visaljs 0.0.2 → 0.0.4

package/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { isBuiltin } from "node:module";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import ts from "typescript";
 import { rolldown } from "rolldown";
@@ -113,7 +113,7 @@ function parse(text, file, module, map, entry, hostPrimitives = {}) {
 function locAt(sf, pos, map) {
 	const { line, character } = sf.getLineAndCharacterOfPosition(pos);
 	const loc = {
-		file: sf.fileName,
+		file: normalize(sf.fileName),
 		line: line + 1,
 		column: character + 1
 	};
@@ -248,7 +248,7 @@ var Converter = class {
 		return {
 			type: "Program",
 			loc: {
-				file: this.sf.fileName,
+				file: normalize(this.sf.fileName),
 				line: 1,
 				column: 1
 			},
@@ -6672,6 +6672,32 @@ function emitModule(m, p, entry, options) {
 //#endregion
 //#region runtime/components.ts
 const COMPONENTS = [
+	{
+		name: "promise",
+		symbol: "js_component_promise",
+		names: ["Promise", "fromAsync"]
+	},
+	{
+		name: "generator",
+		symbol: "js_component_generator",
+		names: ["function*"]
+	},
+	{
+		name: "asynciterator",
+		symbol: "js_component_asynciterator",
+		names: ["async function*", "asyncIterator"],
+		needs: ["promise"]
+	},
+	{
+		name: "weak",
+		symbol: "js_component_weak",
+		names: [
+			"WeakMap",
+			"WeakSet",
+			"WeakRef",
+			"FinalizationRegistry"
+		]
+	},
 	{
 		name: "math",
 		symbol: "js_component_math",
@@ -6810,6 +6836,7 @@ const COMPONENTS = [
 			"CryptoKey"
 		],
 		needs: [
+			"promise",
 			"json",
 			"typedarray",
 			"domexception"
@@ -6834,6 +6861,8 @@ const COMPONENTS = [
 			"TransformStreamDefaultController"
 		],
 		needs: [
+			"promise",
+			"asynciterator",
 			"typedarray",
 			"domexception",
 			"events"
@@ -6843,13 +6872,18 @@ const COMPONENTS = [
 		name: "blob",
 		symbol: "js_component_blob",
 		names: ["Blob", "File"],
-		needs: ["typedarray", "streams"]
+		needs: [
+			"promise",
+			"typedarray",
+			"streams"
+		]
 	},
 	{
 		name: "fetch",
 		symbol: "js_component_fetch",
 		names: ["Request", "Response"],
 		needs: [
+			"promise",
 			"json",
 			"domexception",
 			"url",
@@ -6863,7 +6897,9 @@ const COMPONENTS = [
 ];
 //#endregion
 //#region compiler/src/emit/components.ts
-/** Every identifier name and string literal in the program: the names it can reach built-ins by. */
+/** Every identifier name and string literal in the program: the names it can reach built-ins by.
+*  Syntax adds the names of what it needs: an async function or `await` adds `Promise`, a
+*  generator `function*`, an async generator or `for await` `async function*`. */
 function programNames(program) {
 	const names = /* @__PURE__ */ new Set();
 	namesIn(program.body, names);
@@ -6880,6 +6916,11 @@ function namesIn(node, out) {
 	else if (n.type === "RegExpLiteral") out.add("RegExp");
 	else if (n.type === "BigIntLiteral") out.add("BigInt");
 	else if (n.type === "Literal" && typeof n.value === "string") out.add(n.value);
+	else if (n.type === "FunctionDeclaration" || n.type === "FunctionExpression") {
+		if (n.async) out.add("Promise");
+		if (n.generator) out.add(n.async ? "async function*" : "function*");
+	} else if (n.type === "AwaitExpression" || n.type === "ImportCall") out.add("Promise");
+	else if (n.type === "ForOfStatement" && n.await) out.add("async function*").add("Promise");
 	for (const [key, value] of Object.entries(node)) if (key !== "loc" && value !== null && typeof value === "object") namesIn(value, out);
 }
 /** The optional components the program can reach, and those they need, in COMPONENTS order. */
@@ -6896,6 +6937,8 @@ const RUNTIME_DIR = join(import.meta.dirname, "runtime");
 const RUNTIME_INCLUDE = join(RUNTIME_DIR, "include");
 /** The core-method catalog the compiler reads (ADR 0014). */
 const CORE_DEF = join(RUNTIME_INCLUDE, "js_core.def");
+/** BoringSSL's directory (boringsslLibrary) */
