A class carries the collector header when any class in its hierarchy can
be on a cycle, so instances of classes whose own fields hold nothing
cycle-capable were buffered as candidates and walked by every level. Such
an object has no traced children and is never on a cycle.
Their descriptors now name scr_cyc_no_children, and they are allocated
with buf set to SCR_CYC_ACYCLIC. That value has the buffered bit set, so
a release that leaves the object alive makes no call; scr_cyc_is_buffered
is false for it, and an emitted death or publication mark takes the object
out of a candidate buffer only when buf is below -1. A pass that walks
such an object as a child restores the value when it survives.
The runtime call reads the cert and key options before the SNICallback,
so a cert or key initializer after the callback that reassigned the
callback's binding changed the callback the server used, and the server
could serve the wrong certificate. When SNICallback comes before a cert
or key entry, the callback is now saved just before the next of them is
evaluated. With the callback read in order, a callback expression with
side effects lowers instead of being refused.
crypto.createDiffieHellman, crypto.getDiffieHellman and
crypto.createDiffieHellmanGroup return native DiffieHellman and
DiffieHellmanGroup handles backed by mbedTLS bignums. generateKeys,
computeSecret, getPrime, getGenerator, getPublicKey, getPrivateKey,
setPublicKey, setPrivateKey and verifyError follow Node 24.22:
- the modp1, modp2, modp5 and modp14 through modp18 groups, with the
private key widths of Node's OpenSSL 3 path (200 to 400 bits for
modp5 and up, [2, p - 2] for modp1 and modp2);
- explicit primes and generators in every argument form and encoding,
with keys of bits(p) - 2 bits, or below min(2^N, q) when the
parameters equal an OpenSSL named group (RFC 3526, RFC 7919,
RFC 5114);
- generated safe primes with OpenSSL's congruences for the generator;
- verifyError's DH_check bits, computed when it is first read;
- Node's argument, generator, modulus, key range, state and encoding
errors, including the OpenSSL errors' library and reason properties.
Safe-prime generation sieves candidates with the odd primes below a
bound that grows with the prime's length and tests them with
Miller-Rabin rounds over a variable-time Montgomery exponentiation that
only reads public values; key and secret exponentiations stay on
mbedTLS's constant-time path. Primes longer than 8192 bits, property
reads other than verifyError, property writes, Object.prototype methods,
and calls whose output encoding is typed any or matches no @types/node
overload are refused.
The runtime unit scr_dh.c links, with the mbedTLS archive, only into
programs that use DiffieHellman. wasm32-wasi builds refuse it. The ECDH
unit's argument and encoding helpers move to scr_crypto_args.h, which
both units include.
A counted for loop needs a stable limit to run its counter in integer
storage. Array lengths qualified when the loop provably keeps them, but
a string's length did not, so `for (let i = 0; i < s.length; i++)`
kept a double counter and evaluated the length, through the UTF-16
mapping of a non-ASCII string, on every iteration. A string's length
cannot change, so it is now stable whenever the string's binding is
not rebound in the loop or boxed.
dyn.nameClassPrototype sets the class name on a class's runtime prototype
object and stores no property. The int32 field analysis did not list it as
read-only, so every program that gave a class a runtime prototype counted a
dynamic store that can name any property, and the number fields of every
class reaching dynamic code were stored as doubles.
The type mapper maps the type inferred from an empty object literal to the
empty record as an arm of an unreduced union and to a checked-dynamic
value elsewhere, but both answers shared one memo entry. Once the type had
been mapped on its own, a union such as `typeof empty | DataView` reused
the dynamic answer for its arm and refused (SC2009). The memo key now
includes whether the mapping is for such an arm.
The compiler compiles itself natively, and an empty array in an object
literal took number[] there, so the enum entry did not match the
declaration record. The coverage snapshot of native-npm-imports now
counts one dynamic-tier statement instead of three: the program's
`const point: Vector` takes the interface from the package's .d.ts
instead of any.
The compiler's own source has 24 likely-hot functions that use untyped
values, so its self-builds now print SC6101. The native bootstrap
contracts compare stderr exactly; the rebuilds of the compiler entry pass
--no-dynamic-tier-warning, which changes no IR or LLVM output.
