@scriptc/runtime 0.0.21 → 0.0.23

package/src/scr_url.c

@@ -7,6 +7,7 @@
  *   - scheme lowercasing; "Invalid URL" TypeError on schemeless input
  *   - special schemes (http/https/ws/wss/ftp/file): authority parsing with
  *     host lowercasing, default-port removal (leading zeros stripped),
+ *     canonical bracketed IPv6 literals,
  *     backslash-as-slash, and any run of leading slashes tolerated
  *     (http:foo.com works); file: takes an authority only after exactly
  *     "//" (file:/x and file:x are host-less absolute paths, like Node)
@@ -21,8 +22,8 @@
  *     path kept verbatim (data:text/plain,hi there)
  *
  * DOCUMENTED DIVERGENCES (SEMANTICS.md): non-ASCII and %-escaped hosts are
- * rejected with "Invalid URL" (no IDNA/punycode), IPv6 hosts are rejected,
- * and opaque paths skip the spec's C0-encode pass (kept verbatim).
+ * rejected with "Invalid URL" (no IDNA/punycode), and opaque paths skip
+ * the spec's C0-encode pass (kept verbatim).
  *
  * Failures THROW catchable TypeErrors through the exception cell with
  * Node's messages; callers are compiler-emitted pending checks. */
@@ -33,6 +34,12 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#ifdef _WIN32
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>
+#endif
 
 ScrUrl *scr_url_retain(ScrUrl *u) {
   if (u->rc != SIZE_MAX) u->rc++;
@@ -94,6 +101,65 @@ static ScrStr *ub_take(UrlBuf *b) {
   return s;
 }
 
+/* WHATWG's IPv6 serializer: lowercase hexadecimal with the first longest
+ * run of two-or-more zero pieces compressed. inet_pton supplies the parser,
+ * while serializing the eight pieces here also avoids the platform-specific
+ * dotted-decimal spelling inet_ntop uses for IPv4-mapped addresses. */
+static bool ub_append_ipv6(UrlBuf *out, const char *raw, size_t len) {
+  char *text = malloc(len + 1);
+  if (!text) scr_trap("scriptc: out of memory\n");
+  memcpy(text, raw, len);
+  text[len] = '\0';
+  struct in6_addr address;
+  bool valid = inet_pton(AF_INET6, text, &address) == 1;
+  free(text);
+  if (!valid) return false;
+
+  const unsigned char *bytes = (const unsigned char *)&address;
+  uint16_t pieces[8];
+  for (size_t i = 0; i < 8; i++) {
+    pieces[i] = (uint16_t)(((uint16_t)bytes[i * 2] << 8) |
+                           bytes[i * 2 + 1]);
+  }
+  size_t best_start = 0;
+  size_t best_len = 0;
+  for (size_t i = 0; i < 8;) {
+    if (pieces[i] != 0) {
+      i++;
+      continue;
+    }
+    size_t start = i;
+    while (i < 8 && pieces[i] == 0) i++;
+    size_t run = i - start;
+    if (run > best_len) {
+      best_start = start;
+      best_len = run;
+    }
+  }
+  if (best_len < 2) best_len = 0;
+
+  ub_push(out, '[');
+  bool first = true;
+  size_t compressed_end = best_start + best_len;
+  for (size_t i = 0; i < 8;) {
+    if (best_len > 0 && i == best_start) {
+      ub_append(out, "::", 2);
+      first = false;
+      i = compressed_end;
+      continue;
+    }
+    if (!first && (best_len == 0 || i != compressed_end)) ub_push(out, ':');
+    char hex[5];
+    int hex_len = snprintf(hex, sizeof hex, "%x", pieces[i]);
+    if (hex_len <= 0 || (size_t)hex_len >= sizeof hex) return false;
+    ub_append(out, hex, (size_t)hex_len);
+    first = false;
+    i++;
+  }
+  ub_push(out, ']');
+  return true;
+}
+
 /* ── percent-encode sets (WHATWG) ────────────────────────────────────── */
 