+const BORINGSSL = join(RUNTIME_DIR, "third_party", "boringssl");
 /** Vendored libraries: every .c of these is part of libjsrt. */
 const THIRD_PARTY = [
 	"quickjs-dtoa",
@@ -6904,9 +6947,6 @@ const THIRD_PARTY = [
 	"ada-idna"
 ].map((d) => join(RUNTIME_DIR, "third_party", d));
 const cFiles = (dir, ext) => readdirSync(dir).filter((f) => f.endsWith(ext)).map((f) => join(dir, f));
-const cFilesDeep = (dir, ext) => readdirSync(dir, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? cFilesDeep(join(dir, e.name), ext) : e.name.endsWith(ext) ? [join(dir, e.name)] : []);
-/** BearSSL (ADR 0018): the crypto component's primitives, behind runtime/src/crypto*.c. */
-const BEARSSL = join(RUNTIME_DIR, "third_party", "bearssl");
 /** libjsrt, as a C library the driver builds (the shape host packages give theirs too). */
 function runtimeLibrary() {
 	const src = join(RUNTIME_DIR, "src");
@@ -6921,27 +6961,39 @@ function runtimeLibrary() {
 		flags: [
 			`-I${RUNTIME_INCLUDE}`,
 			...THIRD_PARTY.map((d) => `-I${d}`),
-			`-I${join(BEARSSL, "inc")}`
+			`-I${join(BORINGSSL, "include")}`
 		]
 	};
 }
-/** libbearssl: a library of its own, so runtime changes don't rebuild it. One function per
-*  file: a program links only the primitives it reaches. */
-function bearsslLibrary() {
+/** BoringSSL (ADR 0018, 0019): the crypto component's, node:crypto's and node:tls's primitives,
+*  behind runtime/src/crypto*.c; a library of its own, so runtime changes don't rebuild it. Its
+*  sources are C++ (built without exceptions, RTTI or the C++ library) and per-platform assembly, which guards
+*  itself: every file is compiled everywhere. The lists are BoringSSL's (sources.json, from its
+*  gen/sources.json at the vendored commit). */
+function boringsslLibrary() {
+	const lists = JSON.parse(readFileSync(join(BORINGSSL, "sources.json"), "utf8"));
+	const parts = [
+		"bcm",
+		"crypto",
+		"ssl"
+	].map((k) => lists[k]);
+	const at = (f) => join(BORINGSSL, f);
 	return {
-		name: "bearssl",
-		sources: cFilesDeep(join(BEARSSL, "src"), ".c"),
-		headers: [...cFiles(join(BEARSSL, "inc"), ".h"), ...cFilesDeep(join(BEARSSL, "src"), ".h")],
-		flags: [
-			`-I${join(BEARSSL, "inc")}`,
-			`-I${join(BEARSSL, "src")}`,
-			"-D_DEFAULT_SOURCE"
-		]
+		name: "boringssl",
+		sources: [...parts.flatMap((p) => [...p.srcs, ...p.asm]).map(at), join(RUNTIME_DIR, "src", "boringssl_support.cc")],
+		headers: parts.flatMap((p) => [...p.hdrs ?? [], ...p.internal_hdrs ?? []]).map(at),
+		flags: [`-I${join(BORINGSSL, "include")}`, ...process.platform === "win32" ? BORINGSSL_WINDOWS : []]
 	};
 }
+const BORINGSSL_WINDOWS = [
+	"-DWIN32_LEAN_AND_MEAN",
+	"-DNOMINMAX",
+	"-D_HAS_EXCEPTIONS=0",
+	...process.arch === "x64" ? ["-DOPENSSL_NO_ASM"] : []
+];
 /** The runtime's libraries, in link order: libjsrt, then the libraries it uses. */
 function runtimeLibraries() {
-	return [runtimeLibrary(), bearsslLibrary()];
+	return [runtimeLibrary(), boringsslLibrary()];
 }
 //#endregion
 //#region compiler/src/emit/core.ts
@@ -7031,6 +7083,8 @@ const modules = {
 	async_hooks: join(preludeDir, "async_hooks.js"),
 	buffer: join(preludeDir, "buffer.js"),
 	crypto: join(preludeDir, "crypto.js"),
+	dns: join(preludeDir, "dns.js"),
+	"dns/promises": join(preludeDir, "dns_promises.js"),
 	events: join(preludeDir, "events.js"),
 	fs: join(preludeDir, "fs.js"),
 	http: join(preludeDir, "http.js"),
@@ -7045,9 +7099,11 @@ const modules = {
 	"stream/promises": join(preludeDir, "stream_promises.js"),
 	"stream/web": join(preludeDir, "stream_web.js"),
 	string_decoder: join(preludeDir, "string_decoder.js"),
+	tls: join(preludeDir, "tls.js"),
 	tty: join(preludeDir, "tty.js"),
 	url: join(preludeDir, "url.js"),
 	util: join(preludeDir, "util.js"),
+	"util/types": join(preludeDir, "util_types.js"),
 	zlib: join(preludeDir, "zlib.js")
 };
 /** The host primitives: the name prelude code imports → its C function (JSNativeFn) and length.
