quickwin 1.3.0 → 2.1.0

package/test/test_helper.js

@@ -1,6 +1,7 @@
 import * as std from 'std';
 const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
+const YELLOW = '\x1b[33m';
 const BOLD = '\x1b[1m';
 const RESET = '\x1b[0m';
 function formatDuration(ms) {
@@ -35,6 +36,7 @@ export function readWasmFile(path) {
 export class Tester {
     ok = 0;
     fail = 0;
+    skip = 0;
     startTime = Date.now();
     sectionStart = this.startTime;
     lastSection = '';
@@ -71,6 +73,10 @@ export class Tester {
     checkTrue(name, actual) {
         this.check(name, true, actual);
     }
+    skipCase(name) {
+        this.skip++;
+        std.printf('  %sSKIP:%s %s\n', YELLOW, RESET, name);
+    }
     summary() {
         const now = Date.now();
         if (this.lastSection) {
@@ -79,6 +85,7 @@ export class Tester {
         }
         const total = now - this.startTime;
         const color = this.fail > 0 ? RED : GREEN;
-        std.printf('\n%s%d/%d passed (%s)%s\n', color, this.ok, this.ok + this.fail, formatDuration(total), RESET);
+        const skipped = this.skip > 0 ? ` (${this.skip} skipped)` : '';
+        std.printf('\n%s%d/%d passed%s (%s)%s\n', color, this.ok, this.ok + this.fail, skipped, formatDuration(total), RESET);
     }
 }

package/test/test_helper.ts

@@ -2,6 +2,7 @@ import * as std from 'std'
 
 const GREEN = '\x1b[32m'
 const RED   = '\x1b[31m'
+const YELLOW = '\x1b[33m'
 const BOLD  = '\x1b[1m'
 const RESET = '\x1b[0m'
 
@@ -34,6 +35,7 @@ export function readWasmFile(path: string): ArrayBuffer | null {
 export class Tester {
     ok = 0
     fail = 0
+    skip = 0
     private startTime = Date.now()
     private sectionStart = this.startTime
     private lastSection = ''
@@ -67,6 +69,11 @@ export class Tester {
         this.check(name, true, actual)
     }
 
+    skipCase(name: string): void {
+        this.skip++
+        std.printf('  %sSKIP:%s %s\n', YELLOW, RESET, name)
+    }
+
     summary(): void {
         const now = Date.now()
         if (this.lastSection) {
@@ -75,6 +82,7 @@ export class Tester {
         }
         const total = now - this.startTime
         const color = this.fail > 0 ? RED : GREEN
-        std.printf('\n%s%d/%d passed (%s)%s\n', color, this.ok, this.ok + this.fail, formatDuration(total), RESET)
+        const skipped = this.skip > 0 ? ` (${this.skip} skipped)` : ''
+        std.printf('\n%s%d/%d passed%s (%s)%s\n', color, this.ok, this.ok + this.fail, skipped, formatDuration(total), RESET)
     }
 }

package/test/test_http_import.js

@@ -60,6 +60,24 @@ export const suite = {
             return;
         assert('cache has body files', after.some(function (f) { return f.endsWith('.body'); }));
         assert('cache has meta files', after.some(function (f) { return f.endsWith('.meta'); }));
+        t.section('repeat https import (fresh url, forces TLS)');
+        // http_get_sync() short-circuits on a warm disk cache, so a second
+        // import of the same URL would never build a TLS connection. Use a
+        // distinct query string to force a real handshake into the
+        // process-wide CA store, then import once more to confirm repeated
+        // loadTrustedCerts() calls keep verifying.
+        const url2 = 'https://esm.sh/left-pad@1.3.0?twice=1';
+        let mod2;
+        try {
+            mod2 = await import(url2);
+            assert('repeat import succeeds', true);
+            assert('repeat default is function', typeof mod2.default === 'function');
+            assert('repeat left-pad works', mod2.default('hello', 8) === '   hello');
+        }
+        catch (e) {
+            assert('repeat import succeeds', false);
+            std.printf('  ERROR: %s\n', String(e));
+        }
         for (const f of after) {
             if (f.endsWith('.meta') && (err !== 0 || before.indexOf(f) < 0)) {
                 std.printf('  meta: %s\n', f);