 static bool enc_always(unsigned char c) {
@@ -273,25 +339,48 @@ static bool parse_authority(const char *raw, size_t len, bool special, bool is_f
   *userinfo = ub_take(&ub);
   const char *hp = at >= 0 ? raw + at + 1 : raw;
   size_t hp_len = at >= 0 ? len - (size_t)at - 1 : len;
-  /* host[:port] — no IPv6 ('[' rejected below). */
+  /* host[:port], with IPv6 literals bracketed per WHATWG. */
   long colon = -1;
-  for (size_t i = 0; i < hp_len; i++) {
-    if (hp[i] == ':') colon = (long)i;
+  size_t host_len = hp_len;
+  bool ipv6 = hp_len > 0 && hp[0] == '[';
+  size_t ipv6_end = 0;
+  if (ipv6) {
+    while (ipv6_end < hp_len && hp[ipv6_end] != ']') ipv6_end++;
+    if (ipv6_end == hp_len || ipv6_end == 1) return false;
+    host_len = ipv6_end + 1;
+    if (host_len < hp_len) {
+      if (hp[host_len] != ':') return false;
+      colon = (long)host_len;
+    }
+  } else {
+    for (size_t i = 0; i < hp_len; i++) {
+      if (hp[i] == ':') colon = (long)i;
+    }
+    host_len = colon >= 0 ? (size_t)colon : hp_len;
   }
-  size_t host_len = colon >= 0 ? (size_t)colon : hp_len;
   /* Validate + lowercase (special) the host. Divergence: non-ASCII and
-   * %-escapes (IDNA territory) and IPv6 are rejected outright. */
+   * %-escapes (IDNA territory) are rejected outright. */
   UrlBuf hb;
   ub_init(&hb);
-  for (size_t i = 0; i < host_len; i++) {
-    unsigned char c = (unsigned char)hp[i];
-    if (c >= 0x80 || c == '%' || c == '[' || c == ']' || c <= 0x20 || c == '#' || c == '/' ||
-        c == '<' || c == '>' || c == '?' || c == '@' || c == '\\' || c == '^' || c == '|') {
+  if (ipv6) {
+    if (!ub_append_ipv6(&hb, hp + 1, ipv6_end - 1)) {
       free(hb.data);
       return false;
     }
-    if (special && c >= 'A' && c <= 'Z') c = (unsigned char)(c - 'A' + 'a');
-    ub_push(&hb, (char)c);
+  } else {
+    for (size_t i = 0; i < host_len; i++) {
+      unsigned char c = (unsigned char)hp[i];
+      if (c >= 0x80 || c == '%' || c == ':' || c == '[' || c == ']' ||
+          c <= 0x20 || c == '#' || c == '/' || c == '<' || c == '>' ||
+          c == '?' || c == '@' || c == '\\' || c == '^' || c == '|') {
+        free(hb.data);
+        return false;
+      }
+      if (special && c >= 'A' && c <= 'Z') {
+        c = (unsigned char)(c - 'A' + 'a');
+      }
+      ub_push(&hb, (char)c);
+    }
   }
   /* file: "localhost" normalizes to "" at parse time (Node). */
   if (is_file && hb.len == 9 && memcmp(hb.data, "localhost", 9) == 0) hb.len = 0;
@@ -561,8 +650,7 @@ ScrStr *scr_url_host(ScrUrl *u) {
 }
 
 /* WHATWG hostname getter: the stored port-less host verbatim ("" for
- * authority-less URLs). Node would keep IPv6 brackets here; the parser
- * rejects IPv6 hosts (documented divergence), so none reach this getter. */
+ * authority-less URLs); IPv6 literals retain their brackets. */
 ScrStr *scr_url_hostname(ScrUrl *u) { return scr_str_retain(u->host); }
 