@@ -7085,6 +7141,10 @@ const primitives = {
 		c: "js_host_tty_isatty",
 		length: 1
 	},
+	timerUnref: {
+		c: "js_host_timer_unref",
+		length: 2
+	},
 	osUname: {
 		c: "js_host_os_uname",
 		length: 0
@@ -7141,6 +7201,10 @@ const primitives = {
 		c: "js_util_format_with_options",
 		length: 1
 	},
+	utilTypeTag: {
+		c: "js_util_type_tag",
+		length: 1
+	},
 	cryptoHashNew: {
 		c: "js_crypto_hash_new",
 		length: 2
@@ -7289,6 +7353,26 @@ const primitives = {
 		c: "js_crypto_verify",
 		length: 7
 	},
+	cryptoSignMessage: {
+		c: "js_crypto_sign_message",
+		length: 2
+	},
+	cryptoVerifyMessage: {
+		c: "js_crypto_verify_message",
+		length: 3
+	},
+	cryptoModExp: {
+		c: "js_crypto_mod_exp",
+		length: 4
+	},
+	cryptoGeneratePrime: {
+		c: "js_crypto_generate_prime",
+		length: 4
+	},
+	cryptoCheckPrime: {
+		c: "js_crypto_check_prime",
+		length: 2
+	},
 	cryptoRsaCrypt: {
 		c: "js_crypto_rsa_crypt",
 		length: 6
@@ -7305,29 +7389,177 @@ const primitives = {
 		c: "js_crypto_ec_private",
 		length: 2
 	},
-	httpListen: {
-		c: "js_host_http_listen",
+	tlsContextNew: {
+		c: "js_tls_context_new",
+		length: 6
+	},
+	tlsContextAddRoots: {
+		c: "js_tls_context_add_roots",
+		length: 1
+	},
+	tlsContextAddCA: {
+		c: "js_tls_context_add_ca",
+		length: 2
+	},
+	tlsContextSetCert: {
+		c: "js_tls_context_set_cert",
+		length: 2
+	},
+	tlsContextSetKey: {
+		c: "js_tls_context_set_key",
+		length: 2
+	},
+	tlsRootCertificates: {
+		c: "js_tls_root_certificates",
+		length: 0
+	},
+	tlsCiphers: {
+		c: "js_tls_ciphers",
+		length: 0
+	},
+	tlsNew: {
+		c: "js_tls_new",
 		length: 7
 	},
-	httpAddress: {
-		c: "js_host_http_address",
+	tlsRun: {
+		c: "js_tls_run",
+		length: 3
+	},
+	tlsShutdown: {
+		c: "js_tls_shutdown",
+		length: 1
+	},
+	tlsInfo: {
+		c: "js_tls_info",
+		length: 1
+	},
+	tlsPeerCerts: {
+		c: "js_tls_peer_certs",
+		length: 1
+	},
+	tlsVerifyError: {
+		c: "js_tls_verify_error",
+		length: 1
+	},
+	tlsSession: {
+		c: "js_tls_session",
 		length: 1
 	},
-	httpCloseServer: {
-		c: "js_host_http_close_server",
+	tlsExportKeyingMaterial: {
+		c: "js_tls_export_keying_material",
+		length: 4
+	},
+	tlsSetNoRenegotiation: {
+		c: "js_tls_set_no_renegotiation",
 		length: 1
 	},
+	tlsFinished: {
+		c: "js_tls_finished",
+		length: 2
+	},
+	httpParsers: {
+		c: "js_host_http_parsers",
+		length: 5
+	},
+	httpAttach: {
+		c: "js_host_http_attach",
+		length: 4
+	},
+	httpDetach: {
+		c: "js_host_http_detach",
+		length: 1
+	},
+	httpExpired: {
+		c: "js_host_http_expired",
+		length: 3
+	},
 	httpWrite: {
 		c: "js_host_http_write",
 		length: 2
 	},
-	httpEnd: {
-		c: "js_host_http_end",
-		length: 2
+	httpFlush: {
+		c: "js_host_http_flush",
+		length: 1
 	},
 	httpDate: {
 		c: "js_host_http_date",
 		length: 0
+	},
+	netOpen: {
+		c: "js_host_net_open",
+		length: 2
+	},
+	netGuessHandle: {
+		c: "js_host_net_guess_handle",
+		length: 1
+	},
+	netOpenFd: {
+		c: "js_host_net_open_fd",
+		length: 2
+	},
+	netBind: {
+		c: "js_host_net_bind",
+		length: 4
+	},
+	netChmod: {
+		c: "js_host_net_chmod",
+		length: 2
+	},
+	netListen: {
+		c: "js_host_net_listen",
+		length: 2
+	},
+	netConnect: {
+		c: "js_host_net_connect",
+		length: 3
+	},
+	netCallback: {
+		c: "js_host_net_callback",
+		length: 2
+	},
+	netReadStart: {
+		c: "js_host_net_read_start",
+		length: 1
+	},
+	netReadStop: {
+		c: "js_host_net_read_stop",
+		length: 1
+	},
+	netWrite: {
+		c: "js_host_net_write",
+		length: 2
+	},
+	netShutdown: {
+		c: "js_host_net_shutdown",
+		length: 1
+	},
+	netClose: {
+		c: "js_host_net_close",
+		length: 1
+	},
+	netReset: {
+		c: "js_host_net_reset",
+		length: 1
+	},
+	netRef: {
+		c: "js_host_net_ref",
+		length: 2
+	},
+	netAddress: {
+		c: "js_host_net_address",
+		length: 2
+	},
+	netNoDelay: {
+		c: "js_host_net_no_delay",
+		length: 2
+	},
+	netKeepAlive: {
+		c: "js_host_net_keep_alive",
+		length: 3
+	},
+	dnsLookup: {
+		c: "js_host_dns_lookup",
+		length: 3
 	}
 };
 const UV_COMMON = [
@@ -7364,38 +7596,84 @@ const UV_UNIX = [
 	"tty",
 	"udp",
 	"proctitle"
-];
+].map((f) => `unix/${f}`);
 const UV_PLATFORM = {
 	linux: {
-		sources: [
+		sources: [...UV_UNIX, ...[
 			"linux",
 			"procfs-exepath",
 			"random-getrandom",
 			"random-sysctl-linux"
-		],
+		].map((f) => `unix/${f}`)],
 		defines: ["_GNU_SOURCE", "_POSIX_C_SOURCE=200112"]
 	},
 	darwin: {
-		sources: [
+		sources: [...UV_UNIX, ...[
 			"random-getentropy",
 			"darwin-proctitle",
 			"darwin",
 			"fsevents",
 			"bsd-ifaddrs",
 			"kqueue"
-		],
+		].map((f) => `unix/${f}`)],
 		defines: ["_DARWIN_UNLIMITED_SELECT=1", "_DARWIN_USE_64_BIT_INODE=1"]
