@wix/himalaya-cli 0.1579.0 → 0.1580.0

package/dist/quickjs-web-globals.js

@@ -0,0 +1,540 @@
+// ../../core/dev-server/src/quickjs-web-globals.ts
+var WEB_GLOBALS_SHIM = `
+(function () {
+  var P = globalThis.__himiParseUrl, S = globalThis.__himiSetUrlPart;
+  var DI = globalThis.__himiDecoderInfo, DD = globalThis.__himiDecodeBytes;
+  var QD = globalThis.__himiQueryDecode, QE = globalThis.__himiQueryEncode;
+  delete globalThis.__himiParseUrl; delete globalThis.__himiSetUrlPart;
+  delete globalThis.__himiDecoderInfo; delete globalThis.__himiDecodeBytes;
+  delete globalThis.__himiQueryDecode; delete globalThis.__himiQueryEncode;
+
+  // CAPTURED BEFORE ANY BUNDLE RUNS, the same rule the Intl shim follows. This is not hygiene for
+  // its own sake: the URL parser is a HOST hook, and its answer comes back as a JSON string that
+  // this code parses. A bundle that replaced JSON.parse could therefore forge the parsed result of
+  // a URL it did not pass \u2014 turning a host-side, correct-by-construction parser into one the guest
+  // steers. Everything the wrappers touch on a hot path is captured for the same reason.
+  var $TypeError = TypeError, $String = String, $Array = Array, $Object = Object;
+  var $parse = JSON.parse, $stringify = JSON.stringify;
+  var $encodeURIComponent = encodeURIComponent, $decodeURIComponent = decodeURIComponent;
+  var $defineProperty = Object.defineProperty, $hasOwn = Object.prototype.hasOwnProperty;
+  var $fromCharCode = String.fromCharCode, $Uint8Array = Uint8Array, $Error = Error;
+  var $Symbol = Symbol, $RangeError = RangeError;
+  var $ArrayBuffer = ArrayBuffer, $isView = ArrayBuffer.isView;
+
+  // \u2500\u2500 URLSearchParams \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // application/x-www-form-urlencoded, which is NOT encodeURIComponent: space is "+", and
+  // !'()~ are escaped where encodeURIComponent leaves them. Getting that subset wrong is
+  // invisible until a signature or a filter value stops matching on the server.
+  // PARSE AND SERIALIZE IN THE HOST. The hand-written pair was wrong twice: the escape set is not
+  // encodeURIComponent's (space is "+", and !'()~ differ), and decoding is not decodeURIComponent
+  // either \u2014 the host uses FORGIVING percent/UTF-8 decoding, so "q=a%20%E0%A4%A" keeps the decoded
+  // space and inserts replacement characters, where a try/catch around decodeURIComponent returned
+  // the whole raw component instead. Query strings are built from server and user URLs, so a
+  // component that silently differs is a request sent somewhere else.
+  var parseQuery = function (str) { return $parse(QD($String(str))); };
+  var serializeQuery = function (pairs) {
+    var body = "[";
+    for (var i = 0; i < pairs.length; i++) {
+      body += (i ? "," : "") + $stringify(pairs[i][0]) + "," + $stringify(pairs[i][1]);
+    }
+    return QE(body + "]");
+  };
+
+  // The host requires each sequence member to have EXACTLY two elements and throws otherwise; a
+  // silently-accepted 1- or 3-element entry would build a different query.