package/test/test_http_import.ts

@@ -56,6 +56,25 @@ export const suite = {
         if (err2 !== 0) return
         assert('cache has body files', after.some(function(f: string) { return f.endsWith('.body') }))
         assert('cache has meta files', after.some(function(f: string) { return f.endsWith('.meta') }))
+
+        t.section('repeat https import (fresh url, forces TLS)')
+        // http_get_sync() short-circuits on a warm disk cache, so a second
+        // import of the same URL would never build a TLS connection. Use a
+        // distinct query string to force a real handshake into the
+        // process-wide CA store, then import once more to confirm repeated
+        // loadTrustedCerts() calls keep verifying.
+        const url2 = 'https://esm.sh/left-pad@1.3.0?twice=1'
+        let mod2: any
+        try {
+            mod2 = await import(url2)
+            assert('repeat import succeeds', true)
+            assert('repeat default is function', typeof mod2.default === 'function')
+            assert('repeat left-pad works', mod2.default('hello', 8) === '   hello')
+        } catch (e) {
+            assert('repeat import succeeds', false)
+            std.printf('  ERROR: %s\n', String(e))
+        }
+
         for (const f of after) {
             if (f.endsWith('.meta') && (err !== 0 || before.indexOf(f) < 0)) {
                 std.printf('  meta: %s\n', f)