+	},
+	win32: {
+		sources: [
+			"async",
+			"core",
+			"detect-wakeup",
+			"dl",
+			"error",
+			"fs",
+			"fs-event",
+			"getaddrinfo",
+			"getnameinfo",
+			"handle",
+			"loop-watcher",
+			"pipe",
+			"thread",
+			"poll",
+			"process",
+			"process-stdio",
+			"signal",
+			"snprintf",
+			"stream",
+			"tcp",
+			"tty",
+			"udp",
+			"util",
+			"winapi",
+			"winsock"
+		].map((f) => `win/${f}`),
+		defines: [
+			"WIN32_LEAN_AND_MEAN",
+			"_WIN32_WINNT=0x0A00",
+			"_CRT_DECLARE_NONSTDC_NAMES=0"
+		],
+		link: [
+			"psapi",
+			"user32",
+			"advapi32",
+			"iphlpapi",
+			"userenv",
+			"ws2_32",
+			"dbghelp",
+			"ole32",
+			"shell32"
+		]
 	}
 };
 /** The C libraries to build and link (before libjsrt, which they use). */
 function libraries(runtimeInclude) {
 	const uv = UV_PLATFORM[process.platform];
-	const uvSources = uv ? [...UV_COMMON.map((f) => join(UV, "src", `${f}.c`)), ...[...UV_UNIX, ...uv.sources].map((f) => join(UV, "src", "unix", `${f}.c`))] : [];
+	const uvSources = uv ? [...UV_COMMON, ...uv.sources].map((f) => join(UV, "src", `${f}.c`)) : [];
 	const uvHeaders = [
 		join(UV, "include"),
 		join(UV, "include", "uv"),
 		join(UV, "src"),
-		join(UV, "src", "unix")
+		join(UV, "src", "unix"),
+		join(UV, "src", "win")
 	].flatMap((d) => files(d, ".h"));
 	return [{
 		name: "jsnode",
@@ -7425,7 +7703,8 @@ function libraries(runtimeInclude) {
 			...(uv?.defines ?? []).map((d) => `-D${d}`),
 			`-I${join(UV, "include")}`,
 			`-I${join(UV, "src")}`
-		]
+		],
+		link: uv?.link ?? []
 	}];
 }
 //#endregion
@@ -7447,7 +7726,7 @@ function hostPrimitives(hosts) {
 /** A bundling failure, already formatted as `file:line:col: Kind: message` lines. */
 var BundleError = class extends Error {};
 /** Bundles `entry` with the ADR 0009 configuration, `node:*` imports resolved to the host
-*  packages' modules. Warnings go to `warn`. */
+*  packages' modules. Warnings go to `warn`, with their location ("file:line:col: ", or ""). */
 async function bundle(entry, hosts, warn) {
 	try {
 		const build = await rolldown({
@@ -7455,7 +7734,7 @@ async function bundle(entry, hosts, warn) {
 			cwd: dirname(resolve(entry)),
 			platform: "node",
 			logLevel: "warn",
-			onLog: (_level, log) => warn(formatLog(log, "warning")),
+			onLog: (_level, log) => log.code !== "EVAL" && warn(logText(log), logWhere(log)),
 			plugins: [hostModules(hosts)]
 		});
 		try {
@@ -7525,26 +7804,45 @@ module.exports = m;
 const REQUIRED = "\0visaljs-require:";
 /** rolldown's messages carry ANSI colors and a code frame: keep the first line, without the `[CODE]` tag. */
 function formatLog(log, kind) {
-	const text = log.message.replace(/\x1b\[[0-9;]*m/g, "").split("\n")[0].replace(/^\[[A-Z_]+\] /, "").trim();
-	return `${log.loc ? `${log.loc.file ?? log.id}:${log.loc.line}:${log.loc.column + 1}: ` : log.id ? `${log.id}: ` : ""}${kind}: ${text}`;
+	return `${logWhere(log)}${kind}: ${logText(log)}`;
+}
+function logText(log) {
+	return log.message.replace(/\x1b\[[0-9;]*m/g, "").split("\n")[0].replace(/^\[[A-Z_]+\] /, "").trim();
+}
+/** "file:line:col: ", "file: ", or "". */
+function logWhere(log) {
+	return log.loc ? `${log.loc.file ?? log.id}:${log.loc.line}:${log.loc.column + 1}: ` : log.id ? `${log.id}: ` : "";
 }
 //#endregion
 //#region cli/src/cc.ts
-/** $CC, else the first of the usual C compilers on the PATH. */
-function findCompiler() {
+/** $CC alone, else each of the usual C compilers on the PATH that runs, in order of preference:
+*  a build falls back to the next when one fails. Names for the same program (cc, a link to
+*  gcc) count once. Last comes Zig's clang, which brings its own libc headers and linker: a C
+*  compiler for a machine whose own toolchain is missing or broken. */
+function findCompilers() {
 	if (process.env.CC) {
 		if (!compilerVersion(process.env.CC)) throw new Error(`$CC (${process.env.CC}) doesn't run`);
-		return process.env.CC;
+		return [process.env.CC];
 	}
+	const found = /* @__PURE__ */ new Map();
 	for (const cc of [
 		"cc",
 		"clang",
-		"gcc"
-	]) try {
-		execFileSync(cc, ["--version"], { stdio: "ignore" });
-		return cc;
+		"gcc",
+		"zig cc"
+	]) {
+		const path = onPath(command(cc)[0]);
+		if (path && !found.has(path) && compilerVersion(cc)) found.set(path, cc);
+	}
+	if (found.size === 0) throw new Error("no C compiler found (set CC)");
+	return [...found.values()];
+}
+/** The program `name` runs from the PATH, links resolved; else undefined. */
+function onPath(name) {
+	const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE").split(delimiter) : [""];
