestPath, now, now).catch(() => undefined),
-        ]);
-        return true;
-    }
-    catch {
-        await rm(destination, { force: true }).catch(() => undefined);
-        return false;
-    }
-}
-/** Publish a complete executable/archive and its digest through private names.
- * Data is installed before its verifier, so a racing reader can only observe
- * an invalid/missing digest and take the fresh-build path. */
-async function publishCachedFile(source, destination) {
-    const directory = dirname(destination);
-    await mkdir(directory, { recursive: true });
-    const nonce = `${process.pid}-${Math.random().toString(36).slice(2)}`;
-    const tmp = join(directory, `.tmp-${basename(destination).slice(0, 8)}-${nonce}`);
-    const tmpDigest = `${tmp}.sha256`;
-    try {
-        await copyFile(source, tmp);
-        await chmod(tmp, 0o600);
-        await writeFile(tmpDigest, `${await fileDigest(tmp)}\n`, { mode: 0o600 });
-        await rename(tmp, destination);
-        await rename(tmpDigest, cacheDigestPath(destination));
-    }
-    finally {
-        await Promise.all([
-            rm(tmp, { force: true }).catch(() => undefined),
-            rm(tmpDigest, { force: true }).catch(() => undefined),
-        ]);
-    }
-}
 async function directoryTreeDigest(root, excludedPaths = []) {
     const hash = createHash("sha256").update("native-dependency-tree-v1\0");
     const visited = new Set();
@@ -3069,6 +2531,12 @@ async function snapshotLocalArtifactDependencies(dependencyPaths, recursiveDirec
     const recursive = new Set(recursiveDirectories.map((path) => resolve(path)));
     return Promise.all([...new Set(dependencyPaths)].sort().map((path) => snapshotLocalArtifactDependency(path, recursive.has(resolve(path)) ? recursiveExclusions : null)));
 }
+/** Capture exact filesystem identities for inputs produced outside the C
+ * toolchain but consumed by its cache proofs. Callers carry this snapshot
+ * forward so later stages can prove the same inputs remained installed. */
+export async function snapshotNativeArtifactDependencies(dependencyPaths) {
+    return snapshotLocalArtifactDependencies(dependencyPaths);
+}
 export async function nativeArtifactDependenciesStillMatch(dependencies) {
     if (!dependencies.every((dependency) => dependency !== null && typeof dependency === "object" &&
         typeof dependency.path === "string" &&
@@ -3167,15 +2635,21 @@ function localArtifactIdentity(opts, driver, environmentFingerprint, compilerIde
         // output-local fast-path identity.
         .filter(([key, value]) => value !== undefined && key !== "programShards" && key !== "programPublicSymbols")
         .sort(([a], [b]) => a.localeCompare(b)));
+    const executableSectionFlags = executableSectionEliminationFlags(targetPlatform(driver));
     const hash = createHash("sha256")
-        .update("local-artifact-v1\0")
+        // v2 adds the executable section-GC recipe. A v1 output-local stamp can
+        // name a same-source binary from before unused runtime sections were
+        // eliminated, so it must never short-circuit the new linker invocation.
