@scriptc/runtime 0.0.11 → 0.0.13

package/src/scr_stream.c

@@ -786,7 +786,7 @@ static void scr_stream_resume_kick(ScrStream *s) {
  * parameters implicitly-any: the compiler-emitted invoke thunks box the
  * chunk/encoding/error into dyn, and the COMPLETION callback arrives as
  * a callable dyn function whose glue lands here — arguments arrive as
- * borrowed DOM values: the error is null/undefined (none), an
+ * borrowed dyn values: the error is null/undefined (none), an
  * error-shaped object ({message}), or a string; transform/flush data is
  * bytes, a string, or absent. clo->caps[0] boxes the retained stream. */
 
@@ -870,7 +870,7 @@ ScrDyn *scr_stream_done_dyn_l(ScrClosure *clo, ScrDyn *const *args, size_t argc)
 }
 
 /* Checked-dynamic chunks (the JS lane's push/write of any-typed values):
- * dispatch by DOM tag — bytes copy out, strings convert utf8, null takes
+ * dispatch by dyn tag — bytes copy out, strings convert utf8, null takes
  * the null path (EOF for push; ERR_STREAM_NULL_VALUES for write), and
  * anything else throws the write TypeError (Node would throw
  * ERR_INVALID_ARG_TYPE — approximated by the same shape). Borrow d. */
@@ -1531,7 +1531,7 @@ void scr_stream_set_flush(ScrStream *s, ScrClosure *cb /*moves*/, ScrStreamPlain
  * keys are ignored exactly like Node), and callback slots holding
  * callable values (Node's `typeof === 'function'` guard — anything else
  * leaves the slot to the prototype/fallback) bind as closures whose one
- * cap boxes the dyn callable; the invs below build the DOM arguments the
+ * cap boxes the dyn callable; the invs below build the dyn arguments the
  * way the compiler-emitted dyn thunks do (chunk as Buffer-flavored bytes,
  * encoding 'buffer', the error via the boundary encoding, the completion
  * callback as a callable dyn over the *_done glue). Options that Node's
@@ -3038,7 +3038,7 @@ static void scr_stream_run_tick(ScrStreamTick *t) {
         /* Fully closed: nothing calls the option callbacks again (Node's
          * contract), so drop them here — this breaks the reference cycle
          * a callback capturing its own stream forms, including the dyn-
-         * options closures whose stream edge rides through a DOM function
+         * options closures whose stream edge rides through a dyn function
          * value the cycle collector cannot traverse. */
               if (st->r.read_cb) { scr_closure_release(st->r.read_cb); st->r.read_cb = NULL; }
         if (st->w.write_cb) { scr_closure_release(st->w.write_cb); st->w.write_cb = NULL; }

package/src/scr_tls.c

@@ -350,7 +350,30 @@ typedef struct ScrTlsCli {
 static mbedtls_x509_crt scr_tls_system_roots;
 static bool scr_tls_system_roots_loaded = false;
 
+/* setDefaultCACertificates' replacement anchors (scr_tls_ca.c — always
+ * compiled alongside this unit): parsed lazily per generation, so each
+ * set re-parses once and every later dial reuses the chain. An EMPTY
+ * replacement keeps an initialized, certificate-free chain — every
+ * verification fails, Node's own consequence of trusting nothing. */
+static mbedtls_x509_crt scr_tls_override_roots;
+static uint64_t scr_tls_override_parsed_gen = 0;
+
 static mbedtls_x509_crt *scr_tls_system_ca(void) {
+  const char *pem = NULL;
+  size_t pem_len = 0;
+  uint64_t gen = 0;
+  if (scr_tls_ca_default_override(&pem, &pem_len, &gen)) {
+    if (gen != scr_tls_override_parsed_gen) {
+      if (scr_tls_override_parsed_gen != 0) mbedtls_x509_crt_free(&scr_tls_override_roots);
+      mbedtls_x509_crt_init(&scr_tls_override_roots);
+      /* +1 for the NUL — mbedTLS's PEM mode wants it counted. A parse
+       * failure inside one block leaves the chain with the blocks that
+       * did parse (the scr_tls_ca.c divergence note). */
+      if (pem_len > 0) (void)mbedtls_x509_crt_parse(&scr_tls_override_roots, (const unsigned char *)pem, pem_len + 1);
+      scr_tls_override_parsed_gen = gen;
+    }
+    return &scr_tls_override_roots;
+  }
   if (!scr_tls_system_roots_loaded) {
     scr_tls_system_roots_loaded = true;
     mbedtls_x509_crt_init(&scr_tls_system_roots);
@@ -983,8 +1006,20 @@ ScrHttpClientReq *scr_https_request(ScrStr *host /*borrowed*/, double port,
                               fn, 443, &scr_tls_cli_wrap, cli);
 }
 
