visaljs 0.0.9 → 0.0.11

package/runtime/include/js_gc.h

@@ -50,24 +50,27 @@ typedef struct JSBlock {
     size_t   map_size;           /* JS_BLOCK_SIZE, or the large object's mapping */
     uint32_t cell_size;
     uint32_t cell_count;
-    uint8_t  size_class;
+    uint8_t  size_class;         /* a small block's */
     uint8_t  is_large;
-    union {
-        uint8_t queued;          /* in its class's sweep queue */
-        uint8_t remembered;      /* a large object: in the remembered set, with cards marked */
-    };
+    uint8_t  queued;             /* in its class's sweep queue */
     uint8_t  has_finalizable;
     uint32_t index_magic;        /* ceil(2^32 / cell_size): a cell's index is (offset * magic) >> 32 */
     uint8_t  young;              /* the allocator took it since the last collection */
+    uint8_t  remembered;         /* a large object: in the remembered set, with cards marked */
+    uint8_t  card_shift;         /* a large object: a card is 2^card_shift bytes of it */
     uint64_t mark_bits[JS_BITMAP_WORDS];
-    uint64_t alloc_bits[JS_BITMAP_WORDS];  /* exact only while the world is stopped */
+    union {
+        uint64_t alloc_bits[JS_BITMAP_WORDS];  /* exact only while the world is stopped */
+        /* A large object's: its one cell's allocation bit, then its cards, a bit per card that a
+         * store gave a young cell since the last collection. */
+        struct {
+            uint64_t large_alloc;
+            uint64_t cards[JS_BITMAP_WORDS - 1];
+        };
+    };
 } JSBlock;
 
-/* A large object's cards: a bit per 2^card_shift bytes of the object
- * that a store gave a young cell since the last collection. They live in the allocation bitmap,
- * whose only other bit is bit 0 of word 0. A large object's size_class is its card_shift. */
 #define JS_LARGE_CARDS ((JS_BITMAP_WORDS - 1) * 64)
-static inline uint64_t *js_large_cards(JSBlock *b) { return &b->alloc_bits[1]; }
 
 #define JS_BLOCK_FIRST_CELL \
     ((sizeof(JSBlock) + JS_CELL_ALIGN - 1) & ~(size_t)(JS_CELL_ALIGN - 1))

package/runtime/include/js_jobs.h

@@ -65,6 +65,8 @@ typedef enum JSRejectionMode {
 } JSRejectionMode;
 
 void js_enqueue_microtask(JSContext *ctx, const JSJob *job);
+/* process.nextTick's queue, which a checkpoint runs before the microtasks (Node's order) */
+void js_enqueue_tick(JSContext *ctx, const JSJob *job);
 /* The checkpoint: runs every queued job (and the ones they queue), then processes
  * unhandled rejections. A nested call does nothing. 0, or -1 after an uncaught error
  * or a strict unhandled rejection (already reported). */

package/runtime/include/js_object.h

@@ -296,10 +296,10 @@ JS_WARN_UNUSED JSValue js_own_keys(JSContext *ctx, JSObject *o);
 #define JS_IC_EMPTY  0
 #define JS_IC_OWN    1  /* get: an own data property; set: an own writable data property */
 #define JS_IC_PROTO  2  /* get: a data property of `holder`, `depth` prototypes up */
-#define JS_IC_ADD    3  /* set: adding the key takes the receiver from `shape` to `next` */
+#define JS_IC_ADD    3  /* set: adding the key takes the receiver from `shape` to `next`; `depth` prototypes up to null, or to one whose writable data property it shadows */
 #define JS_IC_GETTER 4  /* get: an accessor of `holder` (NULL: the receiver), `depth` prototypes up */
 #define JS_IC_ABSENT 5  /* get: no such property on the receiver or its `depth` prototypes (the last's proto is null) */
-#define JS_IC_MAX_DEPTH 4
+#define JS_IC_MAX_DEPTH 8  /* prototypes a cache can check: Node's sockets are 6 deep (Socket, Duplex, Readable, Stream, EventEmitter, Object) */
 