package/test/test_http_server.js

@@ -3,6 +3,7 @@ import * as std from 'std';
 import * as os from 'os';
 import * as sock from 'sock';
 import { createServer } from '../lib/http-server.js';
+import '../lib/fetch.js';
 // ── Minimal raw HTTP client for testing ──
 function httpSend(host, port, raw, nResponses = 1) {
     return new Promise((resolve, reject) => {
@@ -82,6 +83,40 @@ export const suite = {
             else if (path === '/json') {
                 return new Response(JSON.stringify({ method: req.method, q: Object.fromEntries(url.searchParams) }), { headers: { 'Content-Type': 'application/json' } });
             }
+            else if (path === '/stream') {
+                // length unknown: server must send chunked frames
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'));
+                        control.enqueue(new TextEncoder().encode('chunkB'));
+                        control.close();
+                    }
+                }), { headers: { 'Content-Type': 'text/plain' } });
+            }
+            else if (path === '/file') {
+                // length known: server streams raw bytes with Content-Length
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'));
+                        control.enqueue(new TextEncoder().encode('chunkB'));
+                        control.close();
+                    }
+                }), { headers: { 'Content-Type': 'text/plain', 'Content-Length': '13' } });
+            }
+            else if (path === '/stream-trailer') {
+                // chunked stream with trailing headers (Node addTrailers
+                // semantics: `Trailer` declaration + frames, then the footer)
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'));
+                        control.enqueue(new TextEncoder().encode('chunkB'));
+                        control.close();
+                    }
+                }), {
+                    headers: { 'Content-Type': 'text/plain', 'Trailer': 'X-Exit-Code' },
+                    trailers: Promise.resolve({ 'X-Exit-Code': '3' })
+                });
+            }
             else {
                 return new Response('not found', { status: 404 });
             }
@@ -101,6 +136,43 @@ export const suite = {
         t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0);
         t.checkTrue('body = hello world', r.endsWith('hello world'));
         t.checkTrue('content-type text', r.toLowerCase().indexOf('content-type: text/plain') >= 0);
+        t.checkTrue('static body gets content-length', r.toLowerCase().indexOf('content-length: 11') >= 0);
+        // ── streaming chunked response (length unknown) ──
+        t.section('streaming chunked response');
+        r = await httpSend('127.0.0.1', port, 'GET /stream HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0);
+        t.checkTrue('transfer-encoding chunked', r.toLowerCase().indexOf('transfer-encoding: chunked') >= 0);
+        t.checkTrue('no content-length', r.toLowerCase().indexOf('content-length:') < 0);
+        t.checkTrue('chunk frames + terminator', r.indexOf('7\r\nchunkA/\r\n6\r\nchunkB\r\n0\r\n\r\n') >= 0);
+        // ── streaming raw response with known length ──
+        t.section('streaming known-length response');
+        r = await httpSend('127.0.0.1', port, 'GET /file HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0);
+        t.checkTrue('content-length 13', r.toLowerCase().indexOf('content-length: 13') >= 0);
+        t.checkTrue('no chunked encoding', r.toLowerCase().indexOf('transfer-encoding: chunked') < 0);
+        t.checkTrue('streamed raw body', r.includes('chunkA/chunkB'));
+        t.checkTrue('no chunk frame headers', r.indexOf('7\r\nchunkA/') < 0);
+        // ── HEAD of a streamed body: headers only, empty body ──
+        t.section('HEAD streaming response');
+        r = await httpSend('127.0.0.1', port, 'HEAD /stream HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
+        t.checkTrue('HEAD 200', r.indexOf('HTTP/1.1 200') === 0);
+        t.checkTrue('HEAD content-length 13', r.toLowerCase().indexOf('content-length: 13') >= 0);
+        const headBodyIdx = r.indexOf('\r\n\r\n');
+        t.checkTrue('HEAD empty body', r.slice(headBodyIdx + 4).length === 0);
+        // ── streaming chunked response with trailing headers ──
+        t.section('streaming trailer response');
+        r = await httpSend('127.0.0.1', port, 'GET /stream-trailer HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0);
+        t.checkTrue('trailer declared in head', r.toLowerCase().indexOf('trailer: x-exit-code') >= 0);
+        t.checkTrue('terminator carries trailer', r.indexOf('0\r\nX-Exit-Code: 3\r\n\r\n') >= 0);
+        t.checkTrue('trailer footer after body', r.indexOf('7\r\nchunkA/\r\n6\r\nchunkB\r\n0\r\nX-Exit-Code: 3\r\n\r\n') >= 0);
+        // ── fetch client consumes chunked response with trailer footer ──
+        t.section('fetch consumes trailer response');
+        {
+            const rr = await fetch(`http://127.0.0.1:${port}/stream-trailer`);
+            t.checkTrue('status 200', rr.status === 200);
+            t.checkTrue('body decoded without trailer', await rr.text() === 'chunkA/chunkB');
+        }
         // ── POST with body ──
         t.section('POST with body');
         r = await httpSend('127.0.0.1', port, 'POST /echo HTTP/1.1\r\nHost: x\r\nContent-Length: 7\r\nConnection: close\r\n\r\npayload');
@@ -132,7 +204,7 @@ export const suite = {
         t.checkTrue('connection close on last', r.toLowerCase().indexOf('connection: close') >= 0);
         // ── server received expected requests ──
         t.section('request log');
-        t.check('total requests', 7, requests.length);
+        t.check('total requests', 12, requests.length);
         t.checkTrue('saw GET /', requests.indexOf('GET /') >= 0);
         t.checkTrue('saw POST /echo', requests.indexOf('POST /echo') >= 0);
         server.close();

package/test/test_http_server.ts

@@ -4,6 +4,7 @@ import * as os from 'os'
 import * as sock from 'sock'
 import { Tester } from './test_helper.js'
 import { createServer } from '../lib/http-server.js'
+import '../lib/fetch.js'
 
