@scriptc/runtime 0.0.9 → 0.0.11

package/src/scr_stream.c

@@ -13,11 +13,12 @@
  * nothing.
  *
  * EVENT TIMING. Node schedules most stream emissions on process.nextTick;
- * here those deferrals ride a FIFO tick queue drained at the top of every
- * loop turn (scr_loop_set_stream — the station before events/net/timers,
- * the closest to nextTick; ticks scheduled from user code on the main
- * stack run when the loop starts, i.e. after all synchronous code — the
- * nextTick shape). The implemented orderings follow lib/internal/streams:
+ * here each deferral enqueues on the stream tick FIFO AND posts a raw
+ * marker on the USER nextTick queue (scr_next_tick_raw), so stream
+ * emissions and user nextTicks run in true FIFO enqueue order — Node's,
+ * where they are the same queue. The scr_loop_set_stream station remains
+ * as the drain of anything a marker never reached (and the uncaught-throw
+ * cleanup). The implemented orderings follow lib/internal/streams:
  *   - on('data') starts flowing on a TICK (resume_): synchronous code
  *     after the registration runs before the first 'data'.
  *   - push() while flowing with an empty buffer emits 'data'
@@ -103,6 +104,10 @@ struct ScrStreamState {
     bool encoded;       /* string-chunk mode (decoder active) */
     ScrStr *enc;        /* owned canonical encoding name, or NULL */
     double dec_pending; /* scr_strdec packed pending state */
+    /* The defaultEncoding option's push-side effect: how push(string)
+     * DECODES string chunks into bytes (Node's Buffer.from(chunk,
+     * state.defaultEncoding)). Owned canonical name; NULL = utf8. */
+    ScrStr *push_enc;
     /* Readable.from mode: entries are whole OBJECTS (each counts 1
      * toward length/hwm and delivers undivided — Node's objectMode
      * accounting for the from() surface; hwm is 1). */
@@ -223,6 +228,7 @@ static void scr_stream_state_drop(ScrStreamState *st, bool gc) {
   for (size_t i = 0; i < st->r.n; i++) scr_stream_entry_release(st, st->r.buf[i]);
   free(st->r.buf);
   if (st->r.enc) scr_str_release(st->r.enc);
+  if (st->r.push_enc) scr_str_release(st->r.push_enc);
   if (!gc && st->r.next_waiter) scr_promise_release(st->r.next_waiter);
   if (!gc) {
     if (st->r.read_cb) scr_closure_release(st->r.read_cb);
@@ -350,6 +356,8 @@ typedef struct ScrStreamTick {
 static ScrStreamTick *scr_st_head = NULL;
 static ScrStreamTick *scr_st_tail = NULL;
 
+static void scr_stream_dispatch_one(void);
+
 static void scr_st_tick(ScrStream *s, ScrStreamTickOp op, ScrError *err /*moves*/,
                         ScrClosure *cb /*moves*/) {
   ScrStreamTick *t = calloc(1, sizeof *t);
@@ -361,6 +369,13 @@ static void scr_st_tick(ScrStream *s, ScrStreamTickOp op, ScrError *err /*moves*
   if (scr_st_tail) scr_st_tail->next = t;
   else scr_st_head = t;
   scr_st_tail = t;
+  /* One marker per tick on the USER nextTick queue: stream emissions are
+   * process.nextTicks in Node (resume_, emitReadable_, endReadableNT,
+   * afterWrite, ...), so they must interleave with user nextTicks in
+   * enqueue order — a `push(); on('data'); process.nextTick(assert)`
+   * sequence sees its data before the assert runs. The station dispatch
+   * below stays as the drain of anything a marker never reached. */
+  scr_next_tick_raw(&scr_stream_dispatch_one);
 }
 