+ScrHttpClientReq *scr_https_request_agent(ScrStr *host /*borrowed*/, double port,
+                                           ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
+                                           double timeout_ms, ScrArr *header_pairs /*borrowed*/,
+                                           bool auto_end, bool reject_unauthorized,
+                                           const char *ca /*borrowed, len 0 = none*/, size_t ca_len,
+                                           const ScrDyn *agent /*borrowed*/,
+                                           ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn) {
+  ScrTlsCli *cli = scr_tls_cli_new(host, reject_unauthorized, ca, ca_len);
+  return scr_http_request_agent_ex(host, port, path, method, timeout_ms, header_pairs, auto_end,
+                                    agent, cb, fn, 443, &scr_tls_cli_wrap, cli);
+}
+
 /* ── RUNTIME options records (the divergence-66 stance) ────────────────
- * A non-literal options value — the checked-dynamic JS lane's DOM record
+ * A non-literal options value — the checked-dynamic JS lane's dyn record
  * — reads its members at RUNTIME. Members the literal path lowers take
  * the same lowering; members whose literal forms are compile fences
  * become runtime gates that THROW the catchable fence instead of
@@ -1002,7 +1037,7 @@ static void scr_tls_opt_fence(const char *api, const char *key, const char *hint
   scr_throw_error(SCR_ERR_ERROR, scr_jb_finish(&b));
 }
 
-/* JS truthiness over the DOM kinds — Node reads requestCert /
+/* JS truthiness over the dyn kinds — Node reads requestCert /
  * rejectUnauthorized through `if (options.x)`. */
 static bool scr_tls_dyn_truthy(const ScrDyn *v) {
   switch (v->kind) {
@@ -1219,9 +1254,11 @@ static bool scr_tls_opts_validate(const ScrDyn *opts) {
 }
 
 /* The server-options walk. Fills the cert/key out-params (+1 each) from a
- * DOM options record; false = exception pending (partial results released). */
-static bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes **cert_out,
-                                   ScrBytes **key_out) {
+ * dyn options record; false = exception pending (partial results released).
+ * Exported runtime-internally: scr_http2.c's createSecureServerDyn rides
+ * the same walk (scr_http2.c always links alongside this unit). */
+bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes **cert_out,
+                            ScrBytes **key_out) {
   *cert_out = NULL;
   *key_out = NULL;
   if (opts == NULL || opts->kind != SCR_DYN_OBJ) {

