@scriptc/runtime 0.0.0 → 0.0.2

package/src/scr_win.c

@@ -0,0 +1,76 @@
+/* win32 libc shims — the POSIX/BSD functions the runtime calls that
+ * mingw-w64's CRT does not provide (declared in scr_runtime.h's _WIN32
+ * block). Compiled into win32-target builds only (cc.ts adds this TU and
+ * -ladvapi32 for windows triples); an empty TU anywhere else, so POSIX
+ * builds cannot change by a byte. */
+#ifdef _WIN32
+
+#include "scr_runtime.h"
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <windows.h>
+
+/* POSIX.1-2008 stpcpy: strcpy returning the END of the copy — scr_number.c
+ * (untouchable by project rule; ryu-adjacent) builds "e+"/"e-" exponent
+ * tails with it. */
+char *stpcpy(char *dst, const char *src) {
+  size_t n = strlen(src);
+  memcpy(dst, src, n + 1);
+  return dst + n;
+}
+
+/* arc4random_buf over RtlGenRandom (advapi32's SystemFunction036) — the
+ * kernel CSPRNG behind rand_s and BCryptGenRandom, available everywhere
+ * without a bcrypt link. Failure aborts: like the BSD/glibc original, the
+ * callers (Math.random, crypto.randomUUID/randomBytes) have no error arm
+ * and returning predictable bytes is never acceptable. */
+BOOLEAN NTAPI SystemFunction036(PVOID buffer, ULONG length);
+
+void arc4random_buf(void *buf, size_t n) {
+  unsigned char *p = buf;
+  while (n > 0) {
+    ULONG step = n > 0x7fffffffUL ? 0x7fffffffUL : (ULONG)n;
+    if (!SystemFunction036(p, step)) {
+      fputs("scriptc: RtlGenRandom failed\n", stderr);
+      abort();
+    }
+    p += step;
+    n -= step;
+  }
+}
+
+/* POSIX gmtime_r: the win32 CRT's gmtime already answers from per-thread
+ * storage, so the reentrant spelling is a copy-out (scr_http.c's Date
+ * header formatter is the caller). */
+struct tm *gmtime_r(const time_t *t, struct tm *out) {
+  struct tm *g = gmtime(t);
+  if (g == NULL) return NULL;
+  *out = *g;
+  return out;
+}
+
+/* GNU/BSD strcasestr — scr_http.c's Connection-token scan. Naive
+ * quadratic scan like the musl original; header values are tiny. */
+char *strcasestr(const char *hay, const char *needle) {
+  size_t n = strlen(needle);
+  if (n == 0) return (char *)hay;
+  for (; *hay != '\0'; hay++) {
+    size_t i = 0;
+    while (i < n && hay[i] != '\0' &&
+           tolower((unsigned char)hay[i]) == tolower((unsigned char)needle[i]))
+      i++;
+    if (i == n) return (char *)hay;
+  }
+  return NULL;
+}
+
+#else /* !_WIN32 */
+
+/* Empty TU off-Windows: cc.ts only compiles this file for windows triples,
+ * but an accidental link elsewhere must stay harmless. */
+typedef int scr_win_unused;
+
+#endif /* _WIN32 */

package/src/scr_zlib.c

@@ -0,0 +1,197 @@
+/* node:zlib, the lowered slice: deflateSync/inflateSync over u8 bytes with
+ * Node's DEFAULT options (zlib format, Z_DEFAULT_COMPRESSION, windowBits
+ * 15). Compiled ONLY when the program uses zlib (cc.ts gates it exactly
+ * like scr_regex.c/libregexp), so zlib-free binaries keep their
+ * historical link line. Host builds link the system -lz; cross targets
+ * link the vendored zlib built per target (ensureZlibObjects in cc.ts).