+        .update("local-artifact-v2\0")
         .update(cacheTargetIdentity(driver)).update("\0")
         .update(environmentFingerprint).update("\0")
         .update(compilerIdentity).update("\0")
         .update(runtimeHash).update("\0")
         .update(driver.argv.join("\x1f")).update("\0")
         .update(driver.targetArgs.join("\x1f")).update("\0")
-        .update(driver.linkArgs.join("\x1f")).update("\0");
+        .update(driver.linkArgs.join("\x1f")).update("\0")
+        .update(executableSectionFlags.compile.join("\x1f")).update("\0")
+        .update(executableSectionFlags.link.join("\x1f")).update("\0");
     if (programShardMerge !== null) {
         updateProgramShardCacheIdentity(hash, opts.programShards, opts.programPublicSymbols, programShardMerge);
     }
@@ -3374,71 +2848,15 @@ export async function stageRuntimeObjects(objects, stageDir) {
     }));
     return new Map(staged);
 }
-/** Size-capped LRU sweep of the whole cache root. A caller-configured cap is
- * enforced after every successful cache write. The 4 GiB default is checked on
- * the first and every 64th write in a long-lived process: a full tree walk per
- * corpus program would otherwise become quadratic as the cache grows. Oldest-
- * mtime files go first until the tree is back under 75% of the cap; reads bump
- * mtimes. Active links use private staged names/hard links, so cache names can
- * be unlinked safely. */
-const rootWriteCounts = new Map();
-async function pruneCache(root, protectedPaths) {
-    const configuredCap = process.env["SCRIPTC_CACHE_MAX_MB"];
-    const writes = (rootWriteCounts.get(root) ?? 0) + 1;
-    rootWriteCounts.set(root, writes);
-    if (configuredCap === undefined && writes !== 1 && writes % 64 !== 0)
-        return;
-    const capBytes = Number(configuredCap ?? "4096") * 1024 * 1024;
-    if (!Number.isFinite(capBytes) || capBytes <= 0)
-        return;
-    const files = [];
-    const walk = async (dir) => {
-        const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
-        for (const ent of entries) {
-            const p = join(dir, ent.name);
-            if (ent.isDirectory())
-                await walk(p);
-            else if (ent.isFile()) {
-                // Atomic publishers use private names until their data/digest or
-                // metadata stamp is complete. They are active writes, not LRU entries.
-                if (ent.name.startsWith(".scriptc-") ||
-                    ent.name.startsWith(".tmp-") ||
-                    ent.name.includes(".tmp-"))
-                    continue;
-                if (protectedPaths?.has(p))
-                    continue;
-                const s = await stat(p).catch(() => null);
-                if (s !== null)
-                    files.push({ path: p, size: s.size, mtimeMs: s.mtimeMs });
-            }
-        }
-    };
-    await walk(root);
-    let total = files.reduce((n, f) => n + f.size, 0);
-    if (total <= capBytes)
-        return;
-    files.sort((a, b) => a.mtimeMs - b.mtimeMs);
-    for (const f of files) {
-        if (total <= capBytes * 0.75)
-            break;
-        try {
-            await unlink(f.path);
-            total -= f.size;
-        }
-        catch {
-            // A concurrent reader/publisher may already have moved the name.
-        }
-    }
-}
 /** Compiles one C program together with the runtime sources.
  * With caching disabled, the runtime (a dozen small files) is recompiled on
- * every build in one historical clang invocation — no cached-archive
+ * every build in one clang invocation — no cached-archive
  * staleness bugs. --dynamic additionally compiles
  * scr_island.c under SCR_DYNAMIC and links the cached engine archive (built
  * lazily, see above); regex-using programs additionally compile scr_regex.c
  * and link libregexp (the cached objects, or the archive's own copy under
- * --dynamic). Without either, the command line is exactly the historical
- * one — regex-free static builds must stay byte-identical.
+ * --dynamic). Executable links use the target's section-elimination recipe
+ * independently of those feature gates.
  *
  * With a caller-supplied dependency identity and an enabled cache root,
  * unchanged programs skip payload code generation/linking via the binary
@@ -3498,8 +2916,9 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             `compile with a library profile (SCRIPTC_CC=zigcc scriptc build --lib --profile <profile.json>) and link the archive from the app project.`);
     }
     const runtimeSources = targetPlatform(driver) === "wasi"
-        ? RUNTIME_SOURCES.filter((source) => source !== "scr_child.c")
-        : RUNTIME_SOURCES;
+        ? EXECUTABLE_RUNTIME_SOURCES.filter((source) => source !== "scr_child.c")
+        : EXECUTABLE_RUNTIME_SOURCES;
+    const executableSectionFlags = executableSectionEliminationFlags(targetPlatform(driver));
     // scr_async.c submits callback-style filesystem work to a native worker.
