@scriptc/compiler 0.0.0 → 0.0.2

package/dist/ir/nodes.js

@@ -0,0 +1,1906 @@
+/* scriptc IR — the only interface between frontend and backends.
+ *
+ * Design rules (see docs/ir.md for node-by-node semantics):
+ * - Plain JSON-safe discriminated unions: no classes, no parent pointers,
+ *   no cycles. Cross-references are by string id.
+ * - Every node carries `loc` (source span) and every expression carries its
+ *   computed `type` — backends never re-derive types.
+ * - Structured control flow (statement tree), not basic blocks: the only
+ * current backend is C and there are no optimization passes yet. When a mid-end
+ *   arrives, a structured→CFG lowering pass slots in after validation.
+ * - The type union is deliberately written for extension (`dyn` shipped
+ *   with JSON, `promise` with async). All switches over IrType/IrExpr/
+ *   IrStmt must have exhaustive `never` default arms so adding a member
+ *   turns into compile errors, not silent misbehavior.
+ */
+/** The ref kinds whose values are JS OBJECTS for truthiness: always true
+ * ([] and {} included) — toBool accepts them (the operand still evaluates;
+ * the test is constant), and per-union truthiness helpers answer their
+ * arms with `true`. */
+export const REF_TRUTHY_KINDS = new Set([
+    // symbol is not a JS object, but every symbol is truthy — the same
+    // constant-true answer.
+    "symbol",
+    "array", "map", "set", "regex", "url", "searchParams", "stats", "spawnRes", "child",
+    "netServer", "netSocket", "http2Session", "http2Stream", "dgramSocket", "testCtx", "httpReq", "httpRes", "httpClientReq",
+    "secureCtx", "fsWatcher", "childStream", "procStream", "bytes", "func", "object", "record", "promise",
+    // A generator object is a JS object: always truthy.
+    "generator",
+    // A class object is a JS object (constructors are functions): always truthy.
+    "classval",
+]);
+export const F64 = { kind: "f64" };
+export const BYTES_U8 = { kind: "bytes", elem: "u8" };
+export const STRING = { kind: "string" };
+export const BOOL = { kind: "bool" };
+export const REGEX = { kind: "regex" };
+export const URL_T = { kind: "url" };
+export const SEARCH_PARAMS_T = { kind: "searchParams" };
+export const SYMBOL_T = { kind: "symbol" };
+export const STATS_T = { kind: "stats" };
+export const SPAWNRES_T = { kind: "spawnRes" };
+export const CHILD_T = { kind: "child" };
+export const NETSERVER_T = { kind: "netServer" };
+export const NETSOCKET_T = { kind: "netSocket" };
+export const HTTP2SESSION_T = { kind: "http2Session" };
+export const HTTP2STREAM_T = { kind: "http2Stream" };
+export const DGRAMSOCK_T = { kind: "dgramSocket" };
+export const TESTCTX_T = { kind: "testCtx" };
+export const HTTPREQ_T = { kind: "httpReq" };
+export const HTTPRES_T = { kind: "httpRes" };
+export const HTTPCLIENTREQ_T = { kind: "httpClientReq" };
+export const SECURECTX_T = { kind: "secureCtx" };
+export const FSWATCHER_T = { kind: "fsWatcher" };
+export const CHILDSTREAM_T = { kind: "childStream" };
+export const PROCSTREAM_T = { kind: "procStream" };
+export const VOID = { kind: "void" };
+export const DYN = { kind: "dyn" };
+export const JSVAL = { kind: "jsval" };
+export const CAUGHT = { kind: "caught" };
+export const UNDEFINED_T = { kind: "undefinedT" };
+export const NULL_T = { kind: "nullT" };
+/** True for the payload-less unit kinds (`undefined`/`null`). Unit values
+ * exist only inside unions: a unit-armed union instance is tag-only, so
+ * wrapping allocates no payload, narrowing to a unit arm produces no value
+ * (the frontend never emits it), and releasing has nothing to release. */
+export function isUnitType(t) {
+    return t.kind === "undefinedT" || t.kind === "nullT";
+}
+export function arrayOf(elem) {
+    return { kind: "array", elem };
+}
+export function bytesOf(elem) {
+    return { kind: "bytes", elem };
+}
+export function mapOf(key, value) {
+    return { kind: "map", key, value };
+}
+export function setOf(elem) {
+    return { kind: "set", elem };
+}
+/** The Map KEY fence: string (content) or number (SameValueZero) — the two
+ * kinds a hash of the VALUE is honest for. Booleans, objects, and the rest
+ * of JS's anything-goes keys stay out. Shared by the frontend's
+ * type mapping/diagnostics and the validator. Set ELEMENTS use the same
+ * fence: a set is hashed storage of its elements exactly as a map is of
+ * its keys (isSupportedSetElem is this predicate under its own name). */
+export function isSupportedMapKey(t) {
+    return t.kind === "f64" || t.kind === "string";
+}
+/** The Set ELEMENT fence — Map's key fence plus the refcounted HANDLE
+ * kinds stored under identity hashing (SameValueZero for JS objects IS
+ * reference identity, so a Set of server handles — portless's auxiliary-
+ * server registry — is honest hashed storage; SCR_MAP_KEY_REF in the
+ * runtime). netServer is the one handle admitted so far: it drops its
+ * listener closures at close, so a set-in-listener cycle is temporary —
+ * the child precedent's story. Symbols are identity values by DESIGN —
+ * SameValueZero on a symbol IS pointer identity, so a Set of symbols (the
+ * sentinel-registry idiom) is the same honest hashed storage with no
+ * cycle risk at all (symbols hold only strings). */
+export function isSupportedSetElem(t) {
+    return isSupportedMapKey(t) || t.kind === "netServer" || t.kind === "symbol";
+}
+/** The Map VALUE fence: scalars plus every refcounted kind EXCEPT
+ * func/promise/dyn/jsval (and map itself — no maps of maps).
+ * Record/object/union values can point back at the map holding them, which
+ * is exactly why ref-valued maps are cycle-capable (see the backend's
+ * cycle analysis and docs/memory.md). Shared frontend/validator. */
+export function isSupportedMapValue(t) {
+    switch (t.kind) {
+        case "f64":
+        case "string":
+        case "bool":
+        case "record":
+        case "object":
+        case "union":
+        case "array":
+            return true;
+        // A spawned child handle (Map<string, ChildProcess> — the mdns
+        // publisher registry): an ordinary refcounted pointer value (the
+        // scr_child_retain/release adapters), stored and read like any ref.
+        // It holds closures only until its terminal event fires (then drops
+        // them), so a child in a map cannot cycle through the map; the RC
+        // adapters handle its lifetime.
+        case "child":
+            return true;
+        // A SecureContext handle (Map<string, tls.SecureContext> — the SNI
+        // callback's per-hostname cache): immutable, holds no references —
+        // the same ordinary refcounted pointer story as child, without even
+        // the pre-settle closures.
+        case "secureCtx":
+            return true;
+        // A promise (Map<string, Promise<SecureContext>> — the SNI callback's
+        // in-flight dedupe map): refcounted, with trace/cycle support already
+        // in place (scr_promise_trace_v — the race machinery's refcounting).
+        // It holds reaction closures only until it settles (settled promises
+        // drop them), so the child rule's temporary-cycle story applies: a
+        // pending promise whose callbacks capture the map is a cycle only
+        // until settlement, and the collector handles the never-settling case.
+        case "promise":
+            return true;
+        // A class object (Map<string, typeof Shape> — the registry/factory
+        // idiom): an immortal static behind no-op RC adapters — it holds no
+        // references at all, so no trace, no cycles, ever.
+        case "classval":
+            return true;
+        default:
+            return false;
+    }
+}
+/** The INDEX-SIGNATURE value fence (`{ [k: string]: V }` shapes): the map
+ * VALUE kinds — the overflow portion IS a string-keyed map — plus dyn
+ * (`unknown`, an unknown-valued pricing-table shape: overflow reads surface ordinary
+ * dyn values validated by the usual checked casts). Shared frontend
+ * (mapType) / validator. */
+export function isSupportedIndexValue(t) {
+    return t.kind === "dyn" || isSupportedMapValue(t);
+}
+export function funcOf(params, ret) {
+    return { kind: "func", params, ret };
+}
+/** Canonical, injective text form of an IrType — the building block of
+ * shape/union identity keys, generic-function instantiation keys, and the
+ * backend's per-type helper interning (jsonStringify/dynCheck walkers).