 ScrStr *scr_url_href(ScrUrl *u) {

package/src/scr_web.c

@@ -294,6 +294,62 @@ static const char web_prelude[] =
     "      return it;\n"
     "    }\n"
     "    [Symbol.asyncIterator](options) { return this.values(options); }\n"
+    "    static from(iterable) {\n"
+    "      if (iterable === undefined || iterable === null) {\n"
+    "        throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "      }\n"
+    "      const asyncMethod = iterable[Symbol.asyncIterator];\n"
+    "      let method;\n"
+    "      let asyncIterator = false;\n"
+    "      if (asyncMethod !== undefined && asyncMethod !== null) {\n"
+    "        if (typeof asyncMethod !== 'function') {\n"
+    "          throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "        }\n"
+    "        method = asyncMethod;\n"
+    "        asyncIterator = true;\n"
+    "      } else {\n"
+    "        method = iterable[Symbol.iterator];\n"
+    "        if (typeof method !== 'function') {\n"
+    "          throw new TypeError('ReadableStream.from requires an iterable');\n"
+    "        }\n"
+    "      }\n"
+    "      const iterator = method.call(iterable);\n"
+    "      if ((typeof iterator !== 'object' || iterator === null) && typeof iterator !== 'function') {\n"
+    "        throw new TypeError('iterator method must return an object');\n"
+    "      }\n"
+    "      const next = iterator.next;\n"
+    "      let finished = false;\n"
+    "      let started = false;\n"
+    "      return new ReadableStream({\n"
+    "        async pull(controller) {\n"
+    "          started = true;\n"
+    "          const result = asyncIterator ? await next.call(iterator) : next.call(iterator);\n"
+    "          if ((typeof result !== 'object' || result === null) && typeof result !== 'function') {\n"
+    "            throw new TypeError('iterator result is not an object');\n"
+    "          }\n"
+    "          if (result.done) { finished = true; controller.close(); return; }\n"
+    "          controller.enqueue(asyncIterator ? result.value : await result.value);\n"
+    "        },\n"
+    "        async cancel(reason) {\n"
+    "          if (finished) return;\n"
+    "          finished = true;\n"
+    "          if (!started) return;\n"
+    "          const finish = iterator.return;\n"
+    "          if (finish === undefined || finish === null) return;\n"
+    "          if (typeof finish !== 'function') throw new TypeError('iterator return is not a function');\n"
+    "          const result = finish.call(iterator, reason);\n"
+    "          if (!asyncIterator && ((typeof result !== 'object' || result === null) && typeof result !== 'function')) {\n"
+    "            throw new TypeError('iterator result is not an object');\n"
+    "          }\n"
+    "          if (asyncIterator) {\n"
+    "            const awaited = await result;\n"
+    "            if ((typeof awaited !== 'object' || awaited === null) && typeof awaited !== 'function') {\n"
+    "              throw new TypeError('iterator result is not an object');\n"
+    "            }\n"
+    "          }\n"
+    "        },\n"
+    "      });\n"
+    "    }\n"
     "    pipeThrough(transform, options) {\n"
     "      if (transform === null || typeof transform !== 'object' || !transform.writable || !transform.readable) {\n"
     "        throw new TypeError('pipeThrough requires a { writable, readable } pair');\n"
@@ -1342,12 +1398,14 @@ static const char web_prelude[] =
     "        this._headers = new g.Headers(input._headers);\n"
     "        this._body = input._body; // shared bytes; fetch copies\n"
     "        this._signal = input._signal;\n"
+    "        this._redirect = input._redirect;\n"
     "      } else {\n"
     "        this._url = String(input);\n"
     "        this._method = 'GET';\n"
     "        this._headers = new g.Headers();\n"
     "        this._body = null;\n"
     "        this._signal = null;\n"
+    "        this._redirect = 'follow';\n"
     "      }\n"
     "      if (init.method !== undefined) this._method = normalizeMethod(init.method);\n"
     "      if (init.headers !== undefined) this._headers = new g.Headers(init.headers);\n"
@@ -1357,19 +1415,35 @@ static const char web_prelude[] =
     "        }\n"
     "        this._signal = init.signal;\n"
     "      }\n"
+    "      if (init.redirect !== undefined) {\n"
+    "        const redirect = String(init.redirect);\n"
+    "        if (redirect !== 'follow' && redirect !== 'error' && redirect !== 'manual') {\n"
+    "          throw new TypeError(`undefined: ${redirect} is not an accepted type. Expected one of follow, manual, error.`);\n"
+    "        }\n"
+    "        this._redirect = redirect;\n"
+    "      }\n"
     "      if (init.body !== undefined && init.body !== null) {\n"
     "        if (this._method === 'GET' || this._method === 'HEAD') {\n"
     "          throw new TypeError('Request with GET/HEAD method cannot have body.');\n"
     "        }\n"
     "        const [bytes, ct] = coerceBodyBytes(init.body);\n"
+    "        if (bytes instanceof g.ReadableStream && init.duplex !== 'half') {\n"
+    "          throw new TypeError('RequestInit: duplex option is required when sending a body.');\n"
+    "        }\n"
     "        this._body = bytes;\n"
     "        if (ct !== null && !this._headers.has('content-type')) this._headers.set('content-type', ct);\n"
     "      }\n"
+    "      // A method override still validates a body inherited from the\n"
+    "      // input Request, not only a body supplied by this init.\n"
+    "      if (this._body !== null && (this._method === 'GET' || this._method === 'HEAD')) {\n"
+    "        throw new TypeError('Request with GET/HEAD method cannot have body.');\n"
+    "      }\n"
     "      this._bodyUsed = false;\n"
     "    }\n"
     "    get url() { return this._url; }\n"
     "    get method() { return this._method; }\n"
     "    get headers() { return this._headers; }\n"
+    "    get redirect() { return this._redirect; }\n"
     "    /* Node's Request.signal is never null — a request built without one\n"
     "     * carries an inert signal; mint it lazily on first access. */\n"
     "    get signal() {\n"
@@ -1391,6 +1465,7 @@ static const char web_prelude[] =
     "      this._headers = new g.Headers(init.headers);\n"
     "      this._url = '';\n"
     "      this._redirected = false;\n"
+    "      this._type = 'default';\n"
     "      this._bodyUsed = false;\n"
     "      if (body === undefined || body === null) {\n"
     "        this._body = null;\n"
@@ -1406,7 +1481,7 @@ static const char web_prelude[] =
     "    get headers() { return this._headers; }\n"
     "    get url() { return this._url; }\n"
     "    get redirected() { return this._redirected; }\n"
-    "    get type() { return 'default'; }\n"
+    "    get type() { return this._type; }\n"
     "    static json(data, init) {\n"
     "      const r = new Response(JSON.stringify(data), init);\n"
     "      r._headers.set('content-type', 'application/json');\n"
@@ -1425,6 +1500,7 @@ static const char web_prelude[] =
     "    r._headers = headers;\n"
     "    r._url = url;\n"
     "    r._redirected = redirected;\n"
+    "    r._type = 'basic';\n"
     "    r._body = bodyStream;\n"
     "    return r;\n"
     "  };\n"