     // POSIX drivers need the thread compile/link mode; win32 uses CreateThread.
     const threadArgs = targetPlatform(driver) === "win32" || targetPlatform(driver) === "wasi"
@@ -3547,15 +2966,16 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     // inputs may include caller-owned headers whose contents are not otherwise
     // represented in this key, so they retain the fully uncached historical
     // path unless the caller supplies its own complete dependency identity.
-    let root = opts.cacheIdentity === undefined || !persistentDriverCache
+    const cacheIdentity = opts.cacheIdentity;
+    let persistentCache = cacheIdentity === undefined || configuredCacheRoot === null || !persistentDriverCache
         ? null
-        : configuredCacheRoot;
-    if (cacheWarmOnly && root === null) {
+        : { root: configuredCacheRoot, identity: cacheIdentity };
+    if (cacheWarmOnly && persistentCache === null) {
         throw new Error("native cache warming requires a persistently cacheable compiler environment");
     }
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
-            await ensurePrivateCacheRoot(root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
+            await ensurePrivateCacheRoot(persistentCache.root, process.env["SCRIPTC_CACHE_DIR"] === undefined);
         }
         catch (error) {
             if (cacheWarmOnly) {
@@ -3563,7 +2983,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                     cause: error,
                 });
             }
-            root = null;
+            persistentCache = null;
         }
     }
     let localArtifact = null;
@@ -3573,9 +2993,9 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     // FFI/native-input builds and the public arbitrary-C cache API stay on the
     // strict path because their dependency graphs are caller-owned.
     if (!cacheWarmOnly &&
-        root !== null &&
+        persistentCache !== null &&
         cachePolicy.completeArtifacts &&
-        opts.cacheIdentity === "scriptc-generated-v1" &&
+        persistentCache.identity === "scriptc-generated-v1" &&
         (opts.linkInputs?.length ?? 0) === 0 &&
         (opts.systemLibraries?.length ?? 0) === 0 &&
         process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] !== "1") {
@@ -3588,7 +3008,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             if (compiler !== null) {
                 const effectiveCompiler = directCompilerSelections.get(compilerDriverProbeKey(driver, toolchainEnv)) ?? compiler;
                 const key = localArtifactIdentity(opts, driver, toolchainEnv, `${compiler.cacheIdentity}\0${effectiveCompiler.cacheIdentity}`, runtimeHash, programBytes, programShardMergeIdentity);
-                const stampPath = localArtifactStampPath(root, opts.outPath);
+                const stampPath = localArtifactStampPath(persistentCache.root, opts.outPath);
                 localArtifact = {
                     stampPath,
                     key,
@@ -3612,11 +3032,11 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     let implicitToolchain = null;
     let implicitCompileToolchain = null;
     let toolchainMetadataStamp = null;
-    const metadataCompiler = root === null
+    const metadataCompiler = persistentCache === null
         ? null
         : await resolvedTool(driver.argv[0] ?? "clang");
     const metadataEffectiveCompiler = directCompilerSelections.get(compilerDriverProbeKey(driver, toolchainEnv)) ?? metadataCompiler;
-    const toolchainMetadataKey = root === null ||
+    const toolchainMetadataKey = persistentCache === null ||
         metadataCompiler === null ||
         metadataEffectiveCompiler === null ||
         process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
@@ -3633,9 +3053,9 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     if (persistentDriverCache) {
         try {
             toolchainMetadataStamp =
-                root === null || toolchainMetadataKey === null
+                persistentCache === null || toolchainMetadataKey === null
                     ? null
-                    : await readNativeMetadataStamp(root, toolchainMetadataKey);
+                    : await readNativeMetadataStamp(persistentCache.root, toolchainMetadataKey);
             implicitToolchain = toolchainMetadataStamp?.values["implicitToolchain"] ?? null;
             implicitCompileToolchain =
                 toolchainMetadataStamp?.values["implicitCompileToolchain"] ?? null;
@@ -3648,13 +3068,13 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             }
             let compilerVersion = toolchainMetadataStamp?.values["compilerVersion"];