 // ── Minimal raw HTTP client for testing ──
 
@@ -69,6 +70,37 @@ export const suite = {
                 return new Response(req.method + ':' + await req.text(), { headers: { 'Content-Type': 'text/plain' } })
             } else if (path === '/json') {
                 return new Response(JSON.stringify({ method: req.method, q: Object.fromEntries(url.searchParams) }), { headers: { 'Content-Type': 'application/json' } })
+            } else if (path === '/stream') {
+                // length unknown: server must send chunked frames
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'))
+                        control.enqueue(new TextEncoder().encode('chunkB'))
+                        control.close()
+                    }
+                }), { headers: { 'Content-Type': 'text/plain' } })
+            } else if (path === '/file') {
+                // length known: server streams raw bytes with Content-Length
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'))
+                        control.enqueue(new TextEncoder().encode('chunkB'))
+                        control.close()
+                    }
+                }), { headers: { 'Content-Type': 'text/plain', 'Content-Length': '13' } })
+            } else if (path === '/stream-trailer') {
+                // chunked stream with trailing headers (Node addTrailers
+                // semantics: `Trailer` declaration + frames, then the footer)
+                return new Response(new ReadableStream({
+                    start(control) {
+                        control.enqueue(new TextEncoder().encode('chunkA/'))
+                        control.enqueue(new TextEncoder().encode('chunkB'))
+                        control.close()
+                    }
+                }), {
+                    headers: { 'Content-Type': 'text/plain', 'Trailer': 'X-Exit-Code' },
+                    trailers: Promise.resolve({ 'X-Exit-Code': '3' })
+                })
             } else {
                 return new Response('not found', { status: 404 })
             }
@@ -87,6 +119,48 @@ export const suite = {
         t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0)
         t.checkTrue('body = hello world', r.endsWith('hello world'))
         t.checkTrue('content-type text', r.toLowerCase().indexOf('content-type: text/plain') >= 0)
+        t.checkTrue('static body gets content-length', r.toLowerCase().indexOf('content-length: 11') >= 0)
+
+        // ── streaming chunked response (length unknown) ──
+        t.section('streaming chunked response')
+        r = await httpSend('127.0.0.1', port, 'GET /stream HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n')
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0)
+        t.checkTrue('transfer-encoding chunked', r.toLowerCase().indexOf('transfer-encoding: chunked') >= 0)
+        t.checkTrue('no content-length', r.toLowerCase().indexOf('content-length:') < 0)
+        t.checkTrue('chunk frames + terminator', r.indexOf('7\r\nchunkA/\r\n6\r\nchunkB\r\n0\r\n\r\n') >= 0)
+
+        // ── streaming raw response with known length ──
+        t.section('streaming known-length response')
+        r = await httpSend('127.0.0.1', port, 'GET /file HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n')
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0)
+        t.checkTrue('content-length 13', r.toLowerCase().indexOf('content-length: 13') >= 0)
+        t.checkTrue('no chunked encoding', r.toLowerCase().indexOf('transfer-encoding: chunked') < 0)
+        t.checkTrue('streamed raw body', r.includes('chunkA/chunkB'))
+        t.checkTrue('no chunk frame headers', r.indexOf('7\r\nchunkA/') < 0)
+
+        // ── HEAD of a streamed body: headers only, empty body ──
+        t.section('HEAD streaming response')
+        r = await httpSend('127.0.0.1', port, 'HEAD /stream HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n')
+        t.checkTrue('HEAD 200', r.indexOf('HTTP/1.1 200') === 0)
+        t.checkTrue('HEAD content-length 13', r.toLowerCase().indexOf('content-length: 13') >= 0)
+        const headBodyIdx = r.indexOf('\r\n\r\n')
+        t.checkTrue('HEAD empty body', r.slice(headBodyIdx + 4).length === 0)
+
+        // ── streaming chunked response with trailing headers ──
+        t.section('streaming trailer response')
+        r = await httpSend('127.0.0.1', port, 'GET /stream-trailer HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n')
+        t.checkTrue('200 status', r.indexOf('HTTP/1.1 200') === 0)
+        t.checkTrue('trailer declared in head', r.toLowerCase().indexOf('trailer: x-exit-code') >= 0)
+        t.checkTrue('terminator carries trailer', r.indexOf('0\r\nX-Exit-Code: 3\r\n\r\n') >= 0)
+        t.checkTrue('trailer footer after body', r.indexOf('7\r\nchunkA/\r\n6\r\nchunkB\r\n0\r\nX-Exit-Code: 3\r\n\r\n') >= 0)
+
+        // ── fetch client consumes chunked response with trailer footer ──
+        t.section('fetch consumes trailer response')
+        {
+            const rr = await fetch(`http://127.0.0.1:${port}/stream-trailer`)
+            t.checkTrue('status 200', rr.status === 200)
+            t.checkTrue('body decoded without trailer', await rr.text() === 'chunkA/chunkB')
+        }
 