+	for (const dir of (process.env.PATH ?? "").split(delimiter)) for (const ext of exts) try {
+		return realpathSync(join(dir, name + ext));
 	} catch {}
-	throw new Error("no C compiler found (set CC)");
 }
 const COMMON = [
 	"-std=c11",
@@ -7556,8 +7854,28 @@ const COMMON = [
 ];
 const LINK = process.platform === "darwin" ? ["-Wl,-dead_strip"] : ["-Wl,--gc-sections"];
 const STRIP = process.platform === "darwin" ? ["-Wl,-S,-x"] : ["-s"];
-/** "GCC 13.3.0", "clang 18.1.3": the compiler's name and version, else its command. */
+/** A compiler's command line, split like make splits $(CC): "zig cc", "ccache gcc". */
+function command(cc) {
+	const [program = cc, ...args] = cc.trim().split(/\s+/);
+	return [program, ...args];
+}
+/** Runs the compiler with `args`, synchronously (execFileSync's options and result). */
+function runCompiler(cc, args, options) {
+	const [program, ...prefix] = command(cc);
+	return execFileSync(program, [...prefix, ...args], options);
+}
+/** Zig compiles C with its clang, and archives with its own ar: a machine without a C
+*  toolchain usually lacks binutils' ar too. */
+function isZig(cc) {
+	return /^zig(\.exe)?$/i.test(basename(command(cc)[0]));
+}
+/** "GCC 13.3.0", "clang 18.1.3", "Zig 0.16.0": the compiler's name and version, else its command. */
 function describeCompiler(cc) {
+	if (isZig(cc)) try {
+		return `Zig ${execFileSync(command(cc)[0], ["version"], { encoding: "utf8" }).trim()}`;
+	} catch {
+		return cc;
+	}
 	const text = compilerVersion(cc);
 	const first = text.split("\n")[0] ?? "";
 	const version = (/version (\d+\.\d+(?:\.\d+)?)/.exec(first) ?? /(\d+\.\d+(?:\.\d+)?)\S*\s*$/.exec(first))?.[1];
@@ -7568,7 +7886,14 @@ function describeCompiler(cc) {
 }
 function compilerVersion(cc) {
 	try {
-		return execFileSync(cc, ["--version"], { encoding: "utf8" });
+		return runCompiler(cc, ["--version"], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
 	} catch {
 		return "";
 	}
@@ -7579,6 +7904,7 @@ function libraryArchive(tc, lib, building) {
 	const hash = createHash("sha256");
 	hash.update(`${tc.cc}\n${compilerVersion(tc.cc)}\n${[
 		...COMMON,
+		...CXX,
 		...tc.opt,
 		...lib.flags
 	].join(" ")}\n`);
@@ -7594,8 +7920,7 @@ function libraryArchive(tc, lib, building) {
 	try {
 		const objects = lib.sources.map((_, i) => join(work, `${i}.o`));
 		compileAll(lib.sources.map((src, i) => [
-			tc.cc,
-			...COMMON,
+			...compileCommand(tc.cc, src),
 			...tc.opt,
 			"-DNDEBUG",
 			...lib.flags,
@@ -7604,7 +7929,9 @@ function libraryArchive(tc, lib, building) {
 			"-o",
 			objects[i]
 		]));
-		execFileSync("ar", [
+		const [ar, ...arPrefix] = isZig(tc.cc) ? [command(tc.cc)[0], "ar"] : ["ar"];
+		execFileSync(ar, [
+			...arPrefix,
 			"rcs",
 			join(work, `lib${lib.name}.a`),
 			...objects
@@ -7625,6 +7952,25 @@ function libraryArchive(tc, lib, building) {
 	}
 	return archive;
 }
+const CXX = [
+	"-std=c++17",
+	"-fno-exceptions",
+	"-fno-rtti",
+	...COMMON.filter((f) => !f.startsWith("-std="))
+];
+function compileCommand(cc, src) {
+	if (!src.endsWith(".cc")) return [...command(cc), ...COMMON];
+	const cmd = command(cc);
+	if (isZig(cc)) return [...cmd.map((w) => w === "cc" ? "c++" : w), ...CXX];
+	return [
+		...cmd,
+		"-x",
+		"c++",
+		...CXX
+	];
+}
+/** Runs the compiler commands, as many at once as there are processors (in a child Node process:
+* the driver's API is synchronous; the commands on its stdin). Throws when one fails, after its output. */
 const PARALLEL = `
 const { spawn } = require("node:child_process");
 const jobs = JSON.parse(require("node:fs").readFileSync(0, "utf8"));
@@ -7675,7 +8021,7 @@ function regexpCompiler(cc) {
 	if (existsSync(tool)) return tool;
 	mkdirSync(cacheRoot(), { recursive: true });
 	const tmp = `${tool}.${process.pid}.tmp`;
-	execFileSync(cc, [
+	runCompiler(cc, [
 		"-std=c11",
 		"-O2",
 		`-I${regexp}`,
@@ -7692,9 +8038,11 @@ function regexpCompiler(cc) {
 	return tool;
 }
 /** A program's archives, in link order: the host packages' libraries, then libjsrt (which they
-*  use). Each is built the first time; `building` hears about it. */
+*  use), then the system libraries they need (-l…). Each is built the first time; `building`
+*  hears about it. */
 function programArchives(tc, hosts, building) {
-	return [...hosts.flatMap((h) => h.libraries(RUNTIME_INCLUDE)).filter((l) => l.sources.length), ...runtimeLibraries()].map((l) => libraryArchive(tc, l, building));
+	const libraries = [...hosts.flatMap((h) => h.libraries(RUNTIME_INCLUDE)).filter((l) => l.sources.length), ...runtimeLibraries()];
+	return [...libraries.map((l) => libraryArchive(tc, l, building)), ...libraries.flatMap((l) => l.link ?? []).map((l) => `-l${l}`)];
