@scriptc/runtime 0.0.12 → 0.0.13

package/src/scr_runtime.h

@@ -1613,7 +1613,7 @@ ScrPromise *scr_sp_pipeline(double n, ScrStream **streams);
  * and settle at the terminal point (right after 'close', the eos timing
  * Node's consumers share) — text answers the utf8 decode, json parses
  * the text (malformed input rejects with the parse's SyntaxError; the
- * result is a +1 DOM tree), buffer the concatenated bytes. Stream
+ * result is a +1 dyn tree), buffer the concatenated bytes. Stream
  * errors reject; an early close rejects ERR_STREAM_PREMATURE_CLOSE; a
  * stream with no readable side rejects Node's async-iterable TypeError.
  * Streams borrowed; +1 promises. */
@@ -2681,6 +2681,8 @@ typedef enum {
   SCR_DYNH_NET_SERVER, /* ScrNetServer — net.Server (http.Server rides the same handle) */
   SCR_DYNH_H2_SESSION, /* ScrH2Session — Http2Session (client & server) */
   SCR_DYNH_H2_STREAM,  /* ScrH2Stream — Http2Stream (client & server) */
+  SCR_DYNH_HTTP_CLIENT, /* ScrHttpClientReq — http.ClientRequest */
+  SCR_DYNH_HTTP_AGENT,  /* ScrHttpAgent — http.Agent / https.Agent */
   SCR_DYNH_COUNT,
 } ScrDynHandleTag;
 
@@ -2861,6 +2863,9 @@ void scr_dyn_obj_set(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value
  * non-object kinds throw Node's catchable TypeErrors (strict-mode
  * wording). All three operands BORROWED (the value is retained in). */
 void scr_dyn_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value);
+/* `key in v` with a runtime key — the dynHasKey fold per value (OBJ own
+ * members, ARR length/valid indices, false elsewhere). Never throws. */
+bool scr_dyn_has_key(const ScrDyn *v, const ScrStr *key);
 /* Bare `typeof v` on a dyn value: the dyn kind's JS answer (+1 string;
  * null answers "object"). Never throws. */
 ScrStr *scr_dyn_typeof(const ScrDyn *d);
@@ -3378,16 +3383,37 @@ void scr_als_disable(double id);
 ScrDyn *scr_als_run(double id, ScrDyn *value, ScrDyn *fn, ScrDyn *args);
 ScrDyn *scr_als_exit_run(double id, ScrDyn *fn, ScrDyn *args);
 
-/* process.on('unhandledRejection', fn): dyn listeners dispatched per
- * never-observed rejection at loop end — (reason, promise), suppressing
- * the default report and the exit-1 (Node's handled-event contract; the
- * end-of-turn vs loop-end timing is a SEMANTICS.md divergence). Throws
- * Node's ERR_INVALID_ARG_TYPE on a non-function. */
-void scr_process_on_unhandled_rejection(ScrDyn *fn);
+/* process.on/once('unhandledRejection', fn): dyn listeners dispatched
+ * per never-observed rejection at loop end — (reason, promise),
+ * suppressing the default report and the exit-1 (Node's handled-event
+ * contract; the end-of-turn vs loop-end timing is a SEMANTICS.md
+ * divergence). `once` auto-removes after one delivery; off removes by
+ * closure identity (the warning registry's story). Throws Node's
+ * ERR_INVALID_ARG_TYPE on a non-function. */
+void scr_process_on_unhandled_rejection(ScrDyn *fn, bool once);
+void scr_process_off_unhandled_rejection(ScrDyn *fn);
+/* process.on/once/off('rejectionHandled', fn): the sibling registry.
+ * Under the loop-exhaustion model the event's ONE firing window is a
+ * handler attached DURING an unhandledRejection listener (a rejection
+ * handled any earlier never enters the report at all — the same
+ * documented divergence); dispatch is synchronous at the attach, with
+ * the promise, Node's payload. */
+void scr_process_on_rejection_handled(ScrDyn *fn, bool once);
+void scr_process_off_rejection_handled(ScrDyn *fn);
 /* The loop-end delivery hook the registration above installs
  * (scr_async_dyn.c → scr_report_unhandled_rejections; NULL = default
  * report). Runtime-internal. */
 extern bool (*scr_urj_deliver_fn)(ScrPromise *p);
+/* The late-handled hook (scr_async_dyn.c installs it when a
+ * 'rejectionHandled' listener registers): scr_async.c calls it when a
+ * promise the report already delivered as unhandled gains a handler.