package/src/scr_tls_ca.c

@@ -0,0 +1,288 @@
+/* node:tls — the CA-store introspection slice: getCACertificates,
+ * rootCertificates, and setDefaultCACertificates (scr_runtime.h has the
+ * contracts). Its own link gate ("tlsca." libCalls), deliberately free
+ * of mbedTLS: everything here is PEM-BLOCK bookkeeping over the host
+ * bundle, so a program that only inspects the CA store keeps the lean
+ * link line. scr_tls.c (when it links — cc.ts compiles this unit
+ * alongside it) consults scr_tls_ca_default_override for its client
+ * trust anchors, which is what makes setDefaultCACertificates LIVE
+ * semantics: the next https/tls dial verifies against the replaced set.
+ *
+ * Divergences, documented: the host bundle stands in for Node's
+ * compiled-in Mozilla roots ('bundled' and rootCertificates) AND for the
+ * platform store ('system') — the same /etc/ssl/cert.pem stance
+ * scr_tls.c's anchors established; and set-time validation is PEM-BLOCK
+ * shaped (a well-formed block with corrupt DER inside is kept here where
+ * Node's X509 parse would drop it — such a cert then fails verification
+ * instead, the same observable outcome one step later). Deduplication is
+ * byte-exact over the extracted block where Node compares parsed X509
+ * identities; re-encoded duplicates of one certificate stay distinct
+ * entries, which no equality the tests observe can distinguish without a
+ * parser. */
+#include "scr_runtime.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* The per-type caches: +1 held here for the process lifetime (an atexit
+ * teardown releases them so the RC audit stays clean). 'default' also
+ * keeps the concatenated PEM buffer scr_tls.c parses into anchors. */
+static ScrArr *scr_ca_bundled = NULL;
+static ScrArr *scr_ca_system = NULL;
+static ScrArr *scr_ca_extra = NULL;
+static ScrArr *scr_ca_default = NULL;
+static char *scr_ca_override_buf = NULL;
+static size_t scr_ca_override_len = 0;
+static uint64_t scr_ca_override_gen = 0; /* 0 = never set */
+
+static void scr_ca_oom(void) {
+  fputs("scriptc: out of memory\n", stderr);
+  abort();
+}
+
+static void scr_ca_teardown(void) {
+  if (scr_ca_bundled != NULL) scr_arr_release(scr_ca_bundled);
+  if (scr_ca_system != NULL) scr_arr_release(scr_ca_system);
+  if (scr_ca_extra != NULL) scr_arr_release(scr_ca_extra);
+  if (scr_ca_default != NULL) scr_arr_release(scr_ca_default);
+  scr_ca_bundled = scr_ca_system = scr_ca_extra = scr_ca_default = NULL;
+  free(scr_ca_override_buf);
+  scr_ca_override_buf = NULL;
+}
+
+static bool scr_ca_teardown_armed = false;
+
+static void scr_ca_arm_teardown(void) {
+  if (!scr_ca_teardown_armed) {
+    scr_ca_teardown_armed = true;
+    atexit(scr_ca_teardown);
+  }
+}
+
+/* Portable bounded substring search (memmem is GNU/BSD-only; win32 has
+ * neither). Needles here are short constant markers — the naive scan is
+ * plenty. */
+static const char *scr_ca_find(const char *hay, size_t hay_len, const char *needle, size_t needle_len) {
+  if (needle_len == 0 || hay_len < needle_len) return NULL;
+  for (size_t i = 0; i + needle_len <= hay_len; i++) {
+    if (hay[i] == needle[0] && memcmp(hay + i, needle, needle_len) == 0) return hay + i;
+  }
+  return NULL;
+}
+
+/* Every "-----BEGIN CERTIFICATE-----" ... "-----END CERTIFICATE-----"
+ * block of `text` (other PEM kinds — keys, CRLs — skip, like Node's CA
+ * loaders), pushed onto `arr` as one string each, END line included.
+ * Returns the number of blocks found. */
+static size_t scr_ca_push_pem_blocks(ScrArr *arr, const char *text, size_t len) {
+  static const char BEGIN[] = "-----BEGIN CERTIFICATE-----";
+  static const char END[] = "-----END CERTIFICATE-----";
+  size_t found = 0;
+  const char *p = text;
+  const char *limit = text + len;
+  while (p < limit) {
+    const char *b = scr_ca_find(p, (size_t)(limit - p), BEGIN, sizeof BEGIN - 1);
+    if (b == NULL) break;
