@scriptc/runtime 0.0.21 → 0.0.22

package/src/scr_runtime.h

@@ -2683,9 +2683,15 @@ typedef enum {
    * a silent wrong answer. The dyn→cell edge is NOT visible to the cycle
    * collector (the dyn→closure stance): a cycle dyn → cell → engine
    * object → host closure → dyn is merely never collected (the
-   * documented cross-boundary-cycle divergence). Enum position: LAST —
-   * the LLVM backend hardcodes the preceding kind numbers. */
+   * documented cross-boundary-cycle divergence). */
   SCR_DYN_JSVAL,
+  /* A compiler-owned typed reference in transit through a native Web
+   * stream. Unlike an ordinary typed→unknown conversion, this capsule
+   * retains the original value so a statically typed reader can recover
+   * its identity. `materialize` supplies the ordinary deep-copy view for
+   * consumers such as fetch request bodies that need a dyn chunk. Enum
+   * position: LAST — LLVM hardcodes every preceding kind number. */
+  SCR_DYN_TYPED_REF,
 } ScrDynKind;
 
 /* The handle-type tags the checked-dynamic tree can carry. The set is deliberately the
@@ -2701,12 +2707,27 @@ typedef enum {
   SCR_DYNH_H2_STREAM,  /* ScrH2Stream — Http2Stream (client & server) */
   SCR_DYNH_HTTP_CLIENT, /* ScrHttpClientReq — http.ClientRequest */
   SCR_DYNH_HTTP_AGENT,  /* ScrHttpAgent — http.Agent / https.Agent */
+  SCR_DYNH_ABORT_SIGNAL, /* native static-fetch AbortSignal */
+  SCR_DYNH_WEB_STREAM,   /* native WHATWG ReadableStream */
+  SCR_DYNH_WEB_READER,   /* native ReadableStreamDefaultReader */
+  SCR_DYNH_WEB_CONTROLLER, /* native ReadableStreamDefaultController */
+  SCR_DYNH_FETCH_RESPONSE, /* native static-fetch Response */
+  SCR_DYNH_FETCH_HEADERS, /* native static-fetch response Headers */
+  SCR_DYNH_EVENT,          /* native static-fetch abort Event */
   SCR_DYNH_COUNT,
 } ScrDynHandleTag;
 