 }
 /** Compiles program.c and links it with `archives` (programArchives). The linker takes only
 *  what the program reaches: a program without I/O links no libuv. The libraries keep their
@@ -7715,19 +8063,96 @@ function compileProgram(tc, cFile, output, archives, extraFlags = []) {
 		output
 	];
 	return new Promise((resolve, reject) => {
-		spawn(tc.cc, args, { stdio: [
+		let errors = "";
+		const [program, ...prefix] = command(tc.cc);
+		const child = spawn(program, [...prefix, ...args], { stdio: [
 			"ignore",
 			"inherit",
-			"inherit"
-		] }).on("error", reject).on("close", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`${tc.cc} exited with code ${code}`)));
+			"pipe"
+		] });
+		child.stderr.on("data", (chunk) => {
+			process.stderr.write(chunk);
+			errors = (errors + chunk.toString()).slice(-16384);
+		});
+		child.on("error", reject).on("close", (code) => {
+			if (code === 0) return resolve();
+			const hint = toolchainHint(errors);
+			reject(/* @__PURE__ */ new Error(`${tc.cc} exited with code ${code}${hint ? `\n  hint: ${hint}` : ""}`));
+		});
 	});
 }
+/** A hint for a compiler failure that isn't the program's fault, else undefined. */
+function toolchainHint(stderr) {
+	if (/tapi error|unknown architecture/.test(stderr)) return "the macOS SDK is newer than the linker (Command Line Tools and SDK don't match). Check `xcode-select -p`, `ld -v` and `xcrun --show-sdk-path`; reinstalling the Command Line Tools (`sudo rm -rf /Library/Developer/CommandLineTools && xcode-select --install`) or setting SDKROOT to an older SDK fixes it.";
+}
 function scratchDir() {
 	const dir = join(tmpdir(), `visaljs-${process.pid}-${Date.now()}`);
 	mkdirSync(dir, { recursive: true });
 	return dir;
 }
 //#endregion
+//#region cli/src/eval.ts
+/** Calls of the global eval that may get source text, and of the global Function (with or
+*  without new), in source order. Aliases (`const F = Function`) aren't followed. */
+function evalCalls(program, info) {
+	const out = [];
+	const global = (callee, name) => callee.type === "Identifier" && callee.name === name && info.references.get(callee)?.binding === null;
+	const walk = (node) => {
+		if (Array.isArray(node)) {
+			for (const x of node) walk(x);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		const n = node;
+		if (n.type === "CallExpression" || n.type === "NewExpression") {
+			if (global(n.callee, "Function")) out.push({
+				kind: "Function",
+				loc: n.loc
+			});
+			else if (n.type === "CallExpression" && global(n.callee, "eval") && mayBeString(n.arguments[0])) out.push({
+				kind: "eval",
+				loc: n.loc
+			});
+		}
+		for (const [key, value] of Object.entries(node)) if (key !== "loc" && value !== null && typeof value === "object") walk(value);
+	};
+	walk(program.body);
+	return out;
+}
+function mayBeString(arg) {
+	if (!arg) return false;
+	switch (arg.type) {
+		case "Literal": return typeof arg.value === "string";
+		case "BigIntLiteral":
+		case "ObjectExpression":
+		case "ArrayExpression":
+		case "FunctionExpression": return false;
+		default: return true;
+	}
+}
+/** The warning's message (null: no calls), and with `verbose` a line per call. */
+function evalWarning(calls, verbose) {
+	if (calls.length === 0) return null;
+	const n = (kind) => calls.filter((c) => c.kind === kind).length;
+	const places = (k) => `${k} ${k === 1 ? "place" : "places"}`;
+	const parts = [];
+	if (n("eval")) parts.push(`eval() of source text in ${places(n("eval"))}`);
+	if (n("Function")) parts.push(`new Function() in ${places(n("Function"))}`);
+	const owners = [...new Set(calls.map((c) => packageOf(c.loc.file) ?? "your code"))];
+	let text = `the program uses ${parts.join(" and ")} (in ${owners.join(", ")}): compiled code can't evaluate source text, so ${calls.length === 1 ? "it throws" : "they throw"} a TypeError if reached`;
+	if (verbose) text += calls.map((c) => `\n  ${c.loc.file}:${c.loc.line}:${c.loc.column}: ${c.kind === "eval" ? "eval()" : "new Function()"}`).join("");
+	else text += "\n  (--verbose lists them)";
+	return text;
+}
+/** The npm package a file belongs to: the last node_modules/<name> (or @scope/name) in its path. */
+function packageOf(file) {
+	const parts = file.split(/[\\/]/);
+	const i = parts.lastIndexOf("node_modules");
+	if (i < 0 || i + 1 >= parts.length) return null;
+	const name = parts[i + 1];
+	return name.startsWith("@") && i + 2 < parts.length ? `${name}/${parts[i + 2]}` : name;
+}
+//#endregion
 //#region cli/src/regexp.ts
 /** The program's regex literals, in source order. */
 function regexpLiterals(program) {