 static bool scr_stream_ticks_pending(void) { return scr_st_head != NULL; }
@@ -1222,6 +1237,24 @@ static ScrStream *scr_stream_alloc(const ScrVt *vt, const char *cls, bool has_r,
   s->reg = NULL;
   s->cls = cls;
   s->st = scr_stream_state_new(has_r, has_w, rhwm, whwm, auto_destroy, emit_close, allow_half_open);
+  /* Node's stream constructors pre-create their known _events keys (a V8
+   * shape optimization) — eventNames() lists these BEFORE user events
+   * added earlier. Same names, same order: Readable close/error/data/end/
+   * readable, Writable close/error/prefinish/finish/drain, Duplex the
+   * union (writable trio first — Node's observed key order). */
+  ScrEmitter *em = (ScrEmitter *)s;
+  scr_emitter_reserve(em, "close");
+  scr_emitter_reserve(em, "error");
+  if (has_w) {
+    scr_emitter_reserve(em, "prefinish");
+    scr_emitter_reserve(em, "finish");
+    scr_emitter_reserve(em, "drain");
+  }
+  if (has_r) {
+    scr_emitter_reserve(em, "data");
+    scr_emitter_reserve(em, "end");
+    scr_emitter_reserve(em, "readable");
+  }
   scr_obj_alloc_note();
   return s;
 }
@@ -2193,6 +2226,133 @@ ScrPromise *scr_sp_pipeline(double n, ScrStream **streams) {
   return p;
 }
 
+/* ── node:stream/consumers ────────────────────────────────────────────
+ * text/json/buffer over the readable machinery: a native 'data' listener
+ * accumulates every chunk (Buffer chunks as-is; string chunks — an
+ * encoded stream or Readable.from strings — as their utf8 bytes, the
+ * Blob rule Node's consumers share for whole-stream accumulation), and
+ * the finished watcher settles at the terminal point — the accumulated
+ * result on a clean end (right after 'close', Node's own timing: the
+ * consumer's async iterator completes through eos), the stream's error,
+ * or ERR_STREAM_PREMATURE_CLOSE on an early close — and marks lifecycle
+ * errors handled, exactly like the iterator's eos registration. Both
+ * closures share the cap layout: caps[0] the pending promise, caps[1]
+ * the chunk list (Buffer entries). */
+
+enum { SCR_SC_TEXT = 0, SCR_SC_JSON = 1, SCR_SC_BUFFER = 2 };
+
+static void scr_sc_settle_ok(ScrClosure *cb, int kind) {
+  ScrPromise *p = scr_box_get_ref(cb->caps[0]);  /* +1 */
+  ScrArr *chunks = scr_box_get_ref(cb->caps[1]); /* +1 */
+  ScrBytes *all = scr_bytes_concat(chunks);
+  scr_arr_release(chunks);
+  if (kind == SCR_SC_BUFFER) {
+    scr_promise_fulfill_ref(p, all, scr_bytes_retain_v, scr_bytes_release_v, NULL);
+    scr_promise_release(p);
+    return;
+  }
+  ScrStr *enc = scr_str_new("utf8", 4);
+  ScrStr *text = scr_bytes_to_str(all, enc); /* U+FFFD per invalid subpart */
+  scr_str_release(enc);
+  scr_bytes_release(all);
+  if (kind == SCR_SC_TEXT) {
+    scr_promise_fulfill_str(p, text); /* moves */
+  } else {
+    ScrDyn *doc = scr_json_parse(text);
+    scr_str_release(text);
+    if (doc == NULL) {
+      /* the parse's SyntaxError rides the cell — the rejection, like
+       * Node's json() rejecting with JSON.parse's throw */
+      scr_promise_reject_pending(p);
+    } else {
+      scr_promise_fulfill_ref(p, doc, scr_dyn_retain_v, scr_dyn_release_v, NULL);
+    }
+  }
+  scr_promise_release(p);
+}
+
+/* The 'data' accumulation (the emit ABI's two payload slots — exactly
+ * one non-NULL). */
+static void scr_sc_data(ScrClosure *cb, void *b, void *str) {
+  ScrArr *chunks = scr_box_get_ref(cb->caps[1]); /* +1 */
+  if (b != NULL) {
+    scr_arr_push_ref(chunks, scr_bytes_retain((ScrBytes *)b));
+  } else if (str != NULL) {
+    ScrStr *enc = scr_str_new("utf8", 4);
+    scr_arr_push_ref(chunks, scr_bytes_from_str((ScrStr *)str, enc));
+    scr_str_release(enc);
+  }
+  scr_arr_release(chunks);
+}
+
+static void scr_sc_fin(ScrClosure *cb, ScrError *err, int kind) {
+  if (err != NULL) {
+    ScrPromise *p = scr_box_get_ref(cb->caps[0]); /* +1 */
+    scr_throw_obj(scr_error_retain(err), &scr_error_retain_v, &scr_error_release_v,
+                  scr_error_trace_arg());
+    scr_promise_reject_pending(p);
+    scr_promise_release(p);
+    return;
+  }
+  scr_sc_settle_ok(cb, kind);
+}
+
+static void scr_sc_fin_text(ScrClosure *cb, ScrStream *s, ScrError *err) {
+  (void)s;
+  scr_sc_fin(cb, err, SCR_SC_TEXT);
+}
+static void scr_sc_fin_json(ScrClosure *cb, ScrStream *s, ScrError *err) {
+  (void)s;
+  scr_sc_fin(cb, err, SCR_SC_JSON);
+}
+static void scr_sc_fin_buffer(ScrClosure *cb, ScrStream *s, ScrError *err) {
+  (void)s;
+  scr_sc_fin(cb, err, SCR_SC_BUFFER);
+}
+
+static ScrClosure *scr_sc_closure(void *fn, ScrPromise *p, ScrArr *chunks) {
+  ScrClosure *c = scr_closure_new(fn, 2);
+  c->caps[0] = scr_box_new_obj(scr_promise_retain_v, scr_promise_release_v, scr_promise_trace_v);
+  scr_box_set_ref(c->caps[0], scr_promise_retain(p));
+  c->caps[1] = scr_box_new_obj(scr_arr_retain_v, scr_arr_release_v, NULL);
+  scr_box_set_ref(c->caps[1], scr_arr_retain(chunks));
+  return c;
+}
+
+static ScrPromise *scr_sc_consume(ScrStream *s, int kind) {
+  ScrPromise *p = scr_promise_new();
+  if (s->st == NULL || !s->st->has_r) {
+    /* Node's consumers for-await the argument; a stream with no readable
+     * side has no async iterator — the TypeError rejects. */
+    static const char msg[] = "stream is not async iterable";
+    scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+    scr_promise_reject_pending(p);
+    return p;
+  }
+  ScrArr *chunks = scr_arr_new_ref(scr_bytes_retain_v, scr_bytes_release_v, NULL, 4);
+  ScrStreamErrInv fin_inv = kind == SCR_SC_TEXT    ? &scr_sc_fin_text
+                            : kind == SCR_SC_JSON  ? &scr_sc_fin_json
+                                                   : &scr_sc_fin_buffer;
+  /* The terminal watcher first (it marks lifecycle errors handled); the
+   * promise form exposes no unhook — the cleanup closure drops. */
+  ScrClosure *cleanup = scr_stream_finished(s, scr_sc_closure((void *)fin_inv, p, chunks), fin_inv);
+  scr_closure_release(cleanup);
+  ScrStr *dn = scr_str_new("data", 4);
+  scr_emitter_release(scr_emitter_on((ScrEmitter *)s, dn,
+                                     scr_sc_closure((void *)&scr_sc_data, p, chunks),
+                                     scr_ee_inv_fixed2, false, false));
+  scr_str_release(dn);
+  /* resume() rather than the 'data' hook alone: Node's consumer pulls
+   * through the iterator, which drains a PAUSED stream too. */
+  scr_stream_release(scr_stream_resume(s));
+  scr_arr_release(chunks);
+  return p;
+}
+
+ScrPromise *scr_sc_text(ScrStream *s) { return scr_sc_consume(s, SCR_SC_TEXT); }
+ScrPromise *scr_sc_json(ScrStream *s) { return scr_sc_consume(s, SCR_SC_JSON); }
+ScrPromise *scr_sc_buffer(ScrStream *s) { return scr_sc_consume(s, SCR_SC_BUFFER); }
+
 /* ── the readable surface ─────────────────────────────────────────────── */
 