+ *
+ * Compressed OUTPUT bytes are zlib-version-dependent — the differential
+ * corpus tests round-trips and fixed-blob inflation, never raw deflate
+ * output. deflate of valid input cannot fail (OOM aborts); inflate of
+ * corrupt input THROWS Node's catchable Error (zlib's own msg text:
+ * "incorrect header check", ...). */
+#include "scr_runtime.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <zlib.h>
+
+static void scr_zlib_oom(void) {
+  fputs("scriptc: out of memory\n", stderr);
+  abort();
+}
+
+ScrBytes *scr_zlib_deflate(const ScrBytes *data) {
+  uLong srcLen = (uLong)data->len;
+  uLong cap = compressBound(srcLen);
+  uint8_t *buf = malloc(cap ? cap : 1);
+  if (!buf) scr_zlib_oom();
+  uLongf outLen = cap;
+  int rc = compress2(buf, &outLen, data->data, srcLen, Z_DEFAULT_COMPRESSION);
+  if (rc != Z_OK) scr_zlib_oom(); /* Z_MEM_ERROR is the only reachable code */
+  ScrBytes *out = scr_bytes_new(SCR_BYTES_U8, (double)outLen);
+  memcpy(out->data, buf, outLen);
+  free(buf);
+  return out;
+}
+
+ScrBytes *scr_zlib_inflate(const ScrBytes *data) {
+  z_stream zs;
+  memset(&zs, 0, sizeof zs);
+  if (inflateInit(&zs) != Z_OK) scr_zlib_oom();
+  size_t cap = data->len > 64 ? data->len * 4 : 256;
+  uint8_t *buf = malloc(cap);
+  if (!buf) scr_zlib_oom();
+  zs.next_in = data->data;
+  zs.avail_in = (uInt)data->len;
+  size_t len = 0;
+  for (;;) {
+    zs.next_out = buf + len;
+    zs.avail_out = (uInt)(cap - len);
+    int rc = inflate(&zs, Z_NO_FLUSH);
+    len = cap - zs.avail_out;
+    if (rc == Z_STREAM_END) break;
+    if (rc == Z_OK || rc == Z_BUF_ERROR) {
+      if (rc == Z_BUF_ERROR && zs.avail_in == 0 && zs.avail_out > 0) {
+        /* Truncated input: Node throws "unexpected end of file". */
+        inflateEnd(&zs);
+        free(buf);
+        static const char msg[] = "unexpected end of file";
+        scr_throw_error_msg(SCR_ERR_ERROR, msg, sizeof msg - 1);
+        return NULL;
+      }
+      if (cap - len < 64) {
+        cap *= 2;
+        uint8_t *grown = realloc(buf, cap);
+        if (!grown) scr_zlib_oom();
+        buf = grown;
+      }
+      continue;
+    }
+    /* Corrupt data: zlib's msg is exactly Node's error message text. */
+    const char *msg = zs.msg ? zs.msg : "zlib error";
+    size_t mlen = strlen(msg);
+    inflateEnd(&zs);
+    free(buf);
+    scr_throw_error_msg(SCR_ERR_ERROR, msg, mlen);
+    return NULL;
+  }
+  inflateEnd(&zs);
+  ScrBytes *out = scr_bytes_new(SCR_BYTES_U8, (double)len);
+  memcpy(out->data, buf, len);
+  free(buf);
+  return out;
+}
+
+/* ── the island's mode variants (scr_zlib_island.c bridges these into
+ * the embedded engine's node:zlib shim) ───────────────────────────────
+ * mode: 0 zlib (windowBits 15), 1 raw (-15), 2 gzip (15+16); inflate
+ * additionally takes 3 = auto-detect zlib/gzip (15+32, Node's unzip). */
+
+static int scr_zlib_window_bits(int mode, bool inflating) {
+  switch (mode) {
+  case 1: return -15;
+  case 2: return 15 + 16;
+  case 3: return inflating ? 15 + 32 : 15;
+  default: return 15;
+  }
+}
+
+ScrBytes *scr_zlib_deflate_mode(const ScrBytes *data, double mode, double level) {
+  z_stream zs;
+  memset(&zs, 0, sizeof zs);
+  int lvl = (int)level;
+  if (lvl < -1 || lvl > 9) lvl = Z_DEFAULT_COMPRESSION;
+  if (deflateInit2(&zs, lvl, Z_DEFLATED, scr_zlib_window_bits((int)mode, false), 8,