+ * Runtime-internal. */
+extern void (*scr_rjh_notify_fn)(ScrPromise *p);
+/* The attach-time handled mark (a dyn then/catch carrying a rejection
+ * handler): marks an already-rejected source observed — Node's attach
+ * moment — firing the late-handled hook when the report already
+ * delivered it. Runtime-internal. */
+void scr_promise_mark_handled(ScrPromise *p);
 /* A rejected promise's reason as a dyn value (identity-preserving for
  * dyn payloads and %Error instances). +1. */
 ScrDyn *scr_promise_reason_dyn(const ScrPromise *p);
@@ -4819,6 +4845,22 @@ void scr_net_sock_end_bytes(ScrNetSocket *s, ScrBytes *data /*borrowed*/);
 void scr_net_sock_write_dynv(ScrNetSocket *s, const ScrDyn *d /*borrowed*/);
 void scr_net_sock_end_dynv(ScrNetSocket *s, const ScrDyn *d /*borrowed*/);
 void scr_net_sock_destroy(ScrNetSocket *s);
+/* Flow control (pause/resume — see the struct's flag comments), the
+ * FIN-flushed destroy (destroySoon), TCP_NODELAY, the deferred write/
+ * finish callbacks (write(chunk, cb) / end(cb) — sweep-fired), and the
+ * counters/flags the compat surface reads. */
+ScrNetSocket *scr_net_sock_pause(ScrNetSocket *s);            /* +1: chaining */
+ScrNetSocket *scr_net_sock_resume(ScrNetSocket *s);           /* +1: chaining */
+ScrNetSocket *scr_net_sock_set_nodelay(ScrNetSocket *s, bool enable); /* +1: chaining */
+void scr_net_sock_destroy_soon(ScrNetSocket *s);
+void scr_net_sock_on_finish(ScrNetSocket *s, ScrClosure *cb /*moves*/);
+void scr_net_sock_on_write_flush(ScrNetSocket *s, ScrClosure *cb /*moves*/);
+double scr_net_sock_bytes_written(ScrNetSocket *s);
+bool scr_net_sock_readable(ScrNetSocket *s);
+/* The deferred dial (the http agent's maxSockets queue): the socket
+ * registers "connecting" and buffers writes; dial_start runs the dial. */
+ScrNetSocket *scr_net_connect_deferred(double port, ScrStr *host /*borrowed, nullable*/); /* +1 */
+void scr_net_sock_dial_start(ScrNetSocket *s);
 void scr_net_sock_set_timeout(ScrNetSocket *s, double ms);
 void scr_net_sock_on_timeout(ScrNetSocket *s, ScrClosure *cb /*moves*/, bool once);
 ScrStr *scr_net_sock_remote_address(ScrNetSocket *s); /* +1 or NULL (undefined arm) */
@@ -4845,6 +4887,7 @@ void scr_net_sock_unshift_bytes(ScrNetSocket *s, ScrBytes *data /*borrowed*/);
 void scr_net_server_emit_connection(ScrNetServer *srv, ScrNetSocket *sock /*borrowed*/);
 void scr_net_data_thunk0(ScrClosure *cb, ScrBytes *chunk);
 void scr_net_data_thunk_bytes(ScrClosure *cb, ScrBytes *chunk);
+void scr_net_data_thunk_str(ScrClosure *cb, ScrBytes *chunk);
 /* The dynCheck-adapted listener's flavor: boxes the chunk as a
  * Buffer-flavored dyn (toString decodes utf8, Node's 'data' payload). */
 void scr_net_data_thunk_dyn(ScrClosure *cb, ScrBytes *chunk);
@@ -5025,6 +5068,29 @@ void scr_tls_sni_answer(ScrClosure *self, bool has_err, ScrSecureCtx *ctx /*move
 long scr_secure_ctx_live_count(void);
 #endif
 
+/* ── node:tls, the CA-store introspection slice (scr_tls_ca.c — its own
+ * unit and link gate; plain PEM-block bookkeeping, NO mbedTLS, so a
+ * getCACertificates-only binary never builds the archive; cc.ts also
+ * compiles it whenever scr_tls.c does). The HOST bundle (the
+ * /etc/ssl/cert.pem probe order scr_tls.c documents) stands in for both
+ * Node's compiled-in Mozilla roots ('bundled', rootCertificates) and the
+ * platform store ('system') — the established SEMANTICS divergence,
+ * extended to introspection; 'extra' reads NODE_EXTRA_CA_CERTS. Arrays
