* fix(runtime): trust Windows root certificates
- Load default TLS roots from the Windows ROOT store.
- Link crypt32 for Windows TLS builds.
- Cover the certificate-store import in cross-build tests.
Co-authored-by: Kayakyx <Kayakyx@users.noreply.github.com>
* fix Windows CA store policy handling
* fix(runtime): cover Windows policy root stores
* fix(runtime): dedupe Windows root stores
* fix(tls): match Windows system CA stores
---------
Co-authored-by: Kayakyx <Kayakyx@users.noreply.github.com>
What we did:
- Add the compiler and runtime support required to build the real Portless CLI as a fully static native binary and run its proxy, alias, framework, parallel-registration, and process-cleanup workflows without Node.
- Support Portless's dual HTTP/1.1 and HTTP/2 secure-server graph, including ALPN dispatch, shared request/connect listeners, HTTP/2 CONNECT responses, enableConnectProtocol settings, req.stream access, session errors, and the required ownership and lifecycle handling.
- Lower Portless's indexed absence probes, strict indexed comparisons, optional chains, server options, and container patterns. Preserve Node-style self-reexecution and correctly frame forwarded chunked responses.
- Add focused corpus and server differentials plus an isolated-copy acceptance harness that builds and exercises the pinned Portless checkout in plain and sanitized modes without modifying the external checkout.
- Validate the static binary against Portless's official e2e suite: all 13 files and 16 tests pass.
What we decided was out of scope:
- Broader HTTP/2 client policy, lifecycle compatibility, protocol validation, listener overloads, and unrelated HTTP/2 completeness.
- General runtime-optional soundness beyond the Portless paths. Making that mechanism generally sound requires function-scoped tracking so reused local IDs cannot leak optional state between functions, assignment-aware tracking so writing a definitely present value clears hidden undefined state, and correct preservation across generators, modules, and finally blocks. That larger cross-cutting change remains a dedicated follow-up.
- Removing the self-reexecution heuristic's inherent ambiguity. A direct invocation whose first user argument canonically names the executable is currently treated as Node's repeated script slot and collapsed. An explicit native reexec marker can address that in future work.
* Support static HTTP server timeout properties
- Lower typed timeout property reads and writes through both native backends.
- Store Node-compatible defaults independently on each HTTP/HTTPS server.
- Cover defaults and assignments with differential corpus tests.
Co-authored-by: Eli Sterling <240321107+eli-sterling@users.noreply.github.com>
* Support keep-alive timeout buffer property
* Fix HTTP server timeout property lowering
* fix: scope HTTP server timeout handling
* fix: preserve HTTP server timeout semantics
---------
Co-authored-by: Eli Sterling <240321107+eli-sterling@users.noreply.github.com>
* feat(fs): expose Stats disk metadata
- Lower blocks, nlink, and atimeMs through the C and LLVM backends.
- Populate path, promise, file-handle, and dynamic bridge stats across supported platforms.
- Add differential, declaration, and npm bridge coverage.
Co-authored-by: I Plan Websites <787729+iplanwebsites@users.noreply.github.com>
* fix(fs): keep Windows stats snapshots coherent
* fix(fs): preserve Windows lstat metadata
* fix(fs): validate Windows mount point payloads
---------
Co-authored-by: I Plan Websites <787729+iplanwebsites@users.noreply.github.com>
* feat: support process write callback and encoding args
- Lower static stdout and stderr writes with encoding and callback overloads.
- Schedule completion callbacks through the next-tick queue in C and LLVM builds.
- Cover encoding aliases, ordering, and async-free refusal behavior.
* fix: handle omitted process write arguments
* feat: support fs/promises FileHandle
- Add static lowering and typing for fs/promises.open and the supported FileHandle surface.
- Implement FileHandle ownership and I/O across the C runtime and C/LLVM backends.
- Add differential corpus coverage and refresh the supported-surface manifest.
* fix fs file handle argument handling
* fix fs file handle validation
* fix(fs): preserve FileHandle read error codes
* fix(runtime): match empty FileHandle buffer behavior
* feat(fs): support static writeSync
- Lower Buffer-window and UTF-8 string overloads through the C and LLVM backends.
- Match Node's positioned and current-offset write behavior, validation, and errors.
- Add differential corpus coverage and publish the static surface manifest entry.
* fix(fs): preserve writeSync runtime semantics
* fix fs.writeSync error parity
* fix fs write descriptor errors
* feat(fs): support static rename APIs
- Lower fs.rename, fs.renameSync, and fs/promises.rename through the C and LLVM backends.