+  var pair = function (entry) {
+    if (entry === null || entry === undefined || typeof entry === "string") {
+      throw new $TypeError("Failed to construct URLSearchParams: the provided value cannot be converted to a sequence");
+    }
+    var len = entry.length;
+    if (entry[$Symbol.iterator] !== undefined && !$Array.isArray(entry)) {
+      var out = [], i2 = it2(entry);
+      for (var v2 = i2.next(); !v2.done; v2 = i2.next()) out.push(v2.value);
+      entry = out; len = out.length;
+    }
+    if (len !== 2) {
+      throw new $TypeError("Failed to construct URLSearchParams: each entry must have exactly two elements");
+    }
+    return [$String(entry[0]), $String(entry[1])];
+  };
+  var it2 = function (o) { return o[$Symbol.iterator](); };
+
+  function USP(init) {
+    if (!(this instanceof USP)) throw new $TypeError("Constructor URLSearchParams requires 'new'");
+    var pairs = [];
+    if (init !== undefined && init !== null) {
+      if (typeof init === "string") {
+        var parsed = parseQuery(init);
+        for (var i = 0; i < parsed.length; i++) pairs.push([parsed[i][0], parsed[i][1]]);
+      } else if (init instanceof USP) {
+        for (var j = 0; j < init._p.length; j++) pairs.push([init._p[j][0], init._p[j][1]]);
+      } else if ($Array.isArray(init)) {
+        for (var k = 0; k < init.length; k++) pairs.push(pair(init[k]));
+      } else if (typeof init === "object" && init[$Symbol.iterator] !== undefined) {
+        // ITERABLES BEFORE THE RECORD FALLBACK. Treating every non-array object as a record meant
+        // 'new URLSearchParams(new Map([["q","a b"]]))' produced an EMPTY query where the host
+        // gives q=a+b, because a Map has no own enumerable keys. Generated SDK clients build
+        // params from Maps and entries iterables, so this dropped request parameters in the
+        // contained realm only.
+        var it = init[$Symbol.iterator](), step;
+        while (!(step = it.next()).done) pairs.push(pair(step.value));
+      } else if (typeof init === "object") {
+        for (var key in init) if ($hasOwn.call(init, key)) pairs.push([key, $String(init[key])]);
+      }
+    }
+    this._p = pairs;
+    this._owner = null;   // set when this belongs to a URL, so mutations write back to it
+  }
+  var sync = function (self) { if (self._owner) self._owner._sync(); };
+  USP.prototype.append = function (n, v) { this._p.push([$String(n), $String(v)]); sync(this); };
+  USP.prototype.set = function (n, v) {
+    n = $String(n); v = $String(v);
+    var done = false, out = [];
+    for (var i = 0; i < this._p.length; i++) {
+      if (this._p[i][0] !== n) { out.push(this._p[i]); continue; }
+      if (!done) { out.push([n, v]); done = true; }
+    }
+    if (!done) out.push([n, v]);
+    this._p = out; sync(this);
+  };
+  USP.prototype.get = function (n) {
+    n = $String(n);
+    for (var i = 0; i < this._p.length; i++) if (this._p[i][0] === n) return this._p[i][1];
+    return null;
+  };
+  USP.prototype.getAll = function (n) {
+    n = $String(n); var out = [];
+    for (var i = 0; i < this._p.length; i++) if (this._p[i][0] === n) out.push(this._p[i][1]);
+    return out;
+  };
+  // AN EXPLICIT 'undefined' COUNTS AS OMITTED, deliberately \u2014 review asked for the opposite and
+  // MEASUREMENT DISAGREED. WebIDL treats an optional argument passed as 'undefined' as not
+  // present, and node implements that:
+  //
+  //   new URLSearchParams("a=1").has("a", undefined)          node true
+  //   new URLSearchParams("a=1&a=2").delete("a", undefined)   node removes BOTH
+  //
+  // Keying on arguments.length alone \u2014 the change review asked for \u2014 made both diverge (false,
+  // and neither removed), so the finding is REJECTED rather than applied. Recorded here because
+  // the next reader will reasonably wonder, and because the only reason this was caught is that
+  // the probe compares against node rather than against a description of node.
+  USP.prototype.has = function (n, v) {
+    n = $String(n);
+    var wantValue = arguments.length > 1 && v !== undefined;
+    var want = wantValue ? $String(v) : "";
+    for (var i = 0; i < this._p.length; i++) {
+      if (this._p[i][0] !== n) continue;
+      if (!wantValue || this._p[i][1] === want) return true;
+    }
+    return false;
+  };
+  // Same rule as has(), and the same rejected finding: an explicit 'undefined' is omitted.