             if (compilerVersion === undefined) {
-                compilerVersion = await ccVersionOnce(driver.argv, toolchainEnv, true);
+                compilerVersion = await ccVersion(driver.argv, toolchainEnv, true);
             }
             if (toolchainMetadataStamp === null &&
-                root !== null &&
+                persistentCache !== null &&
                 toolchainMetadataKey !== null) {
                 if (metadataCompiler !== null && metadataEffectiveCompiler !== null) {
-                    toolchainMetadataStamp = await publishNativeMetadataStamp(root, toolchainMetadataKey, {
+                    toolchainMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, toolchainMetadataKey, {
                         implicitToolchain,
                         ...(implicitCompileToolchain === null ? {} : { implicitCompileToolchain }),
                         compilerVersion,
@@ -3680,7 +3100,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                     cause: error,
                 });
             }
-            root = null;
+            persistentCache = null;
         }
     }
     const vendorBuildIdentity = await currentVendorCacheBuildIdentity(driver, `${toolchainEnv}\0${implicitToolchain ?? "<uncached>"}`);
@@ -3689,10 +3109,10 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     // must follow the same rule instead of silently surviving in the user cache.
     // A private root gives this invocation the usual vendor build recipe
     // without publishing or reusing those prerequisites.
-    const transientVendorRoot = root !== null && implicitToolchain !== null
+    const transientVendorRoot = persistentCache !== null && implicitToolchain !== null
         ? null
         : join(tmpdir(), `scriptc-vendor-${process.pid}-${Math.random().toString(36).slice(2)}`);
-    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(root ?? undefined);
+    const vendorCacheRoot = transientVendorRoot ?? vendorBuildCacheRoot(persistentCache?.root);
     // Every vendor output path is deterministic from pins, flags, driver, and
     // target. Build the command/key from those paths now, but do not materialize
     // them until a complete-binary lookup has missed.
@@ -3708,10 +3128,10 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     let lreObjects = regex && !dynamic
         ? lreObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : [];
-    // Vendored zlib is the CROSS story only — host builds keep the exact
+    // Vendored zlib is the Zig story — default host-clang builds keep the exact
     // historical `-lz` system link (see CcOptions.zlib). The native fetch's
     // gzip decoder rides the same objects/link.
-    let zlibObjects = ((opts.zlib ?? false) || nativeFetch) && driver.target !== null
+    let zlibObjects = ((opts.zlib ?? false) || nativeFetch) && isZigDriver(driver)
         ? zlibObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
         : [];
     // The libcurl import stub is likewise CROSS-only — host builds keep the
@@ -3721,7 +3141,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ? curlStubDirPath(driver, vendorBuildIdentity, vendorCacheRoot)
         : null;
     const materializeVendorPrerequisites = async (stageRoot, materializeCacheRoot = vendorCacheRoot) => {
-        // Preserve the historical order to avoid multiplying first-build resource
+        // Preserve source order to avoid multiplying first-build resource
         // pressure when several large vendor sets are cold simultaneously.
         if (dynamic) {
             const cachedArchive = engineArchivePath(sanitize, driver, vendorBuildIdentity, materializeCacheRoot);
@@ -3781,6 +3201,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(sanitize
             ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
             : [optimization === "dev" ? "-O0" : "-O2"]),
+        ...executableSectionFlags.compile,
         ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
         "-fno-math-errno",
         // The emitted object model is deliberately type-punned C: a hierarchy
@@ -3822,14 +3243,14 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(opts.dc ? [rt(join(rtDir, "scr_dc.c"))] : []),
         ...(opts.dynAsync || opts.dynInvoke || opts.dc || nativeFetch ? [rt(join(rtDir, "scr_async_dyn.c"))] : []),
         // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
-        // libz on hosts, the vendored per-target objects on cross builds)
+        // libz on the default host-clang build, vendored objects on Zig builds)
         // also serves the native fetch's gzip decoder — spread exactly once.