 typedef struct ScrDyn ScrDyn;
 typedef struct ScrBytes ScrBytes; /* full definition below (C11 repeat) */
 typedef struct ScrClosure ScrClosure; /* full definition below (C11 repeat) */
+typedef struct ScrDynTypedCast {
+  const char *type_key;
+  size_t type_key_len;
+  void *ptr;
+  void *(*retain)(void *);
+  void (*release)(void *);
+  struct ScrDynTypedCast *next;
+} ScrDynTypedCast;
 typedef struct ScrJsval ScrJsval; /* opaque island cell (C11 repeat; the
                                    * always-linked dyn core never touches
                                    * its engine value — only the gated ops
@@ -2752,7 +2773,19 @@ struct ScrDyn {
     ScrStr *str; /* owned */
     ScrBytes *bytes; /* owned (SCR_DYN_BYTES) */
     struct { size_t len; size_t cap; ScrDyn **items; } arr;      /* owned */
-    struct { size_t len; size_t cap; ScrDynEntry *entries; } obj; /* owned */
+    struct {
+      size_t len;
+      size_t cap;
+      ScrDynEntry *entries;
+      /* Optional identity of the typed record that produced this ordinary
+       * deep-copy snapshot. EventTarget uses it to recognize the same
+       * EventListenerObject across repeated static→dyn crossings without
+       * changing generic dyn-object `===` semantics. */
+      /* Owned through source_access(source_identity, false). Callback
+       * interfaces may request a fresh snapshot with the true arm. */
+      void *source_identity;
+      ScrDyn *(*source_access)(void *, bool materialize);
+    } obj; /* owned */
     /* SCR_DYN_FUNC: the boxed closure (owned) + its call descriptor. `sig`
      * and `name` are static compiler-emitted literals (never freed); name
      * may be NULL (anonymous — inspect prints [Function (anonymous)]).
@@ -2767,6 +2800,23 @@ struct ScrDyn {
      * so a listener capturing its own boxed handle never cycles past the
      * settle — the settle-releases-listeners story. */
     struct { void *ptr; ScrDynHandleTag tag; } handle;
+    /* SCR_DYN_TYPED_REF: original static value + its compiler-emitted
+     * identity tag, RC adapters, and ordinary dyn snapshot adapter. */
+    struct {
+      void *ptr;
+      void *(*retain)(void *);
+      void (*release)(void *);
+      const char *type_key;
+      size_t type_key_len;
+      ScrDyn *(*materialize)(void *);
+      void (*commit)(void *, const ScrDyn *);
+      /* Both caches belong to this capsule. ReadableStream canonicalizes
+       * capsules for repeated source references, so the refreshed dyn view
+       * and every structurally converted static view keep JS reference
+       * identity while the source reference remains observable. */
+      ScrDyn *materialized;
+      ScrDynTypedCast *casts;
+    } typed_ref;
     /* SCR_DYN_PROMISE: the retained promise. The boundary contract: it
      * settles with a dyn payload (SCR_EXC_REF ScrDyn fulfillment or a
      * void fulfillment awaiters read as the undefined value) — the
@@ -2841,6 +2891,14 @@ ScrDyn *scr_dyn_new_num(double n);
 ScrDyn *scr_dyn_new_str(ScrStr *s);
 ScrDyn *scr_dyn_new_arr(void);
 ScrDyn *scr_dyn_new_obj(void);
+/* The ordinary deep-copy object plus a retained typed source. source_access
+ * releases that source when materialize=false and returns a fresh dyn snapshot
+ * when true. Generic dyn member reads and strict equality remain snapshot/node
+ * based; callback-interface consumers opt into the live arm explicitly. */
+ScrDyn *scr_dyn_new_obj_with_identity(
+    void *source, void *(*source_retain)(void *),
+    ScrDyn *(*source_access)(void *, bool materialize));
+bool scr_dyn_obj_same_source(const ScrDyn *a, const ScrDyn *b);
 /* Object.create(null): the fresh null-prototype dictionary (see the
  * null_proto flavor flag above). */
 ScrDyn *scr_dyn_new_obj_null_proto(void);
@@ -2850,6 +2908,26 @@ ScrDyn *scr_dyn_new_bytes_copy(const ScrBytes *b);
 /* The Buffer-flavored twin (stream chunks): string coercion/toString
  * decode utf8 instead of joining elements. */
 ScrDyn *scr_dyn_new_buffer_copy(const ScrBytes *b);
+/* Identity-preserving transit capsule used by ReadableStream.from over
+ * typed arrays. The constructor retains `ptr`; matching unbox returns +1.
+ * materialize lazily creates and then retains one detached dyn snapshot.
+ * The cast cache lets a non-exact dynCheck reuse one safe, compiler-built
+ * target view instead of raw-casting structurally different layouts. */
+ScrDyn *scr_dyn_new_typed_ref(
+    void *ptr, void *(*retain)(void *), void (*release)(void *),
+    const char *type_key, size_t type_key_len,
+    ScrDyn *(*materialize)(void *),
+    void (*commit)(void *, const ScrDyn *));
+bool scr_dyn_typed_ref_is(
+    const ScrDyn *d, const char *type_key, size_t type_key_len);
+void *scr_dyn_typed_ref_unbox(const ScrDyn *d); /* +1 */
+ScrDyn *scr_dyn_typed_ref_materialize(const ScrDyn *d); /* +1 */
+void scr_dyn_typed_ref_commit(ScrDyn *d);
+void *scr_dyn_typed_ref_cached_cast(
+    const ScrDyn *d, const char *type_key, size_t type_key_len); /* +1/NULL */
+void scr_dyn_typed_ref_cache_cast(
+    ScrDyn *d, const char *type_key, size_t type_key_len, void *ptr,
+    void *(*retain)(void *), void (*release)(void *));
 /* A fresh u8 COPY of a SCR_DYN_BYTES payload (+1) — the dynCheck
  * extraction (`u as Uint8Array`). */
 ScrBytes *scr_dyn_bytes_copy_out(const ScrDyn *d);
@@ -3137,9 +3215,10 @@ ScrDyn *scr_dyn_alloc_jsval(ScrJsval *cell, const ScrDynJsvalOps *ops);
 /* The installed ops (traps on a missing install — impossible unless a
  * JSVAL node was forged without the constructor). */
 const ScrDynJsvalOps *scr_dyn_jsval_ops(void);
-/* dynTest arms that need the ENGINE's answer on a JSVAL node. Each
- * answers false for every other kind (callers test unconditionally —
- * the emitted narrowing tests stay branch-free). Never throw. */
+/* dynTest arms that need the ENGINE's answer on a JSVAL node, or the
+ * materialized answer for a live typed-reference capsule. Each answers
+ * false for every other kind (callers test unconditionally — the emitted
+ * narrowing tests stay branch-free). Never throw. */
 bool scr_dyn_isl_typeof_is(const ScrDyn *d, const char *name);
 bool scr_dyn_isl_is_array(const ScrDyn *d);
 bool scr_dyn_isl_is_error(const ScrDyn *d);
@@ -3819,6 +3898,33 @@ ScrGen *scr_gen_of_fiber(ScrFiber *f);
 long scr_promise_live_count(void);
 #endif
 