+                   Z_DEFAULT_STRATEGY) != Z_OK) {
+    scr_zlib_oom();
+  }
+  uLong cap = deflateBound(&zs, (uLong)data->len);
+  uint8_t *buf = malloc(cap ? cap : 1);
+  if (!buf) scr_zlib_oom();
+  zs.next_in = data->data;
+  zs.avail_in = (uInt)data->len;
+  zs.next_out = buf;
+  zs.avail_out = (uInt)cap;
+  int rc = deflate(&zs, Z_FINISH);
+  if (rc != Z_STREAM_END) scr_zlib_oom(); /* bound guarantees completion */
+  size_t len = cap - zs.avail_out;
+  deflateEnd(&zs);
+  ScrBytes *out = scr_bytes_new(SCR_BYTES_U8, (double)len);
+  memcpy(out->data, buf, len);
+  free(buf);
+  return out;
+}
+
+ScrBytes *scr_zlib_inflate_mode(const ScrBytes *data, double mode) {
+  z_stream zs;
+  memset(&zs, 0, sizeof zs);
+  if (inflateInit2(&zs, scr_zlib_window_bits((int)mode, true)) != Z_OK) scr_zlib_oom();
+  size_t cap = data->len > 64 ? data->len * 4 : 256;
+  uint8_t *buf = malloc(cap);
+  if (!buf) scr_zlib_oom();
+  zs.next_in = data->data;
+  zs.avail_in = (uInt)data->len;
+  size_t len = 0;
+  for (;;) {
+    zs.next_out = buf + len;
+    zs.avail_out = (uInt)(cap - len);
+    int rc = inflate(&zs, Z_NO_FLUSH);
+    len = cap - zs.avail_out;
+    if (rc == Z_STREAM_END) break;
+    if (rc == Z_OK || rc == Z_BUF_ERROR) {
+      if (rc == Z_BUF_ERROR && zs.avail_in == 0 && zs.avail_out > 0) {
+        inflateEnd(&zs);
+        free(buf);
+        static const char msg[] = "unexpected end of file";
+        scr_throw_error_msg_code(SCR_ERR_ERROR, msg, sizeof msg - 1, "Z_BUF_ERROR");
+        return NULL;
+      }
+      if (cap - len < 64) {
+        cap *= 2;
+        uint8_t *grown = realloc(buf, cap);
+        if (!grown) scr_zlib_oom();
+        buf = grown;
+      }
+      continue;
+    }
+    const char *msg = zs.msg ? zs.msg : "zlib error";
+    size_t mlen = strlen(msg);
+    /* Node stamps the zlib return code's name (err.code) */
+    const char *code = rc == Z_DATA_ERROR ? "Z_DATA_ERROR"
+                       : rc == Z_NEED_DICT ? "Z_NEED_DICT"
+                       : rc == Z_MEM_ERROR ? "Z_MEM_ERROR"
+                                           : "Z_STREAM_ERROR";
+    inflateEnd(&zs);
+    free(buf);
+    scr_throw_error_msg_code(SCR_ERR_ERROR, msg, mlen, code);
+    return NULL;
+  }
+  inflateEnd(&zs);
+  ScrBytes *out = scr_bytes_new(SCR_BYTES_U8, (double)len);
+  memcpy(out->data, buf, len);
+  free(buf);
+  return out;
+}
+
+/* One-shot raw-DEFLATE inflate into a caller-sized buffer: the island's
+ * compressed embedded module text (the emitter stores big npm sources
+ * deflated and their exact inflated length in the table row — the emitted
+ * main installs this through scr_island_set_inflate). True only when the
+ * stream ends exactly at dst_len; any mismatch is a build/runtime bug the
+ * caller surfaces, never a silent truncation. */
+bool scr_zlib_inflate_exact(const unsigned char *src, size_t src_len,
+                            unsigned char *dst, size_t dst_len) {
+  z_stream zs;
+  memset(&zs, 0, sizeof zs);
+  if (inflateInit2(&zs, -15) != Z_OK) return false; /* raw DEFLATE */
+  zs.next_in = (Bytef *)(uintptr_t)src;
+  zs.avail_in = (uInt)src_len;
+  zs.next_out = dst;
+  zs.avail_out = (uInt)dst_len;
+  int rc = inflate(&zs, Z_FINISH);
+  bool ok = rc == Z_STREAM_END && zs.total_out == dst_len;
+  inflateEnd(&zs);
+  return ok;
+}

package/src/scr_zlib_island.c

@@ -0,0 +1,15 @@