- Add runtime callback, error, and promise handling for rename operations.
- Cover typed and check-JS usage with differential corpus tests.
Co-authored-by: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
* fix Windows rename semantics
* fix: move callback rename work off main thread
* fix(runtime): preserve rename callback checkpoints
---------
Co-authored-by: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
* Support static util.parseArgs
- Lower typed util.parseArgs calls through the C and LLVM backends.
- Add a link-gated native parser with Node-compatible options, tokens, defaults, and errors.
- Cover ESM, CommonJS, default argv, sanitizer, and TS7 behavior.
* fix(runtime): align parseArgs behavior with Node
* fix(runtime): close parseArgs parity gaps
* fix(runtime): match parseArgs edge cases
* fix(runtime): preserve parseArgs short and default semantics
- Add native RequestInit, AbortSignal, and streaming request and response body support.
- Lower the static fetch surface through both C and LLVM without the embedded engine.
- Add differential, Node-typing, sanitizer, and regression coverage.
- `http.get("http://host/path")` and its https spelling now compile. The declarations only described the options-record form, so the first thing a from-scratch client writes was a type error — the shape worked under --dynamic, where the engine does not consult our declarations, which is how it read as a hello-world failure.
- A URL object is accepted the same way, as its href through the same parse. An unparsable input is the WHATWG "Invalid URL" TypeError and a scheme that is not the calling module's is ERR_INVALID_PROTOCOL, both catchable, matching Node rather than silently upgrading the dial.
- `request` and `get` take one signature with a union first parameter instead of Node's two overloads: `tls ? https.request : http.request` unions two function types, and resolving a call on that union collapses each side to a single signature, so an overload set misresolves in either declaration order. The lowering dispatches on the argument's own type.
- Both rows run on the LLVM backend, and the tls CA-store entries joined it too — the omission there was stale, so 2557-tls-ca-store moved off the C lane with identical output.
- Corpus 2644 and 2645 cover both schemes against loopback servers, so neither needs the network.
- The crypto introspection statics (getFips and the cipher/hash/curve name lists) bake at the call site, and the crypto constant table joins http2's under a generalized per-module baked-constants lowering.
- The CA-store introspection surface lands in its own unit (scr_tls_ca.c) behind its own link gate, so a getCACertificates-only binary never pulls mbedTLS: getCACertificates, rootCertificates, setDefaultCACertificates.
- http2.createSecureServer grows the eager request handler and the runtime options record, riding the same server-options walk as tls.createServer; string-typed 'data' listeners decode.
- process once/off for 'unhandledRejection' plus the sibling 'rejectionHandled' registry, removal by closure identity per the warning-registry stance.
- Merge resolution unions this lane with main's fs ladders, createRequire erasure, and dyn secure-context work; the runtime's retired "DOM" nickname is spelled "dyn" throughout.
- Add Agent connection accounting and HTTP/socket compatibility surfaces
- Support dynamic Buffer at and slice access
- Pin behavior with differential corpus coverage
- for-of, destructuring, and spread over engine-held dyn values ride the engine's own iterator protocol with V8's exact non-iterable spellings; for-of over dyn lowers generally
- Static promises cross into the engine as thenables; Promise.all over mixed and non-literal entries runs the engine's own combinator; engine-array fulfillments exit by reference
- The re-minted silent-wrong-answer path is closed: island-literal members whose values poison fence at the read with the captured diagnostic
- The checked-dynamic tree replaces the old nickname across comments and internal docs
- Node serves the builtin for both spellings — a builtin wins over a same-named npm package for the bare specifier — so both key the same lowering tables
- The stale prefix-only caution predated the createRequire erasure; the hint's claim and the behavior now agree
- text, json, and buffer settle real promises over the readable machinery with Node's settle timing and rejection set; arrayBuffer and blob fence with their representation reasons
- createRequire over this file's URL is compile-time plumbing: builtin specs become namespace imports, relative JSON bakes as validated documents, npm packages ride the require-condition graph, unresolvable names throw Node's catchable MODULE_NOT_FOUND
- module.builtinModules bakes as the compat target's exact list
# Conflicts:
# packages/compiler/src/frontend/lowering/lower-modules.ts
# packages/compiler/src/frontend/lowering/lowerer.ts
- The ratified rename rider (world-unification §7 lane 5): "DOM" collided with the browser DOM and, post-lane-1, the structure is no longer a document tree. Comments and doc prose now say "the checked-dynamic tree" for the noun and "dyn" adjectivally; runtime symbol names (scr_dyn_*), the error.domClone libCall, and the real web DOMException family are unchanged.