 /* One per property access site with a constant named key; a site is either a get or a
  * set. Monomorphic: a miss refills it. Never caches dictionary shapes (their layout
@@ -314,7 +314,7 @@ typedef struct JSPropCache {
     JSShape  *fast;                     /* OWN, inline slot: the receiver shape; else NULL */
     uint16_t  fast_off;                 /* with `fast`: the slot's byte offset in the object */
     uint8_t   kind;                     /* JS_IC_* */
-    uint8_t   depth;                    /* PROTO: hops to the holder; ADD: prototypes up to null */
+    uint8_t   depth;                    /* PROTO: hops to the holder; ADD: prototypes checked (JS_IC_ADD) */
     uint32_t  slot;                     /* OWN, PROTO: the slot */
     JSShape  *shape;                    /* receiver shape; NULL = empty */
     JSObject *holder;                   /* PROTO */
@@ -326,6 +326,8 @@ typedef struct JSPropCache {
 /* A module's caches, once at startup (the GC resets them weakly). */
 void js_register_prop_caches(JSRuntime *rt, JSPropCache *ics, size_t n);
 
+/* The slow paths of a named access: `ic` is the site's cache, or NULL for a computed key's access
+ * (the runtime's shared caches only). */
 JS_WARN_UNUSED JSValue js_get_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic);
 JS_WARN_UNUSED int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSPropCache *ic);
 
@@ -373,6 +375,22 @@ static inline int js_set_prop(JSContext *ctx, JSValue obj, JSValue key, JSValue
     return js_set_prop_slow(ctx, obj, key, v, strict, ic);
 }
 
+/* obj[key] and obj[key] = v at a site whose key is most likely always the same symbol or string
+ * (the optimizer's guess: a module binding stored once, as Node's kState). `site` holds the key
+ * the site's cache is for (EMPTY: none yet): while the key is that one, the access is a named
+ * access's, inline cache and all. Another key the slow path makes the site's, or, when it isn't
+ * a property key already (an index, a string not interned), accesses generically. */
+JS_WARN_UNUSED JSValue js_get_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic);
+JS_WARN_UNUSED int js_set_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic);
+static inline JSValue js_get_keyed(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (JS_LIKELY(js_same_bits(key, *site))) return js_get_prop(ctx, obj, key, ic);
+    return js_get_keyed_slow(ctx, obj, key, site, ic);
+}
+static inline int js_set_keyed(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic) {
+    if (JS_LIKELY(js_same_bits(key, *site))) return js_set_prop(ctx, obj, key, v, strict, ic);
+    return js_set_keyed_slow(ctx, obj, key, v, strict, site, ic);
+}
+
 /* An object's new shape. When the object is a prototype, caches that checked the chain it's on
  * may be stale: the runtime's proto_epoch moves on. */
 static JS_FAST_PATH void js_object_set_shape(JSContext *ctx, JSObject *o, JSShape *s) {
@@ -475,6 +493,64 @@ static inline JSValue js_get_length(JSContext *ctx, JSValue obj, JSValue key, JS
     if (js_is_string(obj)) return js_int32((int32_t)js_string_length(obj));  /* below 2^30 */
     return js_get_prop(ctx, obj, key, ic);
 }
+/* ---- Static code's arrays ("use static": number[], string[], boolean[]) ------------------ */
+
+/* An element's kind (an i32[] is a number[] whose reads the code converts). tsc's element types
+ * aren't sound (a cast, an i32[] alias of a number[]), so every read checks it: a read's value is
+ * of the kind or the read throws. An index past the end is a RangeError, never undefined or a hole. */
+enum { JS_SARRAY_NUMBER, JS_SARRAY_STRING, JS_SARRAY_BOOLEAN };
+
+static inline bool js_sarray_is(JSValue v, int kind) {
+    switch (kind) {
+        case JS_SARRAY_NUMBER: return js_is_number(v);
+        case JS_SARRAY_STRING: return !js_is_empty(v) && js_is_string(v);
+        default: return js_is_bool(v);
+    }
+}
+/* A Number key as an index: -1 (past every end) when it isn't one. */
+static inline int64_t js_sarray_index_f64(double key) {
+    return key >= 0 && key < 4294967295.0 && (double)(int64_t)key == key ? (int64_t)key : -1;
+}
+static inline int64_t js_sarray_index(JSValue key) {
+    return js_is_int32(key) ? js_as_int32(key) : js_sarray_index_f64(js_as_number(key));
+}
+JS_WARN_UNUSED JSValue js_sarray_get_slow(JSContext *ctx, JSValue arr, int64_t i, int kind);
+JS_WARN_UNUSED int js_sarray_set_slow(JSContext *ctx, JSValue arr, int64_t i, JSValue v, int kind);
+JS_WARN_UNUSED JSValue js_sarray_length_slow(JSContext *ctx, JSValue arr);
+JS_WARN_UNUSED JSValue js_sarray_push_slow(JSContext *ctx, JSValue arr, JSValue v, int kind);
+
+static JS_FAST_PATH JSValue js_sarray_get(JSContext *ctx, JSValue arr, int64_t i, int kind) {
+    if (JS_LIKELY(js_is_array(arr))) {
+        JSElements *d = js_as_object(arr)->elements;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && (uint64_t)i < d->length && js_sarray_is(d->data[i], kind))) return d->data[i];
+    }
+    return js_sarray_get_slow(ctx, arr, i, kind);
+}
+/* a[i] = v: at the length, a push; past it, a RangeError. */
+static JS_FAST_PATH int js_sarray_set(JSContext *ctx, JSValue arr, int64_t i, JSValue v, int kind) {
+    if (JS_LIKELY(js_is_array(arr) && js_sarray_is(v, kind))) {
+        JSElements *d = js_as_object(arr)->elements;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && (uint64_t)i < d->length && !js_is_empty(d->data[i]))) {
+            js_store(ctx, &d->cell, &d->data[i], v);
+            return 1;
+        }
+    }
+    return js_sarray_set_slow(ctx, arr, i, v, kind);
+}
+/* a.length, an int32 (a longer array is a RangeError). */
+static JS_FAST_PATH JSValue js_sarray_length(JSContext *ctx, JSValue arr) {
+    if (JS_LIKELY(js_is_array(arr) && js_array_length(js_as_object(arr)) <= INT32_MAX)) return js_int32((int32_t)js_array_length(js_as_object(arr)));
+    return js_sarray_length_slow(ctx, arr);
+}
+/* a.push(v): the new length, an int32. */
+static JS_FAST_PATH JSValue js_sarray_push(JSContext *ctx, JSValue arr, JSValue v, int kind) {
+    if (JS_LIKELY(js_is_array(arr) && js_sarray_is(v, kind) && js_array_length(js_as_object(arr)) < INT32_MAX)) {
+        if (JS_UNLIKELY(js_array_push(ctx, js_as_object(arr), v) < 0)) return JS_EXCEPTION;
+        return js_int32((int32_t)js_array_length(js_as_object(arr)));
+    }
+    return js_sarray_push_slow(ctx, arr, v, kind);
+}
+
 /* delete obj[key]: true or false (sloppy), a TypeError when strict and not deletable.
  * `key` is a property key; js_delete_elem converts it first. */
 JS_WARN_UNUSED JSValue js_delete_value(JSContext *ctx, JSValue obj, JSValue key, bool strict);