+/* The zlib ↔ island bridge — the one translation unit referencing BOTH
+ * scr_zlib.c and the island (the scr_inspect_island.c precedent): cc.ts
+ * compiles it exactly when a --dynamic build's embedded npm graph
+ * imports node:zlib, and the emitted main calls scr_zlib_island_install
+ * before any island entry. zlib-free dynamic builds keep the island's
+ * "zlib is not linked" refusal; island-free zlib builds never load this
+ * file. */
+#include "scr_runtime.h"
+
+void scr_island_set_zlib(ScrBytes *(*deflate)(const ScrBytes *, double, double),
+                         ScrBytes *(*inflate)(const ScrBytes *, double));
+
+void scr_zlib_island_install(void) {
+  scr_island_set_zlib(scr_zlib_deflate_mode, scr_zlib_inflate_mode);
+}

package/vendor/README.md

@@ -0,0 +1,52 @@
+# Vendored third-party code
+
+## ryu/
+
+- Project: https://github.com/ulfjack/ryu
+- Commit: 4c0618b0e44f7ef027ebae05d2cc7812048f7c8f
+- License: Apache-2.0 OR BSL-1.0, used under the Boost Software License 1.0 (see ryu/LICENSE-Boost)
+
+The double-to-shortest-decimal core of Ryū (d2s and its headers only — the float and fixed/exponent variants are not vendored). scr_number.c textually `#include`s d2s.c and calls its internal `d2d` digit generator; ECMA-262 digit *placement* stays in scr_number.c. The only modification to upstream files: `#include "ryu/x.h"` flattened to `#include "x.h"` in d2s.c and d2s_intrinsics.h so the directory is self-contained. To update, re-fetch the listed files at the new commit and re-apply that include flattening.
+
+## quickjs-ng/
+
+- Project: https://github.com/quickjs-ng/quickjs
+- Version: v0.15.1
+- Commit: 3c8f3d68953955950074c41c6e4d999562ae82a7
+- License: MIT (see quickjs-ng/LICENSE)
+
+The QuickJS-ng JavaScript engine, embedded by the opt-in `--dynamic` build mode (see packages/runtime/src/scr_island.c). Static builds never compile or link any of this.
+
+The tree is a plain snapshot of the upstream commit with directories the library build does not need removed (tests/, docs/, examples/, test262 fixtures, CI config, generator scripts). No vendored file is modified; to update, re-clone upstream at the new commit, delete its .git directory, apply the same trim, and update this file.
+
+The engine archive (libqjs.a) is built lazily on the first `--dynamic` compile into `.cache/<commit>-<flavor>/` next to this file — one flavor per lane (plain, asan). The cache directory is gitignored and safe to delete.
+
+## zlib/
+
+- Project: https://github.com/madler/zlib
+- Version: 1.3.1 (release tarball zlib-1.3.1.tar.gz, sha256 9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23)
+- License: zlib (see zlib/LICENSE)
+
+The CROSS-target arm of node:zlib (see packages/runtime/src/scr_zlib.c): host builds keep the historical system `-lz` link (macOS ships libz), but zig's cross sysroots have no libz, so SCRIPTC_TARGET builds compile this vendored copy per target instead. Only the flat `*.c`/`*.h` at the distribution root are vendored (LICENSE beside them) — contrib, tests, build machinery, and docs are not. No vendored file is modified; the gz* file-I/O TUs are vendored for faithfulness but never compiled (nothing references the gzFile API — see ZLIB_SOURCES in packages/compiler/src/backend/cc.ts). To update, re-fetch the release tarball, copy the same flat set, and bump `ZLIB_VERSION` in cc.ts.
