@scriptc/compiler 0.0.11 → 0.0.13

package/dist/ir/validate.js

@@ -1,4 +1,4 @@
-import { arrayOf, BOOL, BYTES_U8, bytesOf, canAdaptDynFuncTo, canConvertToDyn, canExitIslandToType, canMarshalIntoIsland, canMarshalTypedFuncIntoIsland, CHILD_T, CHILDSTREAM_T, DGRAMSOCK_T, DYN, DYN_HANDLE_KINDS, F64, FSWATCHER_T, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, isJsonSafeType, isRefCounted, isSupportedIndexValue, isSupportedMapKey, isSupportedMapValue, isSupportedSetElem, isUnitType, jsOpResultKind, JSVAL, NETSERVER_T, NETSOCKET_T, PROCSTREAM_T, REF_TRUTHY_KINDS, REGEX, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, SEARCH_PARAMS_T, SECURECTX_T, SPAWNRES_T, STATS_T, STRING, SYMBOL_T, TESTCTX_T, typeEquals, typeKey, unionFuncSetArmsOk, URL_T, VOID } from "./nodes.js";
+import { arrayOf, BOOL, BYTES_U8, bytesOf, canAdaptDynFuncTo, canConvertToDyn, canExitIslandToType, canMarshalIntoIsland, canMarshalTypedFuncIntoIsland, CHILD_T, CHILDSTREAM_T, DGRAMSOCK_T, DYN, DYN_HANDLE_KINDS, F64, FSWATCHER_T, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, islandPromisePayloadTag, isJsonSafeType, isRefCounted, isSupportedIndexValue, isSupportedMapKey, isSupportedMapValue, isSupportedSetElem, isUnitType, jsOpResultKind, JSVAL, NETSERVER_T, NETSOCKET_T, PROCSTREAM_T, REF_TRUTHY_KINDS, REGEX, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, SEARCH_PARAMS_T, SECURECTX_T, SPAWNRES_T, STATS_T, STRING, SYMBOL_T, TESTCTX_T, typeEquals, typeKey, unionFuncSetArmsOk, URL_T, VOID } from "./nodes.js";
 /** Per-method signature for strIntrinsic: `argTypes` lists every argument
  * position (optional ones included); `minArgs` is how many may be omitted
  * from the end (backends fill the documented defaults). Exported for the
@@ -63,6 +63,9 @@ export const LIB_FN_SIGS = {
     "json.parse": { argTypes: [STRING], result: DYN },
     "dyn.keySet": { argTypes: [DYN, STRING, DYN], result: VOID },
     "dyn.iterPack": { argTypes: [DYN, STRING], result: DYN },
+    "dyn.arrLen": { argTypes: [DYN], result: F64 },
+    "dyn.arrAt": { argTypes: [DYN, F64], result: DYN },
+    "dyn.hasKey": { argTypes: [DYN, STRING], result: BOOL },
     "dyn.toString": { argTypes: [DYN, STRING, STRING], result: STRING },
     "dyn.defineProps": { argTypes: [DYN, DYN], result: DYN },
     "dyn.typeof": { argTypes: [DYN], result: STRING },
@@ -173,7 +176,7 @@ export const LIB_FN_SIGS = {
     "num.fromString": { argTypes: [STRING], result: F64 },
     "num.isNaN": { argTypes: [F64], result: BOOL },
     "str.encodeUriComponent": { argTypes: [STRING], result: STRING },
-    // The base64 globals: the argument is a DOM value (WebIDL ToString
+    // The base64 globals: the argument is a dyn value (WebIDL ToString
     // runs in the runtime); the zero-argument form always throws.
     "str.atob": { argTypes: [DYN], result: STRING },
     "str.btoa": { argTypes: [DYN], result: STRING },
@@ -230,7 +233,7 @@ export const LIB_FN_SIGS = {
     // node:querystring. qs.parse's result is the call site's ParsedUrlQuery
     // dictionary record (VOID is the networkInterfaces sentinel — the
     // libCall case checks the structure); qs.stringify's object argument
-    // is a DOM value (the frontend dynFroms typed records).
+    // is a dyn value (the frontend dynFroms typed records).