+ * are cached per type (+1 retained answers each call — Node's own
+ * caching, and the identity the suite pins with strictEqual). */
+ScrArr *scr_tls_ca_get(ScrStr *type); /* +1; throws ERR_INVALID_ARG_VALUE on unknown types */
+ScrArr *scr_tls_ca_root(void);        /* +1; === getCACertificates("bundled") */
+/* Replaces the 'default' set: entries filter to their PEM certificate
+ * blocks (deduped byte-exactly — Node dedupes by X509 identity); a
+ * non-empty array yielding no blocks throws Node's
+ * ERR_CRYPTO_OPERATION_FAILED and leaves the set unchanged. Borrows. */
+void scr_tls_ca_set_default(ScrArr *certs);
+/* scr_tls.c's anchor consult: true iff setDefaultCACertificates ran;
+ * *pem/*len then carry the concatenated NUL-terminated blocks (len 0 =
+ * the empty set — verification fails, Node's own consequence), and *gen
+ * a counter that bumps per set so the parsed chain re-parses on change. */
+bool scr_tls_ca_default_override(const char **pem, size_t *len, uint64_t *gen);
+
 /* ── node:http, the server slice (scr_http.c — compiled only when the
  * program uses it; rides scr_net.c wholesale, design note atop the
  * file). http.createServer returns an ORDINARY ScrNetServer (listen/
@@ -5180,6 +5246,23 @@ void scr_http_upgrade_thunk3(ScrClosure *cb, ScrHttpReq *req, ScrNetSocket *sock
 double scr_http_req_status(ScrHttpReq *r); /* < 0 = the undefined arm (server request) */
 ScrNetSocket *scr_http_req_socket(ScrHttpReq *r); /* +1 */
 void scr_http_req_resume(ScrHttpReq *r);
+/* pause()/resume() hold and drain 'data'/'end' delivery (the parser keeps
+ * consuming; the drain rides the emit queue); setTimeout delegates to the
+ * socket's idle timer; the flags back req.destroyed/req.readable. */
+void scr_http_req_pause(ScrHttpReq *r);
+void scr_http_req_set_timeout(ScrHttpReq *r, double ms, ScrClosure *cb /*moves, nullable*/);
+bool scr_http_req_destroyed_flag(ScrHttpReq *r);
+bool scr_http_req_readable(ScrHttpReq *r);
+/* flushHeaders/cork/uncork/writableCorked, the res.req backref, the
+ * socket-delegated setTimeout, and write(chunk, cb)'s deferred callback. */
+void scr_http_res_flush_headers(ScrHttpRes *r);
+void scr_http_res_cork(ScrHttpRes *r);
+void scr_http_res_uncork(ScrHttpRes *r);
+double scr_http_res_writable_corked(ScrHttpRes *r);
+bool scr_http_res_destroyed_flag(ScrHttpRes *r);
+void scr_http_res_set_req(ScrHttpRes *r, ScrHttpReq *req /*borrowed, nullable*/);
+void scr_http_res_set_timeout(ScrHttpRes *r, double ms, ScrClosure *cb /*moves, nullable*/);
+void scr_http_res_on_write_flush(ScrHttpRes *r, ScrClosure *cb /*moves*/);
 /* req.setEncoding(enc) — the socket twin's contract; may throw. */
 void scr_http_req_set_encoding(ScrHttpReq *r, ScrStr *enc /*borrowed*/);
 void scr_http_req_destroy(ScrHttpReq *r);
@@ -5244,6 +5327,30 @@ ScrHttpClientReq *scr_http_request_ex(ScrStr *host /*borrowed*/, double port,
 ScrHttpClientReq *scr_http_request_url(ScrStr *url /*borrowed*/, ScrStr *method /*borrowed*/,
                                         bool auto_end, ScrClosure *cb /*moves, nullable*/,
                                         ScrHttpRespFn fn); /* +1 */
+/* ── the http Agent (new http.Agent(opts) — option surface, getName, and
+ * the maxSockets queue over one-dial-per-request connections; keep-alive
+ * POOLING is not modeled: keepAlive: true fences at construction).
+ * agent_new answers the SCR_DYNH_HTTP_AGENT handle (+1 dyn) or throws.