 bool scr_stream_push(ScrStream *s, ScrBytes *chunk) {
@@ -2200,13 +2360,41 @@ bool scr_stream_push(ScrStream *s, ScrBytes *chunk) {
 }
 
 bool scr_stream_push_str(ScrStream *s, ScrStr *str) {
-  ScrBytes *b = scr_bytes_new(SCR_BYTES_U8, (double)str->len);
-  memcpy(b->data, str->data, str->len);
+  ScrStr *enc = s->st->has_r ? s->st->r.push_enc : NULL;
+  ScrBytes *b;
+  if (enc != NULL) {
+    /* Node: Buffer.from(chunk, state.defaultEncoding). */
+    b = scr_bytes_from_str(str, enc);
+  } else {
+    b = scr_bytes_new(SCR_BYTES_U8, (double)str->len);
+    memcpy(b->data, str->data, str->len);
+  }
+  bool ret = scr_stream_add_chunk(s, b, false);
+  scr_bytes_release(b);
+  return ret;
+}
+
+/* push(chunk, encoding) with an explicit non-utf8 literal: the per-call
+ * encoding overrides the stream's default. Borrows both strings. */
+bool scr_stream_push_str_enc(ScrStream *s, ScrStr *str, ScrStr *enc) {
+  ScrBytes *b = scr_bytes_from_str(str, enc);
   bool ret = scr_stream_add_chunk(s, b, false);
   scr_bytes_release(b);
   return ret;
 }
 