+ * Nested records/unions are represented by their (already interned, already
+ * canonical) shapeId/unionId, so keys stay finite and comparable. Lives in
+ * the IR (not the frontend) because both ends need it. */
+export function typeKey(t) {
+    switch (t.kind) {
+        case "f64":
+        case "string":
+        case "bool":
+        case "regex":
+        case "url":
+        case "searchParams":
+        case "symbol":
+        case "stats":
+        case "spawnRes":
+        case "child":
+        case "netServer":
+        case "netSocket":
+        case "http2Session":
+        case "http2Stream":
+        case "dgramSocket":
+        case "testCtx":
+        case "httpReq":
+        case "httpRes":
+        case "httpClientReq":
+        case "secureCtx":
+        case "fsWatcher":
+        case "childStream":
+        case "procStream":
+        case "dyn":
+        case "jsval":
+        case "caught":
+        case "void":
+            return t.kind;
+        case "undefinedT":
+            return "undefined";
+        case "nullT":
+            return "null";
+        case "array":
+            return `array<${typeKey(t.elem)}>`;
+        case "bytes":
+            return `bytes<${t.elem}>`;
+        case "map":
+            return `map<${typeKey(t.key)},${typeKey(t.value)}>`;
+        case "set":
+            return `set<${typeKey(t.elem)}>`;
+        case "func":
+            return `func(${[...t.params.map(typeKey), ...(t.rest ? ["...dyn[]"] : [])].join(",")})=>${typeKey(t.ret)}`;
+        case "object":
+            return `object:${t.className}`;
+        case "classval":
+            return `classval:${t.className}`;
+        case "record":
+            return `record:${t.shapeId}`;
+        case "union":
+            return `union:${t.unionId}`;
+        case "promise":
+            return `promise<${typeKey(t.inner)}>`;
+        case "generator":
+            return `generator<${typeKey(t.yieldT)},${typeKey(t.retT)},${typeKey(t.nextT)}>`;
+        default: {
+            const _exhaustive = t;
+            void _exhaustive;
+            throw new Error("unreachable");
+        }
+    }
+}
+export function typeEquals(a, b) {
+    if (a.kind === "array")
+        return b.kind === "array" && typeEquals(a.elem, b.elem);
+    if (a.kind === "bytes")
+        return b.kind === "bytes" && a.elem === b.elem;
+    if (a.kind === "map") {
+        return b.kind === "map" && typeEquals(a.key, b.key) && typeEquals(a.value, b.value);
+    }
+    if (a.kind === "set")
+        return b.kind === "set" && typeEquals(a.elem, b.elem);
+    if (a.kind === "func") {
+        return (b.kind === "func" &&
+            a.params.length === b.params.length &&
+            (a.rest === true) === (b.rest === true) &&
+            a.params.every((p, i) => typeEquals(p, b.params[i])) &&
+            typeEquals(a.ret, b.ret));
+    }
+    if (a.kind === "object")
+        return b.kind === "object" && a.className === b.className;
+    if (a.kind === "classval")
+        return b.kind === "classval" && a.className === b.className;
+    // The frontend deduplicates shapes structurally (one shapeId per canonical
+    // field list), so id equality IS structural equality.
+    if (a.kind === "record")
+        return b.kind === "record" && a.shapeId === b.shapeId;
+    // Unions are interned like shapes: one unionId per canonical arm list.
+    if (a.kind === "union")
+        return b.kind === "union" && a.unionId === b.unionId;
+    if (a.kind === "promise")
+        return b.kind === "promise" && typeEquals(a.inner, b.inner);
+    if (a.kind === "generator") {
+        return (b.kind === "generator" &&
+            typeEquals(a.yieldT, b.yieldT) &&
+            typeEquals(a.retT, b.retT) &&
+            typeEquals(a.nextT, b.nextT));
+    }
+    return a.kind === b.kind;
+}
+/** True for types whose values are heap-allocated and reference-counted.
+ * The single dispatch point for the backend's RC machinery: retains,
+ * releases, frame/scope tracking, and NULL-initialized locals all key off
+ * this — adding a refcounted kind must not grow new per-kind checks outside
+ * the type-directed helpers. */
+export function isRefCounted(t) {
+    return (t.kind === "string" ||
+        t.kind === "array" ||
+        t.kind === "map" ||
+        t.kind === "set" ||
+        // Every regex value is an immortal interned literal today, so its
+        // retains/releases are no-ops — riding the uniform machinery anyway
+        // means dynamic construction can arrive without a redesign.
+        t.kind === "regex" ||
+        // URL, Stats, and spawnSync-result instances are ordinary refcounted
+        // heap values (immutable, no cycles — strings/scalars inside only).
+        t.kind === "url" ||
+        // URLSearchParams lists are ordinary refcounted heap values (strings
+        // plus at most the owning-URL edge — no cycles).
+        t.kind === "searchParams" ||
+        // Symbols are the same story: immutable identity values holding at
+        // most two strings.
+        t.kind === "symbol" ||
+        t.kind === "stats" ||
+        t.kind === "spawnRes" ||
+        t.kind === "child" ||
+        // net handles are refcounted like child (listeners drop at settle,
+        // so lean allocation — see the IrType comment).
+        t.kind === "netServer" ||
+        t.kind === "netSocket" ||
+        // h2 sessions/streams are refcounted like the net pair (listeners
+        // drop at settlement; the session→stream↔session cycle breaks there).
+        t.kind === "http2Session" ||
+        t.kind === "http2Stream" ||
+        t.kind === "dgramSocket" ||
+        // TestContext handles are refcounted like dgramSocket (the runner
+        // tree owns children; no cycles through the handle).
+        t.kind === "testCtx" ||
+        t.kind === "httpReq" ||
+        t.kind === "httpRes" ||
+        t.kind === "httpClientReq" ||
+        // SecureContext handles are refcounted like url/stats (immutable, no
+        // cycles — parsed cert/key material inside only).
+        t.kind === "secureCtx" ||
+        // FSWatcher handles are refcounted like child (listeners drop at
+        // close, so lean allocation — see the IrType comment).
+        t.kind === "fsWatcher" ||
+        // Child-output streams are refcounted like child (listeners drop at
+        // EOF — see the IrType comment).
+        t.kind === "childStream" ||
+        // Typed arrays / Buffers are ordinary refcounted heap values (mutable,
+        // no cycles — raw bytes inside only).
+        t.kind === "bytes" ||
+        t.kind === "func" ||
+        t.kind === "object" ||
+        // Every class object is an immortal emitted static, so its
+        // retains/releases are no-ops — riding the uniform machinery (the
+        // regex-literal stance) keeps every container and box path unchanged.
+        t.kind === "classval" ||
+        t.kind === "record" ||
+        // The union CONTAINER is heap/refcounted regardless of which arm it
+        // holds (uniform representation keeps the RC discipline simple).
+        t.kind === "union" ||
+        t.kind === "promise" ||
+        // A generator object is a refcounted handle over its paused fiber and
+        // typed channel slots (ScrGen — lean allocation, no cycle header).
+        t.kind === "generator" ||
+        // A dyn value is a refcounted JSON DOM tree (ScrDyn).
+        t.kind === "dyn" ||
+        // An island value is a refcounted cell owning one engine value.
+        t.kind === "jsval" ||
+        // A catch binding is a refcounted snapshot box (ScrCaught).
+        t.kind === "caught");
+}
+/** The runtime-provided error classes, keyed by IR class name. The names
+ * are '%'-prefixed ('%' cannot appear in a TS identifier, so a user's own
+ * `class Error` can never collide). `lib` is the standard-library name the
+ * frontend recognizes; `kind` is the runtime's SCR_ERR_* index (backends
+ * stamp scr_error_vts[kind] and pick constructor kinds by it). Every
+ * emitted module carries all four class defs (flagged `runtime`) so the
+ * program's preorder numbering always covers them — the runtime's own
+ * throws (JSON/dynCheck/regex) mint instances of these classes whether or
+ * not user code mentions Error. */
+export const RUNTIME_ERROR_CLASSES = new Map([
+    ["%Error", { lib: "Error", kind: 0, base: null }],
+    ["%TypeError", { lib: "TypeError", kind: 1, base: "%Error" }],
+    ["%RangeError", { lib: "RangeError", kind: 2, base: "%Error" }],
+    ["%SyntaxError", { lib: "SyntaxError", kind: 3, base: "%Error" }],
+    // DOMException — the web-standard error shape (a Node global since
+    // v17). Its extra state (the legacy numeric code, the options form's
+    // cause) lives in runtime-side slots BEYOND the ScrError prefix the IR
+    // fields describe, reached only through the error.dom* libCalls — so
+    // user `extends DOMException` is fenced (the subclass layout would
+    // overlap the hidden slots), where the other four extend freely.
+    ["%DOMException", { lib: "DOMException", kind: 4, base: "%Error" }],
+]);
+/** The runtime-provided node:events EventEmitter class (ScrEmitter /
+ * scr_emitter_*, scr_events_emitter.c — link-gated by moduleUsesEmitter,
+ * so unlike the error classes its def rides a module only when the
+ * program touches the surface). The '%' name keeps it clear of user
+ * identifiers, exactly like the error classes. Backends emit no struct/
+ * RC/vtable for it; user subclasses embed the ScrEmitter prefix (the
+ * registry pointer and the display-name slot, stamped by the emitted
+ * allocation) and main() stamps the runtime vtable's preorder interval.