+ * max_sockets/max_free arrive < 0 for "unset" (Infinity / 256);
+ * timeout_ms < 0 = no idle timer. request_agent_ex threads the agent dyn
+ * (undefined/null = the default path; false = one-shot with Connection:
+ * close; an Agent handle = queue accounting); port < 0 means "no port
+ * option" — the agent's (settable) defaultPort, then the scheme's. */
+ScrDyn *scr_http_agent_new(bool secure, bool keep_alive, double ka_msecs,
+                            double max_sockets, double max_free, double timeout_ms,
+                            double port /* < 0 = unset: the option-merge default */); /* +1 */
+ScrHttpClientReq *scr_http_request_agent_ex(ScrStr *host /*borrowed*/, double port,
+                                             ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
+                                             double timeout_ms, ScrArr *header_pairs /*borrowed*/,
+                                             bool auto_end, const ScrDyn *agent /*borrowed*/,
+                                             ScrClosure *cb /*moves, nullable*/,
+                                             ScrHttpRespFn fn, int default_port,
+                                             void (*wrap)(ScrNetSocket *, void *), void *wrap_ctx); /* +1 */
+ScrHttpClientReq *scr_http_request_agent(ScrStr *host /*borrowed*/, double port,
+                                          ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
+                                          double timeout_ms, ScrArr *header_pairs /*borrowed*/,
+                                          bool auto_end, const ScrDyn *agent /*borrowed*/,
+                                          ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn); /* +1 */
 #ifdef SCR_RC_AUDIT
 long scr_http_live_count(void);
 #endif
@@ -5288,6 +5395,19 @@ ScrNetServer *scr_http2_create_server_req(ScrClosure *handler /*moves*/, ScrHttp
  * the same session machinery behind an mbedTLS handshake whose ALPN
  * advertises h2 alone — protocol-identical after establishment. */
 ScrNetServer *scr_http2_create_secure_server(const char *cert, size_t cert_len, const char *key, size_t key_len); /* +1 */
+/* createSecureServer(options, handler): the eager COMPAT handler as the
+ * first 'request' listener over the ALPN=h2 server (the createServerReq
+ * route, secured). */
+ScrNetServer *scr_http2_create_secure_server_req(const char *cert, size_t cert_len, const char *key, size_t key_len, ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn); /* +1 */
+/* createSecureServer with a RUNTIME options record (the divergence-66
+ * stance): allowHTTP1 picks the flavor at runtime, cert/key ride the
+ * shared TLS server walk (out-of-bounds members throw the catchable
+ * fence), h2 session-tuning keys drop like the literal walk ignores
+ * them. +1, or NULL with the exception pending. */
+ScrNetServer *scr_http2_create_secure_server_dyn(const struct ScrDyn *opts /*borrowed*/, ScrClosure *handler /*moves, nullable*/, ScrHttpReqFn fn);
+/* The TLS server-options walk (scr_tls.c) — runtime-internal, shared
+ * with scr_http2.c's createSecureServerDyn. */
+bool scr_tls_srv_opts_walk(const struct ScrDyn *opts, const char *api, ScrBytes **cert_out, ScrBytes **key_out);
 void scr_http2_server_on_stream(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrH2StreamFn fn, bool once);
 void scr_http2_server_on_session(ScrNetServer *s, ScrClosure *cb /*moves*/, ScrH2SessionFn fn, bool once);
 
@@ -5394,6 +5514,14 @@ ScrHttpClientReq *scr_https_request(ScrStr *host /*borrowed*/, double port,
                                      bool auto_end, bool reject_unauthorized,
                                      const char *ca /*borrowed, len 0 = none*/, size_t ca_len,
                                      ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn); /* +1 */
+/* The agent-threaded twin (the scr_http_request_agent story over TLS). */
+ScrHttpClientReq *scr_https_request_agent(ScrStr *host /*borrowed*/, double port,
+                                           ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
+                                           double timeout_ms, ScrArr *header_pairs /*borrowed*/,
+                                           bool auto_end, bool reject_unauthorized,
+                                           const char *ca /*borrowed, len 0 = none*/, size_t ca_len,
+                                           const struct ScrDyn *agent /*borrowed*/,
+                                           ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn); /* +1 */