+  USP.prototype["delete"] = function (n, v) {
+    n = $String(n);
+    var wantValue = arguments.length > 1 && v !== undefined;
+    var want = wantValue ? $String(v) : "";
+    var out = [];
+    for (var i = 0; i < this._p.length; i++) {
+      var keep = this._p[i][0] !== n || (wantValue && this._p[i][1] !== want);
+      if (keep) out.push(this._p[i]);
+    }
+    this._p = out; sync(this);
+  };
+  USP.prototype.forEach = function (fn, thisArg) {
+    for (var i = 0; i < this._p.length; i++) fn.call(thisArg, this._p[i][1], this._p[i][0], this);
+  };
+  USP.prototype.keys = function () { return this._p.map(function (x) { return x[0]; })[Symbol.iterator](); };
+  USP.prototype.values = function () { return this._p.map(function (x) { return x[1]; })[Symbol.iterator](); };
+  USP.prototype.entries = function () { return this._p.map(function (x) { return [x[0], x[1]]; })[Symbol.iterator](); };
+  USP.prototype[Symbol.iterator] = USP.prototype.entries;
+  USP.prototype.sort = function () {
+    this._p.sort(function (a, b) { return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0; }); sync(this);
+  };
+  USP.prototype.toString = function () { return serializeQuery(this._p); };
+  $defineProperty(USP.prototype, "size", { get: function () { return this._p.length; }, configurable: true });
+
+  // \u2500\u2500 URL \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // Parsed by the HOST, then held here. Every setter re-parses through the host too, so a
+  // mutation cannot drift from what node would have produced for the same href.
+  function URLCtor(url, base) {
+    if (!(this instanceof URLCtor)) throw new $TypeError("Constructor URL requires 'new'");
+    // Created ONCE, before the first load, so every later load and setter refills this same
+    // object rather than replacing it.
+    this._sp = new USP("");
+    this._sp._owner = this;
+    this._load(P($String(url), base === undefined || base === null ? "" : $String(base)));
+  }
+  // ONE URLSearchParams per URL, for the URL's whole lifetime. Its pair list is rewritten in
+  // place; the object identity never changes, which is the contract node keeps.
+  var adoptQuery = function (url, search) {
+    var pairs = parseQuery(search);
+    var out = [];
+    for (var i = 0; i < pairs.length; i++) out.push([pairs[i][0], pairs[i][1]]);
+    // Assigned directly rather than through append(), so refilling does not call back into
+    // _sync() and rebuild the URL we are in the middle of loading.
+    url._sp._p = out;
+  };
+  URLCtor.prototype._load = function (json) {
+    var p = $parse(json);
+    if (p.error) throw new $TypeError(p.error);
+    this._c = p;
+    adoptQuery(this, p.search);
+  };
+  // Keep the query string and the live URLSearchParams in agreement in BOTH directions: node's
+  // URL does, and a bundle that appends a param and then reads .href would otherwise silently
+  // send the un-appended URL.
+  URLCtor.prototype._sync = function () {
+    // Through the host setter as well: the search component has its own normalisation, and the
+    // concatenated rebuild this replaced could not express a non-special scheme at all.
+    var q = this._sp.toString();
+    var p = $parse(S(this._c.href, "search", q));
+    if (!p.error) this._c = p;
+  };
+  // Assign through the HOST. Rebuilding an href by concatenation was wrong in every direction:
+  // it skipped normalisation and, worse, produced a different URL entirely \u2014 see the note on
+  // __himiSetUrlPart. Non-special schemes were broken too, since a mailto: has no "//" to splice.
+  URLCtor.prototype._set = function (part, value) {
+    var p = $parse(S(this._c.href, part, $String(value)));
+    if (p.error) throw new $TypeError(p.error);
+    this._c = p;
+    adoptQuery(this, p.search);
+  };
+  var plain = ["protocol", "username", "password", "host", "hostname", "port", "pathname", "hash", "href"];
+  for (var pi = 0; pi < plain.length; pi++) {
+    (function (name) {
+      $defineProperty(URLCtor.prototype, name, {
+        configurable: true,
+        get: function () { return this._c[name]; },
+        set: function (v) {
+          if (name === "href") { this._load(P($String(v), "")); return; }
+          this._set(name, v);
+        },
+      });
+    })(plain[pi]);
+  }
+  $defineProperty(URLCtor.prototype, "origin", { configurable: true, get: function () { return this._c.origin; } });
+  $defineProperty(URLCtor.prototype, "searchParams", { configurable: true, get: function () { return this._sp; } });
+  $defineProperty(URLCtor.prototype, "search", {
+    configurable: true,
+    get: function () { return this._c.search; },
+    set: function (v) { this._set("search", v); },
+  });
+  URLCtor.prototype.toString = function () { return this._c.href; };
+  URLCtor.prototype.toJSON = function () { return this._c.href; };
+
+  // \u2500\u2500 TextEncoder / TextDecoder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // UTF-8 only, which is all either class supports for encoding anyway. Surrogate pairs are
+  // combined and a LONE surrogate becomes U+FFFD, exactly as the host does \u2014 a naive
+  // charCodeAt loop instead emits invalid bytes for any emoji.