+ * The emitter hierarchy is UNCONDITIONALLY cycle-capable: the registry
+ * owns listener closures, whatever the subclass fields say. */
+export const RUNTIME_EMITTER_CLASS = "%EventEmitter";
+/** The runtime-provided node:stream classes (ScrStream / scr_stream_*,
+ * scr_stream.c — link-gated by moduleUsesStream). They root at the
+ * emitter class (base chains below), so the emitter method surface and
+ * upcasts apply unchanged; every instance shares ONE runtime layout (the
+ * ScrEmitter prefix plus a lazily-allocated stream-state pointer), so a
+ * Duplex upcast to Readable is the usual pointer reinterpret. `sides`
+ * names which halves the class carries — the lowering admits readable
+ * members on "r"-siders, writable members on "w"-siders. User `extends`
+ * compiles (phase 2): subclass structs embed the full ScrStream prefix
+ * (registry, display name, state pointer — one slot past the emitter
+ * prefix), construction runs the emitted allocation then a stream .init
+ * libCall at super(options), and overridden underscore methods bind as
+ * synthesized wrapper closures dispatching through the vtable; main()
+ * stamps each runtime vtable's preorder interval like the emitter's. */
+export const RUNTIME_STREAM_CLASSES = new Map([
+    ["%Readable", { lib: "Readable", base: RUNTIME_EMITTER_CLASS, sides: "r" }],
+    ["%Writable", { lib: "Writable", base: RUNTIME_EMITTER_CLASS, sides: "w" }],
+    ["%Duplex", { lib: "Duplex", base: "%Readable", sides: "rw" }],
+    ["%Transform", { lib: "Transform", base: "%Duplex", sides: "rw" }],
+    ["%PassThrough", { lib: "PassThrough", base: "%Transform", sides: "rw" }],
+]);
+/** Object-literal ACCESSOR properties (`{ get x() {...}, set x(v) {...} }`)
+ * live on the shape as reserved '%'-fields holding closures: `%get:x` a
+ * `() => T` invoked once per property READ (side effects and all — JS's
+ * evaluation), `%set:x` a `(v: T) => void` invoked per WRITE. The property
+ * name itself has NO data slot. Like every '%'-field the slots stay out of
+ * declaredOrder — and because the slot types are funcs, accessor-carrying
+ * shapes are never JSON-safe or dyn-convertible; the enumeration surfaces
+ * Node would answer differently (Object.keys includes accessor names,
+ * values/entries and spread invoke the getters) fence by name at their
+ * lowerings. */
+export function accessorSlotProp(fieldName) {
+    if (fieldName.startsWith("%get:"))
+        return { kind: "get", prop: fieldName.slice(5) };
+    if (fieldName.startsWith("%set:"))
+        return { kind: "set", prop: fieldName.slice(5) };
+    return null;
+}
+/** True when the shape carries at least one accessor slot (see
+ * accessorSlotProp) — the predicate behind every enumeration-surface
+ * fence. */
+export function shapeHasAccessorSlots(shape) {
+    return shape.fields.some((f) => accessorSlotProp(f.name) !== null);
+}
+/** The bytesIntrinsic methods that can raise a catchable error — backends'
+ * may-throw analyses seed on these exactly like MAY_THROW_LIB_FNS. */
+export const MAY_THROW_BYTES_METHODS = new Set([
+    "setFrom",
+    "readNum",
+    "writeNum",
+    "readNumVar",
+    "writeNumVar",
+    "compareBuf",
+    "fill",
+    "fillNum",
+    "fillStr",
+    "copy",
+    "swap16",
+    "swap32",
+    "swap64",
+    "writeStr",
+    "dataViewNew",
+    "dvGetUint8",
+    "dvGetInt8",
+    "dvGetUint16",
+    "dvGetInt16",
+    "dvGetUint32",
+    "dvGetInt32",
+    "dvGetFloat32",
+    "dvGetFloat64",
+    "dvGetBigUint64Number",
+    "dvGetBigInt64Number",
+]);
+/** Result-type rule for each island op (the validator enforces it; the
+ * frontend constructs nodes with exactly these). */
+export function jsOpResultKind(op) {
+    switch (op) {
+        case "add":
+        case "sub":
+        case "mul":
+        case "div":
+        case "mod":
+        case "pow":
+        case "neg":
+        case "plus":
+        case "getProp":
+        case "getIdx":
+        case "callMethod":
+        case "callFn":
+        case "construct":
+        case "globalGet":
+        case "objLit":
+        case "arrLit":
+        case "undefLit":
+        case "nullLit":
+        case "iterNew":
+        case "optCallMethod":
+            return "jsval";
+        case "lt":
+        case "le":
+        case "gt":
+        case "ge":
+        case "eq":
+        case "neq":
+        case "instanceOf":
+        case "truthy":
+        case "not":
+            return "bool";
+        case "typeof":
+        case "toStr":
+            return "string";
+        case "setProp":
+        case "setIdx":
+            return "void";
+        default: {
+            const _exhaustive = op;
+            void _exhaustive;
+            throw new Error("unreachable");
+        }
+    }
+}
+/** True when a type is a union with an undefined arm — the optional-flavored
+ * slot marker shared by the frontend (record literals may omit such fields)
+ * and backends (JSON serializers DROP such fields when they hold undefined,
+ * dynCheck builders produce the undefined arm for a MISSING key). Note the
+ * question is about the TYPE, not a declaration's `?:` token: without
+ * exactOptionalPropertyTypes, `{a?: string}` and `{a: string | undefined}`
+ * are the same shape and behave identically — which is exactly Node's rule
+ * (JSON.stringify drops ANY undefined-valued field, declared optional or
+ * not). */
+export function isUndefinedArmedUnion(t, getUnion) {
+    if (t.kind !== "union")
+        return false;
+    const def = getUnion(t.unionId);
+    return !!def && def.arms.some((a) => a.kind === "undefinedT");
+}
+/** True when a type is JSON-representable — the shared fence for
+ * `jsonStringify` (what can be serialized) and `dynCheck` (what a dyn value
+ * can be validated against): f64, string, bool, records, arrays, and unions
+ * of those, recursively. Closures, class instances, dyn itself, and void are
+ * not JSON. Registry lookups are parameters because the frontend holds
+ * registries and the validator/backend hold maps; recursive shapes/unions
+ * cannot exist (the frontend rejects them), so the recursion terminates. */
+export function isJsonSafeType(t, getRecord, getUnion) {
+    return isJsonSafeAt(t, getRecord, getUnion, false);
+}
+/** The recursion behind isJsonSafeType. `inRecordField` is the ONE position
+ * where an undefined arm is JSON-representable: an undefined-armed union as
+ * a record field (the `a?: T` spelling) serializes by DROPPING the field
+ * when it holds undefined and validates a MISSING key as the undefined arm
+ * — both exactly Node. Everywhere else (a bare `T | undefined` value,
+ * stringified whole or cast to) exactness is unreachable: Node's stringify
+ * of bare undefined is not a string at all, and JSON text can never contain
+ * a value that matches the arm. */
+function isJsonSafeAt(t, getRecord, getUnion, inRecordField) {
+    switch (t.kind) {
+        case "f64":
+        case "string":
+        case "bool":
+            return true;
+        case "array":
+            return isJsonSafeAt(t.elem, getRecord, getUnion, false);
+        case "record": {
+            const shape = getRecord(t.shapeId);
+            if (!shape)
+                return false;
+            // TUPLE positions are array slots, not droppable object keys: an
+            // undefined-armed position would stringify as `null` in JS (not
+            // drop), so tuples keep the array rule for their fields.
+            if (!shape.fields.every((f) => isJsonSafeAt(f.type, getRecord, getUnion, !shape.tuple))) {
+                return false;
+            }
+            // Overflow values sit in record-key position too: dyn is JSON-safe
+            // HERE (the DOM serializes itself; undefined-valued entries drop
+            // like any undefined-valued key), everything else follows the
+            // record-field rule.
+            if (shape.indexValue && shape.indexValue.kind !== "dyn") {
+                return isJsonSafeAt(shape.indexValue, getRecord, getUnion, true);
+            }
+            return true;
+        }
+        case "union": {
+            const def = getUnion(t.unionId);
+            return !!def && def.arms.every((a) => isJsonSafeAt(a, getRecord, getUnion, inRecordField));
+        }
+        case "func":
+        case "object":
+        // Class values stringify as "{}" husks in Node (own enumerable statics
+        // aside — not representable type-directedly); rejected like Maps.
+        case "classval":
+        // Maps are not JSON (JSON.stringify(new Map()) is "{}" in Node — an
+        // empty-object husk nobody wants; stringify/dynCheck reject instead).
+        case "map":
+        // Sets stringify as the same "{}" husk — rejected like Maps.
+        case "set":
+        // Regexes are not JSON (JSON.stringify(/a/) is "{}" in Node — the same
+        // empty-object husk as Maps; stringify/dynCheck reject instead).
+        case "regex":
+        // URLs stringify as "{}" husks in Node too (data properties live on
+        // internal slots) — rejected the same way; use url.href instead.
+        case "url":
+        // URLSearchParams stringifies as the same "{}" husk — rejected; use
+        // sp.toString() instead.
+        case "searchParams":
+        // Symbols are DROPPED by Node's stringify (undefined at the top level,
+        // omitted as object values) — silent divergence banned; rejected.
+        case "symbol":
+        // Typed arrays stringify as index-keyed objects ({"0":1,...}) and
+        // Buffers as {type:"Buffer",data:[...]} in Node — neither shape is
+        // representable type-directedly; rejected like Maps.