     "qs.parse": { argTypes: [STRING, STRING, STRING, F64], result: VOID },
     "qs.stringify": { argTypes: [DYN, STRING, STRING], result: STRING },
     "qs.escape": { argTypes: [STRING], result: STRING },
@@ -438,6 +441,9 @@ export const LIB_FN_SIGS = {
     // program-dependent (checked below); header pairs arrive flat.
     "http.request": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL], result: HTTPCLIENTREQ_T },
     "http.requestCb": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, null], result: HTTPCLIENTREQ_T },
+    "http.agentNew": { argTypes: [BOOL, BOOL, F64, F64, F64, F64, F64], result: DYN },
+    "http.requestAgent": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, DYN], result: HTTPCLIENTREQ_T },
+    "http.requestAgentCb": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, DYN, null], result: HTTPCLIENTREQ_T },
     "http.requestUrl": { argTypes: [STRING, STRING, BOOL], result: HTTPCLIENTREQ_T },
     "http.requestUrlCb": { argTypes: [STRING, STRING, BOOL, null], result: HTTPCLIENTREQ_T },
     "net.sockOnReadable": { argTypes: [NETSOCKET_T, null, BOOL], result: VOID },
@@ -446,6 +452,13 @@ export const LIB_FN_SIGS = {
     // placeholder the special case overrides).
     "net.sockRead": { argTypes: [NETSOCKET_T, F64], result: VOID },
     "net.sockUnshift": { argTypes: [NETSOCKET_T, BYTES_U8], result: VOID },
+    "net.sockPause": { argTypes: [NETSOCKET_T], result: NETSOCKET_T },
+    "net.sockResume": { argTypes: [NETSOCKET_T], result: NETSOCKET_T },
+    "net.sockSetNoDelay": { argTypes: [NETSOCKET_T, BOOL], result: NETSOCKET_T },
+    "net.sockDestroySoon": { argTypes: [NETSOCKET_T], result: VOID },
+    "net.sockBytesWritten": { argTypes: [NETSOCKET_T], result: F64 },
+    "net.sockReadable": { argTypes: [NETSOCKET_T], result: BOOL },
+    "net.sockOnFinish": { argTypes: [NETSOCKET_T, { kind: "func", params: [], ret: VOID }], result: VOID },
     "net.serverEmitConnection": { argTypes: [NETSERVER_T, NETSOCKET_T], result: VOID },
     // tls/https: cert/key/ca PEM arguments are strings OR Buffers (null =
     // both accepted; the emitter passes data+len either way).
@@ -459,6 +472,10 @@ export const LIB_FN_SIGS = {
     "tls.createServerDynCb": { argTypes: [DYN, null], result: NETSERVER_T },
     "https.createServerDyn": { argTypes: [DYN], result: NETSERVER_T },
     "https.createServerDynCb": { argTypes: [DYN, null], result: NETSERVER_T },
+    "http2.createSecureServerReq": { argTypes: [null, null, null], result: NETSERVER_T },
+    "http2.createSecureServerH2Req": { argTypes: [null, null, null], result: NETSERVER_T },
+    "http2.createSecureServerDyn": { argTypes: [DYN], result: NETSERVER_T },
+    "http2.createSecureServerDynCb": { argTypes: [DYN, null], result: NETSERVER_T },
     // tls.connect(port, host, opts[, cb]) — port -1 / host "" read the
     // options record; the callback fires post-handshake (secureConnect).
     "tls.connect": { argTypes: [F64, STRING, DYN], result: NETSOCKET_T },
@@ -473,6 +490,11 @@ export const LIB_FN_SIGS = {
     "tls.createSecureContext": { argTypes: [null, null], result: SECURECTX_T },
     "tls.createSecureContextDyn": { argTypes: [DYN], result: SECURECTX_T },
     "tls.caCertsChk": { argTypes: [DYN, STRING], result: VOID },
+    // The CA-store introspection unit (scr_tls_ca.c): per-type cached PEM
+    // string arrays and the default-set replacement.