         ...(opts.zlib
-            ? driver.target !== null
+            ? isZigDriver(driver)
                 ? ["-I", vendorZlibDir(), rt(join(rtDir, "scr_zlib.c")), ...zlibObjects]
                 : [rt(join(rtDir, "scr_zlib.c"))]
             : nativeFetch
-                ? driver.target !== null
+                ? isZigDriver(driver)
                     ? ["-I", vendorZlibDir(), ...zlibObjects]
                     : []
                 : []),
@@ -3921,11 +3342,6 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                 // left-to-right archive resolution. Other dynamic targets keep
                 // the historical engine-adjacent spelling.
                 ...(driver.linkArgs.includes("-lm") ? [] : ["-lm"]),
-                // ld64 dead-stripping claws back a chunk of the engine archive;
-                // harmless elsewhere but only spelled this way on macOS. Keyed on
-                // the TARGET platform (= the host on the default path, where this
-                // expression is byte-identical to the historical one).
-                ...(targetPlatform(driver) === "darwin" ? ["-Wl,-dead_strip"] : []),
                 // The PE stack reserve, pinned to the 8MB POSIX main-stack
                 // geometry ISL_MAIN_STACK_BUDGET is sized against (4MB engine
                 // budget + 4MB excursion margin) — quickjs-ng's own CMake makes
@@ -3953,16 +3369,17 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(opts.linkInputs ?? []),
         ...(opts.systemLibraries ?? []).map((name) => `-l${name}`),
         // GNU ld resolves libraries from left to right and commonly enables
-        // --as-needed: host libz must follow scr_zlib.c/scr_fetch.c and every
+        // --as-needed: host-clang libz must follow scr_zlib.c/scr_fetch.c and every
         // generated/native input that references inflate symbols. Cross
-        // builds use vendored zlib objects in the input section above.
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null
+        // and targetless Zig builds use vendored zlib objects in the input section above.
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver)
             ? ["-lz"]
             : []),
         // glibc keeps libm separate from libc. This must trail the generated
         // program and every native FFI input because GNU ld resolves archives
         // from left to right.
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
         "-o", build.outPath ?? opts.outPath,
     ];
     // Compile-only flags shared by runtime-object population and the caller-TU
@@ -3975,6 +3392,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(sanitize
             ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
             : [optimization === "dev" ? "-O0" : "-O2"]),
+        ...executableSectionFlags.compile,
         ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
         "-fno-math-errno",
         "-fno-strict-aliasing", // the emitted object model type-puns — see buildArgs
@@ -4021,7 +3439,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     let programCompilerInvocation = null;
     let payloadMetadata = null;
     let compileMetadataStamp = null;
-    const compileMetadataKey = root === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
+    const compileMetadataKey = persistentCache === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
         ? null
         : nativeMetadataKey("compile", [
             cacheTargetIdentity(driver),
@@ -4032,14 +3450,14 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             programCompilerArgs,
             programSourceExtension,
         ]);
-    if (root !== null) {
+    if (persistentCache !== null) {
         try {
             // These probes inspect disjoint inputs. Start the payload reads here as
             // well so runtime hashing and clang's dry-run traces overlap instead of
             // forming a serial prelude before every cache lookup.
             payloadMetadata = Promise.all([
                 Promise.resolve(toolchainMetadataStamp?.values["compilerVersion"] ??