package/runtime/include/js_ops.h

@@ -46,6 +46,33 @@ JS_WARN_UNUSED JSValue js_ge(JSContext *ctx, JSValue a, JSValue b);
 /* ===, !==: never throw (strings compare by content). */
 bool js_strict_equals(JSContext *ctx, JSValue a, JSValue b);
 static inline JSValue js_strict_eq(JSContext *ctx, JSValue a, JSValue b) { return js_bool(js_strict_equals(ctx, a, b)); }
+/* A Number as a typed file's ("use static") int, an int64_t: truncated toward zero and wrapped
+ * modulo 2^64, as ToInt32 is for 32 bits; NaN and the infinities 0 (a plain C conversion of those
+ * would be undefined behaviour). */
+static inline int64_t js_f64_to_i64(double d) {
+    if (d >= -9223372036854775808.0 && d < 9223372036854775808.0) return (int64_t)d;
+    if (d != d || d == INFINITY || d == -INFINITY) return 0;
+    double m = fmod(trunc(d), 18446744073709551616.0);  /* exact: d is an integer this large */
+    if (m < 0) m += 18446744073709551616.0;
+    return (int64_t)(uint64_t)m;
+}
+/* A Number value as an int; anything else (typed code's caller passed it unchecked) 0. */
+static inline int64_t js_value_to_i64(JSValue v) {
+    if (js_is_int32(v)) return js_as_int32(v);
+    return js_is_number(v) ? js_f64_to_i64(js_as_number(v)) : 0;
+}
+
+/* v === d, d a number literal (not NaN): v is a Number of that value (0 and -0 alike). */
+static inline bool js_strict_eq_num(JSValue v, double d) {
+    if (js_is_int32(v)) return (double)js_as_int32(v) == d;
+    return js_is_number(v) && js_as_number(v) == d;
+}
+
+/* a === s, s a string literal: an atom, so a string with its units is s itself unless it isn't
+ * interned */
+static inline bool js_strict_eq_atom(JSContext *ctx, JSValue a, JSValue s) {
+    return js_same_bits(a, s) || (js_is_string(a) && !js_is_atom(a) && js_string_equals(ctx, a, s));
+}
 static inline JSValue js_strict_ne(JSContext *ctx, JSValue a, JSValue b) { return js_bool(!js_strict_equals(ctx, a, b)); }
 