- The few user-facing strings carrying the nickname move with it (the structuredClone cyclic message, the dc subscriber/publish fences, two emitter ICE texts); diagnostics snapshots regenerated (96 pass). One private compiler constant (DOM_PROTO_METHOD_NAMES -> DYN_PROTO_METHOD_NAMES) rides along.
- Mechanical sweep, 142 files, comments/prose only — no behavior change.
- createRequire(import.meta.url) (or __filename / import.meta.filename) in a const binding is compile-time plumbing that emits nothing; each require call through it resolves per site against the binding's own file, and the inline createRequire(import.meta.url)("spec") spelling erases identically
- The erasure per target: a builtin spec makes the binding a namespace import in const clothing (namespace, destructured, and inline-member spellings all key the existing module tables, with the fallback-typed 'as typeof import(...)' cast idiom stripped); a relative .json document validates at compile time and lowers to json.parse over its baked text (JSON.parse's checked-dynamic unknown stance — exactly Node's value); a bare name nothing installed resolves compiles to Node's catchable MODULE_NOT_FOUND throw (the optional-dependency try/require pattern); an installed npm package embeds under --dynamic through the island's NEW require-condition entry (NpmGraphBuilder.addRequire — a dual package answers its CJS arm, exactly Node's createRequire) and reports the requires-dynamic diagnostic in a static build
- Dynamic specifiers, '#' project imports, relative non-.json targets, --npm-static opt-ins, and non-this-file bases all fence by name; the island-handle rescue skips the plumbing decls so --dynamic builds erase them too
- module.builtinModules bakes as Node v24's exact list (a fresh string[] per read, pinned to the compat target so emitted programs stay host-independent); isBuiltin and syncBuiltinESMExports fence per site with pointed hints, and the createRequire hint, its diagnostics snapshot, the surface manifest, and the npm-static offender wording follow
- Corpus 2606 pins json/builtin/builtinModules/MODULE_NOT_FOUND differentially on both backends and under ASan; the npm create-require fixture case pins cjszoo's module.exports, dual's require-condition CJS arm, and the missing-package rejection against Node
- scr_bytes_subarray: a same-elem view retaining the owner (the DataView rule, chain depth 1); subarray() and Buffer's slice() lower there, plain typed arrays' slice() keeps the copy — mutations through views are visible both ways now, byte-exactly with Node
- Buffer.from(x.buffer, byteOffset?, length?) lowers as the dataViewNew view construction (the syntactic .buffer peel); the fallback lib gains the ArrayBuffer overload
- fillElem: TypedArray.prototype.fill on non-u8 receivers, per-element coercion with slice-clamped indices; u8 keeps the Buffer fill family
- Both backends emit the new intrinsics; corpus 2604-bytes-views pins aliasing, offset composition, swap-through-slice, clamping, and fill coercion differentially
- scr_sc_text/json/buffer accumulate every chunk through a native 'data' listener (string chunks as their utf8 bytes, the Blob rule) and settle at the terminal point through the finished watcher — Node's own eos timing, verified byte-exact including resolution landing after 'close'
- Rejections match Node's set: the stream's error, ERR_STREAM_PREMATURE_CLOSE on an early close, json's SyntaxError on malformed text, and the async-iterable TypeError for a stream with no readable side
- lower-stream's stream/consumers arm lowers text/json/buffer over one lowered stream argument (json answers a checked-dynamic promise — the JSON.parse unknown stance); arrayBuffer and blob fence module-qualified with pointed hints, since neither value has a representation
- Both backends emit sc.text/sc.json/sc.buffer; the trio joins the may-throw seeds, the loop-liveness set, and moduleUsesStream's link gate; the SC1010 hint, its snapshots, and the surface manifest gain stream/consumers
- Corpus 2604/2605 pin the consumers differentially on both backends and under ASan + RC audit: split multibyte sequences across chunks, encoded string-chunk streams, settle ordering, empty streams, and all four rejection arms
- the static net.Socket lane gains pause()/resume()/setNoDelay() (chaining, like Node), destroySoon(), on/once('finish'), and the bytesWritten/readable reads — the same runtime entry points the dyn dispatcher uses
- strict equality over runtime handle kinds is pointer identity (c.pause() === c — JS object equality; validator and both backends)
- http/https Agent TYPES map to dyn (the value IS the DOM handle), the stdlib member fence steps aside for dyn-mapped receivers, and ClientRequest joins DYN_HANDLE_KINDS so typed client requests box by reference
- fallback declarations catch up (Socket flow control, the full Agent surface incl. getName/defaultPort/protocol); fixture 2575 pins flavor-independent dyn Buffer at()/slice()