+/* ── fetch (scr_fetch.c) ──────────────────────────────────────────────
+ * The native bridge over scr_net + scr_tls + scr_http's client parser.
+ * Static fetch(url) resolves at the response head with native Response
+ * and ReadableStream handles; Response.json consumes that same stream.
+ * AbortSignal and streaming request bodies stay native too. Under
+ * --dynamic the same TU boots the broader engine web surface. The
+ * emitted main calls scr_fetch_install in either form. */
+void scr_fetch_install(void);
+ScrPromise *scr_fetch_static(ScrStr *url, ScrDyn *init); /* +1 promise<Response handle> */
+ScrPromise *scr_fetch_response_json(ScrDyn *response); /* +1 promise<dyn> */
+ScrPromise *scr_fetch_response_text(ScrDyn *response); /* +1 promise<dyn> */
+ScrPromise *scr_fetch_response_bytes(ScrDyn *response); /* +1 promise<dyn> */
+/* Borrowed number; +1 AbortSignal handle or NULL pending. */
+ScrDyn *scr_fetch_abort_timeout(ScrDyn *delay);
+ScrDyn *scr_fetch_abort_now(ScrDyn *reason); /* borrowed reason; +1 handle */
+ScrDyn *scr_fetch_abort_any(ScrDyn *signals); /* borrowed array; +1 handle or NULL pending */
+ScrDyn *scr_fetch_stream_new(ScrDyn *source); /* borrowed source; +1 handle or NULL pending */
+ScrDyn *scr_fetch_stream_from(ScrDyn *iterable); /* borrowed iterable; +1 handle or NULL pending */
+ScrDyn *scr_fetch_stream_from_array(
+    ScrArr *iterable,
+    ScrDyn *(*item)(ScrArr *, double)); /* borrowed array/callback; +1 handle */
+ScrDyn *scr_fetch_stream_from_bytes(
+    ScrBytes *iterable); /* borrowed bytes; +1 handle */
+ScrDyn *scr_fetch_stream_from_string(
+    ScrStr *iterable); /* borrowed string; +1 handle */
+ScrPromise *scr_fetch_reader_read(ScrDyn *reader); /* borrowed handle; +1 */
+
 /* ── dynamic island (scr_island.c; --dynamic builds ONLY) ────────────
  * The embedded QuickJS-ng engine. Compiled and linked only under
  * -DSCR_DYNAMIC; static builds never reference these symbols (nor the
@@ -3948,18 +4054,12 @@ bool scr_island_timers_due(void);
 bool scr_island_timers_fire_due(void); /* true = fired at least one */
 void scr_island_timers_teardown(void);
 
-/* ── fetch (scr_fetch.c) ──────────────────────────────────────────────
- * The native bridge behind the island's fetch (scr_net + scr_tls +
- * scr_http's client parser + zlib), compiled and linked ONLY into
- * --dynamic builds whose graph references fetch. The emitted main calls
- * scr_fetch_install BEFORE any island entry; install registers the
- * bridge's hooks with the island, which boots the fetch glue with the
- * engine. The native bridge registers NO pending/poll hooks (its
+/* ── dynamic fetch hooks ──────────────────────────────────────────────
+ * The native bridge registers NO pending/poll hooks (its
  * transfers live on real sockets the loop's poller sleeps on); the curl
  * reference implementation (scr_fetch_curl.c, SCRIPTC_FETCH_CURL=1 —
  * one release as the flip's reference) still registers all four so the
  * loop can sleep on curl's fds. */
-void scr_fetch_install(void);
 void scr_island_set_fetch(void (*boot)(void *jsctx), bool (*pending)(void),
                            void (*poll)(double max_wait_ms), void (*teardown)(void));
 