 /* A switch whose cases are all string literals: the index of the first case `v` is === to, or

package/runtime/include/js_runtime.h

@@ -17,6 +17,7 @@
 #include "js_console.h"
 #include "js_ops.h"
 #include "js_object.h"
+#include "js_buffer.h"
 #include "js_function.h"
 #include "js_error.h"
 #include "js_generator.h"

package/runtime/include/js_web.h

@@ -13,9 +13,6 @@
 JS_WARN_UNUSED JSValue js_throw_node_error(JSContext *ctx, JSErrorKind kind, const char *code, const char *fmt, ...);
 /* ERR_INVALID_THIS: `Value of "this" must be of type TextDecoder`. */
 JS_WARN_UNUSED JSValue js_throw_invalid_this(JSContext *ctx, const char *type);
-/* ERR_INVALID_ARG_TYPE: `The "dest" argument must be <expected>. Received …` (Node's wording
- * of the value). */
-JS_WARN_UNUSED JSValue js_throw_invalid_arg_type(JSContext *ctx, const char *name, const char *expected, JSValue value);
 /* Node's "Received …" tail for a value: " Received type number (1)", " Received an instance of
  * Array", " Received undefined". */
 void js_node_received(JSContext *ctx, JSValue v, char *buf, size_t cap);

package/runtime/include/jscontext.h

@@ -189,6 +189,7 @@ struct JSRuntime {
     JSValue   symbol_registry;  /* Symbol.for's GlobalSymbolRegistry: key -> symbol (a root) */
     uintptr_t stack_limit;  /* lowest usable stack address, margin included */
     JSJobQueue jobs;        /* microtasks */
+    JSJobQueue ticks;       /* process.nextTick's: each checkpoint runs them all before the microtasks (Node's) */
     JSTimers  timers;       /* setTimeout / setInterval */
     /* The async context: an opaque value the host keeps per chain of async work
      * (node:async_hooks' AsyncLocalStorage keeps its stores in it). Every job, timer and promise
@@ -226,6 +227,12 @@ struct JSRuntime {
     const JSBigIntOps *bigint;  /* set by the bigint component */
     /* A typed array's length now: -1 when out of bounds (detached), -2 for anything else. */
     double  (*typed_array_length)(JSValue v);
+    /* Set by typed arrays: obj[i] and obj[i] = d (a Number) of a typed array, inline, for an index
+     * in bounds and an element that is a Number (not a BigInt): true when done; false for
+     * anything else, which takes the generic path. */
+    bool    (*typed_array_get)(JSValue v, int32_t i, JSValue *out);
+    bool    (*typed_array_set)(JSValue v, int32_t i, double d);
+    const struct JSClass *typed_array_class;  /* set by typed arrays: js_buffer.h's inline element access tests it */
     /* Set by typed arrays: a typed array's or DataView's bytes (its current window), true; false
      * for anything else (an ArrayBuffer too: process.stdout.write takes views only). */
     bool    (*view_bytes)(JSValue v, uint8_t **data, size_t *length);
@@ -240,6 +247,7 @@ struct JSContext {
     uint8_t    barrier_threshold; /* js_store's slow path runs for an owner whose GC byte is this or more */
     JSValue    intrinsics[JS_INTRINSIC_COUNT];
     JSContext *next_realm;
+    struct JSShape *array_shape;  /* the root shape of its arrays with Array.prototype (js_new_array), made at the first */
 };
 
 JSRuntime *js_runtime_new(void);

package/runtime/src/builtins.c

@@ -793,7 +793,7 @@ CORE(object_proto_lookup_setter) {
 
 /* ---- Function.prototype (§20.2.3) --------------------------------------------------------------- */
 