+        case "bytes":
+        case "stats":
+        case "spawnRes":
+        case "child":
+        case "netServer":
+        case "netSocket":
+        case "http2Session":
+        case "http2Stream":
+        case "dgramSocket":
+        case "testCtx":
+        case "httpReq":
+        case "httpRes":
+        case "httpClientReq":
+        case "secureCtx":
+        case "fsWatcher":
+        case "childStream":
+        case "procStream":
+        case "dyn":
+        case "jsval":
+        case "caught":
+        case "promise":
+        case "generator":
+        case "void":
+            return false;
+        // Representable exactly as a union arm in record-field position (the
+        // optional-field story above); bare undefined-armed unions stay fenced
+        // out of both stringify and dynCheck (narrow with '!== undefined'
+        // first, or model absence with a null arm).
+        case "undefinedT":
+            return inRecordField;
+        // JSON null ↔ the nullT arm: null-armed unions stringify (`null`) and
+        // validate (a JSON null matches exactly the nullT arm).
+        case "nullT":
+            return true;
+        default: {
+            const _exhaustive = t;
+            void _exhaustive;
+            throw new Error("unreachable");
+        }
+    }
+}
+/** THE island boundary predicate: true when a static type can cross into
+ * the island (jsMarshal — primitives by value, composites as deep JSON
+ * copies) and back out (jsExit — strict primitive extraction, composites
+ * through the dynCheck walker). Primitives are JSON-safe, so the rule
+ * coincides with isJsonSafeType; it has its own name because the boundary
+ * is its own concept — the frontend's implicit coercions, the explicit-cast
+ * lowering, and the validator's jsMarshal/jsExit rules all ask this ONE
+ * question, and the boundary rejection messages describe exactly this set. */
+export function canCrossIslandBoundary(t, getRecord, getUnion) {
+    return isJsonSafeType(t, getRecord, getUnion);
+}
+/** True for a closure type that can cross INTO the island as a host
+ * function: every parameter jsval (the engine's arguments pass through as
+ * handles — no per-type extraction exists inside a host call) and the
+ * result jsval, void, or a primitive (which marshals back by value —
+ * `(x) => x * 2` on an 'any' x infers a number return). Contextual typing
+ * produces exactly this shape for callbacks passed to package APIs
+ * (`.action((a, b) => ...)` against `(...args: any[]) => void`). Arity is
+ * capped by the runtime's host-call argument buffer (scr_island.c). */
+export const MAX_ISLAND_CALLBACK_ARITY = 16;
+export function canMarshalFuncIntoIsland(t) {
+    return (t.kind === "func" &&
+        t.params.length <= MAX_ISLAND_CALLBACK_ARITY &&
+        t.params.every((p) => p.kind === "jsval") &&
+        (t.ret.kind === "jsval" || t.ret.kind === "void" ||
+            t.ret.kind === "f64" || t.ret.kind === "bool" || t.ret.kind === "string"));
+}
+/** Parameter types a TYPED closure may declare when it crosses INTO the
+ * island as a host function: jsval params take the engine argument as a
+ * handle (the all-'any' shape above); every other admitted type converts
+ * AT CALL TIME through the validated-exit machinery — strict primitives,
+ * JSON round-trip composites (the dynCheck walker: width-tolerant records,
+ * path-annotated failures). On top of the jsExit set, a bare `T | undefined`
+ * union is admitted here — an absent or undefined engine argument takes the
+ * undefined arm, exactly the missing-optional-field rule (and exactly the
+ * commander case: `.action((text: string | undefined, opts) => ...)` sees
+ * undefined when the command argument is omitted). */
+export function isIslandCallbackParamType(t, getRecord, getUnion) {
+    if (t.kind === "jsval")
+        return true;
+    if (isJsonSafeType(t, getRecord, getUnion))
+        return true;
+    if (t.kind === "union") {
+        // A bare undefined-armed union: every non-undefined arm must be
+        // JSON-safe (arms never nest unions, so plain isJsonSafeType applies).
+        const def = getUnion(t.unionId);
+        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion));
+    }
+    return false;
+}
+/** Classify a typed island callback's RETURN for adapter synthesis: sync
+ * kinds marshal back by value ('void'|'jsval'|'f64'|'bool'|'string' — the
+ * canMarshalFuncIntoIsland set), 'json' marshals a JSON-safe composite
+ * through the type-directed serializer + engine parse (the jsMarshal
+ * composite path — commander's option-argument collectors return arrays
+ * this way), and a Promise of the by-value kinds wraps as an engine
+ * promise settled when the scriptc promise settles (async callbacks —
+ * the `.action(async ...)` case). Null for anything else (Promise of
+ * composites: still fenced). */
+export function islandCallbackRet(t, getRecord, getUnion) {
+    const tagOf = (r) => r.kind === "void" || r.kind === "jsval" || r.kind === "f64" || r.kind === "bool" || r.kind === "string"
+        ? r.kind
+        : null;
+    if (t.kind === "promise") {
+        const tag = tagOf(t.inner);
+        return tag ? { async: true, tag } : null;
+    }
+    const tag = tagOf(t);
+    if (tag)
+        return { async: false, tag };
+    return isJsonSafeType(t, getRecord, getUnion) ? { async: false, tag: "json" } : null;
+}
+/** The TYPED extension of canMarshalFuncIntoIsland (a strict superset):
+ * closures whose params are per-argument-convertible at call time
+ * (isIslandCallbackParamType) and whose return classifies
+ * (islandCallbackRet). Same arity cap — the runtime's host-call argument
+ * buffer. Closures taking closures and 'unknown'-typed params stay fenced
+ * (no per-type extraction exists for them inside a host call). */
+export function canMarshalTypedFuncIntoIsland(t, getRecord, getUnion) {
+    return (t.kind === "func" &&
+        t.params.length <= MAX_ISLAND_CALLBACK_ARITY &&
+        t.params.every((p) => isIslandCallbackParamType(p, getRecord, getUnion)) &&
+        islandCallbackRet(t.ret, getRecord, getUnion) !== null);
+}
+/* ── the checked-dynamic FUNCTION boundary ──────────────────────────────
+ * The STATIC twin of the island's typed-function marshaling
+ * (canMarshalTypedFuncIntoIsland): closures cross the dyn boundary as a
+ * callable DOM kind carrying the closure + a compiled per-signature call
+ * thunk. Two directions, two predicates, mutually recursive with the
+ * conversion domains (function types cannot ride records/unions — jsonSafe
+ * excludes them — so the recursion terminates):
+ *
+ * IN (canBoxFuncIntoDyn, the dynFrom domain's function arm): calling the
+ * box happens with DYN arguments, so every declared param must be
+ * dynCheckABLE (the thunk validates each argument into it) and the result
+ * must convert BACK to dyn (dynFrom's domain, functions included — a
+ * wrapper returning a wrapper boxes recursively).
+ *
+ * OUT (canAdaptDynFuncTo, the dynCheck domain's function arm): a dyn
+ * function landing in a typed func slot either unwraps directly (the boxed
+ * signature key equals the target's — same type, same ABI) or wraps in a
+ * per-target ADAPTER closure that converts each typed argument INTO dyn
+ * (so params must be dyn-convertible) and validates the dyn result into
+ * the target's return type (so the return must be dynCheckable).
+ *
+ * Deliberately fenced OUT of both directions: generic signatures (no
+ * concrete IR type exists), this-parameters, construct signatures (`new`
+ * through a dyn value), properties ON function values, and params/results
+ * outside the conversion domains (Maps, class instances, ...). Promises
+ * CONVERT in (canConvertToDyn's promise arm — an async dyn-boxed closure's
+ * return) but do not check OUT (`u as Promise<T>` stays fenced).
+ */
+/** The runtime HANDLE kinds that cross the checked-dynamic boundary as
+ * the DOM's HANDLE kind (SCR_DYN_HANDLE): boxed by REFERENCE (identity —
+ * stateful I/O objects never copy), unboxed by tag check, members
+ * dispatched at runtime onto the same entry points the static lowerings
+ * use. The set is deliberately the handles whose member surfaces have
+ * complete static lowerings (the http/net receiver surface —
+ * `server.on('request', mustCall((req, res) => ...))` is the canonical
+ * crossing); other handle kinds keep the honest cannot-box fence. Each
+ * entry carries the runtime tag spelling and the class display name
+ * (dynCheck's "expected IncomingMessage ..." texts). */
+export const DYN_HANDLE_KINDS = new Map([
+    ["httpReq", { tag: "SCR_DYNH_HTTP_REQ", cls: "IncomingMessage" }],
+    ["httpRes", { tag: "SCR_DYNH_HTTP_RES", cls: "ServerResponse" }],
+    ["netSocket", { tag: "SCR_DYNH_NET_SOCKET", cls: "Socket" }],
+    ["netServer", { tag: "SCR_DYNH_NET_SERVER", cls: "Server" }],
+    ["http2Session", { tag: "SCR_DYNH_H2_SESSION", cls: "Http2Session" }],
+    ["http2Stream", { tag: "SCR_DYNH_H2_STREAM", cls: "Http2Stream" }],
+]);
+/** A static type that CONVERTS into a dyn DOM value — the dynFrom domain:
+ * JSON-safe data, bytes<u8> (payload copied), undefined-armed unions of
+ * JSON-safe arms, boxable function types, and the runtime HANDLE kinds
+ * (boxed by reference — DYN_HANDLE_KINDS). */
+export function canConvertToDyn(t, getRecord, getUnion) {
+    if (isJsonSafeType(t, getRecord, getUnion))
+        return true;
+    // bytes<u8> is a DOM kind the walker boxes ANYWHERE (payload copied),
+    // including nested in records/arrays/unions — the tls/https options
+    // record's cert/key/ca Buffers. isJsonSafeType rejects nested bytes
+    // (no JSON-exact round trip), but dynFrom needs only that the walker
+    // can build the DOM value, which it can — so canConvertToDyn folds the
+    // bytes-bearing composites in beyond the JSON-safe core.