+    const char *e = scr_ca_find(b, (size_t)(limit - b), END, sizeof END - 1);
+    if (e == NULL) break;
+    const char *stop = e + (sizeof END - 1);
+    /* Node's entries carry the block's trailing newline when the source
+     * had one — keep it so round-trips through writeFileSync + parse
+     * stay concatenation-safe. */
+    if (stop < limit && *stop == '\r') stop++;
+    if (stop < limit && *stop == '\n') stop++;
+    scr_arr_push_ref(arr, scr_str_new(b, (size_t)(stop - b)));
+    found++;
+    p = stop;
+  }
+  return found;
+}
+
+/* One whole file, malloc'd (NULL on any failure — absent bundles answer
+ * empty stores, the same silence Node has on hosts without the file). */
+static char *scr_ca_read_file(const char *path, size_t *out_len) {
+  FILE *f = fopen(path, "rb");
+  if (f == NULL) return NULL;
+  if (fseek(f, 0, SEEK_END) != 0) {
+    fclose(f);
+    return NULL;
+  }
+  long sz = ftell(f);
+  if (sz < 0) {
+    fclose(f);
+    return NULL;
+  }
+  rewind(f);
+  char *buf = malloc((size_t)sz + 1);
+  if (buf == NULL) scr_ca_oom();
+  size_t got = fread(buf, 1, (size_t)sz, f);
+  fclose(f);
+  buf[got] = '\0';
+  *out_len = got;
+  return buf;
+}
+
+/* The host bundle, probed in scr_tls.c's documented order. */
+static ScrArr *scr_ca_load_host_bundle(void) {
+  ScrArr *arr = scr_arr_new(SCR_ELEM_STR, 128);
+  static const char *const bundles[] = {
+      "/etc/ssl/cert.pem",                  /* macOS, Alpine */
+      "/etc/ssl/certs/ca-certificates.crt", /* Debian/Ubuntu */
+      "/etc/pki/tls/certs/ca-bundle.crt",   /* Fedora/RHEL */
+      "/etc/ssl/ca-bundle.pem",             /* openSUSE */
+  };
+  for (size_t i = 0; i < sizeof bundles / sizeof bundles[0]; i++) {
+    size_t len = 0;
+    char *text = scr_ca_read_file(bundles[i], &len);
+    if (text == NULL) continue;
+    scr_ca_push_pem_blocks(arr, text, len);
+    free(text);
+    break; /* first bundle wins, like the anchor probe */
+  }
+  return arr;
+}
+
+static ScrArr *scr_ca_bundled_arr(void) {
+  if (scr_ca_bundled == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_bundled = scr_ca_load_host_bundle();
+  }
+  return scr_ca_bundled;
+}
+
+static ScrArr *scr_ca_system_arr(void) {
+  if (scr_ca_system == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_system = scr_ca_load_host_bundle();
+  }
+  return scr_ca_system;
+}
+
+static ScrArr *scr_ca_extra_arr(void) {
+  if (scr_ca_extra == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_extra = scr_arr_new(SCR_ELEM_STR, 4);
+    const char *path = getenv("NODE_EXTRA_CA_CERTS");
+    if (path != NULL && path[0] != '\0') {
+      size_t len = 0;
+      char *text = scr_ca_read_file(path, &len);
+      if (text != NULL) {
+        scr_ca_push_pem_blocks(scr_ca_extra, text, len);
+        free(text);
+      }
+    }
+  }
+  return scr_ca_extra;
+}
+
+/* 'default' with no override: bundled ∪ extra (Node's own composition
+ * when no --use-*-ca flag redirects it). */
+static ScrArr *scr_ca_default_arr(void) {
+  if (scr_ca_default == NULL) {
+    scr_ca_arm_teardown();
+    ScrArr *bundled = scr_ca_bundled_arr();
+    ScrArr *extra = scr_ca_extra_arr();
+    size_t nb = (size_t)scr_arr_len(bundled);
+    size_t ne = (size_t)scr_arr_len(extra);
+    scr_ca_default = scr_arr_new(SCR_ELEM_STR, nb + ne > 0 ? nb + ne : 1);
+    for (size_t i = 0; i < nb; i++) scr_arr_push_ref(scr_ca_default, scr_arr_get_ref(bundled, (double)i));
+    for (size_t i = 0; i < ne; i++) scr_arr_push_ref(scr_ca_default, scr_arr_get_ref(extra, (double)i));
+  }
+  return scr_ca_default;
+}
+
+ScrArr *scr_tls_ca_get(ScrStr *type) {
+  ScrArr *arr = NULL;
+  if (strcmp(type->data, "default") == 0) arr = scr_ca_default_arr();
+  else if (strcmp(type->data, "bundled") == 0) arr = scr_ca_bundled_arr();
+  else if (strcmp(type->data, "system") == 0) arr = scr_ca_system_arr();
+  else if (strcmp(type->data, "extra") == 0) arr = scr_ca_extra_arr();
+  if (arr == NULL) {