-BUILTIN(function_proto_call) {
+JSValue js_function_proto_call(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.call called on a non-function");
     return js_call(ctx, this_val, ARG(0), argc > 1 ? argc - 1 : 0, argv + (argc > 1 ? 1 : argc));
@@ -822,10 +822,23 @@ static JSValueArray *list_from_array_like(JSContext *ctx, JSValue v) {
 
 JSValueArray *js_list_from_array_like(JSContext *ctx, JSValue v) { return list_from_array_like(ctx, v); }
 
-BUILTIN(function_proto_apply) {
+JSValue js_function_proto_apply(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.apply was called on a non-function");
     if (js_is_nullish(ARG(1))) return js_call(ctx, this_val, ARG(0), 0, NULL);
+    /* a short dense array without holes (emit's arguments): its elements are its own data
+     * properties, so reading them can't run code. Copied, as the callee may change the array. */
+    if (js_is_array(ARG(1))) {
+        JSObject *a = js_as_object(ARG(1));
+        JSElements *e = a->elements;
+        uint32_t n = js_array_length(a);
+        JSValue args[8];
+        if (e->kind == JS_ELEMENTS_DENSE && e->length == n && n <= 8) {
+            uint32_t i = 0;
+            while (i < n && !js_is_empty(e->data[i])) args[i] = e->data[i], i++;
+            if (i == n) return js_call(ctx, this_val, ARG(0), n, args);
+        }
+    }
     JSValueArray *list = list_from_array_like(ctx, ARG(1));
     if (!list) return JS_EXCEPTION;
     JSValue r = js_call(ctx, this_val, ARG(0), list->cell.aux, list->values);
@@ -959,8 +972,8 @@ void js_builtins_realm_init(JSContext *ctx, JSObject *global) {
 
     JSValue object = define_constructor(ctx, global, "Object", object_ctor, 1, in[JS_INTRINSIC_OBJECT_PROTOTYPE]);
     static const JSBuiltin function_proto[] = {
-        JS_BUILTIN_FN("call", function_proto_call, 1),
-        JS_BUILTIN_FN("apply", function_proto_apply, 2),
+        JS_BUILTIN_FN("call", js_function_proto_call, 1),
+        JS_BUILTIN_FN("apply", js_function_proto_apply, 2),
         JS_BUILTIN_FN("bind", function_proto_bind, 1),
         JS_BUILTIN_FN("toString", function_proto_to_string, 0),
     };

package/runtime/src/crypto_internal.h

@@ -267,6 +267,7 @@ const char *js_ec_curve_jwk(int curve);
 typedef enum JSWebAlg {
     JS_WEB_HMAC = 1, JS_WEB_PBKDF2, JS_WEB_HKDF, JS_WEB_AES_CTR, JS_WEB_AES_CBC, JS_WEB_AES_GCM, JS_WEB_AES_KW,
     JS_WEB_RSASSA, JS_WEB_RSA_PSS, JS_WEB_RSA_OAEP, JS_WEB_ECDSA, JS_WEB_ECDH, JS_WEB_X25519, JS_WEB_ED25519,
+    JS_WEB_CHACHA20_POLY1305,
 } JSWebAlg;
 
 /* KeyUsage, as bits in this order */

package/runtime/src/crypto_subtle.c

@@ -226,14 +226,15 @@ static int arg_enum(Call *c, JSValue v, const char *const *values, int count, co
                                     c->op, where, shown, type));
 }
 
-enum { FORMAT_RAW, FORMAT_SPKI, FORMAT_PKCS8, FORMAT_JWK };
-static const char *const FORMATS[] = { "raw", "spki", "pkcs8", "jwk" };
+/* the raw-* formats (Node 24's, from WebCrypto's Modern Algorithms draft) say which key raw is */
+enum { FORMAT_RAW, FORMAT_SPKI, FORMAT_PKCS8, FORMAT_JWK, FORMAT_RAW_PUBLIC, FORMAT_RAW_PRIVATE, FORMAT_RAW_SEED, FORMAT_RAW_SECRET };
+static const char *const FORMATS[] = { "raw", "spki", "pkcs8", "jwk", "raw-public", "raw-private", "raw-seed", "raw-secret" };
 static const char *const USAGES[] = { "encrypt", "decrypt", "sign", "verify", "deriveKey", "deriveBits", "wrapKey", "unwrapKey" };
 
 static int arg_format(Call *c, JSValue v, int i) {
     char where[32];
     snprintf(where, sizeof where, "%s argument", ORDINALS[i]);
-    return arg_enum(c, v, FORMATS, 4, "KeyFormat", where);
+    return arg_enum(c, v, FORMATS, 8, "KeyFormat", where);
 }
 