@@ -4078,6 +4178,7 @@ ScrJsval *scr_jsval_destr_check(ScrJsval *v, const char *spell, const char *firs
 ScrJsval *scr_jsval_iter_n(ScrJsval *v, double n);
 int scr_jsval_set_idx(ScrJsval *o, ScrJsval *key, ScrJsval *v);
 ScrJsval *scr_jsval_call_method(ScrJsval *o, const ScrStr *name, int argc, ScrJsval **argv);
+ScrJsval *scr_jsval_call_this(ScrJsval *f, ScrJsval *receiver, int argc, ScrJsval **argv);
 /* `o.name?.(...)`: a nullish member answers the engine's undefined;
  * anything else calls with this = o (non-callables throw in the engine). */
 ScrJsval *scr_jsval_opt_call_method(ScrJsval *o, const ScrStr *name, int argc, ScrJsval **argv);
@@ -4468,6 +4569,9 @@ void scr_dataview_set(ScrBytes *b, double byte_off, double value, ScrDataViewGet
  * toward zero, wrap mod 2^8/2^32), f32 by double→float rounding. */
 double scr_bytes_get(const ScrBytes *b, double i);
 void scr_bytes_set(ScrBytes *b, double i, double v);
+/* Replace a live typed-array capsule's fixed-size payload from its dyn
+ * snapshot. Source and target have the same compiler-checked bytes type. */
+void scr_bytes_copy_contents(ScrBytes *dst, const ScrBytes *src);
 
 /* TypedArray.prototype.slice(start, end): relative indices clamp like
  * string/array slice (ToIntegerOrInfinity, negatives from the end); the
@@ -5125,9 +5229,12 @@ long scr_secure_ctx_live_count(void);
  * /etc/ssl/cert.pem probe order scr_tls.c documents) stands in for both
  * Node's compiled-in Mozilla roots ('bundled', rootCertificates) and the
  * platform store ('system') — the established SEMANTICS divergence,
- * extended to introspection; 'extra' reads NODE_EXTRA_CA_CERTS. Arrays
- * are cached per type (+1 retained answers each call — Node's own
- * caching, and the identity the suite pins with strictEqual). */
+ * extended to introspection; 'extra' uses the NODE_EXTRA_CA_CERTS file
+ * captured before user code runs. Arrays are cached per type (+1 retained
+ * answers each call — Node's own caching, and the identity the suite pins
+ * with strictEqual). */
+void scr_tls_ca_install(void); /* snapshots NODE_EXTRA_CA_CERTS + file bytes */
+bool scr_tls_ca_extra_pem(const char **pem, size_t *len); /* borrowed launch snapshot */
 ScrArr *scr_tls_ca_get(ScrStr *type); /* +1; throws ERR_INVALID_ARG_VALUE on unknown types */
 ScrArr *scr_tls_ca_root(void);        /* +1; === getCACertificates("bundled") */
 /* Replaces the 'default' set: entries filter to their PEM certificate

package/src/scr_tls.c

@@ -336,17 +336,14 @@ typedef struct ScrTlsCli {
 } ScrTlsCli;
 
 /* The default trust anchors when no `ca` option is given: the system
- * bundle, standing in for Node's compiled-in Mozilla roots. Probed once
- * across the distro spellings — /etc/ssl/cert.pem first (macOS ships it;
- * Alpine links it), then Debian/Ubuntu's ca-certificates.crt,
- * Fedora/RHEL's ca-bundle.crt, and openSUSE's ca-bundle.pem. On macOS
- * only the first path exists, so the probe order changes nothing there.
- * A host with none leaves the chain empty: verification fails, exactly
- * the no-roots behavior /etc/ssl/cert.pem-only had. Windows is that host
- * by construction (no PEM bundle ships; the OS store is cert-database-
- * shaped) — a no-`ca` client there fails verification like a bundle-less
- * Unix host, which agrees with the oracle wherever the fixtures tread
- * (their CAs are local, never in Node's Mozilla roots either). */
+ * bundle, standing in for Node's compiled-in Mozilla roots, plus
+ * NODE_EXTRA_CA_CERTS. The system bundle is probed once across the distro
+ * spellings — /etc/ssl/cert.pem first (macOS ships it; Alpine links it),
+ * then Debian/Ubuntu's ca-certificates.crt, Fedora/RHEL's ca-bundle.crt,
+ * and openSUSE's ca-bundle.pem. On macOS only the first path exists, so
+ * the probe order changes nothing there. A host with none leaves only the
+ * optional extra chain. Windows is that host by construction (no PEM
+ * bundle ships; the OS store is cert-database-shaped). */
 static mbedtls_x509_crt scr_tls_system_roots;
 static bool scr_tls_system_roots_loaded = false;
 