+
+The objects build lazily on the first zlib-using cross compile into `.cache/zlib-<version>-<flavor>/` next to this file — one flavor per driver/target (the lre-objects pattern). Zlib-free binaries never compile any of this; compressed OUTPUT bytes are zlib-version-dependent, which is why the corpus only compares round-trips and fixed-blob inflation.
+
+## curl/
+
+- Project: https://curl.se/ (Debian bookworm's libcurl4-openssl-dev 7.88.1, the exact library the Linux lane's pinned container image ships)
+- Version: 7.88.1 (headers copied byte-for-byte from `node:24.15.0-bookworm`'s `/usr/include/aarch64-linux-gnu/curl/`; the arch-specific include dir is Debian multiarch layout — the headers themselves are architecture-independent, `system.h` selects per-arch typedefs at preprocessing time)
+- License: curl (see curl/COPYRIGHT — the Debian machine-readable copyright file for the package the headers came from)
+
+HEADERS ONLY — no curl C source is vendored and none is ever compiled. These headers now serve ONLY the RETIRED curl reference implementation of fetch (packages/runtime/src/scr_fetch_curl.c, selected by `SCRIPTC_FETCH_CURL=1`; kept compilable for one release as the native flip's reference — see scr_fetch.c, the default, which rides scr_net/scr_tls/scr_http/zlib and touches nothing here). Under the flag: host builds link the system `-lcurl` (macOS ships libcurl), and linux-gnu CROSS builds compile scr_fetch_curl.c against these headers, then link against a generated STUB `libcurl.so` (soname `libcurl.so.4`, empty definitions of exactly the symbols scr_fetch_curl.c calls — see CURL_STUB_SYMBOLS in packages/compiler/src/backend/cc.ts) so the produced binary records a plain `DT_NEEDED libcurl.so.4` that the TARGET system's real libcurl satisfies at load time, the standard cross-link import-stub technique. The 7.88.1 pin is a floor, not a lock: scr_fetch_curl.c's newest requirement is CURLOPT_PROTOCOLS_STR (7.85.0) and the unversioned symbol references bind to any libcurl.so.4. This whole directory leaves with scr_fetch_curl.c when the reference retires for good.
+
+The stub builds lazily on the first flag-selected fetch cross compile into `.cache/curl-stub-<flavor>/` next to this file (the zlib-objects pattern). Default builds never see any of this, and no build ever compiles curl itself.
+
+## mbedtls/
+
+- Project: https://github.com/Mbed-TLS/mbedtls
+- Version: mbedtls-3.6.7 (the 3.6 LTS line — 4.x moved the crypto core into the separate TF-PSA-Crypto repository; the self-contained LTS is what a vendored tree wants)
+- License: Apache-2.0 (see mbedtls/LICENSE)
+
+The TLS provider behind node:tls/node:https (see the design note atop packages/runtime/src/scr_tls.c for why mbedTLS over SecureTransport/BoringSSL/libtls). Only `include/` and `library/` are vendored (LICENSE beside them) — tests, docs, programs, scripts, and CMake machinery are not. No vendored file is modified and no custom config is applied (the stock `mbedtls_config.h` builds every `library/*.c` standalone with clang); to update, re-fetch the release tarball, copy the same two directories, and bump `MBEDTLS_VERSION` in packages/compiler/src/backend/cc.ts.
+
+The archive (libmbedtls.a) is built lazily on the first TLS-using compile into `.cache/mbedtls-<version>-<flavor>/` next to this file — one flavor per lane (plain, asan), the libqjs.a pattern. TLS-free binaries never compile or link any of this.