package/vendor/README.md

@@ -19,7 +19,7 @@ The QuickJS-ng JavaScript engine, embedded by the opt-in `--dynamic` build mode
 
 The tree is a plain snapshot of the upstream commit with directories the library build does not need removed (tests/, docs/, examples/, test262 fixtures, CI config, generator scripts). No vendored file is modified; to update, re-clone upstream at the new commit, delete its .git directory, apply the same trim, and update this file.
 
-The engine archive (libqjs.a) is built lazily on the first `--dynamic` compile into `.cache/<commit>-<flavor>/` next to this file — one flavor per lane (plain, asan). The cache directory is gitignored and safe to delete.
+The engine archive (libqjs.a) is built lazily on the first `--dynamic` compile into `.cache/<commit>-<flavor>-<target>-<toolchain>/` next to this file — one flavor per lane (plain, asan), native platform/architecture or explicit cross target, and compiler environment/identity. The cache directory is gitignored and safe to delete.
 
 ## zlib/
 
@@ -29,7 +29,7 @@ The engine archive (libqjs.a) is built lazily on the first `--dynamic` compile i
 
 The CROSS-target arm of node:zlib (see packages/runtime/src/scr_zlib.c): host builds keep the historical system `-lz` link (macOS ships libz), but zig's cross sysroots have no libz, so SCRIPTC_TARGET builds compile this vendored copy per target instead. Only the flat `*.c`/`*.h` at the distribution root are vendored (LICENSE beside them) — contrib, tests, build machinery, and docs are not. No vendored file is modified; the gz* file-I/O TUs are vendored for faithfulness but never compiled (nothing references the gzFile API — see ZLIB_SOURCES in packages/compiler/src/backend/cc.ts). To update, re-fetch the release tarball, copy the same flat set, and bump `ZLIB_VERSION` in cc.ts.
 