+    "tlsca.get": { argTypes: [STRING], result: arrayOf(STRING) },
+    "tlsca.root": { argTypes: [], result: arrayOf(STRING) },
+    "tlsca.set": { argTypes: [arrayOf(STRING)], result: VOID },
     "https.createServer": { argTypes: [null, null, null], result: NETSERVER_T },
     // http2's allowHTTP1 compatibility server (divergence 57): cert/key
     // like tls.createServer; the 'request' handler arrives separately via
@@ -560,6 +582,8 @@ export const LIB_FN_SIGS = {
     "http.requestConnCb": { argTypes: [null, STRING, STRING, F64, arrayOf(STRING), BOOL, null], result: HTTPCLIENTREQ_T },
     "https.request": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, BOOL, null], result: HTTPCLIENTREQ_T },
     "https.requestCb": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, BOOL, null, null], result: HTTPCLIENTREQ_T },
+    "https.requestAgent": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, BOOL, null, DYN], result: HTTPCLIENTREQ_T },
+    "https.requestAgentCb": { argTypes: [STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, BOOL, null, DYN, null], result: HTTPCLIENTREQ_T },
     // The requestFn binding's runtime-secure rows: https.request's shape
     // with the leading `secure` bool.
     "https.requestFn": { argTypes: [BOOL, STRING, F64, STRING, STRING, F64, arrayOf(STRING), BOOL, BOOL, null], result: HTTPCLIENTREQ_T },
@@ -647,7 +671,7 @@ export const LIB_FN_SIGS = {
     "buffer.isEncoding": { argTypes: [STRING], result: BOOL },
     "buffer.concatLen": { argTypes: [arrayOf(BYTES_U8), F64], result: BYTES_U8 },
     // The checked-dynamic compare/equals validators (Node's argument
-    // ladders over DOM-boxed invalid-input probes).
+    // ladders over dyn-boxed invalid-input probes).
     "buffer.compareChk": { argTypes: [DYN, DYN], result: F64 },
     "bytes.equalsChk": { argTypes: [BYTES_U8, DYN], result: BOOL },
     "bytes.compareChk": { argTypes: [BYTES_U8, DYN, DYN, DYN, DYN, DYN], result: F64 },
@@ -726,7 +750,7 @@ export const LIB_FN_SIGS = {
     // Receiver (any error-hierarchy object) and the program-dependent
     // `string | undefined` result are checked in the libCall case.
     "error.code": { argTypes: [null], result: VOID },
-    // DOMException: construction takes the two DOM args (WebIDL's
+    // DOMException: construction takes the two dyn args (WebIDL's
     // resolution runs in the runtime); the %DOMException result is a
     // program-dependent object type, checked in the libCall case. The
     // read surface takes the %DOMException receiver (a null slot — the
@@ -877,7 +901,7 @@ export const LIB_FN_SIGS = {
     // Symbol strict equality (pointer identity; scr_symbol.c).
     "assert.eqSym": { argTypes: [{ kind: "symbol" }, { kind: "symbol" }, BOOL, BOOL, STRING, BOOL], result: VOID },
     // The equality quartet over checked-dynamic operands (the frontend
-    // boxes a static side into the DOM first).
+    // boxes a static side into the checked-dynamic tree first).
     "assert.eqDyn": { argTypes: [DYN, DYN, BOOL, BOOL, STRING, BOOL], result: VOID },
     // The throws(fn, {shape}) accumulator: begin/slot calls never throw;
     // shapeEnd throws the Comparison diff. The error slot is the
@@ -957,7 +981,10 @@ export const LIB_FN_SIGS = {
     "dc.tcTraceSync": { argTypes: [F64, DYN, DYN, DYN, DYN], result: DYN },
     "dc.tcTraceCallback": { argTypes: [F64, DYN, F64, DYN, DYN, DYN], result: DYN },
     "dc.tcTracePromise": { argTypes: [F64, DYN, DYN, DYN, DYN], result: { kind: "promise", inner: DYN } },
-    "process.onUnhandledRejection": { argTypes: [DYN], result: VOID },
+    "process.onUnhandledRejection": { argTypes: [DYN, BOOL], result: VOID },
+    "process.offUnhandledRejection": { argTypes: [DYN], result: VOID },
+    "process.onRejectionHandled": { argTypes: [DYN, BOOL], result: VOID },
+    "process.offRejectionHandled": { argTypes: [DYN], result: VOID },
     "process.onWarning": { argTypes: [DYN], result: VOID },
     "process.offWarning": { argTypes: [DYN], result: VOID },
     "process.emitWarning": { argTypes: [DYN], result: VOID },
@@ -1183,7 +1210,7 @@ export function validateModule(mod) {
             // Unit kinds (undefinedT/nullT) exist only as union arms — a BARE
             // unit field is as malformed as a void one. dyn fields are VALID
             // (`[string, unknown]` entries tuples, `{ v: unknown }` records):
-            // the slot holds a DOM value with the overflow map's plumbing.