+    if (canBoxBytesComposite(t, getRecord, getUnion))
+        return true;
+    if (t.kind === "bytes" && t.elem === "u8")
+        return true;
+    // %Error converts as the DOM's error encoding ({%error, name, message,
+    // code?} — the caughtToDyn shape, scr_dyn_from_error): the dyn 'error'
+    // listener boundary (a mustCall-wrapped handler receiving the payload).
+    if (t.kind === "object" && t.className === "%Error")
+        return true;
+    if (t.kind === "func")
+        return canBoxFuncIntoDyn(t, getRecord, getUnion);
+    if (DYN_HANDLE_KINDS.has(t.kind))
+        return true;
+    // Promises box by REFERENCE (SCR_DYN_PROMISE): promise<dyn> carries its
+    // ScrPromise directly (the payload is already a DOM value), any other
+    // convertible-or-void inner boxes an ADAPTER promise whose emitted
+    // settle callback converts the payload (rejections copy raw — reasons
+    // are dynamically tagged). The dc tracePromise boundary and dyn-boxed
+    // async closures are the crossings.
+    if (t.kind === "promise") {
+        return (t.inner.kind === "dyn" ||
+            t.inner.kind === "void" ||
+            canConvertToDyn(t.inner, getRecord, getUnion));
+    }
+    if (t.kind === "union") {
+        const def = getUnion(t.unionId);
+        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion));
+    }
+    return false;
+}
+/** The bytes-bearing extension of the dynFrom domain: JSON-safe scalars
+ * plus bytes<u8> anywhere, recursing through records (fields + index
+ * value), arrays, and unit-armed unions — exactly the sc_td_* walker's
+ * capability for the tls/https options-record shapes. Returns false for
+ * a composite carrying any kind the walker cannot box (funcs, Maps,
+ * handles nested in a record); those still fence. */
+function canBoxBytesComposite(t, getRecord, getUnion) {
+    switch (t.kind) {
+        case "f64":
+        case "string":
+        case "bool":
+        case "dyn":
+        case "undefinedT":
+        case "nullT":
+            return true;
+        case "bytes":
+            return t.elem === "u8";
+        case "array":
+            return canBoxBytesComposite(t.elem, getRecord, getUnion);
+        case "record": {
+            const shape = getRecord(t.shapeId);
+            if (!shape)
+                return false;
+            if (!shape.fields.every((f) => canBoxBytesComposite(f.type, getRecord, getUnion)))
+                return false;
+            return !shape.indexValue || canBoxBytesComposite(shape.indexValue, getRecord, getUnion);
+        }
+        case "union": {
+            const def = getUnion(t.unionId);
+            return !!def && def.arms.every((a) => canBoxBytesComposite(a, getRecord, getUnion));
+        }
+        default:
+            return false;
+    }
+}
+/** A type a dyn value can be VALIDATED into — the dynCheck domain:
+ * JSON-safe data, bytes<u8> (a fresh copy out), the %Error extraction,
+ * undefined-armed unions of JSON-safe arms, adaptable function types,
+ * and the runtime HANDLE kinds (a tag-checked reference unwrap —
+ * DYN_HANDLE_KINDS). */
+export function canDynCheckTo(t, getRecord, getUnion) {
+    if (isJsonSafeType(t, getRecord, getUnion))
+        return true;
+    if (t.kind === "bytes" && t.elem === "u8")
+        return true;
+    if (t.kind === "object" && t.className === "%Error")
+        return true;
+    if (t.kind === "func")
+        return canAdaptDynFuncTo(t, getRecord, getUnion);
+    if (DYN_HANDLE_KINDS.has(t.kind))
+        return true;
+    if (t.kind === "union") {
+        const def = getUnion(t.unionId);
+        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion));
+    }
+    return false;
+}
+/** A closure type that can BOX into the DOM's function kind (dynFrom):
+ * every param dyn or dynCheckable (the thunk validates dyn arguments into
+ * them), return void, dyn, or dyn-convertible (the thunk converts it
+ * back). */
+export function canBoxFuncIntoDyn(t, getRecord, getUnion) {
+    return (t.kind === "func" &&
+        t.params.every((p) => p.kind === "dyn" || canDynCheckTo(p, getRecord, getUnion)) &&
+        (t.ret.kind === "void" || t.ret.kind === "dyn" || canConvertToDyn(t.ret, getRecord, getUnion)));
+}
+/** A closure type a dyn function value can ADAPT to (dynCheck): every
+ * param dyn or dyn-convertible (the adapter converts typed arguments into
+ * dyn), return void, dyn, or dynCheckable (the adapter validates the dyn
+ * result). */
+export function canAdaptDynFuncTo(t, getRecord, getUnion) {
+    return (t.kind === "func" &&
+        // A variadic (rest-marked) target would need the trailing rest-array
+        // param synthesized by the adapter — no adapter models that; variadic
+        // values live boxed and are called through their own thunks.
+        t.rest !== true &&
+        t.params.every((p) => p.kind === "dyn" || canConvertToDyn(p, getRecord, getUnion)) &&
+        (t.ret.kind === "void" || t.ret.kind === "dyn" || canDynCheckTo(t.ret, getRecord, getUnion)));
+}
+/** The MARSHAL-direction boundary (jsMarshal): everything that can cross
+ * out and back (canCrossIslandBoundary) plus qualifying closures — those
+ * enter as host functions but never EXIT (jsExit keeps the narrower
+ * predicate). */
+export function canMarshalIntoIsland(t, getRecord, getUnion) {
+    return isJsonSafeType(t, getRecord, getUnion) || canMarshalFuncIntoIsland(t);
+}
+/** The EXIT-direction boundary (jsExit): everything round-trippable
+ * (canCrossIslandBoundary) plus BARE undefined/null-armed unions whose
+ * data arms are all JSON-safe — the engine's undefined takes the
+ * undefined arm before the JSON detour (JSON cannot spell undefined, and
+ * bare undefined-armed unions are JSON-unsafe for exactly that reason),
+ * null and data ride the round trip into the union's dynCheck. The
+ * package-API shape `result.headers` : `Record<string, string> |
+ * undefined` is the motivating case. */
+export function canExitIslandToType(t, getRecord, getUnion) {
+    if (canCrossIslandBoundary(t, getRecord, getUnion))
+        return true;
+    // Uint8Array exits with a validated kind check + copy (engine Buffers
+    // pass — they ARE Uint8Arrays); other element widths stay out.
+    if (t.kind === "bytes" && t.elem === "u8")
+        return true;
+    if (t.kind === "union") {
+        const def = getUnion(t.unionId);
+        return (!!def &&
+            def.arms.some((a) => a.kind === "undefinedT") &&
+            def.arms.every((a) => isUnitType(a) || isJsonSafeType(a, getRecord, getUnion)));
+    }
+    return false;
+}
+/** True when the module contains any regex construct — a regexLit /
+ * regexIntrinsic node or a regex-typed slot anywhere. This is the link
+ * switch that pulls scr_regex.c + the vendored libregexp into the binary
+ * (cc.ts); regex-free programs keep the historical command line. A generic
+ * JSON walk: `kind` discriminants live only on IR objects, so user string
+ * VALUES can never false-positive. */
+export function moduleUsesRegex(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const kind = v.kind;
+        if (kind === "regex" || kind === "regexLit" || kind === "regexIntrinsic") {
+            found = true;
+            return;
+        }
+        // The lre-backed case conversions live in scr_regex.c (libunicode's
+        // case tables): they ride the same link switch as regex nodes.
+        if (kind === "strIntrinsic") {
+            const method = v.method;
+            if (method === "toLowerCase" || method === "toUpperCase") {
+                found = true;
+                return;
+            }
+        }
+        // RegExp.escape lives in scr_regex.c too (needing no engine — it
+        // keeps the always-linked string TU out of hello-world's size class).