+  // One place that turns any BufferSource into a byte view, honouring a view's own range.
+  // The host accepts only an ArrayBuffer or an ArrayBufferView. The old fallback coerced anything
+  // \u2014 'decode([0x41])' and 'decode({})' returned a string here and THROW under node:vm \u2014 so
+  // worker code that relies on a decode failure diverged silently.
+  var viewOf = function (input) {
+    if (input instanceof $Uint8Array) return input;
+    if ($isView(input)) {
+      return new $Uint8Array(input.buffer, input.byteOffset || 0, input.byteLength);
+    }
+    if (input instanceof $ArrayBuffer) return new $Uint8Array(input);
+    throw new $TypeError(
+      "Failed to execute 'decode' on 'TextDecoder': The provided value is not of type '(ArrayBuffer or ArrayBufferView)'",
+    );
+  };
+  var stringifyArr = function (a) {
+    var out = "[";
+    for (var i = 0; i < a.length; i++) out += (i ? "," : "") + a[i];
+    return out + "]";
+  };
+
+  function TextEncoderCtor() {}
+  // encodeInto, which node has and this did not \u2014 a bundle calling it worked in the host sandbox
+  // and threw here, diverging before any transport call.
+  //
+  // Written out rather than delegated because the destination is a GUEST buffer: the host cannot
+  // write into it, so only the byte computation could cross and that is the whole of the work.
+  // The one rule that makes it more than a loop: a code point is never SPLIT \u2014 if its bytes do
+  // not all fit, nothing of it is written and 'read' stops before it.
+  TextEncoderCtor.prototype.encodeInto = function (source, dest) {
+    var s2 = source === undefined ? "" : $String(source);
+    if (!(dest instanceof $Uint8Array)) {
+      throw new $TypeError(
+        "Failed to execute 'encodeInto' on 'TextEncoder': parameter 2 is not of type 'Uint8Array'",
+      );
+    }
+    var read = 0, written = 0, cap = dest.length;
+    for (var i = 0; i < s2.length; ) {
+      var c = s2.charCodeAt(i), units = 1;
+      if (c >= 0xd800 && c <= 0xdbff && i + 1 < s2.length) {
+        var d = s2.charCodeAt(i + 1);
+        if (d >= 0xdc00 && d <= 0xdfff) { c = 0x10000 + ((c - 0xd800) << 10) + (d - 0xdc00); units = 2; }
+      }
+      if (c >= 0xd800 && c <= 0xdfff) c = 0xfffd;   // lone surrogate, as encode() does
+      var need = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0x10000 ? 3 : 4;
+      if (written + need > cap) break;              // never a partial code point
+      if (need === 1) dest[written] = c;
+      else if (need === 2) { dest[written] = 0xc0 | (c >> 6); dest[written + 1] = 0x80 | (c & 63); }
+      else if (need === 3) {
+        dest[written] = 0xe0 | (c >> 12);
+        dest[written + 1] = 0x80 | ((c >> 6) & 63);
+        dest[written + 2] = 0x80 | (c & 63);
+      } else {
+        dest[written] = 0xf0 | (c >> 18);
+        dest[written + 1] = 0x80 | ((c >> 12) & 63);
+        dest[written + 2] = 0x80 | ((c >> 6) & 63);
+        dest[written + 3] = 0x80 | (c & 63);
+      }
+      written += need;
+      read += units;
+      i += units;
+    }
+    return { read: read, written: written };
+  };
+  TextEncoderCtor.prototype.encode = function (input) {
+    var s = input === undefined ? "" : $String(input);
+    var bytes = [];
+    for (var i = 0; i < s.length; i++) {
+      var c = s.charCodeAt(i);
+      if (c >= 0xd800 && c <= 0xdbff && i + 1 < s.length) {
+        var d = s.charCodeAt(i + 1);
+        if (d >= 0xdc00 && d <= 0xdfff) { c = 0x10000 + ((c - 0xd800) << 10) + (d - 0xdc00); i++; }
+      }
+      if (c >= 0xd800 && c <= 0xdfff) c = 0xfffd;    // lone surrogate
+      if (c < 0x80) bytes.push(c);
+      else if (c < 0x800) bytes.push(0xc0 | (c >> 6), 0x80 | (c & 63));
+      else if (c < 0x10000) bytes.push(0xe0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+      else bytes.push(0xf0 | (c >> 18), 0x80 | ((c >> 12) & 63), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));
+    }
+    return new $Uint8Array(bytes);
+  };
+  // LABEL AND OPTIONS ARE PART OF THE CONTRACT. Hard-coding utf-8 non-fatal diverged from the host
+  // twice over: 'new TextDecoder("utf-16le").decode([0x41,0x00])' gives "A" there and "A\0"
+  // here, and '{ fatal: true }' must THROW on malformed input rather than emit U+FFFD.