+            // the slot holds a dyn value with the overflow map's plumbing.
             if (f.type.kind === "void" || f.type.kind === "jsval" ||
                 isUnitType(f.type)) {
                 errors.push({ message: `record ${rec.id}: field "${f.name}" is ${f.type.kind}`, loc: noLoc });
@@ -1525,7 +1552,10 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                         // Symbol identity IS pointer identity (the frontend's rule).
                         e.left.type.kind === "symbol" ||
                         e.left.type.kind === "bytes" ||
-                        e.left.type.kind === "promise")) {
+                        e.left.type.kind === "promise" ||
+                        // Runtime handles are objects to === (one handle per socket/
+                        // request — pointer identity is JS's object equality).
+                        DYN_HANDLE_KINDS.has(e.left.type.kind))) {
                     // Reference identity: both operands must be the same ref type.
                     if (!typeEquals(e.left.type, e.right.type)) {
                         err(`bin ${e.op} on references: operand types differ`, e.loc);
@@ -1741,10 +1771,10 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     }
                     break;
                 }
-                // A dyn (DOM) chain (`rawName?.match(re)` on a JSON.parse result):
+                // A dyn (dyn) chain (`rawName?.match(re)` on a JSON.parse result):
                 // the nullish test reads the node's kind tag; the body is the
                 // validated dynamic dispatch, its result converted back into the
-                // DOM (dynFrom) — so body and result are dyn, or void for
+                // dyn (dynFrom) — so body and result are dyn, or void for
                 // statement-position chains.
                 if (e.receiver.type.kind === "dyn") {
                     if (activeChains.has(e.id))
@@ -1789,7 +1819,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     break;
                 }
                 expectType(e.body, e.type, "optChain body");
-                // dyn results carry the unit path as the undefined DOM value; every
+                // dyn results carry the unit path as the undefined dyn value; every
                 // other value result needs an undefined arm to land on.
                 if (e.type.kind !== "dyn") {
                     const rdef = e.type.kind === "union" ? unions.get(e.type.unionId) : undefined;
@@ -1821,7 +1851,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 }
                 // The CHECKED-DYNAMIC form: the runtime kind decides (the
                 // emitters' scr_dyn_is_nullish arm) — left, right, and result
-                // all live in the DOM.
+                // all live in the checked-dynamic tree.
                 if (e.left.type.kind === "dyn") {
                     if (e.type.kind !== "dyn")
                         err("dyn nullish must answer dyn", e.loc);
@@ -1862,6 +1892,21 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     err(`orDefault left references unknown union ${e.left.type.unionId}`, e.loc);
                     break;
                 }
+                // Retagged shape: the truthy side is a call to the named helper, so
+                // the arm count is free and the type rule is the helper's signature.
+                if (e.retag !== undefined) {
+                    const helper = functions.get(e.retag);
+                    if (!helper) {
+                        err(`orDefault retag calls undeclared function "${e.retag}"`, e.loc);
+                    }
+                    else if (helper.params.length !== 1 || !typeEquals(helper.params[0].type, e.left.type)) {
+                        err(`orDefault retag ${e.retag} must take exactly the left union`, e.loc);
+                    }
+                    else if (!typeEquals(callSiteReturnType(helper), e.type)) {
+                        err(`orDefault retag ${e.retag} must return the node's type`, e.loc);
+                    }
+                    break;
+                }
                 const rest = def.arms.filter((a) => !isUnitType(a));
                 if (rest.length !== 1 || !typeEquals(e.type, rest[0])) {
                     err("orDefault type must be the left union's single non-unit arm", e.loc);
@@ -2398,7 +2443,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     }
                 });
                 // Result func type must match the target's signature. A VARIADIC
-                // (rest-marked) type hides one synthetic trailing DOM-array param
+                // (rest-marked) type hides one synthetic trailing dyn-array param
                 // in the lifted function (the thunk fills it) — the type's
                 // declared params plus that one must match.
                 if (e.type.kind === "func") {
@@ -2771,7 +2816,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 expectType(e.obj, { kind: "record", shapeId: e.shapeId }, "recordKeyGet receiver");
                 expectType(e.key, STRING, "recordKeyGet key");
                 // Every reachable value must SURFACE as the result type: identity,
-                // an arm of a union result, or (dyn results) a DOM conversion —
+                // an arm of a union result, or (dyn results) a dyn conversion —
                 // the frontend's recordKeyResultOk mirror. overflowOnly reads (a
                 // literal key naming no declared field) skip the declared check
                 // and require the overflow to exist.