 /* The fetch unit's https leg (defined in scr_tls.c): a client transport
  * context (SNI/verify against the URL hostname — the DIALED address may
  * be a resolved IP) plus the wrap hook scr_http_request_ex installs on

package/src/scr_tls.c

@@ -350,7 +350,30 @@ typedef struct ScrTlsCli {
 static mbedtls_x509_crt scr_tls_system_roots;
 static bool scr_tls_system_roots_loaded = false;
 
+/* setDefaultCACertificates' replacement anchors (scr_tls_ca.c — always
+ * compiled alongside this unit): parsed lazily per generation, so each
+ * set re-parses once and every later dial reuses the chain. An EMPTY
+ * replacement keeps an initialized, certificate-free chain — every
+ * verification fails, Node's own consequence of trusting nothing. */
+static mbedtls_x509_crt scr_tls_override_roots;
+static uint64_t scr_tls_override_parsed_gen = 0;
+
 static mbedtls_x509_crt *scr_tls_system_ca(void) {
+  const char *pem = NULL;
+  size_t pem_len = 0;
+  uint64_t gen = 0;
+  if (scr_tls_ca_default_override(&pem, &pem_len, &gen)) {
+    if (gen != scr_tls_override_parsed_gen) {
+      if (scr_tls_override_parsed_gen != 0) mbedtls_x509_crt_free(&scr_tls_override_roots);
+      mbedtls_x509_crt_init(&scr_tls_override_roots);
+      /* +1 for the NUL — mbedTLS's PEM mode wants it counted. A parse
+       * failure inside one block leaves the chain with the blocks that
+       * did parse (the scr_tls_ca.c divergence note). */
+      if (pem_len > 0) (void)mbedtls_x509_crt_parse(&scr_tls_override_roots, (const unsigned char *)pem, pem_len + 1);
+      scr_tls_override_parsed_gen = gen;
+    }
+    return &scr_tls_override_roots;
+  }
   if (!scr_tls_system_roots_loaded) {
     scr_tls_system_roots_loaded = true;
     mbedtls_x509_crt_init(&scr_tls_system_roots);
@@ -983,6 +1006,18 @@ ScrHttpClientReq *scr_https_request(ScrStr *host /*borrowed*/, double port,
                               fn, 443, &scr_tls_cli_wrap, cli);
 }
 
+ScrHttpClientReq *scr_https_request_agent(ScrStr *host /*borrowed*/, double port,
+                                           ScrStr *path /*borrowed*/, ScrStr *method /*borrowed*/,
+                                           double timeout_ms, ScrArr *header_pairs /*borrowed*/,
+                                           bool auto_end, bool reject_unauthorized,
+                                           const char *ca /*borrowed, len 0 = none*/, size_t ca_len,
+                                           const ScrDyn *agent /*borrowed*/,
+                                           ScrClosure *cb /*moves, nullable*/, ScrHttpRespFn fn) {
+  ScrTlsCli *cli = scr_tls_cli_new(host, reject_unauthorized, ca, ca_len);
+  return scr_http_request_agent_ex(host, port, path, method, timeout_ms, header_pairs, auto_end,
+                                    agent, cb, fn, 443, &scr_tls_cli_wrap, cli);
+}
+
 /* ── RUNTIME options records (the divergence-66 stance) ────────────────
  * A non-literal options value — the checked-dynamic JS lane's dyn record
  * — reads its members at RUNTIME. Members the literal path lowers take
@@ -1219,9 +1254,11 @@ static bool scr_tls_opts_validate(const ScrDyn *opts) {
 }
 
 /* The server-options walk. Fills the cert/key out-params (+1 each) from a
- * dyn options record; false = exception pending (partial results released). */
-static bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes **cert_out,
-                                   ScrBytes **key_out) {
+ * dyn options record; false = exception pending (partial results released).
+ * Exported runtime-internally: scr_http2.c's createSecureServerDyn rides
+ * the same walk (scr_http2.c always links alongside this unit). */
+bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes **cert_out,
+                            ScrBytes **key_out) {
   *cert_out = NULL;
   *key_out = NULL;
   if (opts == NULL || opts->kind != SCR_DYN_OBJ) {

package/src/scr_tls_ca.c

@@ -0,0 +1,288 @@
+/* node:tls — the CA-store introspection slice: getCACertificates,
+ * rootCertificates, and setDefaultCACertificates (scr_runtime.h has the
+ * contracts). Its own link gate ("tlsca." libCalls), deliberately free
+ * of mbedTLS: everything here is PEM-BLOCK bookkeeping over the host
+ * bundle, so a program that only inspects the CA store keeps the lean
+ * link line. scr_tls.c (when it links — cc.ts compiles this unit
+ * alongside it) consults scr_tls_ca_default_override for its client
+ * trust anchors, which is what makes setDefaultCACertificates LIVE
+ * semantics: the next https/tls dial verifies against the replaced set.