-The objects build lazily on the first zlib-using cross compile into `.cache/zlib-<version>-<flavor>/` next to this file — one flavor per driver/target (the lre-objects pattern). Zlib-free binaries never compile any of this; compressed OUTPUT bytes are zlib-version-dependent, which is why the corpus only compares round-trips and fixed-blob inflation.
+The objects build lazily on the first zlib-using cross compile into `.cache/zlib-<version>-<flavor>-<target>-<toolchain>/` next to this file — one flavor per driver/target and compiler environment/identity (the lre-objects pattern). Zlib-free binaries never compile any of this; compressed OUTPUT bytes are zlib-version-dependent, which is why the corpus only compares round-trips and fixed-blob inflation.
 
 ## curl/
 
@@ -39,7 +39,7 @@ The objects build lazily on the first zlib-using cross compile into `.cache/zlib
 
 HEADERS ONLY — no curl C source is vendored and none is ever compiled. These headers now serve ONLY the RETIRED curl reference implementation of fetch (packages/runtime/src/scr_fetch_curl.c, selected by `SCRIPTC_FETCH_CURL=1`; kept compilable for one release as the native flip's reference — see scr_fetch.c, the default, which rides scr_net/scr_tls/scr_http/zlib and touches nothing here). Under the flag: host builds link the system `-lcurl` (macOS ships libcurl), and linux-gnu CROSS builds compile scr_fetch_curl.c against these headers, then link against a generated STUB `libcurl.so` (soname `libcurl.so.4`, empty definitions of exactly the symbols scr_fetch_curl.c calls — see CURL_STUB_SYMBOLS in packages/compiler/src/backend/cc.ts) so the produced binary records a plain `DT_NEEDED libcurl.so.4` that the TARGET system's real libcurl satisfies at load time, the standard cross-link import-stub technique. The 7.88.1 pin is a floor, not a lock: scr_fetch_curl.c's newest requirement is CURLOPT_PROTOCOLS_STR (7.85.0) and the unversioned symbol references bind to any libcurl.so.4. This whole directory leaves with scr_fetch_curl.c when the reference retires for good.
 
-The stub builds lazily on the first flag-selected fetch cross compile into `.cache/curl-stub-<flavor>/` next to this file (the zlib-objects pattern). Default builds never see any of this, and no build ever compiles curl itself.
+The stub builds lazily on the first flag-selected fetch cross compile into `.cache/curl-stub-<target>-<toolchain>/` next to this file (the zlib-objects pattern). Default builds never see any of this, and no build ever compiles curl itself.
 
 ## mbedtls/
 
@@ -49,4 +49,4 @@ The stub builds lazily on the first flag-selected fetch cross compile into `.cac
 
 The TLS provider behind node:tls/node:https (see the design note atop packages/runtime/src/scr_tls.c for why mbedTLS over SecureTransport/BoringSSL/libtls). Only `include/` and `library/` are vendored (LICENSE beside them) — tests, docs, programs, scripts, and CMake machinery are not. No vendored file is modified and no custom config is applied (the stock `mbedtls_config.h` builds every `library/*.c` standalone with clang); to update, re-fetch the release tarball, copy the same two directories, and bump `MBEDTLS_VERSION` in packages/compiler/src/backend/cc.ts.
 
-The archive (libmbedtls.a) is built lazily on the first TLS-using compile into `.cache/mbedtls-<version>-<flavor>/` next to this file — one flavor per lane (plain, asan), the libqjs.a pattern. TLS-free binaries never compile or link any of this.
+The archive (libmbedtls.a) is built lazily on the first TLS-using compile into `.cache/mbedtls-<version>-<flavor>-<target>-<toolchain>/` next to this file — one flavor per lane (plain, asan), native platform/architecture or explicit cross target, and compiler environment/identity, the libqjs.a pattern. TLS-free binaries never compile or link any of this.