+/* The defaultEncoding option's push side (canonical literal, frontend-
+ * folded; never "utf8" — that stays the NULL fast path). Answers the
+ * receiver +1, the setEncoding chaining shape. */
+ScrStream *scr_stream_set_push_encoding(ScrStream *s, ScrStr *enc) {
+  ScrStreamState *st = s->st;
+  if (st->has_r) {
+    if (st->r.push_enc) scr_str_release(st->r.push_enc);
+    st->r.push_enc = scr_str_retain(enc);
+  }
+  return scr_stream_retain(s);
+}
+
 bool scr_stream_push_null(ScrStream *s) {
   ScrStreamState *st = s->st;
   if (!st->has_r || st->destroyed) return false;
@@ -2891,6 +3079,25 @@ static void scr_stream_run_tick(ScrStreamTick *t) {
   }
 }
 
+static void scr_stream_dispatch(void);
+
+/* One tick-marker's dispatch: the queue's FIFO head (markers and entries
+ * are enqueued 1:1 in the same order). After an uncaught throw the
+ * remaining entries drop through the station's exc branch below, keeping
+ * the RC audit clean. */
+static void scr_stream_dispatch_one(void) {
+  ScrStreamTick *t = scr_st_head;
+  if (t == NULL || scr_exc_pending()) return;
+  scr_st_head = t->next;
+  if (scr_st_head == NULL) scr_st_tail = NULL;
+  scr_stream_run_tick(t);
+  scr_stream_release(t->s);
+  if (t->err) scr_error_release(t->err);
+  if (t->cb) scr_closure_release(t->cb);
+  free(t);
+  if (scr_exc_pending()) scr_stream_dispatch(); /* its exc branch drops the rest */
+}
+
 static void scr_stream_dispatch(void) {
   while (scr_st_head != NULL && !scr_exc_pending() && !scr_loop_has_ready()) {
     ScrStreamTick *t = scr_st_head;

package/src/scr_tls.c

@@ -73,6 +73,7 @@
 #include "scr_runtime.h"
 
 #include <errno.h>
+#include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -1102,6 +1103,121 @@ static const char *const SCR_TLS_SRV_FENCED_OPTIONS[] = {
   "sessionTimeout", "sigalgs", "ticketKeys", NULL,
 };
 