         // ── POST with body ──
         t.section('POST with body')
@@ -124,7 +198,7 @@ export const suite = {
 
         // ── server received expected requests ──
         t.section('request log')
-        t.check('total requests', 7, requests.length)
+        t.check('total requests', 12, requests.length)
         t.checkTrue('saw GET /', requests.indexOf('GET /') >= 0)
         t.checkTrue('saw POST /echo', requests.indexOf('POST /echo') >= 0)
 

package/test/test_ipv6.js

@@ -79,7 +79,7 @@ export const suite = {
         // ── 4. fetch HTTPS IPv6 ──
         t.section('fetch https://[::1]');
         {
-            const r = await fetch(`https://[::1]:${HTTPS_PORT}/`, { timeout: 5000 });
+            const r = await fetch(`https://[::1]:${HTTPS_PORT}/`, { timeout: 5000, rejectUnauthorized: false });
             assert('fetch IPv6 HTTPS status 200', r.status === 200);
             const body = await r.text();
             assert('fetch IPv6 HTTPS body', body === 'hello from test server');
@@ -110,7 +110,7 @@ export const suite = {
         // ── 6. WebSocket WSS IPv6 ──
         t.section('wss://[::1] echo');
         await new Promise((resolve, reject) => {
-            const ws = new WebSocket(`wss://[::1]:${HTTPS_PORT}/`);
+            const ws = new WebSocket(`wss://[::1]:${HTTPS_PORT}/`, { rejectUnauthorized: false });
             const timeoutId = os.setTimeout(() => reject(new Error('WSS IPv6 timeout')), 10000);
             ws.onopen = () => {
                 t.ok++;

package/test/test_ipv6.ts

@@ -70,7 +70,7 @@ export const suite = {
         // ── 4. fetch HTTPS IPv6 ──
         t.section('fetch https://[::1]')
         {
-            const r = await fetch(`https://[::1]:${HTTPS_PORT}/`, { timeout: 5000 })
+            const r = await fetch(`https://[::1]:${HTTPS_PORT}/`, { timeout: 5000, rejectUnauthorized: false })
             assert('fetch IPv6 HTTPS status 200', r.status === 200)
             const body = await r.text()
             assert('fetch IPv6 HTTPS body', body === 'hello from test server')
@@ -104,7 +104,7 @@ export const suite = {
         // ── 6. WebSocket WSS IPv6 ──
         t.section('wss://[::1] echo')
         await new Promise<void>((resolve, reject) => {
-            const ws = new WebSocket(`wss://[::1]:${HTTPS_PORT}/`)
+            const ws = new WebSocket(`wss://[::1]:${HTTPS_PORT}/`, { rejectUnauthorized: false })
             const timeoutId = os.setTimeout(() => reject(new Error('WSS IPv6 timeout')), 10000)
 