 /* sequence<KeyUsage>: a new array of the strings, in order (duplicates kept, as Node keeps them),
@@ -373,7 +374,7 @@ typedef enum Op {
 
 /* Parameter dictionaries, and their members (alphabetical, as WebIDL converts them) */
 typedef enum Dict {
-    DICT_NONE, DICT_HMAC_IMPORT, DICT_HMAC_KEYGEN, DICT_PBKDF2, DICT_HKDF, DICT_AES_CBC, DICT_AES_CTR, DICT_AES_GCM, DICT_AES_KEYGEN,
+    DICT_NONE, DICT_HMAC_IMPORT, DICT_HMAC_KEYGEN, DICT_PBKDF2, DICT_HKDF, DICT_AES_CBC, DICT_AES_CTR, DICT_AES_GCM, DICT_AEAD, DICT_AES_KEYGEN,
     DICT_AES_DERIVED, DICT_RSA_HASHED_IMPORT, DICT_RSA_HASHED_KEYGEN, DICT_RSA_PSS, DICT_RSA_OAEP, DICT_EC_IMPORT, DICT_EC_KEYGEN,
     DICT_ECDSA, DICT_ECDH_DERIVE,
 } Dict;
@@ -402,6 +403,7 @@ static const struct {
     [DICT_AES_CBC] = { "AesCbcParams", { M_IV, M_END }, 1, 0 },
     [DICT_AES_CTR] = { "AesCtrParams", { M_COUNTER, M_LENGTH, M_END }, 3, 255 },
     [DICT_AES_GCM] = { "AesGcmParams", { M_ADDITIONAL_DATA, M_IV, M_TAG_LENGTH, M_END }, 2, 0 },
+    [DICT_AEAD] = { "AeadParams", { M_ADDITIONAL_DATA, M_IV, M_TAG_LENGTH, M_END }, 2, 0 },
     [DICT_AES_KEYGEN] = { "AesKeyGenParams", { M_LENGTH, M_END }, 1, 65535 },
     [DICT_AES_DERIVED] = { "AesDerivedKeyParams", { M_LENGTH, M_END }, 1, 65535 },
     [DICT_RSA_HASHED_IMPORT] = { "RsaHashedImportParams", { M_HASH, M_END }, 1, 0 },
@@ -446,6 +448,8 @@ static const struct {
       { [OP_IMPORT_KEY] = DICT_EC_IMPORT, [OP_GENERATE_KEY] = DICT_EC_KEYGEN, [OP_DERIVE_BITS] = DICT_ECDH_DERIVE } },
     { "X25519", JS_WEB_X25519, KEY_OPS | BIT(OP_DERIVE_BITS), { [OP_DERIVE_BITS] = DICT_ECDH_DERIVE } },
     { "Ed25519", JS_WEB_ED25519, KEY_OPS | BIT(OP_SIGN) | BIT(OP_VERIFY), { 0 } },
+    { "ChaCha20-Poly1305", JS_WEB_CHACHA20_POLY1305, BIT(OP_IMPORT_KEY) | BIT(OP_GENERATE_KEY) | BIT(OP_ENCRYPT) | BIT(OP_DECRYPT),
+      { [OP_ENCRYPT] = DICT_AEAD, [OP_DECRYPT] = DICT_AEAD } },
 };
 
 /* A normalized algorithm: its registry entry and the members its dictionary has. */
@@ -714,6 +718,7 @@ static bool is_aes(uint8_t alg) { return alg >= JS_WEB_AES_CTR && alg <= JS_WEB_
 /* A JWK's `alg` for a secret key: HS256, A128GCM, … */
 static void jwk_alg(uint8_t alg, const JSHashAlg *hash, uint32_t length, char *out, size_t cap) {
     if (alg == JS_WEB_HMAC) snprintf(out, cap, "HS%s", hash->web + 4);
+    else if (alg == JS_WEB_CHACHA20_POLY1305) snprintf(out, cap, "C20P");
     else snprintf(out, cap, "A%u%s", length, web_alg_name(alg) + 4);
 }
 