+/* ── the typed option-validation ladders (checked-dynamic lane) ────────
+ * Node's configSecureContext / Server-constructor argument contracts over
+ * every PRESENT validated key, run BEFORE the pem walk and its fences so
+ * Node's typed errors always come first (the invalid-input probes isolate
+ * one bad option per call, so the fixed order below matches each).
+ * false = exception pending. */
+static bool scr_tls_opts_validate(const ScrDyn *opts) {
+  if (opts == NULL || opts->kind != SCR_DYN_OBJ) return true;
+  static const char *const STR_OPTS[] = { "ciphers", "passphrase", "ecdhCurve", "sessionIdContext", NULL };
+  for (size_t i = 0; STR_OPTS[i] != NULL; i++) {
+    const ScrDyn *v = scr_dyn_obj_get(opts, STR_OPTS[i], strlen(STR_OPTS[i]));
+    if (v != NULL && v->kind != SCR_DYN_UNDEF && v->kind != SCR_DYN_NULL && v->kind != SCR_DYN_STR) {
+      char name[48];
+      snprintf(name, sizeof name, "options.%s", STR_OPTS[i]);
+      scr_dyn_prop_type_fail(name, "of type string", v);
+      return false;
+    }
+  }
+  static const char *const ENGINE_OPTS[] = { "clientCertEngine", "privateKeyEngine", "privateKeyIdentifier", NULL };
+  for (size_t i = 0; ENGINE_OPTS[i] != NULL; i++) {
+    const ScrDyn *v = scr_dyn_obj_get(opts, ENGINE_OPTS[i], strlen(ENGINE_OPTS[i]));
+    if (v != NULL && v->kind != SCR_DYN_UNDEF && v->kind != SCR_DYN_NULL && v->kind != SCR_DYN_STR) {
+      char name[48];
+      snprintf(name, sizeof name, "options.%s", ENGINE_OPTS[i]);
+      scr_dyn_prop_type_fail(name, "of type string or one of null or undefined", v);
+      return false;
+    }
+  }
+  static const char *const VERSION_OPTS[] = { "minVersion", "maxVersion", NULL };
+  for (size_t i = 0; VERSION_OPTS[i] != NULL; i++) {
+    const ScrDyn *v = scr_dyn_obj_get(opts, VERSION_OPTS[i], strlen(VERSION_OPTS[i]));
+    if (v == NULL || v->kind == SCR_DYN_UNDEF) continue;
+    bool valid = false;
+    if (v->kind == SCR_DYN_STR) {
+      static const char *const KNOWN[] = { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3", NULL };
+      for (size_t k = 0; KNOWN[k] != NULL; k++) {
+        if (v->v.str->len == strlen(KNOWN[k]) && memcmp(v->v.str->data, KNOWN[k], v->v.str->len) == 0) {
+          valid = true;
+          break;
+        }
+      }
+    }
+    if (!valid) {
+      /* %j: strings render JSON-quoted, everything else inspect-lite. */
+      char rendered[96];
+      if (v->kind == SCR_DYN_STR) {
+        snprintf(rendered, sizeof rendered, "\"%.*s\"",
+                 (int)(v->v.str->len < 80 ? v->v.str->len : 80), v->v.str->data);
+      } else {
+        /* %j over non-strings: JSON.stringify's scalar renderings. */
+        char lite[64];
+        snprintf(rendered, sizeof rendered, "%s", scr_dyn_inspect_lite(v, lite, sizeof lite));
+      }
+      char msg[192];
+      int len = snprintf(msg, sizeof msg, "%s is not a valid %s TLS protocol version",
+                         rendered, VERSION_OPTS[i][2] == 'n' ? "minimum" : "maximum");
+      scr_throw_error_msg_code(SCR_ERR_TYPE, msg, (size_t)len, "ERR_TLS_INVALID_PROTOCOL_VERSION");
+      return false;
+    }
+  }
+  static const char *const NUM_OPTS[] = { "handshakeTimeout", "keepAliveInitialDelay", NULL };
+  for (size_t i = 0; NUM_OPTS[i] != NULL; i++) {
+    const ScrDyn *v = scr_dyn_obj_get(opts, NUM_OPTS[i], strlen(NUM_OPTS[i]));
+    if (v != NULL && v->kind != SCR_DYN_UNDEF && v->kind != SCR_DYN_NULL && v->kind != SCR_DYN_NUM) {
+      char name[48];
+      snprintf(name, sizeof name, "options.%s", NUM_OPTS[i]);
+      scr_dyn_prop_type_fail(name, "of type number", v);
+      return false;
+    }
+  }
+  {
+    const ScrDyn *v = scr_dyn_obj_get(opts, "sessionTimeout", 14);
+    if (v != NULL && v->kind != SCR_DYN_UNDEF && v->kind != SCR_DYN_NULL) {
+      if (v->kind != SCR_DYN_NUM) {
+        scr_dyn_prop_type_fail("options.sessionTimeout", "of type number", v);
+        return false;
+      }
+      double n = v->v.num;
+      char recv[48], msg[192];
+      if (!(isfinite(n) && trunc(n) == n)) {
+        scr_num_received(n, recv);
+        int len = snprintf(msg, sizeof msg,
+                           "The value of \"options.sessionTimeout\" is out of range. It must be an integer. Received %s", recv);
+        scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+        return false;
+      }
+      if (n < 0 || n > 2147483647.0) {
+        scr_num_received(n, recv);
+        int len = snprintf(msg, sizeof msg,
+                           "The value of \"options.sessionTimeout\" is out of range. It must be >= 0 && <= 2147483647. Received %s", recv);
+        scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+        return false;
+      }
+    }
+  }
+  {
+    const ScrDyn *v = scr_dyn_obj_get(opts, "ticketKeys", 10);
+    if (v != NULL && v->kind != SCR_DYN_UNDEF && v->kind != SCR_DYN_NULL) {
+      if (v->kind != SCR_DYN_BYTES) {
+        scr_dyn_prop_type_fail("options.ticketKeys", "an instance of Buffer, TypedArray, or DataView", v);
+        return false;
+      }
+      double bytelen = scr_bytes_byte_len(v->v.bytes);
+      if (bytelen != 48) {
+        char msg[160];
+        int len = snprintf(msg, sizeof msg,
+                           "The property 'options.ticketKeys' must be exactly 48 bytes. Received %.0f", bytelen);
+        scr_throw_error_msg_code(SCR_ERR_TYPE, msg, (size_t)len, "ERR_INVALID_ARG_VALUE");
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
 /* The server-options walk. Fills the cert/key out-params (+1 each) from a
  * DOM options record; false = exception pending (partial results released). */
 static bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes **cert_out,
@@ -1112,6 +1228,7 @@ static bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes
     scr_dyn_arg_type_fail("options", "of type object", opts ? opts : scr_dyn_undefined());
     return false;
   }
+  if (!scr_tls_opts_validate(opts)) return false; /* Node's typed errors first */
   bool ok = true;
   for (size_t i = 0; ok && i < opts->v.obj.len; i++) {
     const ScrDynEntry *e = &opts->v.obj.entries[i];
@@ -1176,6 +1293,45 @@ static bool scr_tls_srv_opts_walk(const ScrDyn *opts, const char *api, ScrBytes
   return ok;
 }
 