             ws.onopen = () => {

package/test/test_net_fetch.js

@@ -14,13 +14,24 @@ export const suite = {
                 std.printf('  FAIL: %s\n', name);
             }
         }
+        // Retry: public-site reachability (baidu/jsdelivr/esm.sh) depends on
+        // CI network conditions, and a single dropped connection must not be
+        // reported as a certificate regression. The last error is printed so a
+        // real failure is still diagnosable.
         async function safeFetch(url, init) {
-            try {
-                return await fetch(url, init);
-            }
-            catch {
-                return null;
+            let last = 'unknown';
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    return await fetch(url, init);
+                }
+                catch (e) {
+                    last = String(e?.message || e);
+                    if (attempt < 2)
+                        os.sleep(500);
+                }
             }
+            std.printf('    fetch %s failed after 3 attempts: %s\n', String(url), last);
+            return null;
         }
         const BASE = 'http://localhost:18923';
         // ── Plain HTTP GET (regression: slot 0 + !s bug) ──
@@ -247,7 +258,7 @@ export const suite = {
         }
         // ── HTTPS fetch ──
         t.section('HTTPS fetch');
-        const r11 = await safeFetch('https://localhost:18924/', { timeout: 5000 });
+        const r11 = await safeFetch('https://localhost:18924/', { timeout: 5000, rejectUnauthorized: false });
         if (r11) {
             assert('https status 200', r11.status === 200);
             const body = await r11.text();
@@ -256,15 +267,67 @@ export const suite = {
         else {
             assert('https endpoint reachable', false);
         }
-        // ── large HTTPS body (wolfSSL_read null regression) ──
-        // Pre-fix: wolfSSL_read returned number -1 on WANT_READ →
-        // receivedBytes became NaN → stream never closed → hang.
+        // ── GlobalSign R3 root chain (regression: ASN_SIG_CONFIRM_E -155) ──
+        // baidu.com and jsdelivr terminate in GlobalSign's 2018 re-keyed R3,
+        // which reuses the self-signed R3's subject-key-identifier with a
+        // different public key. Shipping the self-signed R3 in lib/certs.ts
+        // made wolfSSL match the wrong key and fail the handshake with -155.
+        // Both are public CDNs: a 500/429 or a dropped connection then counts
+        // as a retried attempt, not an immediate failure — only a persistent
+        // failure (cert regression or long-lived outage) should fail CI.
+        t.section('GlobalSign R3 root chain');
+        {
+            async function fetchR3(url) {
+                const init = { timeout: 10000 };
+                for (let attempt = 0; attempt < 3; attempt++) {
+                    try {
+                        const r = await fetch(url, init);
+                        const body = await r.text();
+                        if (r.status === 200 && body.length > 0)
+                            return body;
+                        std.printf('    fetch %s status=%s len=%d (attempt %d)\n', String(url), String(r.status), body.length, attempt);
+                    }
+                    catch (e) {
+                        std.printf('    fetch %s error: %s (attempt %d)\n', String(url), String(e?.message || e), attempt);
+                    }
+                    os.sleep(1000);
+                }
+                return null;
+            }
+            const bb = await fetchR3('https://www.baidu.com/');
+            if (bb) {
+                assert('baidu (GlobalSign R3) status', true);
+                assert('baidu (GlobalSign R3) body non-empty', bb.length > 0);
+            }
+            else {
+                assert('baidu (GlobalSign R3) reachable', false);
+            }
+            const JSDELIVR_HOSTS = ['cdn.jsdelivr.net', 'fastly.jsdelivr.net', 'gcore.jsdelivr.net'];
+            for (const host of JSDELIVR_HOSTS) {
+                const bj = await fetchR3('https://' + host + '/npm/left-pad@1.3.0');
+                if (bj) {
+                    assert('jsdelivr (GlobalSign R3) status', true);
+                    assert('jsdelivr (GlobalSign R3) body non-empty', bj.length > 0);
+                    break;
+                }
+                if (host !== JSDELIVR_HOSTS[JSDELIVR_HOSTS.length - 1]) {
+                    std.printf('    jsdelivr host %s failed, trying next\n', host);
+                }
+                else {
+                    assert('jsdelivr (GlobalSign R3) reachable', false);
+                }
+            }
+        }
+        // ── large HTTPS body (wolfSSL_read int contract) ──
+        // read returns the raw int; -1/WANT_READ must never leak into
+        // byte accounting (regression: a leaked -1 made receivedBytes
+        // NaN → stream never closed → hang).
         t.section('large HTTPS body');
         {
             const LARGE = 200000;
             try {
                 const r = await Promise.race([
-                    fetch(`https://localhost:18924/large/${LARGE}`, { timeout: 15000 }),
+                    fetch(`https://localhost:18924/large/${LARGE}`, { timeout: 15000, rejectUnauthorized: false }),
                     new Promise((_, rej) => os.setTimeout(() => rej(new Error('Body hang watchdog 15s')), 15000))
                 ]);
                 assert('large HTTPS status 200', r.status === 200);
@@ -304,7 +367,7 @@ export const suite = {
             let rejected = false;
             let msg = '';
             try {
-                const r = await fetch('https://localhost:18924/stall', { timeout: 2000 });
+                const r = await fetch('https://localhost:18924/stall', { timeout: 2000, rejectUnauthorized: false });
                 await Promise.race([
                     r.arrayBuffer(),
                     new Promise((_, rej) => os.setTimeout(() => rej(new Error('Body timeout')), 8000))