@@ -728,6 +733,14 @@ static JSValue aes_algorithm(JSContext *ctx, const char *name, uint32_t length)
     return o;
 }
 
+/* a secret key's algorithm object: { name, length } for AES; ChaCha20-Poly1305's, { name } */
+static JSValue secret_algorithm(JSContext *ctx, uint8_t alg, const char *name, uint32_t length) {
+    if (alg != JS_WEB_CHACHA20_POLY1305) return aes_algorithm(ctx, name, length);
+    JSValue a = js_new_object(ctx);
+    put(ctx, a, "name", str(ctx, name));
+    return a;
+}
+
 static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JWK *jwk, Params *p, bool extractable, JSValue usages,
                           uint16_t mask) {
     uint8_t alg = params_alg(p);
@@ -750,7 +763,7 @@ static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JW
         return dom_error(ctx, "NotSupportedError", m);
     }
     uint32_t length = (uint32_t)raw.n * 8;
-    if (length != 128 && length != 192 && length != 256) {
+    if (alg == JS_WEB_CHACHA20_POLY1305 ? length != 256 : length != 128 && length != 192 && length != 256) {
         bytes_free(&raw);
         return dom_error(ctx, "DataError", "Invalid key length");
     }
@@ -764,7 +777,7 @@ static JSValue import_aes(JSContext *ctx, int format, JSValue key_data, const JW
     }
     JSValue data = js_new_secret_key(ctx, raw.p, raw.n);
     bytes_free(&raw);
-    return js_new_crypto_key(ctx, data, alg, NULL, length, aes_algorithm(ctx, p->name, length), usages, mask, extractable);
+    return js_new_crypto_key(ctx, data, alg, NULL, length, secret_algorithm(ctx, alg, p->name, length), usages, mask, extractable);
 }
 
 /* ---- Asymmetric keys: RSA, EC, X25519 and Ed25519 ------------------------------------------------- */
@@ -1048,6 +1061,18 @@ static JSValue generate_asym(JSContext *ctx, Params *p, bool extractable, uint16
     return pair;
 }
 