@@ -386,6 +383,13 @@ static mbedtls_x509_crt *scr_tls_system_ca(void) {
     for (size_t i = 0; i < sizeof bundles / sizeof bundles[0]; i++) {
       if (mbedtls_x509_crt_parse_file(&scr_tls_system_roots, bundles[i]) == 0) break;
     }
+    const char *extra = NULL;
+    size_t extra_len = 0;
+    if (scr_tls_ca_extra_pem(&extra, &extra_len) && extra_len > 0) {
+      (void)mbedtls_x509_crt_parse(
+          &scr_tls_system_roots, (const unsigned char *)extra,
+          extra_len + 1);
+    }
   }
   return &scr_tls_system_roots;
 }

package/src/scr_tls_ca.c

@@ -32,6 +32,9 @@ static ScrArr *scr_ca_bundled = NULL;
 static ScrArr *scr_ca_system = NULL;
 static ScrArr *scr_ca_extra = NULL;
 static ScrArr *scr_ca_default = NULL;
+static char *scr_ca_extra_buf = NULL;
+static size_t scr_ca_extra_len = 0;
+static bool scr_ca_installed = false;
 static char *scr_ca_override_buf = NULL;
 static size_t scr_ca_override_len = 0;
 static uint64_t scr_ca_override_gen = 0; /* 0 = never set */
@@ -47,6 +50,9 @@ static void scr_ca_teardown(void) {
   if (scr_ca_extra != NULL) scr_arr_release(scr_ca_extra);
   if (scr_ca_default != NULL) scr_arr_release(scr_ca_default);
   scr_ca_bundled = scr_ca_system = scr_ca_extra = scr_ca_default = NULL;
+  free(scr_ca_extra_buf);
+  scr_ca_extra_buf = NULL;
+  scr_ca_extra_len = 0;
   free(scr_ca_override_buf);
   scr_ca_override_buf = NULL;
 }
@@ -123,6 +129,31 @@ static char *scr_ca_read_file(const char *path, size_t *out_len) {
   return buf;
 }
 
+/*
+ * Node consumes NODE_EXTRA_CA_CERTS while the process is initialized:
+ * changing process.env or replacing the referenced file later does not
+ * alter either TLS trust or getCACertificates("extra"). Generated main
+ * calls this install hook before user code; the lazy fallback only serves
+ * library/direct-runtime callers that have no executable startup hook.
+ */
+void scr_tls_ca_install(void) {
+  if (scr_ca_installed) return;
+  scr_ca_installed = true;
+  scr_ca_arm_teardown();
+  const char *path = getenv("NODE_EXTRA_CA_CERTS");
+  if (path != NULL && path[0] != '\0') {
+    scr_ca_extra_buf = scr_ca_read_file(path, &scr_ca_extra_len);
+  }
+}
+
+bool scr_tls_ca_extra_pem(const char **pem, size_t *len) {
+  scr_tls_ca_install();
+  if (scr_ca_extra_buf == NULL) return false;
+  *pem = scr_ca_extra_buf;
+  *len = scr_ca_extra_len;
+  return true;
+}
+
 /* The host bundle, probed in scr_tls.c's documented order. */
 static ScrArr *scr_ca_load_host_bundle(void) {
   ScrArr *arr = scr_arr_new(SCR_ELEM_STR, 128);
@@ -163,14 +194,10 @@ static ScrArr *scr_ca_extra_arr(void) {
   if (scr_ca_extra == NULL) {
     scr_ca_arm_teardown();
     scr_ca_extra = scr_arr_new(SCR_ELEM_STR, 4);
-    const char *path = getenv("NODE_EXTRA_CA_CERTS");
-    if (path != NULL && path[0] != '\0') {
-      size_t len = 0;
-      char *text = scr_ca_read_file(path, &len);
-      if (text != NULL) {
-        scr_ca_push_pem_blocks(scr_ca_extra, text, len);
-        free(text);
-      }
+    const char *pem = NULL;
+    size_t len = 0;
+    if (scr_tls_ca_extra_pem(&pem, &len)) {
+      scr_ca_push_pem_blocks(scr_ca_extra, pem, len);
     }
   }
   return scr_ca_extra;

package/src/scr_url.c

@@ -7,6 +7,7 @@
  *   - scheme lowercasing; "Invalid URL" TypeError on schemeless input
  *   - special schemes (http/https/ws/wss/ftp/file): authority parsing with
  *     host lowercasing, default-port removal (leading zeros stripped),
+ *     canonical bracketed IPv6 literals,
  *     backslash-as-slash, and any run of leading slashes tolerated
  *     (http:foo.com works); file: takes an authority only after exactly
  *     "//" (file:/x and file:x are host-less absolute paths, like Node)
@@ -21,8 +22,8 @@
  *     path kept verbatim (data:text/plain,hi there)
  *
  * DOCUMENTED DIVERGENCES (SEMANTICS.md): non-ASCII and %-escaped hosts are
- * rejected with "Invalid URL" (no IDNA/punycode), IPv6 hosts are rejected,
- * and opaque paths skip the spec's C0-encode pass (kept verbatim).
+ * rejected with "Invalid URL" (no IDNA/punycode), and opaque paths skip
+ * the spec's C0-encode pass (kept verbatim).
  *
  * Failures THROW catchable TypeErrors through the exception cell with
  * Node's messages; callers are compiler-emitted pending checks. */
@@ -33,6 +34,12 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#ifdef _WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>
+#endif
 