package/test/test_net_fetch.ts

@@ -11,12 +11,22 @@ export const suite = {
             else { t.fail++; std.printf('  FAIL: %s\n', name) }
         }
 
+        // Retry: public-site reachability (baidu/jsdelivr/esm.sh) depends on
+        // CI network conditions, and a single dropped connection must not be
+        // reported as a certificate regression. The last error is printed so a
+        // real failure is still diagnosable.
         async function safeFetch(url: any, init?: RequestInit) {
-            try {
-                return await fetch(url, init);
-            } catch {
-                return null;
+            let last = 'unknown'
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    return await fetch(url, init)
+                } catch (e) {
+                    last = String((e as Error)?.message || e)
+                    if (attempt < 2) os.sleep(500)
+                }
             }
+            std.printf('    fetch %s failed after 3 attempts: %s\n', String(url), last)
+            return null
         }
         const BASE = 'http://localhost:18923'
 
@@ -227,7 +237,7 @@ export const suite = {
 
         // ── HTTPS fetch ──
         t.section('HTTPS fetch')
-        const r11 = await safeFetch('https://localhost:18924/', { timeout: 5000 })
+        const r11 = await safeFetch('https://localhost:18924/', { timeout: 5000, rejectUnauthorized: false })
         if (r11) {
             assert('https status 200', r11.status === 200)
             const body = await r11.text()
@@ -236,15 +246,68 @@ export const suite = {
             assert('https endpoint reachable', false)
         }
 