+        if (kind === "libCall" && v.fn === "regexp.escape") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the embedded npm graph references fetch — the link switch
+ * that pulls scr_fetch.c + its socket/tls/zlib dependencies into the binary (cc.ts) and
+ * has the emitted main call scr_fetch_install. A word-boundary scan over
+ * the embedded SOURCES, erring toward linking: a false positive costs one
+ * dylib reference; a false negative would leave embedded code without the
+ * global at runtime. Static builds and fetch-free graphs keep their exact
+ * historical link lines. */
+export function moduleUsesFetch(mod) {
+    const embedded = mod.embedded;
+    if (embedded && embedded.modules.some((m) => /\bfetch\b/.test(m.source)))
+        return true;
+    // USER-code fetch (the island-backed ambient): its lowering reads the
+    // engine's fetch global — the same jsOp walk shape as moduleUsesZlib.
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "jsOp" && node.op === "globalGet" && node.name === "fetch") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** The libCall fns served by the OPTIONAL events unit (scr_events.c):
+ * process signal/exit listeners and the piped-stdin surface. */
+const PROCESS_EVENT_LIB_FNS = new Set([
+    "process.onSignal",
+    "process.offSignal",
+    "process.onExit",
+    "process.offExit",
+    "stdin.onData",
+    "stdin.onEnd",
+    "stdin.onError",
+    "stdin.nextChunk",
+    // node:readline rides the stdin unit (scr_readline.c links beside
+    // scr_events.c under the same gate).
+    "rl.create",
+    "rl.question",
+    "rl.close",
+    "rl.onClose",
+]);
+/** True when the module uses the process-events surface — the link switch
+ * that pulls scr_events.c into the binary and has the emitted main call
+ * scr_events_install (cc.ts + emitter; the scr_regex/scr_fetch/scr_zlib
+ * gating precedent). Event-free programs pay zero bytes and keep their
+ * exact link line. Same generic-walk shape as moduleUsesRegex. */
+export function moduleUsesProcessEvents(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && PROCESS_EVENT_LIB_FNS.has(node.fn)) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module uses the node:events EventEmitter surface — the
+ * link switch that pulls scr_events_emitter.c into the binary (cc.ts; the
+ * scr_events.c gating precedent, but pure data structure: no install, no
+ * loop hooks). Two signals: the `%EventEmitter` class def rides the
+ * module (any emitter-typed value or `extends EventEmitter` subclass
+ * references it, and the emitted RC/trace helpers call scr_emitter_*),
+ * or an emitter.* libCall survived (the defaultMaxListeners statics carry
+ * no emitter-typed value). Emitter-free programs pay zero bytes and keep
+ * their exact link line. */
+export function moduleUsesEmitter(mod) {
+    if ((mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS))
+        return true;
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("emitter.")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the program touches the node:stream surface (scr_stream.c —
+ * the moduleUsesEmitter story: the class defs ride the module whenever a
+ * stream-typed value exists, and every stream libCall names its unit).
+ * Stream programs always use the emitter unit too — the stream class
+ * defs pull `%EventEmitter` through their base chain, so
+ * moduleUsesEmitter answers true whenever this does. Stream-free
+ * programs pay zero bytes and keep their exact link line. */
+export function moduleUsesStream(mod) {
+    if ((mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)))
+        return true;
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" &&
+            typeof node.fn === "string" &&
+            (node.fn.startsWith("readable.") || node.fn.startsWith("writable.") ||
+                node.fn.startsWith("duplex.") || node.fn.startsWith("transform.") ||
+                node.fn.startsWith("passthrough.") ||
+                node.fn === "stream.destroy" || node.fn === "stream.destroyErr" ||
+                node.fn === "stream.prop" || node.fn === "stream.errored" ||
+                node.fn.startsWith("stream.set"))) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the embedded npm graph has an edge into `builtin` — the
+ * island shim needs the corresponding native bridge linked (zlib's is
+ * the first; the emitted main installs it before any island entry). */
+export function moduleEmbedsBuiltin(mod, builtin) {
+    return mod.embedded !== undefined && mod.embedded.edges.some((e) => e.to === builtin);
+}
+/** Embedded module texts at least this long are DEFLATE-compressed into
+ * the emitted C (emit-island.ts; each stays plain when deflate does not
+ * shrink it) and inflated lazily by the island's module loader at first
+ * load. Below it the zlib round trip cannot pay for itself. */
+export const NPM_COMPRESS_MIN = 1024;
+/** True when the emitted npm tables will carry compressed module text —
+ * the SAME candidate test emit-island.ts compresses by, so index.ts's
+ * zlib link switch and emitter.ts's inflater installation stay in
+ * lockstep with the emission (a candidate whose deflate happens not to
+ * shrink stays plain; the installed inflater is then just unused). */
+export function moduleEmbedsCompressedNpm(mod) {
+    return (mod.embedded !== undefined &&
+        mod.embedded.modules.some((m) => m.source.length >= NPM_COMPRESS_MIN || (m.esm ?? "").length >= NPM_COMPRESS_MIN));
+}
+/** True when the module contains any zlib libCall (the static lowering)
+ * OR the embedded npm graph imports node:zlib (the island shim) — the
+ * link switch that pulls scr_zlib.c + the system libz into the binary
+ * (cc.ts); zlib-free programs keep their exact link line. Same
+ * generic-walk shape as moduleUsesRegex: `kind`/`fn` discriminants live
+ * only on IR objects. */
+export function moduleUsesZlib(mod) {
+    if (moduleEmbedsBuiltin(mod, "node:zlib"))
+        return true;
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("zlib.")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any dc.* libCall — the link switch that
+ * pulls scr_dc.c (the diagnostics_channel registry and pub/sub) into the
+ * binary (cc.ts). Channel-free binaries keep their exact size class.
+ * Same walk shape as moduleUsesZlib. */
+export function moduleUsesDc(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("dc.")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any assert libCall — the link switch
+ * that pulls scr_assert.c into the binary (cc.ts). scr_regex.c calls the
+ * assert throw/inspect helpers (assert.match lives there), so the regex
+ * switch also pulls scr_assert.c; assert-free, regex-free binaries keep
+ * the historical command line and size. Same walk shape as
+ * moduleUsesZlib. */
+export function moduleUsesAssert(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("assert.")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any dynInvoke node or dyn.defineProps
+ * libCall — the link switch that pulls scr_dyn_invoke.c (the prototype-
+ * method dispatch on dyn receivers, plus scr_dyn_display and
+ * scr_dyn_define_props) into the binary (cc.ts; the assert gating
+ * precedent — dispatch-free binaries keep their exact size class). Same
+ * walk shape as moduleUsesZlib. */
+export function moduleUsesDynInvoke(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "dynInvoke" || (node.kind === "libCall" && node.fn === "dyn.defineProps")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any insp libCall — the link switch that
+ * pulls scr_inspect.c into the binary (cc.ts; the assert gating
+ * precedent — inspect-free binaries keep the historical command line and
+ * size class). Same walk shape as moduleUsesZlib. */
+/** True when the module needs scr_async_dyn.c — the checked-dynamic
+ * async surfaces (DOM-promise then/catch/finally reactions, await of a
+ * dyn value, `new Promise(setImmediate)`, AsyncLocalStorage, the
+ * unhandledRejection/warning process events). Also pulled by the
+ * dynInvoke and dc gates (their TUs call into this one) — cc.ts. Same
+ * walk shape as moduleUsesZlib. */
+export function moduleUsesDynAsync(mod) {
+    const fns = new Set([
+        "async.awaitDyn", "timers.immediatePromise",
+        "process.onUnhandledRejection", "process.onWarning", "process.offWarning", "process.emitWarning",
+        "als.new", "als.get", "als.run", "als.exitRun", "als.enterWith", "als.disable",
+        "dc.chanBindStore", "dc.chanUnbindStore", "dc.chanRunStores",
+    ]);
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && fns.has(node.fn)) {
+            found = true;
+            return;
+        }
+        // A DYN-typed await reads through scr_await_dyn (the DOM-crossing
+        // await lives in the gated TU) — promise<dyn> receivers' awaits and
+        // the lifted then/catch helpers alike.
+        if (node.kind === "awaitExpr" && node.type !== undefined && node.type.kind === "dyn") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+export function moduleUsesInspect(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("insp.")) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any net libCall — the link switch that
+ * pulls scr_net.c into the binary and has the emitted main call
+ * scr_net_install (cc.ts + emitter; the scr_events gating precedent).
+ * Net-free programs pay zero bytes and keep their exact link line. Same
+ * generic-walk shape as moduleUsesZlib. */
+export function moduleUsesNet(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("net.") || node.fn.startsWith("http.") ||
+                node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
+                node.fn.startsWith("http2."))) {
+            // http/tls/https/http2 all ride ON net: their libCalls need scr_net.c
+            // linked and installed too, so the net switch answers for every
+            // server-family prefix.
+            found = true;
+            return;
+        }
+        // A net-family HANDLE TYPE anywhere in the IR (a global or local whose
+        // initializing statement compiled to a runtime fence still carries the
+        // type): its emitted release call needs the unit linked even when no
+        // libCall survived the fencing.