+  //
+  // The split is deliberate. utf-8 \u2014 every real worker's case, and the one whose 13 malformed
+  // shapes are already verified byte-for-byte against node \u2014 decodes LOCALLY, with 'fatal' handled
+  // by throwing instead of substituting. Any other encoding DELEGATES to the host, because
+  // implementing the Encoding Standard's legacy label set here would be a large near-miss, and a
+  // near-miss is what this shim exists to avoid. An unknown label throws at CONSTRUCTION, as the
+  // host does, via the same hook.
+  var decoderSeq = 0;
+  function TextDecoderCtor(label, options) {
+    var info = $parse(DI(label === undefined ? "utf-8" : $String(label)));
+    if (info.error) throw new $RangeError(info.error);
+    // Internal slots with readonly accessors below. As own writable properties, guest code could
+    // do 'd.encoding = "utf-16le"' before the first decode and the host decoder would then be
+    // created with the mutated value, where node keeps decoding as utf-8 and ignores the write.
+    this._encoding = info.encoding;
+    this._fatal = !!(options && options.fatal);
+    this._ignoreBOM = !!(options && options.ignoreBOM);
+    // A DECODER IS STATEFUL. 'decode(bytes, { stream: true })' must buffer an incomplete trailing
+    // sequence and emit nothing for it, so the next call completes it \u2014 a host decoder returns ""
+    // for [0xE2] and then the euro sign for [0x82,0xAC]. Emitting a replacement per call instead
+    // corrupts every chunked response body, which is how a worker reads a large one.
+    this._pending = [];
+    this._bomSeen = false;
+    // Non-utf-8 delegates, so its state has to live where its decoder does: the host keeps one
+    // real TextDecoder per id and this is the handle to it.
+    this._id = ++decoderSeq;
+  }
+  // MALFORMED INPUT MUST BECOME U+FFFD, not a guess. The first cut accepted any non-ASCII lead
+  // byte and blindly consumed continuations, so a lone 0x80 \u2014 which the host decodes to "\uFFFD"
+  // with the default non-fatal decoder \u2014 produced a NUL here. Server bytes are exactly where
+  // truncated or invalid UTF-8 shows up, and a decoder that silently invents a different string
+  // from the same bytes is the divergence class this shim exists to remove.
+  //
+  // Implements WHATWG's non-fatal UTF-8 decode: range-check the lead byte, validate each
+  // continuation, reject overlong encodings, surrogates and values above U+10FFFF, and emit one
+  // replacement character per maximal subpart while RE-EXAMINING the byte that broke the sequence.
+  // ALWAYS DELEGATED, including utf-8.
+  //
+  // A local fast path existed for utf-8 and produced four separate findings on its own: malformed
+  // sequences, label and options handling, streaming state, and BOM stripping \u2014 each fixed only
+  // after review named it. Every one came from the same reasoning ("no worker does that"), which
+  // was wrong every time. Measured before deleting it: delegation costs ~1.6x on a 512KB body
+  // (128ms -> 202ms) and nothing measurable under 16KB, at author time. That is a fair price for a
+  // decoder whose behaviour is the host's by construction rather than by my recollection of the
+  // Encoding Standard.
+  //
+  // A no-input 'decode()' is NOT a no-op: it is the final flush of a stream, so it must reach the
+  // host too. Returning early left pending bytes undelivered and _bomSeen latched, where node
+  // emits the replacement for the truncated sequence and resets.