+ *
+ * Divergences, documented: the host bundle stands in for Node's
+ * compiled-in Mozilla roots ('bundled' and rootCertificates) AND for the
+ * platform store ('system') — the same /etc/ssl/cert.pem stance
+ * scr_tls.c's anchors established; and set-time validation is PEM-BLOCK
+ * shaped (a well-formed block with corrupt DER inside is kept here where
+ * Node's X509 parse would drop it — such a cert then fails verification
+ * instead, the same observable outcome one step later). Deduplication is
+ * byte-exact over the extracted block where Node compares parsed X509
+ * identities; re-encoded duplicates of one certificate stay distinct
+ * entries, which no equality the tests observe can distinguish without a
+ * parser. */
+#include "scr_runtime.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* The per-type caches: +1 held here for the process lifetime (an atexit
+ * teardown releases them so the RC audit stays clean). 'default' also
+ * keeps the concatenated PEM buffer scr_tls.c parses into anchors. */
+static ScrArr *scr_ca_bundled = NULL;
+static ScrArr *scr_ca_system = NULL;
+static ScrArr *scr_ca_extra = NULL;
+static ScrArr *scr_ca_default = NULL;
+static char *scr_ca_override_buf = NULL;
+static size_t scr_ca_override_len = 0;
+static uint64_t scr_ca_override_gen = 0; /* 0 = never set */
+
+static void scr_ca_oom(void) {
+  fputs("scriptc: out of memory\n", stderr);
+  abort();
+}
+
+static void scr_ca_teardown(void) {
+  if (scr_ca_bundled != NULL) scr_arr_release(scr_ca_bundled);
+  if (scr_ca_system != NULL) scr_arr_release(scr_ca_system);
+  if (scr_ca_extra != NULL) scr_arr_release(scr_ca_extra);
+  if (scr_ca_default != NULL) scr_arr_release(scr_ca_default);
+  scr_ca_bundled = scr_ca_system = scr_ca_extra = scr_ca_default = NULL;
+  free(scr_ca_override_buf);
+  scr_ca_override_buf = NULL;
+}
+
+static bool scr_ca_teardown_armed = false;
+
+static void scr_ca_arm_teardown(void) {
+  if (!scr_ca_teardown_armed) {
+    scr_ca_teardown_armed = true;
+    atexit(scr_ca_teardown);
+  }
+}
+
+/* Portable bounded substring search (memmem is GNU/BSD-only; win32 has
+ * neither). Needles here are short constant markers — the naive scan is
+ * plenty. */
+static const char *scr_ca_find(const char *hay, size_t hay_len, const char *needle, size_t needle_len) {
+  if (needle_len == 0 || hay_len < needle_len) return NULL;
+  for (size_t i = 0; i + needle_len <= hay_len; i++) {
+    if (hay[i] == needle[0] && memcmp(hay + i, needle, needle_len) == 0) return hay + i;
+  }
+  return NULL;
+}
+
+/* Every "-----BEGIN CERTIFICATE-----" ... "-----END CERTIFICATE-----"
+ * block of `text` (other PEM kinds — keys, CRLs — skip, like Node's CA
+ * loaders), pushed onto `arr` as one string each, END line included.