+        if (node.kind === "netServer" || node.kind === "netSocket" ||
+            node.kind === "http2Session" || node.kind === "http2Stream" ||
+            node.kind === "httpReq" || node.kind === "httpRes" ||
+            node.kind === "httpClientReq" || node.kind === "secureCtx") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any sym.* libCall or a symbol-kind type
+ * anywhere in the IR — the link switch that pulls scr_symbol.c into the
+ * binary (cc.ts; the scr_net gating precedent — no install call, the
+ * Symbol.for registry initializes lazily). The TYPE check matters like
+ * net's: a symbol-typed local whose initializer compiled to a runtime
+ * fence still emits release calls that need the unit linked. Symbol-free
+ * programs pay zero bytes and keep their exact link line. */
+export function moduleUsesSymbol(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("sym.")) {
+            found = true;
+            return;
+        }
+        if (node.kind === "symbol") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module uses the URLSearchParams surface — sp.* libCalls,
+ * the url.searchParams getter, or a searchParams-kind type anywhere on
+ * the IR (a fenced statement can leave a typed local whose release call
+ * still needs the unit linked) — the link switch that pulls
+ * scr_url_params.c into the binary (the moduleUsesSymbol precedent: pure
+ * data structure, no loop hooks, cross-compiles everywhere). sp-free
+ * programs keep their exact link line; scr_url.c itself stays
+ * always-linked and never references the unit. */
+export function moduleUsesSearchParams(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("sp.") || node.fn === "url.searchParams")) {
+            found = true;
+            return;
+        }
+        if (node.kind === "searchParams") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any fs.watch/watcher.* libCall — the
+ * link switch that pulls scr_watch.c into the binary and has the emitted
+ * main call scr_watch_install (cc.ts + emitter; the scr_net gating
+ * precedent). Watch-free programs pay zero bytes and keep their exact
+ * link line. Same generic-walk shape as moduleUsesZlib. */
+export function moduleUsesFsWatch(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("fs.watch") || node.fn.startsWith("watcher."))) {
+            found = true;
+            return;
+        }
+        // A watcher HANDLE TYPE left behind by a fenced statement still emits
+        // scr_watcher_release — the unit must link.
+        if (node.kind === "fsWatcher") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any test.* libCall or a testCtx handle
+ * type — the link switch that pulls scr_test.c into the binary and has
+ * the emitted main return scr_test_exit_code() after the loop drains
+ * (cc.ts + emitter; the moduleUsesDgram shape). Test-free programs pay
+ * zero bytes and keep their exact link line. */
+export function moduleUsesNodeTest(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("test.")) {
+            found = true;
+            return;
+        }
+        // A TestContext HANDLE TYPE left behind by a fenced statement still
+        // emits a release call — the unit must link (the dgram type story).
+        if (node.kind === "testCtx") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any dgram.* or dns.* libCall — the
+ * link switch that pulls scr_dgram.c into the binary and has the emitted
+ * main call scr_dgram_install (cc.ts + emitter; the scr_net gating
+ * precedent — dns.lookup lives in the same unit, so either prefix
+ * answers). Dgram-free programs pay zero bytes and keep their exact link
+ * line. Same generic-walk shape as moduleUsesZlib. */
+export function moduleUsesDgram(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("dgram.") || node.fn.startsWith("dns."))) {
+            found = true;
+            return;
+        }
+        // A dgram HANDLE TYPE left behind by a fenced statement still emits a
+        // release call — the unit must link (the moduleUsesNet type story).
+        if (node.kind === "dgramSocket") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any http.* libCall — the link switch
+ * that pulls scr_http.c into the binary (cc.ts; moduleUsesNet already
+ * answers true for these, so scr_net.c comes along). */
+export function moduleUsesHttpServer(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("http.") || node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
+                node.fn.startsWith("http2."))) {
+            // scr_tls.c calls into scr_http.c unconditionally (the https server
+            // and client are the http ones over a transport), so any tls/https
+            // use pulls the http unit too.
+            found = true;
+            return;
+        }
+        // An http-family HANDLE TYPE left behind by a fenced statement still
+        // emits its release call — the unit must link (the moduleUsesNet type
+        // story; secureCtx rides here because scr_tls.c calls into scr_http.c).
+        if (node.kind === "httpReq" || node.kind === "httpRes" ||
+            node.kind === "httpClientReq" || node.kind === "secureCtx") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** The legacy http2.* libCalls implemented by scr_http.c/scr_tls.c (the
+ * allowHTTP1 compatibility slice) — they must NOT pull scr_http2.c, so
+ * divergence-57 binaries keep their exact link line. */
+const HTTP2_LEGACY_FNS = new Set([
+    "http2.createSecureServer", "http2.createSecureServerSni",
+    "http2.serverOnSessionError", "http2.streamNoop", "http2.streamUndefCall",
+]);
+/** True when the module uses the REAL h2 surface (scr_http2.c): any core
+ * http2.* libCall, or an h2 handle type left behind by a fenced statement
+ * (its emitted release call needs the unit — the moduleUsesNet story). */
+export function moduleUsesHttp2(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            node.fn.startsWith("http2.") && !HTTP2_LEGACY_FNS.has(node.fn)) {
+            found = true;
+            return;
+        }
+        if (node.kind === "http2Session" || node.kind === "http2Stream") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** True when the module contains any tls.* or https.* libCall — the link
+ * switch that pulls scr_tls.c and the vendored mbedTLS archive into the
+ * binary (cc.ts; moduleUsesNet and moduleUsesHttpServer already answer
+ * true for these, so scr_net.c and scr_http.c come along). TLS-free
+ * programs keep their exact link line and never build mbedTLS. */
+export function moduleUsesTls(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" && typeof node.fn === "string" &&
+            (node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
+                node.fn.startsWith("http2."))) {
+            found = true;
+            return;
+        }
+        // A secureCtx HANDLE TYPE left behind by a fenced statement still
+        // emits scr_secure_ctx_release — the unit must link.
+        if (node.kind === "secureCtx") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
+/** The may-throw seed: libCall members that can raise. Every fs.* member
+ * EXCEPT existsSync (which, like Node's, swallows errors and returns false)
+ * throws a catchable error on failure; json.parse throws a catchable
+ * SyntaxError-shaped string on malformed input; process.* members never
+ * throw. Backends' may-throw analyses must treat a function containing one
+ * of these as throwing, exactly like a `throw` statement (and must ALSO
+ * seed on `dynCheck` and `awaitExpr` nodes, which throw on validation
+ * failure / promise rejection). */
+export const MAY_THROW_LIB_FNS = new Set([
+    "insp.jsonDyn",
+    // diagnostics_channel: publish runs subscribers synchronously (a throw
+    // propagates — the documented divergence from triggerUncaughtException);
+    // the subscribe/unsubscribe forms throw Node's ERR_INVALID_ARG_TYPE for
+    // non-function subscribers.
+    "dc.publish",
+    "dc.subscribe",
+    "dc.unsubscribe",
+    "dc.chanSubscribe",
+    "dc.chanUnsubscribe",
+    "dc.tcSubscribe",
+    "dc.tcUnsubscribe",
+    "dc.tcTraceSync",
+    "dc.tcTraceCallback",
+    "dc.tcTracePromise",
+    "process.onUnhandledRejection",
+    "async.awaitDyn",
+    "als.run",
+    "als.exitRun",
+    "dc.chanBindStore",
+    "dc.chanRunStores",
+    "http.resWriteHeadDyn",
+    "net.sockSetEncoding",
+    "http.reqSetEncoding",
+    "fs.readFileSyncBuf",
+    "fs.readFileSyncDyn",
+    // tls/https runtime options records: the walks throw the catchable
+    // runtime fence for out-of-bounds members and non-PEM values (the
+    // divergence-66 stance).
+    "tls.pemDyn",
+    "tls.createServerDyn",
+    "tls.createServerDynCb",
+    "https.createServerDyn",
+    "https.createServerDynCb",
+    "tls.connect",
+    "tls.connectCb",
+    // EventEmitter dispatch runs user listeners synchronously (emit), and
+    // the mutation forms fire the newListener/removeListener meta events —
+    // any of them can throw. emitError additionally THROWS its payload when
+    // 'error' has no listener, Node's unhandled-'error' contract.
+    "emitter.emit",
+    "emitter.emitError",
+    "emitter.on",
+    "emitter.off",
+    "emitter.checkListener",
+    "emitter.onDyn",
+    "emitter.offDyn",
+    "emitter.onData",
+    "emitter.onDataDyn",
+    "emitter.emitData",
+    "readable.nextChunk",
+    "readable.nextChunkDyn",
+    // The checked-dynamic chunk forms throw Node's ERR_INVALID_ARG_TYPE
+    // chunk TypeError on a non-string/Buffer DOM kind.
+    "net.sockWriteDyn",
+    "net.sockEndDyn",
+    "http.resWriteDyn",
+    "http.resEndDyn",
+    "http.clientWriteDyn",
+    "http.clientEndDyn",
+    // The URL-string client form throws catchably on an unparsable input
+    // ("Invalid URL") or a non-http scheme (ERR_INVALID_PROTOCOL).
+    "http.requestUrl",
+    "http.requestUrlCb",
+    // The h2 client's throwing entries: connect on a bad/non-http
+    // authority (ERR_INVALID_URL / ERR_INVALID_PROTOCOL), request on a
+    // closed/destroyed session (ERR_HTTP2_INVALID_SESSION), setEncoding on
+    // an unknown name (ERR_UNKNOWN_ENCODING). Event fires run user code
+    // synchronously (the stream-operations stance below), so the data/
+    // write paths that can fire inline join too.