 ScrUrl *scr_url_retain(ScrUrl *u) {
   if (u->rc != SIZE_MAX) u->rc++;
@@ -94,6 +101,65 @@ static ScrStr *ub_take(UrlBuf *b) {
   return s;
 }
 
+/* WHATWG's IPv6 serializer: lowercase hexadecimal with the first longest
+ * run of two-or-more zero pieces compressed. inet_pton supplies the parser,
+ * while serializing the eight pieces here also avoids the platform-specific
+ * dotted-decimal spelling inet_ntop uses for IPv4-mapped addresses. */
+static bool ub_append_ipv6(UrlBuf *out, const char *raw, size_t len) {
+  char *text = malloc(len + 1);
+  if (!text) scr_trap("scriptc: out of memory\n");
+  memcpy(text, raw, len);
+  text[len] = '\0';
+  struct in6_addr address;
+  bool valid = inet_pton(AF_INET6, text, &address) == 1;
+  free(text);
+  if (!valid) return false;
+
+  const unsigned char *bytes = (const unsigned char *)&address;
+  uint16_t pieces[8];
+  for (size_t i = 0; i < 8; i++) {
+    pieces[i] = (uint16_t)(((uint16_t)bytes[i * 2] << 8) |
+                           bytes[i * 2 + 1]);
+  }
+  size_t best_start = 0;
+  size_t best_len = 0;
+  for (size_t i = 0; i < 8;) {
+    if (pieces[i] != 0) {
+      i++;
+      continue;
+    }
+    size_t start = i;
+    while (i < 8 && pieces[i] == 0) i++;
+    size_t run = i - start;
+    if (run > best_len) {
+      best_start = start;
+      best_len = run;
+    }
+  }
+  if (best_len < 2) best_len = 0;
+
+  ub_push(out, '[');
+  bool first = true;
+  size_t compressed_end = best_start + best_len;
+  for (size_t i = 0; i < 8;) {
+    if (best_len > 0 && i == best_start) {
+      ub_append(out, "::", 2);
+      first = false;
+      i = compressed_end;
+      continue;
+    }
+    if (!first && (best_len == 0 || i != compressed_end)) ub_push(out, ':');
+    char hex[5];
+    int hex_len = snprintf(hex, sizeof hex, "%x", pieces[i]);
+    if (hex_len <= 0 || (size_t)hex_len >= sizeof hex) return false;
+    ub_append(out, hex, (size_t)hex_len);
+    first = false;
+    i++;
+  }
+  ub_push(out, ']');
+  return true;
+}
+
 /* ── percent-encode sets (WHATWG) ────────────────────────────────────── */
 