+ * Returns the number of blocks found. */
+static size_t scr_ca_push_pem_blocks(ScrArr *arr, const char *text, size_t len) {
+  static const char BEGIN[] = "-----BEGIN CERTIFICATE-----";
+  static const char END[] = "-----END CERTIFICATE-----";
+  size_t found = 0;
+  const char *p = text;
+  const char *limit = text + len;
+  while (p < limit) {
+    const char *b = scr_ca_find(p, (size_t)(limit - p), BEGIN, sizeof BEGIN - 1);
+    if (b == NULL) break;
+    const char *e = scr_ca_find(b, (size_t)(limit - b), END, sizeof END - 1);
+    if (e == NULL) break;
+    const char *stop = e + (sizeof END - 1);
+    /* Node's entries carry the block's trailing newline when the source
+     * had one — keep it so round-trips through writeFileSync + parse
+     * stay concatenation-safe. */
+    if (stop < limit && *stop == '\r') stop++;
+    if (stop < limit && *stop == '\n') stop++;
+    scr_arr_push_ref(arr, scr_str_new(b, (size_t)(stop - b)));
+    found++;
+    p = stop;
+  }
+  return found;
+}
+
+/* One whole file, malloc'd (NULL on any failure — absent bundles answer
+ * empty stores, the same silence Node has on hosts without the file). */
+static char *scr_ca_read_file(const char *path, size_t *out_len) {
+  FILE *f = fopen(path, "rb");
+  if (f == NULL) return NULL;
+  if (fseek(f, 0, SEEK_END) != 0) {
+    fclose(f);
+    return NULL;
+  }
+  long sz = ftell(f);
+  if (sz < 0) {
+    fclose(f);
+    return NULL;
+  }
+  rewind(f);
+  char *buf = malloc((size_t)sz + 1);
+  if (buf == NULL) scr_ca_oom();
+  size_t got = fread(buf, 1, (size_t)sz, f);
+  fclose(f);
+  buf[got] = '\0';
+  *out_len = got;
+  return buf;
+}
+
+/* The host bundle, probed in scr_tls.c's documented order. */
+static ScrArr *scr_ca_load_host_bundle(void) {
+  ScrArr *arr = scr_arr_new(SCR_ELEM_STR, 128);
+  static const char *const bundles[] = {
+      "/etc/ssl/cert.pem",                  /* macOS, Alpine */
+      "/etc/ssl/certs/ca-certificates.crt", /* Debian/Ubuntu */
+      "/etc/pki/tls/certs/ca-bundle.crt",   /* Fedora/RHEL */
+      "/etc/ssl/ca-bundle.pem",             /* openSUSE */
+  };
+  for (size_t i = 0; i < sizeof bundles / sizeof bundles[0]; i++) {
+    size_t len = 0;
+    char *text = scr_ca_read_file(bundles[i], &len);
+    if (text == NULL) continue;
+    scr_ca_push_pem_blocks(arr, text, len);
+    free(text);
+    break; /* first bundle wins, like the anchor probe */
+  }
+  return arr;
+}
+
+static ScrArr *scr_ca_bundled_arr(void) {
+  if (scr_ca_bundled == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_bundled = scr_ca_load_host_bundle();
+  }
+  return scr_ca_bundled;
+}
+
+static ScrArr *scr_ca_system_arr(void) {
+  if (scr_ca_system == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_system = scr_ca_load_host_bundle();
+  }
+  return scr_ca_system;
+}
+
+static ScrArr *scr_ca_extra_arr(void) {
+  if (scr_ca_extra == NULL) {
+    scr_ca_arm_teardown();
+    scr_ca_extra = scr_arr_new(SCR_ELEM_STR, 4);
+    const char *path = getenv("NODE_EXTRA_CA_CERTS");
+    if (path != NULL && path[0] != '\0') {
+      size_t len = 0;
+      char *text = scr_ca_read_file(path, &len);
+      if (text != NULL) {
+        scr_ca_push_pem_blocks(scr_ca_extra, text, len);
+        free(text);
+      }
+    }
+  }
+  return scr_ca_extra;
+}
+
+/* 'default' with no override: bundled ∪ extra (Node's own composition
+ * when no --use-*-ca flag redirects it). */
+static ScrArr *scr_ca_default_arr(void) {
+  if (scr_ca_default == NULL) {
+    scr_ca_arm_teardown();
+    ScrArr *bundled = scr_ca_bundled_arr();
+    ScrArr *extra = scr_ca_extra_arr();
+    size_t nb = (size_t)scr_arr_len(bundled);
+    size_t ne = (size_t)scr_arr_len(extra);
+    scr_ca_default = scr_arr_new(SCR_ELEM_STR, nb + ne > 0 ? nb + ne : 1);
+    for (size_t i = 0; i < nb; i++) scr_arr_push_ref(scr_ca_default, scr_arr_get_ref(bundled, (double)i));