-                    ccVersionOnce(driver.argv, toolchainEnv, true)),
+                    ccVersion(driver.argv, toolchainEnv, true)),
                 localArtifact === null
                     ? runtimeFingerprint(rtDir)
                     : Promise.resolve(localArtifact.runtimeHash),
@@ -4049,7 +3467,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             ]);
             compileMetadataStamp = compileMetadataKey === null
                 ? null
-                : await readNativeMetadataStamp(root, compileMetadataKey);
+                : await readNativeMetadataStamp(persistentCache.root, compileMetadataKey);
             if (compileMetadataStamp !== null) {
                 runtimeCompilerInvocation = compileMetadataStamp.values["runtimeInvocation"] ?? null;
                 programCompilerInvocation = compileMetadataStamp.values["programInvocation"] ?? null;
@@ -4067,7 +3485,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                 runtimeCompilerInvocation = runtimeInvocation;
                 programCompilerInvocation = programInvocation ?? runtimeInvocation;
                 if (compileMetadataKey !== null) {
-                    compileMetadataStamp = await publishNativeMetadataStamp(root, compileMetadataKey, {
+                    compileMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, compileMetadataKey, {
                         runtimeInvocation: runtimeCompilerInvocation,
                         programInvocation: programCompilerInvocation,
                     }, [
@@ -4085,11 +3503,11 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                     cause: error,
                 });
             }
-            root = null;
+            persistentCache = null;
         }
     }
-    if (root === null) {
-        // The exact historical command line, byte for byte.
+    if (persistentCache === null) {
+        // The direct uncached command is the source-of-truth executable recipe.
         await runUncachedBuild();
         return;
     }
@@ -4098,7 +3516,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     let cBytes;
     try {
         [cv, fingerprint, cBytes] = await (payloadMetadata ?? Promise.all([
-            ccVersionOnce(driver.argv, toolchainEnv, true),
+            ccVersion(driver.argv, toolchainEnv, true),
             runtimeFingerprint(rtDir),
             readFile(opts.cPath),
         ]));
@@ -4135,8 +3553,9 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null ? ["-lz"] : []),
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
     ];
     // Both the wrapper dry run and dependency trace need the real build's
     // compile/link flag shape: wrappers commonly inject flags or native inputs
@@ -4151,12 +3570,12 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         ...(curlStubDir !== null ? [`-L${curlStubDir}`] : []),
         ...(curlFetch && driver.target === null ? ["-lcurl"] : []),
         ...(dynamic && !driver.linkArgs.includes("-lm") ? ["-lm"] : []),
-        ...(dynamic && targetPlatform(driver) === "darwin" ? ["-Wl,-dead_strip"] : []),
         ...(dynamic && targetPlatform(driver) === "win32"
             ? ["-Wl,--stack,8388608"]
             : []),
-        ...(((opts.zlib ?? false) || nativeFetch) && driver.target === null ? ["-lz"] : []),
+        ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
         ...driver.linkArgs,
+        ...executableSectionFlags.link,
     ];
     // A complete hit is checked before cross-target curl's generated import stub
     // is materialized. Its -L spelling still joins the dry-run identity, while
@@ -4168,7 +3587,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     let preBuildDependencies = null;
     let localArtifactDependencyPaths = null;
     let linkMetadataStamp = null;
-    const linkMetadataKey = root === null || process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
+    const linkMetadataKey = process.env["SCRIPTC_TEST_TRUST_COMPILER_WRAPPER"] === "1"
         ? null
         : nativeMetadataKey("link", [
             cacheTargetIdentity(driver),
@@ -4189,7 +3608,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             // cache hits and ordinary edit/build misses without changing either key.