- The promise forms ride the callback machinery: scr_sp_finished/scr_sp_pipeline park a settling watcher (fulfilled on a clean finish, rejected with the stream's error or ERR_STREAM_PREMATURE_CLOSE), verified byte-exact against Node including the already-closed async settlement
- lower-stream's stream/promises arm replaces its not-yet fence: finished(stream) and pipeline(...streams) lower to sp.finished/sp.pipeline (stream stages only — the options argument and iterable/generator/function stages keep pointed fences); both specifier spellings and the CJS require forms resolve
- Both backends emit it: the C compound-literal stream list and an LLVM stack array beside the callback pipeline's emission; sp.* joins the may-throw seeds, the loop-liveness set, and moduleUsesStream's link gate
- The SC1010 hint gains stream/promises and the long-missing querystring; hint snapshots and the surface manifest repin
- Corpus 2560/2561/2562 pin pipeline success/error teardown, finished's clean/errored/premature/writable arms, and the CJS destructured-require spelling — green on both backends and under ASan + RC audit
- console.log routes non-scalar arguments through the static inspect machinery
- Union arguments dispatch per arm at runtime; string arms print raw
- Object literals widen per-field into a uniquely-fitting union arm
- The limitations page documents the type surface
- The full legacy surface: parse, stringify, escape, unescape, the aliases
- Node's scan state machine in C: separators, maxKeys, malformed-escape and truncation quirks
- Link-gated; escape-only programs never link the unit
- The performance global routes through the perf_hooks lowering in all spellings
- Response declares its implemented headers/arrayBuffer/bytes surface
- Math.max and Math.min lower at any arity
- Copy-installed workspace members classify like symlinked ones
- scr_qs.c ports Node v24's legacy codec quirk-faithfully (the scan state machine with maxKeys' pair budget, unescapeBuffer's code-unit byte truncation with U+FFFD replacement decode, encodeStringified's value rules over the DOM crossing); link-gated by moduleUsesQs, and escape rides the always-linked component encoder
- parse's result is the call site's ParsedUrlQuery dictionary (the networkInterfaces verification stance; the runtime fills the overflow map and groups repeats into string[] buckets), sep/eq/maxKeys complete to Node's defaults, and custom encoder/decoder options fence by name
- decode/encode lower as Node's own aliases; both backends emit the same runtime calls byte-identically
- querystring joins SUPPORTED_BUILTIN_MODULES, the fallback declarations, and the regenerated surface manifest, so npm-static packages requiring it unguarded stop falling back to the island (the shim stays for island code)
- corpus 2460-2464 pin the grammar corners against Node: malformed escapes, '+' vs %2B, repeated keys, maxKeys with empty segments, multi-char/multi-byte separators, astral truncation, and every CJS acquisition spelling
- console.log/info/debug/error/warn take unknown[] and render every non-scalar argument through the static util.inspect at the rest-args depth 2, strings verbatim
- top-level unions dispatch per arm at runtime with string arms raw, and util.format's %s/rest args take the same per-arm rule
- info and debug lower as stdout aliases of log; the remaining stock console members are declared in the fallback so stock-clean programs meet per-site SC2020 hints instead of a fallback-manufactured SC0001
- corpus 2440/2441 pin the widened shapes on both backends, console.log(process.argv), a find() miss union, and console.log(undefined) included
- diagnostics snapshots re-pinned: the union console fences retire and utility-types reports its real per-site fences
- redeclaring an inherited field WITH an initializer lowers as the [[Define]]-equivalent assignment into the base slot at the subclass's field-init position (builtin Error prefix included — prettier's errors.js `name = "ConfigError"`); bare and type-changing redeclares keep sharpened fences (corpus 2428, diagnostics inheritance re-record)
- object destructuring of CLASS instances desugars to one member read per element, left to right: fields read slots, accessors call getters through the fieldGetExpr dispatch, renames/parameter patterns/defaults included (corpus 2429 — prettier's AstPath { previous, next })
- an object literal missing an 'unknown' field completes with the DOM undefined (the absent-property read's answer), at literal completion and in the record width relation (corpus 2430 — prettier's getFileInfo(file, {}))
- node:module joins the supported builtins prefix-only as an admit-then-fence surface: createRequire keeps a per-member fence that defers to a catchable runtime error in JS sources (diagnostics create-require pins the hint naming the pattern)
Chris Tate