+    "http2.connect",
+    "http2.connectCb",
+    "http2.sessionRequest",
+    "http2.streamSetEncoding",
+    "http2.streamRespond",
+    "http2.streamWrite",
+    "http2.streamWriteBytes",
+    "http2.streamEnd",
+    "http2.streamEndStr",
+    "http2.streamEndBytes",
+    "emitter.removeAll",
+    // Stream operations run user code synchronously (option callbacks and
+    // 'data'/'drain'/... listeners on the caller's stack, like emit) — any
+    // of them may leave a listener's throw pending. destroy with no 'error'
+    // listener throws the payload itself (the emitter.emitError contract).
+    // The dyn-options constructors walk the record at runtime: a consumed-
+    // but-unlowered option (objectMode, construct, ...) throws the compile
+    // fence's runtime twin; a bad encoding throws ERR_UNKNOWN_ENCODING.
+    "stream.finished",
+    "stream.finishedDyn",
+    "stream.pipeline",
+    "stream.pipelineDyn",
+    "readable.newDyn",
+    "writable.newDyn",
+    "duplex.newDyn",
+    "transform.newDyn",
+    "passthrough.newDyn",
+    "readable.initDyn",
+    "writable.initDyn",
+    "duplex.initDyn",
+    "transform.initDyn",
+    "passthrough.initDyn",
+    "readable.push",
+    "readable.pushStr",
+    "readable.pushNull",
+    "readable.pushU",
+    "readable.pushDyn",
+    "readable.unshift",
+    "readable.unshiftStr",
+    "readable.read",
+    "readable.resume",
+    "readable.pipe",
+    "readable.unpipe",
+    "writable.write",
+    "writable.writeStr",
+    "writable.writeU",
+    "writable.writeDyn",
+    "writable.end",
+    "writable.uncork",
+    "stream.destroy",
+    "stream.destroyErr",
+    // setMaxListeners(n) throws Node's ERR_OUT_OF_RANGE RangeError for
+    // negative/NaN arguments; the static form's default-max write validates
+    // identically (Node's validateNumber(n, "setMaxListeners", 0)).
+    "emitter.setMax",
+    "emitter.setDefaultMax",
+    // The createConnection request forms run the caller's dialer closure
+    // synchronously — a throw there propagates like Node's.
+    "http.requestConn",
+    "http.requestConnCb",
+    "process.kill",
+    "process.killNum",
+    // cpuUsage(prev)'s field validation: negative/non-finite prev fields
+    // throw Node's ERR_INVALID_ARG_VALUE RangeError, catchably.
+    "process.cpuPrevValidate",
+    // Non-TTY stdin: Node's stdin has no setRawMode member, so the call is
+    // the exact catchable TypeError.
+    "process.stdinSetRawMode",
+    // The unguarded h2-only stream call: always throws Node's TypeError.
+    "http2.streamUndefCall",
+    // A read of a declare-d const nothing defines: always throws Node's
+    // catchable ReferenceError.
+    "global.undefRead",
+    "child.kill",
+    // The caller's lookup runs synchronously inside the connect call — a
+    // throw there propagates like Node's.
+    "net.connectLookup",
+    "cp.execSync",
+    "cp.execCapture",
+    // The client request constructors validate the method token
+    // synchronously (Node's ClientRequest ctor throw:
+    // ERR_INVALID_HTTP_TOKEN).
+    "http.request",
+    "http.requestCb",
+    "http.requestConn",
+    "http.requestConnCb",
+    "https.request",
+    "https.requestCb",
+    "https.requestFn",
+    "https.requestFnCb",
+    "rl.question",
+    "island.eval",
+    "island.import",
+    "island.castFail",
+    "json.parse",
+    // decodeURIComponent throws the spec's URIError on bad hex/invalid
+    // UTF-8 octets (encodeURIComponent never throws — see the IrLibFn doc).
+    "str.decodeUriComponent",
+    // The base64 globals: atob/btoa throw the catchable DOMException
+    // InvalidCharacterError on malformed input; the zero-argument form
+    // always throws Node's TypeError [ERR_MISSING_ARGS].
+    "str.atob",
+    "str.btoa",
+    "str.b64Missing",
+    // queueMicrotask's checked-dynamic form throws ERR_INVALID_ARG_TYPE
+    // synchronously on a non-function argument (the closure form never
+    // throws — the callback's own throw surfaces at drain, uncaught).
+    "timers.queueMicrotaskDyn",
+    // structuredClone: option validation throws Node's TypeErrors,
+    // functions/handles the spec's DataCloneError, cycles the scriptc
+    // fence; the zero-argument form always throws ERR_MISSING_ARGS. The
+    // DOMException clone shares the option validation.
+    "dyn.structuredClone",
+    "dyn.cloneMissing",
+    "dyn.cloneTransferFail",
+    // the dyn Object walks throw on null/undefined receivers
+    "dyn.objKeys",
+    "dyn.objValues",
+    "dyn.objEntries",
+    "error.domClone",
+    // new RegExp compiles the pattern eagerly: an invalid pattern or flag
+    // throws Node's catchable SyntaxError at construction.
+    "regex.new",
+    "dyn.keySet",
+    "dyn.toString",
+    "dyn.defineProps",
+    "process.chdir",
+    "fs.realpathSync",
+    "fs.readFileSync",
+    "fs.writeFileSync",
+    "fs.appendFileSync",
+    "fs.mkdirSync",
+    "fs.rmSync",
+    "fs.rmdirSync",
+    "fs.readdirSync",
+    "fs.readdirTypesSync",
+    "url.new",
+    "url.fileURLToPathUrl",
+    "url.fileURLToPathStr",
+    // The win32-target flavor of pathToFileURL (same runtime entry point —
+    // the bridge dispatches by the binary's platform): Node's win32 arm
+    // raises ERR_INVALID_ARG_VALUE TypeErrors for malformed UNC inputs, so
+    // only THIS flavor seeds may-throw — posix emission stays untouched.
+    "url.pathToFileURLWin32",
+    // URLSearchParams from a string[][]: Node's ERR_INVALID_TUPLE TypeError
+    // on a row that is not a [name, value] pair. The rest of the sp family
+    // never throws.
+    "sp.fromPairs",
+    "fs.statSync",
+    "crypto.randomBytesToString",
+    "crypto.randomBytes",
+    "buffer.concatLen",
+    "fs.readFileSyncBytes",
+    "fs.writeFileSyncBytes",
+    "zlib.inflateSync",
+    "date.toISOString",
+    "fs.mkdirRecursiveSync",
+    "fs.rmOptsSync",
+    "fs.rmRetrySync",
+    "fs.mkdtempSync",
+    "fs.accessSync",
+    "fs.readFdSync",
+    "fs.readFdSyncBytes",
+    // node:dgram state errors (Node throws synchronously): bind on a bound
+    // socket, connect on a connected one, send/close/address on a closed or
+    // never-bound one.
+    "dgram.bind",
+    "dgram.bindCb",
+    "dgram.connect",
+    "dgram.connectCb",
+    "dgram.sendStr",
+    "dgram.sendBytes",
+    "dgram.address",
+    "dgram.close",
+    "dgram.closeCb",
+    // The assert surface: every entry point except sameValue, bytesDeepEq,
+    // and the shape accumulator's begin/slot/test calls throws the
+    // catchable AssertionError on failure.
+    "assert.ok",
+    "assert.eqF64",
+    "assert.eqStr",
+    "assert.eqBool",
+    "assert.eqSym",
+    "assert.eqDyn",
+    "assert.deepResult",
+    "assert.match",
+    "assert.refEqBytes",
+    "assert.refEqFn",
+    "assert.throwsNone",
+    "assert.throwsMismatch",
+    "assert.throwsRegex",
+    "assert.shapeEnd",
+    "assert.unwantedRejection",
+    "assert.expectsErrDyn",
+    "assert.ifErrorErr",
+    "assert.ifErrorF64",
+    "assert.ifErrorStr",
+    "assert.ifErrorBool",
+    "assert.ifErrorDyn",
+    // util.inspect of an island `any` composite: the runtime tag is all
+    // there is, so the honest answer is a catchable TypeError.
+    "insp.jsval",
+    // The wider sync fs slice: same catchable errno throws as the rest.
+    "fs.unlinkSync",
+    "fs.chmodSync",
+    "fs.chownSync",
+    "fs.copyFileSync",
+    "fs.lstatSync",
+    "fs.writeFileModeSync",
+    "fs.mkdirModeSync",
+    "fs.mkdirRecursiveModeSync",
+    "fs.openSync",
+    "fs.readSync",
+    "fs.closeSync",
+    "fs.watch",
+    "fs.watchCb",
+    "crypto.x509Fingerprint",
+    "crypto.x509FingerprintStr",
+    "crypto.x509ValidFrom",
+    "crypto.x509ValidFromStr",
+    "crypto.x509ValidTo",
+    "crypto.x509ValidToStr",
+]);
+//# sourceMappingURL=nodes.js.map