             linkMetadataStamp = linkMetadataKey === null
                 ? null
-                : await readNativeMetadataStamp(root, linkMetadataKey);
+                : await readNativeMetadataStamp(persistentCache.root, linkMetadataKey);
             if (linkMetadataStamp !== null) {
                 implicitLinker = linkMetadataStamp.values["implicitLinker"] ?? null;
                 if (implicitLinker === null)
@@ -4202,7 +3621,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                     : Promise.resolve(implicitLinker),
             ]);
             if (linkMetadataStamp === null && linkMetadataKey !== null) {
-                linkMetadataStamp = await publishNativeMetadataStamp(root, linkMetadataKey, { implicitLinker }, fingerprintDependencyPaths(implicitLinker), [implicitLinker]);
+                linkMetadataStamp = await publishNativeMetadataStamp(persistentCache.root, linkMetadataKey, { implicitLinker }, fingerprintDependencyPaths(implicitLinker), [implicitLinker]);
             }
             preBuildDependencies = await snapshotLocalArtifactDependencies([
                 ...(await runtimeFingerprintInputPaths(rtDir)),
@@ -4274,7 +3693,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             });
         }
     }
-    const binDir = join(root, "bin");
+    const binDir = join(persistentCache.root, "bin");
     let keyHex = null;
     let cachedBin = null;
     if (cacheCompleteArtifact) {
@@ -4296,7 +3715,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             .update(programCompilerInvocation).update("\0")
             .update(implicitLinker).update("\0")
             .update(programDependencies).update("\0")
-            .update(opts.cacheIdentity).update("\0")
+            .update(persistentCache.identity).update("\0")
             // Preserve both the spelling clang sees (__FILE__) and the location used
             // to resolve relative includes. The top-level bytes are not sufficient.
             .update(opts.cPath).update("\0")
@@ -4329,7 +3748,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             await chmod(tmpOut, 0o777 & ~process.umask());
             await rename(tmpOut, opts.outPath);
             if (localArtifact !== null && localArtifactDependencyPaths !== null) {
-                const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [root]).catch(() => null);
+                const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [persistentCache.root]).catch(() => null);
                 if (stamp !== null) {
                     await opts.onArtifactReady?.({ dependencies: stamp.dependencies }).catch(() => undefined);
                 }
@@ -4357,7 +3776,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
         // between hashing and clang and publish one invocation's code under the
         // other's key. The prefix map preserves the original __FILE__/debug-file
         // spelling while clang reads this invocation-private snapshot.
-        const programPath = join(buildDir, `program${opts.cPath.endsWith(".ll") ? ".ll" : ".c"}`);
+        const programPath = join(buildDir, `program${programSourceExtension}`);
         // Preserve the caller-visible basename while keeping Darwin builds on a
         // private inode: ld uses this spelling as the embedded ad-hoc signing
         // identifier. Other targets retain the basename-independent cache key.
@@ -4387,7 +3806,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             return strictObjectVerification;
         };
         try {
-            const cached = await ensureRuntimeObjects(root, driver.argv, cflags, rtInputs, `obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${ccName}\0${cv}\0${fingerprint}\0`, async () => await objectImplicitToolchainStillMatches(), cacheWarmPaths);
+            const cached = await ensureRuntimeObjects(persistentCache.root, driver.argv, cflags, rtInputs, `obj-v5\0${cacheTargetIdentity(driver)}\0${toolchainEnv}\0${implicitToolchain}\0${runtimeCompilerInvocation}\0${ccName}\0${cv}\0${fingerprint}\0`, async () => await objectImplicitToolchainStillMatches(), cacheWarmPaths);
             objects = await stageRuntimeObjects(cached, join(buildDir, "runtime-objects"));
         }
         catch (err) {
@@ -4417,7 +3836,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                         .update(toolchainEnv).update("\0")
                         .update(implicitCompileToolchain).update("\0")
                         .update(programCompilerInvocation).update("\0")
-                        .update(opts.cacheIdentity).update("\0")
+                        .update(persistentCache.identity).update("\0")