+/* A raw-* format as raw for the algorithm it fits (raw-secret: a secret key's; raw-public: an EC,
+ * X25519 or Ed25519 public key's), other formats as they are; -1 where it doesn't fit (raw-private
+ * and raw-seed are ML-DSA's and ML-KEM's). */
+static int raw_alias(int alg, int format) {
+    if (format == FORMAT_RAW && alg == JS_WEB_CHACHA20_POLY1305) return -1;  /* Node: raw-secret only */
+    if (format < FORMAT_RAW_PUBLIC) return format;
+    bool secret = !is_asym_alg(alg);
+    if (format == FORMAT_RAW_SECRET && secret) return FORMAT_RAW;
+    if (format == FORMAT_RAW_PUBLIC && !secret && alg != JS_WEB_RSASSA && alg != JS_WEB_RSA_PSS && alg != JS_WEB_RSA_OAEP) return FORMAT_RAW;
+    return -1;
+}
+
 /* importKey's steps after the `this` check, for subtle.importKey and deriveKey. */
 static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
     Call c = { ctx, "importKey" };
@@ -1066,6 +1091,14 @@ static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
         params_free(&p);
         return JS_EXCEPTION;
     }
+    int raw = raw_alias(REGISTRY[p.entry].alg, format);
+    if (raw < 0) {
+        char m[96];
+        snprintf(m, sizeof m, "Unable to import %s using %s format", p.name, FORMATS[format]);
+        params_free(&p);
+        return dom_error(ctx, "NotSupportedError", m);
+    }
+    format = raw;
     JSValue key;
     switch (REGISTRY[p.entry].alg) {
     case JS_WEB_HMAC:
@@ -1075,6 +1108,7 @@ static JSValue import_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
     case JS_WEB_AES_CBC:
     case JS_WEB_AES_GCM:
     case JS_WEB_AES_KW:
+    case JS_WEB_CHACHA20_POLY1305:
         key = import_aes(ctx, format, argv[1], &jwk, &p, extractable, usages, mask);
         break;
     case JS_WEB_RSASSA:
@@ -1121,6 +1155,14 @@ static JSValue export_key(JSContext *ctx, uint32_t argc, const JSValue *argv) {
         return dom_error(ctx, "NotSupportedError", m);
     }
     if (!k->extractable) return dom_error(ctx, "InvalidAccessError", "key is not extractable");
+    int raw = raw_alias(k->alg, format);
+    if (raw < 0 || (format == FORMAT_RAW_PUBLIC && js_key_data(k->data)->type != JS_KEY_PUBLIC)) {
+        uint8_t type = js_key_data(k->data)->type;
+        snprintf(m, sizeof m, "Unable to export %s %s key using %s format", web_alg_name(k->alg),
+                 type == JS_KEY_SECRET ? "secret" : type == JS_KEY_PUBLIC ? "public" : "private", FORMATS[format]);
+        return dom_error(ctx, "NotSupportedError", m);
+    }
+    format = raw;
     if (is_asym_alg(k->alg)) return export_asym(ctx, format, k);
     JSKeyData *d = js_key_data(k->data);
     if (format == FORMAT_RAW) return array_buffer_of(ctx, d->bytes, d->len);
@@ -1229,6 +1271,9 @@ static JSValue generate_key(JSContext *ctx, uint32_t argc, const JSValue *argv)
         if (p.has_length && p.length == 0) return dom_error(ctx, "OperationError", "HmacKeyGenParams.length cannot be 0");
         length = p.has_length ? p.length : (uint32_t)p.hash->block_len * 8;
         if (has_any_not_in(mask, JS_USAGE_SIGN | JS_USAGE_VERIFY)) return dom_error(ctx, "SyntaxError", "Unsupported key usage for HMAC key");
+    } else if (alg == JS_WEB_CHACHA20_POLY1305) {
+        length = 256;
+        if (has_any_not_in(mask, aes_usages(alg))) return usage_error(ctx, p.name);
     } else {
         length = p.length;
         if (length != 128 && length != 192 && length != 256)
@@ -1245,7 +1290,7 @@ static JSValue generate_key(JSContext *ctx, uint32_t argc, const JSValue *argv)
     JSValue data = js_new_secret_key(ctx, bytes, n);
     free(bytes);
     if (js_array_length(js_as_object(usages)) == 0) return dom_error(ctx, "SyntaxError", "Usages cannot be empty when creating a key.");
-    JSValue algorithm = alg == JS_WEB_HMAC ? hmac_algorithm(ctx, p.hash, length) : aes_algorithm(ctx, p.name, length);
+    JSValue algorithm = alg == JS_WEB_HMAC ? hmac_algorithm(ctx, p.hash, length) : secret_algorithm(ctx, alg, p.name, length);
     return js_new_crypto_key(ctx, data, alg, p.hash, length, algorithm, usages, mask, extractable);
 }
 
@@ -1564,6 +1609,20 @@ static JSValue aes_cipher(JSContext *ctx, bool encrypt, JSCryptoKey *k, Params *
                                   data->p, data->n - tag_n, &out);
         break;
     }
+    case JS_WEB_CHACHA20_POLY1305: {
+        uint32_t tag_bits = p->has_tag_length ? p->tag_length : 128;
+        if (tag_bits != 128) {
+            char m[64];
+            snprintf(m, sizeof m, "%u is not a valid ChaCha20-Poly1305 tag length", tag_bits);
+            return dom_error(ctx, "OperationError", m);
+        }
+        if (p->iv.n != 12) return dom_error(ctx, "OperationError", "algorithm.iv must contain exactly 12 bytes");
+        if (!encrypt && data->n < 16) return op_failed(ctx);
+        const JSCipherAlg *alg = js_cipher_by_name("chacha20-poly1305");
+        ok = encrypt ? run_cipher(alg, true, d, p->iv.p, 12, 16, &p->additional_data, NULL, 0, data->p, data->n, &out)
+                     : run_cipher(alg, false, d, p->iv.p, 12, 16, &p->additional_data, data->p + data->n - 16, 16, data->p, data->n - 16, &out);
+        break;
+    }
     default: { /* AES-KW, with RFC 3394's default IV */
         static const uint8_t KW_IV[8] = { 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 };
         ok = run_cipher(js_cipher_aes(JS_CIPHER_WRAP, d->len), encrypt, d, KW_IV, 8, -1, NULL, NULL, 0, data->p, data->n, &out);