+/* createSecureContext over a RUNTIME options record: Node's typed
+ * validations first (scr_tls_opts_validate), then the pem walk — a bag
+ * that validates AND carries both cert and key builds the real context;
+ * everything else met its ladder error or the walk's per-key fence.
+ * +1, or NULL with the exception pending. */
+ScrSecureCtx *scr_tls_create_secure_context_dyn(const ScrDyn *opts /*borrowed*/) {
+  ScrBytes *cert, *key;
+  if (!scr_tls_srv_opts_walk(opts, "tls.createSecureContext", &cert, &key)) return NULL;
+  ScrSecureCtx *c = scr_tls_create_secure_context((const char *)cert->data, cert->len,
+                                                   (const char *)key->data, key->len);
+  scr_bytes_release(cert);
+  scr_bytes_release(key);
+  return c;
+}
+
+/* tls.getCACertificates(type): validateString, then the documented name
+ * set — an unknown name answers ERR_INVALID_ARG_VALUE; the real CA list
+ * has no lowering, so a valid name meets the fence. Always throws. */
+void scr_tls_ca_certs_chk(const ScrDyn *type, const ScrStr *fence) {
+  if (type->kind != SCR_DYN_STR) {
+    scr_dyn_arg_type_fail("type", "of type string", type);
+    return;
+  }
+  static const char *const KNOWN[] = { "default", "system", "bundled", "extra", NULL };
+  bool valid = false;
+  for (size_t i = 0; KNOWN[i] != NULL; i++) {
+    if (type->v.str->len == strlen(KNOWN[i]) &&
+        memcmp(type->v.str->data, KNOWN[i], type->v.str->len) == 0) {
+      valid = true;
+      break;
+    }
+  }
+  if (!valid) {
+    scr_dyn_arg_value_fail("type", NULL, type);
+    return;
+  }
+  scr_throw_lowering_fence(fence);
+}
+
 ScrNetServer *scr_tls_create_server_dyn(const ScrDyn *opts /*borrowed*/,
                                          ScrClosure *handler /*moves, nullable*/,
                                          ScrNetConnFn fn) {
@@ -1241,6 +1397,22 @@ ScrNetSocket *scr_tls_connect_dyn(double port, ScrStr *host /*borrowed, nullable
     for (size_t i = 0; ok && i < opts->v.obj.len; i++) {
       const ScrDynEntry *e = &opts->v.obj.entries[i];
       const ScrDyn *v = e->value;
+      if (strcmp(e->key, "checkServerIdentity") == 0) {
+        /* Node spreads user options over the defaults, so a PRESENT key
+         * replaces the builtin verifier even when its value is undefined
+         * — validateFunction then throws for anything non-callable. A
+         * real function keeps the fence (custom verification has no
+         * lowering). */
+        if (v->kind != SCR_DYN_FUNC) {
+          scr_dyn_prop_type_fail("options.checkServerIdentity", "of type function", v);
+          ok = false;
+        } else {
+          scr_tls_opt_fence("tls.connect", "checkServerIdentity",
+                            "custom identity verification has no lowering — the runtime verifies against the servername/host");
+          ok = false;
+        }
+        continue;
+      }
       if (v->kind == SCR_DYN_UNDEF) continue;
       if (strcmp(e->key, "port") == 0) {
         if (port >= 0) continue; /* the argument form wins, like Node */