-        // ── large HTTPS body (wolfSSL_read null regression) ──
-        // Pre-fix: wolfSSL_read returned number -1 on WANT_READ →
-        // receivedBytes became NaN → stream never closed → hang.
+        // ── GlobalSign R3 root chain (regression: ASN_SIG_CONFIRM_E -155) ──
+        // baidu.com and jsdelivr terminate in GlobalSign's 2018 re-keyed R3,
+        // which reuses the self-signed R3's subject-key-identifier with a
+        // different public key. Shipping the self-signed R3 in lib/certs.ts
+        // made wolfSSL match the wrong key and fail the handshake with -155.
+        // Both are public CDNs: a 500/429 or a dropped connection then counts
+        // as a retried attempt, not an immediate failure — only a persistent
+        // failure (cert regression or long-lived outage) should fail CI.
+        t.section('GlobalSign R3 root chain')
+        {
+            async function fetchR3(url: any): Promise<string | null> {
+                const init = { timeout: 10000 }
+                for (let attempt = 0; attempt < 3; attempt++) {
+                    try {
+                        const r = await fetch(url, init)
+                        const body = await r.text()
+                        if (r.status === 200 && body.length > 0) return body
+                        std.printf('    fetch %s status=%s len=%d (attempt %d)\n',
+                            String(url), String(r.status), body.length, attempt)
+                    } catch (e) {
+                        std.printf('    fetch %s error: %s (attempt %d)\n',
+                            String(url), String((e as Error)?.message || e), attempt)
+                    }
+                    os.sleep(1000)
+                }
+                return null
+            }
+
+            const bb = await fetchR3('https://www.baidu.com/')
+            if (bb) {
+                assert('baidu (GlobalSign R3) status', true)
+                assert('baidu (GlobalSign R3) body non-empty', bb.length > 0)
+            } else {
+                assert('baidu (GlobalSign R3) reachable', false)
+            }
+
+            const JSDELIVR_HOSTS = ['cdn.jsdelivr.net', 'fastly.jsdelivr.net', 'gcore.jsdelivr.net']
+            for (const host of JSDELIVR_HOSTS) {
+                const bj = await fetchR3('https://' + host + '/npm/left-pad@1.3.0')
+                if (bj) {
+                    assert('jsdelivr (GlobalSign R3) status', true)
+                    assert('jsdelivr (GlobalSign R3) body non-empty', bj.length > 0)
+                    break
+                }
+                if (host !== JSDELIVR_HOSTS[JSDELIVR_HOSTS.length - 1]) {
+                    std.printf('    jsdelivr host %s failed, trying next\n', host)
+                } else {
+                    assert('jsdelivr (GlobalSign R3) reachable', false)
+                }
+            }
+        }
+
+        // ── large HTTPS body (wolfSSL_read int contract) ──
+        // read returns the raw int; -1/WANT_READ must never leak into
+        // byte accounting (regression: a leaked -1 made receivedBytes
+        // NaN → stream never closed → hang).
         t.section('large HTTPS body')
         {
             const LARGE = 200000
             try {
                 const r = await Promise.race([
-                    fetch(`https://localhost:18924/large/${LARGE}`, { timeout: 15000 }),
+                    fetch(`https://localhost:18924/large/${LARGE}`, { timeout: 15000, rejectUnauthorized: false }),
                     new Promise<never>((_, rej) =>
                         os.setTimeout(() => rej(new Error('Body hang watchdog 15s')), 15000)
                     )
@@ -292,7 +355,7 @@ export const suite = {
             let rejected = false
             let msg = ''
             try {
-                const r = await fetch('https://localhost:18924/stall', { timeout: 2000 })
+                const r = await fetch('https://localhost:18924/stall', { timeout: 2000, rejectUnauthorized: false })
                 await Promise.race([
                     r.arrayBuffer(),
                     new Promise<never>((_, rej) =>

package/test/test_net_websocket.js

@@ -158,7 +158,7 @@ export const suite = {
         t.section('wss basic text message');
         const p7 = waitForTest();
         let opened7 = false, received7 = false, closed7 = false;
-        const ws7 = new WebSocket("wss://localhost:18924");
+        const ws7 = new WebSocket("wss://localhost:18924", { rejectUnauthorized: false });
         ws7.onopen = () => { opened7 = true; ws7.send("Hello WSS!"); };
         ws7.onmessage = () => { received7 = true; ws7.close(1000, "done"); };
         ws7.onclose = (e) => {

package/test/test_net_websocket.ts

@@ -145,7 +145,7 @@ export const suite = {
         t.section('wss basic text message')
         const p7 = waitForTest()
         let opened7 = false, received7 = false, closed7 = false
-        const ws7 = new WebSocket("wss://localhost:18924")
+        const ws7 = new WebSocket("wss://localhost:18924", { rejectUnauthorized: false })
         ws7.onopen = () => { opened7 = true; ws7.send("Hello WSS!") }
         ws7.onmessage = () => { received7 = true; ws7.close(1000, "done") }
         ws7.onclose = (e) => {