+    for (size_t i = 0; i < ne; i++) scr_arr_push_ref(scr_ca_default, scr_arr_get_ref(extra, (double)i));
+  }
+  return scr_ca_default;
+}
+
+ScrArr *scr_tls_ca_get(ScrStr *type) {
+  ScrArr *arr = NULL;
+  if (strcmp(type->data, "default") == 0) arr = scr_ca_default_arr();
+  else if (strcmp(type->data, "bundled") == 0) arr = scr_ca_bundled_arr();
+  else if (strcmp(type->data, "system") == 0) arr = scr_ca_system_arr();
+  else if (strcmp(type->data, "extra") == 0) arr = scr_ca_extra_arr();
+  if (arr == NULL) {
+    /* Node's ERR_INVALID_ARG_VALUE TypeError, message-exact. */
+    char msg[256];
+    int n = snprintf(msg, sizeof msg, "The argument 'type' is invalid. Received '%s'", type->data);
+    scr_throw_error_msg_code(SCR_ERR_TYPE, msg, n < 0 ? 0 : (size_t)n, "ERR_INVALID_ARG_VALUE");
+    return NULL;
+  }
+  return scr_arr_retain(arr);
+}
+
+ScrArr *scr_tls_ca_root(void) { return scr_arr_retain(scr_ca_bundled_arr()); }
+
+void scr_tls_ca_set_default(ScrArr *certs) {
+  size_t n = (size_t)scr_arr_len(certs);
+  /* Extract + dedupe first — a throw must leave the current set intact
+   * (Node's own error contract, pinned by the suite's error test). */
+  ScrArr *next = scr_arr_new(SCR_ELEM_STR, n > 0 ? n : 1);
+  size_t blocks = 0;
+  for (size_t i = 0; i < n; i++) {
+    ScrStr *entry = scr_arr_get_ref(certs, (double)i); /* +1 */
+    size_t before = (size_t)scr_arr_len(next);
+    blocks += scr_ca_push_pem_blocks(next, entry->data, entry->len);
+    /* Dedupe the freshly pushed blocks against everything before them. */
+    size_t after = (size_t)scr_arr_len(next);
+    for (size_t j = after; j > before; j--) {
+      ScrStr *cand = scr_arr_get_ref(next, (double)(j - 1)); /* +1 */
+      bool dup = false;
+      for (size_t k = 0; k + 1 < j && !dup; k++) {
+        ScrStr *prev = scr_arr_get_ref(next, (double)k); /* +1 */
+        dup = prev->len == cand->len && memcmp(prev->data, cand->data, cand->len) == 0;
+        scr_str_release(prev);
+      }
+      scr_str_release(cand);
+      if (dup) {
+        /* Drop the duplicate: rebuild without index j-1 (rare path —
+         * a simple splice via slice would copy anyway; do it in place). */
+        ScrArr *trimmed = scr_arr_new(SCR_ELEM_STR, after);
+        for (size_t k = 0; k < (size_t)scr_arr_len(next); k++) {
+          if (k == j - 1) continue;
+          scr_arr_push_ref(trimmed, scr_arr_get_ref(next, (double)k));
+        }
+        scr_arr_release(next);
+        next = trimmed;
+      }
+    }
+    scr_str_release(entry);
+  }
+  if (n > 0 && blocks == 0) {
+    scr_arr_release(next);
+    static const char MSG[] = "No valid certificates found in the provided array";
+    scr_throw_error_msg_code(SCR_ERR_ERROR, MSG, sizeof MSG - 1, "ERR_CRYPTO_OPERATION_FAILED");
+    return;
+  }
+  /* Commit: the cached 'default' array and the concatenated anchor
+   * buffer scr_tls.c parses (NUL-terminated for mbedTLS's PEM mode). */
+  scr_ca_arm_teardown();
+  if (scr_ca_default != NULL) scr_arr_release(scr_ca_default);
+  scr_ca_default = next;
+  size_t total = 0;
+  size_t count = (size_t)scr_arr_len(next);
+  for (size_t i = 0; i < count; i++) {
+    ScrStr *s = scr_arr_get_ref(next, (double)i);
+    total += s->len;
+    scr_str_release(s);
+  }
+  char *buf = malloc(total + 1);
+  if (buf == NULL) scr_ca_oom();
+  size_t off = 0;
+  for (size_t i = 0; i < count; i++) {
+    ScrStr *s = scr_arr_get_ref(next, (double)i);
+    memcpy(buf + off, s->data, s->len);
+    off += s->len;
+    scr_str_release(s);
+  }
+  buf[off] = '\0';
+  free(scr_ca_override_buf);
+  scr_ca_override_buf = buf;
+  scr_ca_override_len = off;
+  scr_ca_override_gen++;
+}
+
+bool scr_tls_ca_default_override(const char **pem, size_t *len, uint64_t *gen) {
+  if (scr_ca_override_gen == 0) return false;
+  *pem = scr_ca_override_buf;
+  *len = scr_ca_override_len;
+  *gen = scr_ca_override_gen;
+  return true;
+}