@@ -7764,7 +8189,7 @@ function compileRegExps(cc, literals) {
 		maxBuffer: 1 << 30
 	});
 	if (run.status !== 0) throw new Error(`regexp-compile failed: ${run.stderr || run.error?.message}`);
-	const lines = run.stdout.split("\n");
+	const lines = run.stdout.split(/\r?\n/);
 	let i = 0;
 	for (const [key, lit] of todo) {
 		const line = lines[i++] ?? "";
@@ -7839,6 +8264,10 @@ var Report = class {
 		this.#write(`${text}\n`);
 		if (this.#live && this.#running) this.#draw();
 	}
+	/** A warning, after its location (`where`, if any): printed even when quiet, its label in yellow. */
+	warn(message, where = "") {
+		this.note(`${where}${this.#paint("1;33", "warning:")} ${message}`);
+	}
 	/** The last line, given the whole build's time. */
 	finish(icon, text) {
 		if (this.#style) this.#write(`\n ${icon} ${this.#paint("1", text(since(this.#start)))}\n`);
@@ -7853,11 +8282,13 @@ var Report = class {
 		const { icon, label } = this.#running;
 		this.#write(`${CLEAR} ${this.#paint("36", FRAMES[this.#frame % FRAMES.length])} ${icon} ${this.#paint("2", `${label}…`)}`);
 	}
+	/** A multi-line `line` keeps its time on the first: the rest is detail under it. */
 	#end(line) {
 		clearInterval(this.#timer);
 		const start = this.#running.since;
 		this.#running = void 0;
-		if (this.#style) this.#write(`${this.#live ? CLEAR : ""} ${line}  ${this.#paint("2", since(start))}\n`);
+		const [first, ...rest] = line.split("\n");
+		if (this.#style) this.#write(`${this.#live ? CLEAR : ""} ${first}  ${this.#paint("2", since(start))}\n${rest.map((l) => `${l}\n`).join("")}`);
 	}
 };
 function since(start) {
@@ -7885,7 +8316,7 @@ function lineCount(text) {
 }
 //#endregion
 //#region cli/src/main.ts
-const VERSION = "0.0.2";
+const VERSION = "0.0.4";
 const USAGE = `usage: visaljs build <entry.js> [options]
 
 options:
@@ -7899,6 +8330,7 @@ options:
   --no-bundle        skip the bundler: the input is one ES module (a bundle)
   --script           compile as a classic script (sloppy mode, no bundler)
   -q, --quiet        don't report each step of the build
+  --verbose          list each place a warning is about
   --version          print the version
   --help             print this help
 `;
@@ -7926,6 +8358,7 @@ async function main(argv, io) {
 					type: "boolean",
 					short: "q"
 				},
+				verbose: { type: "boolean" },
 				version: { type: "boolean" },
 				help: {
 					type: "boolean",
@@ -7946,10 +8379,6 @@ async function main(argv, io) {
 		io.stdout(USAGE);
 		return values.help ? 0 : 2;
 	}
-	if ((io.platform ?? process.platform) === "win32") {
-		io.stderr("visaljs: Windows is not supported yet; use Linux or macOS (on Windows, WSL works)\n");
-		return 1;
-	}
 	const [command, ...rest] = positionals;
 	switch (command) {
 		case "build":
@@ -7976,9 +8405,9 @@ async function build(entry, options, io) {
 	const binary = !dump && !options["emit-c"];
 	const hosts = DEFAULT_HOSTS;
 	const primitives = hostPrimitives(hosts);
-	let cc;
+	let compilers;
 	if (binary) try {
-		cc = await report.step("🔍", "Detecting a C compiler", findCompiler, (cc) => `Detected ${describeCompiler(cc)}${process.env.CC ? " (from $CC)" : ""}`);
+		compilers = await report.step("🔍", "Detecting C compilers", findCompilers, detected);
 	} catch (e) {
 		io.stderr(`visaljs: ${e.message}\n`);
 		return 1;
@@ -7987,7 +8416,7 @@ async function build(entry, options, io) {
 	const bundled = !script && options["no-bundle"] !== true;
 	let map;
 	if (bundled) try {
-		const b = await report.step("📦", "Rolling the modules into a single file", () => bundle(entry, hosts, (message) => report.note(message)), (b) => `Rolled ${count(b.modules, "module")} into a single file (${size(Buffer.byteLength(b.code))})`);
+		const b = await report.step("📦", "Rolling the modules into a single file", () => bundle(entry, hosts, (message, where) => report.warn(message, where)), (b) => `Rolled ${count(b.modules, "module")} into a single file (${size(Buffer.byteLength(b.code))})`);
 		source = b.code;
 		if (b.map) map = new SourceMap(b.map, displayPath);
 	} catch (e) {
@@ -8003,8 +8432,10 @@ async function build(entry, options, io) {
 			return 0;
 		}
 		const info = analyze(ast);
+		const evalWarn = evalWarning(evalCalls(ast, info), options.verbose === true);
+		if (evalWarn) report.warn(evalWarn);
 		const literals = regexpLiterals(ast);
-		const regexps = literals.length ? await report.step("🧩", "Compiling the regular expressions", () => compileRegExps(cc ??= findCompiler(), literals), () => `Compiled ${count(literals.length, "regular expression")}`) : /* @__PURE__ */ new Map();