 static bool enc_always(unsigned char c) {
@@ -273,25 +339,48 @@ static bool parse_authority(const char *raw, size_t len, bool special, bool is_f
   *userinfo = ub_take(&ub);
   const char *hp = at >= 0 ? raw + at + 1 : raw;
   size_t hp_len = at >= 0 ? len - (size_t)at - 1 : len;
-  /* host[:port] — no IPv6 ('[' rejected below). */
+  /* host[:port], with IPv6 literals bracketed per WHATWG. */
   long colon = -1;
-  for (size_t i = 0; i < hp_len; i++) {
-    if (hp[i] == ':') colon = (long)i;
+  size_t host_len = hp_len;
+  bool ipv6 = hp_len > 0 && hp[0] == '[';
+  size_t ipv6_end = 0;
+  if (ipv6) {
+    while (ipv6_end < hp_len && hp[ipv6_end] != ']') ipv6_end++;
+    if (ipv6_end == hp_len || ipv6_end == 1) return false;
+    host_len = ipv6_end + 1;
+    if (host_len < hp_len) {
+      if (hp[host_len] != ':') return false;
+      colon = (long)host_len;
+    }
+  } else {
+    for (size_t i = 0; i < hp_len; i++) {
+      if (hp[i] == ':') colon = (long)i;
+    }
+    host_len = colon >= 0 ? (size_t)colon : hp_len;
   }
-  size_t host_len = colon >= 0 ? (size_t)colon : hp_len;
   /* Validate + lowercase (special) the host. Divergence: non-ASCII and
-   * %-escapes (IDNA territory) and IPv6 are rejected outright. */
+   * %-escapes (IDNA territory) are rejected outright. */
   UrlBuf hb;
   ub_init(&hb);
-  for (size_t i = 0; i < host_len; i++) {
-    unsigned char c = (unsigned char)hp[i];
-    if (c >= 0x80 || c == '%' || c == '[' || c == ']' || c <= 0x20 || c == '#' || c == '/' ||
-        c == '<' || c == '>' || c == '?' || c == '@' || c == '\\' || c == '^' || c == '|') {
+  if (ipv6) {
+    if (!ub_append_ipv6(&hb, hp + 1, ipv6_end - 1)) {
       free(hb.data);
       return false;
     }
-    if (special && c >= 'A' && c <= 'Z') c = (unsigned char)(c - 'A' + 'a');
-    ub_push(&hb, (char)c);
+  } else {
+    for (size_t i = 0; i < host_len; i++) {
+      unsigned char c = (unsigned char)hp[i];
+      if (c >= 0x80 || c == '%' || c == ':' || c == '[' || c == ']' ||
+          c <= 0x20 || c == '#' || c == '/' || c == '<' || c == '>' ||
+          c == '?' || c == '@' || c == '\\' || c == '^' || c == '|') {
+        free(hb.data);
+        return false;
+      }
+      if (special && c >= 'A' && c <= 'Z') {
+        c = (unsigned char)(c - 'A' + 'a');
+      }
+      ub_push(&hb, (char)c);
+    }
   }
   /* file: "localhost" normalizes to "" at parse time (Node). */
   if (is_file && hb.len == 9 && memcmp(hb.data, "localhost", 9) == 0) hb.len = 0;
@@ -561,8 +650,7 @@ ScrStr *scr_url_host(ScrUrl *u) {
 }
 
 /* WHATWG hostname getter: the stored port-less host verbatim ("" for
- * authority-less URLs). Node would keep IPv6 brackets here; the parser
- * rejects IPv6 hosts (documented divergence), so none reach this getter. */
+ * authority-less URLs); IPv6 literals retain their brackets. */
 ScrStr *scr_url_hostname(ScrUrl *u) { return scr_str_retain(u->host); }
 