On the error path, a callback's result reads from a checked-dynamic
slot. Passing it on into a Buffer parameter still handed over the
adapter's original value, so after `if (!out) out = Buffer.from(...)`
a typed callee received the absent Buffer instead of the fallback and
crashed. The forward now tests the slot: while it holds undefined the
callee gets the absent Buffer, and otherwise the Buffer the slot holds.
An array helper specialized for its callback calls the callback's
function directly once the closure's entry matches it, and falls back to
the entry otherwise. Both paths were followed by the pending-exception
test. When the direct target is outside the may-throw set, only the
fallback can leave an exception pending, so the test now runs behind a
guard that is true on that path alone; a known closure called directly
skips it. Worker programs keep the test on every path, where it also
observes termination.
The prerelease libnode-dev-24.22.1 mirrors the dockfries v24.22.1 libnode,
Node's v24.22.1 headers and Node's license byte for byte, as CI-only inputs
(not a scriptc release). dev-pack.json lists the mirror first and the
original locations after it; fetch-dev-pack.mjs takes the first source
whose bytes match the pinned sha256 and logs which one it used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An installed @scriptc/libnode-<platform> pack versions in lockstep with
the compiler, whose version every executable cache key already holds;
keying on it as well made the full compiler's key differ from the
bootstrap's routed key wherever a pack directory was present, so routed
cache hits stopped. Only directories with a manifest.json count as
installed packs, so an unbuilt workspace package is not one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stack the libnode packs on the in-process loader (#1685) and use its
pack assembler and manifest format instead of a second one:
build-pack.mjs keeps its CLI and fields (schema, nodeVersion,
moduleVersion, bridgeAbi, platform, arch, files), adds the libnode and
bridge names, strips and (on macOS) re-signs the bridge and links it with
-z defs, and exports buildPack(), which the platform packs call with their
package, target and build inputs as extra manifest fields.
libnodeRecord falls back to the installed @scriptc/libnode-<platform>
pack, found from the entry's directory and then next to the compiler,
when neither --libnode nor SCRIPTC_LIBNODE names one.
The Linux test lanes restore the libnode build that the libnode-packs
workflow cached, assemble the linux-x64 pack from it in seconds
(build.mjs --from-cache never builds Node) and export SCRIPTC_LIBNODE, so
the Node island corpus and harness tests run instead of skipping.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the @scriptc/libnode-<platform> packs (linux-x64-gnu, linux-arm64-gnu,
darwin-arm64, darwin-x64): the pinned Node.js 24.22.0 built as a stripped
shared library with full ICU and its startup snapshot, the scriptc bridge
compiled against that release's headers, Node's LICENSE and a manifest
with the Node version, NODE_MODULE_VERSION, bridge ABI and file hashes.
packages/libnode-common holds the pin, the build (fetch and verify the
source tarball, configure --shared, build only the libnode target, strip,
stage with headers in a cache keyed by release, flags, platform and
toolchain; the bridge rebuilds in seconds against the cached headers),
a verifier, and a smoke test: a C program that loads a pack the way the
runtime does, starts Node from the snapshot and evaluates expressions
synchronously, asynchronously and throwing.
The libnode-packs workflow builds the packs on native runners, Linux in
the manylinux_2_28 images for a glibc 2.28 floor, caches each libnode
build, smoke-tests and uploads every pack. It never runs in the ordinary
build or test path. The compiler gains the pack lookup (SCRIPTC_LIBNODE,
then the installed package), validation, the nodeIslands.libnode
placements and the license notices for the Node island loader to use.
The bridge source and its C ABI header are the NI-1 bridge agent's,
included here so the packs build; the packs stay private until the
in-process island runtime ships.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Constructor types declared in the program hold class values as
checked-dynamic values since #1725. A fetched provenance source counts as
a program file, so the unused `@__PURE__` const typed `{ new (): any }` in
the provenance fixture now had a mapping, no longer elided, and its
initializer refused (SC1090). Fetched sources keep their constructor types
unmapped, as before #1725.
Chris Tate