+  TextDecoderCtor.prototype.decode = function (input, options) {
+    var stream = !!(options && options.stream);
+    // ONLY 'undefined' is an omitted input. 'decode(null)' throws TypeError on the host, and
+    // treating it as a zero-byte flush turned a decode failure into a successful path here \u2014
+    // the same invalid-input gap as the plain-array case, one value over.
+    var arr = [];
+    if (input !== undefined) {
+      var view = viewOf(input);
+      for (var vi = 0; vi < view.length; vi++) arr.push(view[vi]);
+    }
+    var res = $parse(DD($String(this._id), this._encoding, this._fatal ? "1" : "",
+                        this._ignoreBOM ? "1" : "", stream ? "1" : "", stringifyArr(arr)));
+    if (res.error) throw new $TypeError(res.error);
+    return res.v;
+  };
+
+  // \u2500\u2500 AbortController \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // A flag plus listeners. No DOM event machinery: what a worker actually uses is .signal,
+  // .aborted, .abort(), addEventListener("abort") and throwIfAborted.
+  // Getter-only, so a write is ignored in sloppy mode and throws in strict \u2014 which is what the
+  // host's readonly accessors do.
+  // Readonly, as node's is. It was a writable data property, so 'e.encoding = "x"' reported "x"
+  // here and "utf-8" there \u2014 the same defect already fixed on TextDecoder, missed on its sibling.
+  $defineProperty(TextEncoderCtor.prototype, "encoding", {
+    configurable: true, get: function () { return "utf-8"; },
+  });
+
+  $defineProperty(TextDecoderCtor.prototype, "encoding", {
+    configurable: true, get: function () { return this._encoding; },
+  });
+  $defineProperty(TextDecoderCtor.prototype, "fatal", {
+    configurable: true, get: function () { return this._fatal; },
+  });
+  $defineProperty(TextDecoderCtor.prototype, "ignoreBOM", {
+    configurable: true, get: function () { return this._ignoreBOM; },
+  });
+
+  function AbortSignalCtor() { this.aborted = false; this.reason = undefined; this._l = []; this.onabort = null; }
+  AbortSignalCtor.prototype.addEventListener = function (type, fn) { if (type === "abort" && fn) this._l.push(fn); };
+  AbortSignalCtor.prototype.removeEventListener = function (type, fn) {
+    if (type !== "abort") return;
+    var out = []; for (var i = 0; i < this._l.length; i++) if (this._l[i] !== fn) out.push(this._l[i]);
+    this._l = out;
+  };
+  AbortSignalCtor.prototype.throwIfAborted = function () { if (this.aborted) throw this.reason; };
+  function AbortControllerCtor() { this.signal = new AbortSignalCtor(); }
+  AbortControllerCtor.prototype.abort = function (reason) {
+    var s = this.signal;
+    if (s.aborted) return;
+    s.aborted = true;
+    // The host's default reason is an AbortError DOMException; there is no DOMException here, so
+    // an Error carrying the same name is the closest honest stand-in and is what code checking
+    // err.name === "AbortError" expects.