+		const regexps = literals.length ? await report.step("🧩", "Compiling the regular expressions", () => withCompiler(compilers ??= findCompilers(), report, (cc) => compileRegExps(cc, literals)), () => `Compiled ${count(literals.length, "regular expression")}`) : /* @__PURE__ */ new Map();
 		const unsupported = firstUnsupported(ast);
 		if (unsupported) throw unsupported;
 		const ir = await report.step("🔧", "Converting to IR and optimizing", () => optimize(lower(ast, info)), (ir) => `Converted ${count(ir.functions.length + 1, "function")} to IR and optimized them`);
@@ -8033,22 +8464,26 @@ async function build(entry, options, io) {
 		report.finish("📂", (time) => `Wrote ${displayPath(resolve(options["emit-c"], "program.c"))} in ${time}`);
 		return 0;
 	}
-	const output = options.output ?? basename(entry).replace(/\.[cm]?js$/, "");
-	const tc = {
-		cc,
-		opt: options.debug ? ["-O0"] : ["-O2"],
-		strip: !options.debug
-	};
+	let output = options.output ?? basename(entry).replace(/\.[cm]?js$/, "");
+	if (process.platform === "win32" && !extname(output)) output += ".exe";
+	const opt = options.debug ? ["-O0"] : ["-O2"];
 	const dir = scratchDir();
 	try {
 		const file = join(dir, "program.c");
 		writeFileSync(file, c);
-		const built = [];
-		const archives = await report.step("📚", "Preparing the runtime libraries", () => programArchives(tc, hosts, (name) => {
-			built.push(`lib${name}`);
-			report.relabel(`Building lib${name} (first build only: it's cached after)`);
-		}), () => built.length ? `Built ${built.join(", ")} (cached for next time)` : "Runtime libraries ready (cached ⚡)");
-		await report.step("🔨", `Compiling with ${describeCompiler(tc.cc)}`, () => compileProgram(tc, file, output, archives), () => `Compiled the binary (${tc.opt.join(" ")}, ${tc.strip ? "stripped" : "with debug info"})`);
+		await withCompiler(compilers, report, async (cc) => {
+			const tc = {
+				cc,
+				opt,
+				strip: !options.debug
+			};
+			const built = [];
+			const archives = await report.step("📚", "Preparing the runtime libraries", () => programArchives(tc, hosts, (name) => {
+				built.push(`lib${name}`);
+				report.relabel(`Building lib${name} with ${describeCompiler(cc)} (first build only: it's cached after)`);
+			}), () => built.length ? `Built ${built.join(", ")} (cached for next time)` : "Runtime libraries ready (cached ⚡)");
+			await report.step("🔨", `Compiling with ${describeCompiler(cc)}`, () => compileProgram(tc, file, output, archives), () => `Compiled the binary with ${describeCompiler(cc)} (${opt.join(" ")}, ${tc.strip ? "stripped" : "with debug info"})`);
+		});
 	} catch (e) {
 		io.stderr(`visaljs: C compilation failed: ${e.message}\n`);
 		return 1;
@@ -8062,12 +8497,36 @@ async function build(entry, options, io) {
 	report.finish("🎉", (time) => `Built ${displayPath(resolve(output))} in ${time}: ${size(bytes)}, ${sizeQuip(bytes)}`);
 	return 0;
 }
+/** "Detected GCC 13.3.0", else the compilers numbered in the order they're tried, under the
+*  step's line (indented to its text). */
+function detected(compilers) {
+	const names = compilers.map(describeCompiler);
+	if (names.length === 1) return `Detected ${names[0]}${process.env.CC ? " (from $CC)" : ""}`;
+	return [`Detected ${count(names.length, "C compiler")} (tried in this order, falling back to the next if one fails):`, ...names.map((name, i) => `      ${i + 1}. ${name}`)].join("\n");
+}
+/** Runs `run` with each compiler in turn until one succeeds. A failure that isn't the
+*  program's (not a CompileError) is noted and moves on to the next; the compilers that failed
+*  are dropped, so later steps start with the one that worked. The last failure is rethrown. */
+async function withCompiler(compilers, report, run) {
+	for (;;) {
+		const cc = compilers[0];
+		try {
+			return await run(cc);
+		} catch (e) {
+			if (e instanceof CompileError || compilers.length === 1) throw e;
+			compilers.shift();
+			const reason = e.message.split("\n")[0];
+			const why = reason.startsWith("Command failed") ? "" : ` (${reason})`;
+			report.note(` ⚠ ${describeCompiler(cc)} failed${why}, trying ${describeCompiler(compilers[0])}`);
+		}
+	}
+}
 /** How diagnostics and #line name an original file: relative to the working directory when
 *  it's inside it, else absolute. Code the bundler generated keeps its own name. */
 function displayPath(source) {
 	if (source.startsWith("\0")) return source.slice(1);
 	const rel = relative(process.cwd(), source);
-	return rel.startsWith("..") || isAbsolute(rel) ? source : rel;
+	return rel.startsWith("..") || isAbsolute(rel) ? normalize(source) : rel;
 }
 //#endregion
 //#region cli/src/cli.ts