 ScrStr *scr_url_href(ScrUrl *u) {

package/src/scr_web.c

@@ -294,6 +294,62 @@ static const char web_prelude[] =
     "      return it;\n"
     "    }\n"
     "    [Symbol.asyncIterator](options) { return this.values(options); }\n"
+    "    static from(iterable) {\n"
+    "      if (iterable === undefined || iterable === null) {\n"
+    "        throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "      }\n"
+    "      const asyncMethod = iterable[Symbol.asyncIterator];\n"
+    "      let method;\n"
+    "      let asyncIterator = false;\n"
+    "      if (asyncMethod !== undefined && asyncMethod !== null) {\n"
+    "        if (typeof asyncMethod !== 'function') {\n"
+    "          throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "        }\n"
+    "        method = asyncMethod;\n"
+    "        asyncIterator = true;\n"
+    "      } else {\n"
+    "        method = iterable[Symbol.iterator];\n"
+    "        if (typeof method !== 'function') {\n"
+    "          throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "        }\n"
+    "      }\n"
+    "      const iterator = method.call(iterable);\n"
+    "      if ((typeof iterator !== 'object' || iterator === null) && typeof iterator !== 'function') {\n"
+    "        throw new TypeError('iterator method must return an object');\n"
+    "      }\n"
+    "      const next = iterator.next;\n"
+    "      let finished = false;\n"
+    "      let started = false;\n"
+    "      return new ReadableStream({\n"
+    "        async pull(controller) {\n"
+    "          started = true;\n"
+    "          const result = asyncIterator ? await next.call(iterator) : next.call(iterator);\n"
+    "          if ((typeof result !== 'object' || result === null) && typeof result !== 'function') {\n"
+    "            throw new TypeError('iterator result is not an object');\n"
+    "          }\n"
+    "          if (result.done) { finished = true; controller.close(); return; }\n"
+    "          controller.enqueue(asyncIterator ? result.value : await result.value);\n"
+    "        },\n"
+    "        async cancel(reason) {\n"
+    "          if (finished) return;\n"
+    "          finished = true;\n"
+    "          if (!started) return;\n"
+    "          const finish = iterator.return;\n"
+    "          if (finish === undefined || finish === null) return;\n"
+    "          if (typeof finish !== 'function') throw new TypeError('iterator return is not a function');\n"
+    "          const result = finish.call(iterator, reason);\n"
+    "          if (!asyncIterator && ((typeof result !== 'object' || result === null) && typeof result !== 'function')) {\n"
+    "            throw new TypeError('iterator result is not an object');\n"
+    "          }\n"
+    "          if (asyncIterator) {\n"
+    "            const awaited = await result;\n"
+    "            if ((typeof awaited !== 'object' || awaited === null) && typeof awaited !== 'function') {\n"
+    "              throw new TypeError('iterator result is not an object');\n"
+    "            }\n"
+    "          }\n"
+    "        },\n"
+    "      });\n"
+    "    }\n"
     "    pipeThrough(transform, options) {\n"
     "      if (transform === null || typeof transform !== 'object' || !transform.writable || !transform.readable) {\n"
     "        throw new TypeError('pipeThrough requires a { writable, readable } pair');\n"
@@ -1342,12 +1398,14 @@ static const char web_prelude[] =
     "        this._headers = new g.Headers(input._headers);\n"
     "        this._body = input._body; // shared bytes; fetch copies\n"
     "        this._signal = input._signal;\n"
+    "        this._redirect = input._redirect;\n"
     "      } else {\n"
     "        this._url = String(input);\n"
     "        this._method = 'GET';\n"
     "        this._headers = new g.Headers();\n"
     "        this._body = null;\n"
     "        this._signal = null;\n"
+    "        this._redirect = 'follow';\n"
     "      }\n"
     "      if (init.method !== undefined) this._method = normalizeMethod(init.method);\n"
     "      if (init.headers !== undefined) this._headers = new g.Headers(init.headers);\n"
@@ -1357,19 +1415,35 @@ static const char web_prelude[] =
     "        }\n"
     "        this._signal = init.signal;\n"
     "      }\n"
+    "      if (init.redirect !== undefined) {\n"
+    "        const redirect = String(init.redirect);\n"
+    "        if (redirect !== 'follow' && redirect !== 'error' && redirect !== 'manual') {\n"
+    "          throw new TypeError(`undefined: ${redirect} is not an accepted type. Expected one of follow, manual, error.`);\n"
+    "        }\n"
+    "        this._redirect = redirect;\n"
+    "      }\n"
     "      if (init.body !== undefined && init.body !== null) {\n"
     "        if (this._method === 'GET' || this._method === 'HEAD') {\n"
     "          throw new TypeError('Request with GET/HEAD method cannot have body.');\n"
     "        }\n"
     "        const [bytes, ct] = coerceBodyBytes(init.body);\n"
+    "        if (bytes instanceof g.ReadableStream && init.duplex !== 'half') {\n"
+    "          throw new TypeError('RequestInit: duplex option is required when sending a body.');\n"
+    "        }\n"
     "        this._body = bytes;\n"
     "        if (ct !== null && !this._headers.has('content-type')) this._headers.set('content-type', ct);\n"
     "      }\n"
+    "      // A method override still validates a body inherited from the\n"
+    "      // input Request, not only a body supplied by this init.\n"
+    "      if (this._body !== null && (this._method === 'GET' || this._method === 'HEAD')) {\n"
+    "        throw new TypeError('Request with GET/HEAD method cannot have body.');\n"
+    "      }\n"
     "      this._bodyUsed = false;\n"
     "    }\n"
     "    get url() { return this._url; }\n"
     "    get method() { return this._method; }\n"
     "    get headers() { return this._headers; }\n"
+    "    get redirect() { return this._redirect; }\n"
     "    /* Node's Request.signal is never null — a request built without one\n"
     "     * carries an inert signal; mint it lazily on first access. */\n"
     "    get signal() {\n"
@@ -1391,6 +1465,7 @@ static const char web_prelude[] =
     "      this._headers = new g.Headers(init.headers);\n"
     "      this._url = '';\n"
     "      this._redirected = false;\n"
+    "      this._type = 'default';\n"
     "      this._bodyUsed = false;\n"
     "      if (body === undefined || body === null) {\n"
     "        this._body = null;\n"
@@ -1406,7 +1481,7 @@ static const char web_prelude[] =
     "    get headers() { return this._headers; }\n"
     "    get url() { return this._url; }\n"
     "    get redirected() { return this._redirected; }\n"
-    "    get type() { return 'default'; }\n"
+    "    get type() { return this._type; }\n"
     "    static json(data, init) {\n"
     "      const r = new Response(JSON.stringify(data), init);\n"
     "      r._headers.set('content-type', 'application/json');\n"
@@ -1425,6 +1500,7 @@ static const char web_prelude[] =
     "    r._headers = headers;\n"
     "    r._url = url;\n"
     "    r._redirected = redirected;\n"
+    "    r._type = 'basic';\n"
     "    r._body = bodyStream;\n"
     "    return r;\n"
     "  };\n"