                         .update(driver.argv.join("\x1f")).update("\0")
                         .update(cv).update("\0")
                         .update(fingerprint).update("\0")
@@ -4432,7 +3851,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                         ...shard,
                         sourcePath,
                         staged,
-                        cachePath: join(root, "program-shard", key),
+                        cachePath: join(persistentCache.root, "program-shard", key),
                         missed: false,
                     };
                 });
@@ -4453,7 +3872,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                         ]);
                     }));
                 }
-                const arArgv = driver.argv[0] === "zig" ? [driver.argv[0], "ar"] : ["ar"];
+                const arArgv = isZigDriver(driver) ? [driver.argv[0], "ar"] : ["ar"];
                 const merged = await localizeLibraryObjects(driver, arArgv, buildDir, entries.map((entry) => entry.staged), [], programPublicSymbols, `${stem}.program`);
                 const publishable = entries.filter((entry) => entry.missed);
                 if (publishable.length > 0) {
@@ -4463,7 +3882,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                             implicitToolchainFingerprints(driver, toolchainEnv),
                             effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, ".ll"),
                             translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv),
-                            ccVersionOnce(driver.argv, toolchainEnv, true),
+                            ccVersion(driver.argv, toolchainEnv, true),
                             resolveProgramShardMergeIdentity(driver),
                         ]);
                         if (currentRuntime === fingerprint &&
@@ -4511,7 +3930,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
                 effectiveCompilerInvocationFingerprint(driver, toolchainEnv, programCompilerArgs, programSourceExtension).catch(() => null),
                 translationUnitDependencyFingerprint(driver, cflags, opts.cPath, cBytes, toolchainEnv).catch(() => null),
                 implicitLinkerFingerprint(driver, toolchainEnv, linkProbeArgs, effectiveLinkInvocationArgs, linkTraceInvocationArgs).catch(() => null),
-                ccVersionOnce(driver.argv, toolchainEnv, true).catch(() => null),
+                ccVersion(driver.argv, toolchainEnv, true).catch(() => null),
                 programShards === null
                     ? Promise.resolve(null)
                     : resolveProgramShardMergeIdentity(driver).catch(() => null),
@@ -4544,7 +3963,7 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
             localArtifactDependencyPaths !== null &&
             cacheCompleteArtifact &&
             cacheInputsStable) {
-            const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [root]).catch(() => null);
+            const stamp = await publishLocalArtifactStamp(localArtifact.stampPath, opts.outPath, localArtifact.key, localArtifactDependencyPaths, [dirname(resolve(opts.cPath))], [persistentCache.root]).catch(() => null);
             if (stamp !== null) {
                 await opts.onArtifactReady?.({ dependencies: stamp.dependencies }).catch(() => undefined);
             }
@@ -4555,9 +3974,10 @@ async function compileCInternal(opts, cacheWarmOnly, cacheWarmPaths) {
     }
     // Runtime-object population is itself a cache write, including on builds
     // whose native link inputs disable complete-artifact publication.
-    await pruneCache(root, cacheWarmPaths).catch(() => undefined);
+    await pruneCache(persistentCache.root, cacheWarmPaths).catch(() => undefined);
 }
 export async function compileC(opts) {
+    clearCcCaches();
     await compileCInternal(opts, false);
 }
 export function supportedNativeCacheWarmProfiles(driver) {
@@ -4571,6 +3991,7 @@ export function supportedNativeCacheWarmProfiles(driver) {
  * before a developer's first program asks for them. Synthetic link products
  * are discarded and never enter the complete-executable cache. */
 export async function warmNativeCaches(options = {}) {
+    clearCcCaches();
     const cacheRoot = cacheRootDir();
     if (cacheRoot === null) {
         throw new Error("the native build cache is disabled (unset SCRIPTC_NO_CACHE and use a non-empty SCRIPTC_CACHE_DIR)");
@@ -4629,4 +4050,4 @@ export async function warmNativeCaches(options = {}) {
         await rm(workDir, { recursive: true, force: true }).catch(() => undefined);
     }
 }
-//# sourceMappingURL=cc.js.map
+//# sourceMappingURL=native-toolchain.js.map