+    /* Node's ERR_INVALID_ARG_VALUE TypeError, message-exact. */
+    char msg[256];
+    int n = snprintf(msg, sizeof msg, "The argument 'type' is invalid. Received '%s'", type->data);
+    scr_throw_error_msg_code(SCR_ERR_TYPE, msg, n < 0 ? 0 : (size_t)n, "ERR_INVALID_ARG_VALUE");
+    return NULL;
+  }
+  return scr_arr_retain(arr);
+}
+
+ScrArr *scr_tls_ca_root(void) { return scr_arr_retain(scr_ca_bundled_arr()); }
+
+void scr_tls_ca_set_default(ScrArr *certs) {
+  size_t n = (size_t)scr_arr_len(certs);
+  /* Extract + dedupe first — a throw must leave the current set intact
+   * (Node's own error contract, pinned by the suite's error test). */
+  ScrArr *next = scr_arr_new(SCR_ELEM_STR, n > 0 ? n : 1);
+  size_t blocks = 0;
+  for (size_t i = 0; i < n; i++) {
+    ScrStr *entry = scr_arr_get_ref(certs, (double)i); /* +1 */
+    size_t before = (size_t)scr_arr_len(next);
+    blocks += scr_ca_push_pem_blocks(next, entry->data, entry->len);
+    /* Dedupe the freshly pushed blocks against everything before them. */
+    size_t after = (size_t)scr_arr_len(next);
+    for (size_t j = after; j > before; j--) {
+      ScrStr *cand = scr_arr_get_ref(next, (double)(j - 1)); /* +1 */
+      bool dup = false;
+      for (size_t k = 0; k + 1 < j && !dup; k++) {
+        ScrStr *prev = scr_arr_get_ref(next, (double)k); /* +1 */
+        dup = prev->len == cand->len && memcmp(prev->data, cand->data, cand->len) == 0;
+        scr_str_release(prev);
+      }
+      scr_str_release(cand);
+      if (dup) {
+        /* Drop the duplicate: rebuild without index j-1 (rare path —
+         * a simple splice via slice would copy anyway; do it in place). */
+        ScrArr *trimmed = scr_arr_new(SCR_ELEM_STR, after);
+        for (size_t k = 0; k < (size_t)scr_arr_len(next); k++) {
+          if (k == j - 1) continue;
+          scr_arr_push_ref(trimmed, scr_arr_get_ref(next, (double)k));
+        }
+        scr_arr_release(next);
+        next = trimmed;
+      }
+    }
+    scr_str_release(entry);
+  }
+  if (n > 0 && blocks == 0) {
+    scr_arr_release(next);
+    static const char MSG[] = "No valid certificates found in the provided array";
+    scr_throw_error_msg_code(SCR_ERR_ERROR, MSG, sizeof MSG - 1, "ERR_CRYPTO_OPERATION_FAILED");
+    return;
+  }
+  /* Commit: the cached 'default' array and the concatenated anchor
+   * buffer scr_tls.c parses (NUL-terminated for mbedTLS's PEM mode). */
+  scr_ca_arm_teardown();
+  if (scr_ca_default != NULL) scr_arr_release(scr_ca_default);
+  scr_ca_default = next;
+  size_t total = 0;
+  size_t count = (size_t)scr_arr_len(next);
+  for (size_t i = 0; i < count; i++) {
+    ScrStr *s = scr_arr_get_ref(next, (double)i);
+    total += s->len;
+    scr_str_release(s);
+  }
+  char *buf = malloc(total + 1);
+  if (buf == NULL) scr_ca_oom();
+  size_t off = 0;
+  for (size_t i = 0; i < count; i++) {
+    ScrStr *s = scr_arr_get_ref(next, (double)i);
+    memcpy(buf + off, s->data, s->len);
+    off += s->len;
+    scr_str_release(s);
+  }
+  buf[off] = '\0';
+  free(scr_ca_override_buf);
+  scr_ca_override_buf = buf;
+  scr_ca_override_len = off;
+  scr_ca_override_gen++;
+}
+
+bool scr_tls_ca_default_override(const char **pem, size_t *len, uint64_t *gen) {
+  if (scr_ca_override_gen == 0) return false;
+  *pem = scr_ca_override_buf;
+  *len = scr_ca_override_len;
+  *gen = scr_ca_override_gen;
+  return true;
+}

package/src/scr_web.c

@@ -791,7 +791,7 @@ static const char web_prelude[] =
     "    [Symbol.iterator]() { return this.entries(); }\n"
     "  }\n"
     "\n"
-    /* Event + EventTarget + CustomEvent — the DOM event plumbing Node
+    /* Event + EventTarget + CustomEvent — the dyn event plumbing Node
      * exposes as globals since v15. Synchronous dispatch on one target
      * (no tree, no phases — composedPath answers []), once/capture-shaped
      * options accepted, handleEvent objects honored, dispatchEvent