+    if (reason === undefined) { var e = new $Error("This operation was aborted"); e.name = "AbortError"; s.reason = e; }
+    else s.reason = reason;
+    var ev = { type: "abort", target: s };
+    if (typeof s.onabort === "function") s.onabort(ev);
+    for (var i = 0; i < s._l.length; i++) s._l[i](ev);
+  };
+
+  globalThis.URLSearchParams = USP;
+  globalThis.URL = URLCtor;
+  globalThis.TextEncoder = TextEncoderCtor;
+  globalThis.TextDecoder = TextDecoderCtor;
+  globalThis.AbortController = AbortControllerCtor;
+  globalThis.AbortSignal = AbortSignalCtor;
+})();
+`;
+function urlComponents(u) {
+  return {
+    href: u.href,
+    origin: u.origin,
+    protocol: u.protocol,
+    username: u.username,
+    password: u.password,
+    host: u.host,
+    hostname: u.hostname,
+    port: u.port,
+    pathname: u.pathname,
+    search: u.search,
+    hash: u.hash
+  };
+}
+function installWebGlobals(ctx) {
+  const setPart = ctx.newFunction("__himiSetUrlPart", (hrefH, partH, valueH) => {
+    const href = ctx.getString(hrefH);
+    const part = ctx.getString(partH);
+    const value = ctx.getString(valueH);
+    try {
+      const u = new URL(href);
+      u[part] = value;
+      return ctx.newString(JSON.stringify(urlComponents(u)));
+    } catch (err) {
+      return ctx.newString(JSON.stringify({ error: err?.message ?? "Invalid URL" }));
+    }
+  });
+  ctx.setProp(ctx.global, "__himiSetUrlPart", setPart);
+  setPart.dispose();
+  const decoderInfo = ctx.newFunction("__himiDecoderInfo", (labelH) => {
+    const label = ctx.getString(labelH);
+    try {
+      const d = new TextDecoder(label);
+      return ctx.newString(JSON.stringify({ encoding: d.encoding }));
+    } catch (err) {
+      return ctx.newString(JSON.stringify({ error: err?.message ?? `Invalid label: ${label}` }));
+    }
+  });
+  ctx.setProp(ctx.global, "__himiDecoderInfo", decoderInfo);
+  decoderInfo.dispose();
+  const decoders = /* @__PURE__ */ new Map();
+  const MAX_DECODERS = 256;
+  const decodeBytes = ctx.newFunction(
+    "__himiDecodeBytes",
+    (idH, encH, fatalH, bomH, streamH, bytesH) => {
+      try {
+        const id = ctx.getString(idH);
+        const encoding = ctx.getString(encH);
+        const fatal = ctx.getString(fatalH) === "1";
+        const ignoreBOM = ctx.getString(bomH) === "1";
+        const stream = ctx.getString(streamH) === "1";
+        const bytes = JSON.parse(ctx.getString(bytesH));
+        let dec = decoders.get(id);
+        if (!dec) {
+          if (decoders.size >= MAX_DECODERS) {
+            return ctx.newString(JSON.stringify({ error: `too many TextDecoder instances (cap ${MAX_DECODERS})` }));
+          }
+          dec = new TextDecoder(encoding, { fatal, ignoreBOM });
+          decoders.set(id, dec);
+        }
+        const v = dec.decode(new Uint8Array(bytes), { stream });
+        if (!stream) decoders.delete(id);
+        return ctx.newString(JSON.stringify({ v }));
+      } catch (err) {
+        return ctx.newString(JSON.stringify({ error: err?.message ?? "decode failed" }));
+      }
+    }
+  );
+  ctx.setProp(ctx.global, "__himiDecodeBytes", decodeBytes);
+  decodeBytes.dispose();
+  const queryDecode = ctx.newFunction("__himiQueryDecode", (strH) => {
+    const usp = new URLSearchParams(ctx.getString(strH));
+    return ctx.newString(JSON.stringify([...usp.entries()]));
+  });
+  ctx.setProp(ctx.global, "__himiQueryDecode", queryDecode);
+  queryDecode.dispose();
+  const queryEncode = ctx.newFunction("__himiQueryEncode", (pairsH) => {
+    const flat = JSON.parse(ctx.getString(pairsH));
+    const usp = new URLSearchParams();
+    for (let i = 0; i + 1 < flat.length; i += 2) usp.append(String(flat[i]), String(flat[i + 1]));
+    return ctx.newString(usp.toString());
+  });
+  ctx.setProp(ctx.global, "__himiQueryEncode", queryEncode);
+  queryEncode.dispose();
+  const parse = ctx.newFunction("__himiParseUrl", (hrefH, baseH) => {
+    const href = ctx.getString(hrefH);
+    const base = ctx.getString(baseH);
+    try {
+      const u = base ? new URL(href, base) : new URL(href);
+      return ctx.newString(JSON.stringify(urlComponents(u)));
+    } catch (err) {
+      return ctx.newString(JSON.stringify({ error: err?.message ?? "Invalid URL" }));
+    }
+  });
+  ctx.setProp(ctx.global, "__himiParseUrl", parse);
+  parse.dispose();
+  const res = ctx.evalCode(WEB_GLOBALS_SHIM, "himi-web-globals.js");
+  if (res.error) {
+    const detail = ctx.dump(res.error);
+    res.error.dispose();
+    throw new Error(`web globals shim failed: ${String(detail?.message ?? detail)}`);
+  }
+  res.value.dispose();
+}
+export {
+  installWebGlobals
+};