@@ -2812,7 +2857,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 if (e.type.kind !== "dyn")
                     err(`dynFrom must be dyn-typed, got ${e.type.kind}`, e.loc);
                 // A bare unit literal is legal exactly here (like unionWrap): the
-                // DOM has first-class undefined/null values.
+                // dyn has first-class undefined/null values.
                 if (e.value.kind === "unitLit") {
                     const want = e.value.unit === "undefined" ? "undefinedT" : "nullT";
                     if (e.value.type.kind !== want) {
@@ -2821,19 +2866,19 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     break;
                 }
                 checkExpr(e.value);
-                // Domain: JSON-safe, bytes<u8> (the DOM's bytes kind — payload
+                // Domain: JSON-safe, bytes<u8> (the checked-dynamic tree's bytes kind — payload
                 // copied), an undefined-armed union of JSON-safe arms (the
-                // undefined arm becomes the undefined DOM value), or a BOXABLE
-                // function type (the DOM's function kind — canConvertToDyn folds
+                // undefined arm becomes the undefined dyn value), or a BOXABLE
+                // function type (the checked-dynamic tree's function kind — canConvertToDyn folds
                 // all four in).
                 const vt = e.value.type;
                 if (!canConvertToDyn(vt, (id) => records.get(id), (id) => unions.get(id))) {
-                    err(`dynFrom of non-DOM-convertible type ${vt.kind}`, e.loc);
+                    err(`dynFrom of non-dyn-convertible type ${vt.kind}`, e.loc);
                 }
                 break;
             }
             case "dynFromJsval": {
-                // The jsval→DOM crossing: exactly a jsval operand into a dyn
+                // The jsval→dyn crossing: exactly a jsval operand into a dyn
                 // result (the by-reference island wrap; scalars normalize at
                 // runtime).
                 checkExpr(e.value);
@@ -3013,7 +3058,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 break;
             }
             case "caughtToDyn": {
-                // The caught snapshot converting to a dyn DOM value (an unknown
+                // The caught snapshot converting to a dyn value (an unknown
                 // slot): operand caught, result dyn — the runtime dispatch handles
                 // every payload kind, so nothing else constrains it.
                 checkExpr(e.value);
@@ -3428,9 +3473,14 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                     }
                     break;
                 }
-                if (e.fn === "http.requestCb" || e.fn === "http.requestUrlCb" || e.fn === "http.clientOnResponse") {
+                if (e.fn === "http.requestCb" || e.fn === "http.requestUrlCb" || e.fn === "http.clientOnResponse" ||
+                    e.fn === "http.requestAgentCb" || e.fn === "https.requestAgentCb") {
                     // The response listener: void, no params or exactly (res: httpReq).
-                    const cbT = e.args[e.fn === "http.requestCb" ? 7 : e.fn === "http.requestUrlCb" ? 3 : 1]?.type;
+                    const cbT = e.args[e.fn === "http.requestCb" ? 7
+                        : e.fn === "http.requestUrlCb" ? 3
+                            : e.fn === "http.requestAgentCb" ? 8
+                                : e.fn === "https.requestAgentCb" ? 10
+                                    : 1]?.type;
                     let ok = cbT?.kind === "func" && cbT.ret.kind === "void" && cbT.params.length <= 1;
                     if (ok && cbT?.kind === "func" && cbT.params.length === 1) {
                         ok = cbT.params[0].kind === "httpReq";
@@ -4259,7 +4309,7 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 }
                 // The value's STATIC type drives the emitted serializer — it must be
                 // JSON-safe (the frontend rejects the rest with a specific message).
-                // A dyn ROOT is the one non-static shape allowed: the runtime's DOM
+                // A dyn ROOT is the one non-static shape allowed: the runtime's dyn
                 // walker serializes it (scr_dyn_format_j), no emitted serializer.
                 if (e.value.type.kind !== "dyn" &&
                     !isJsonSafeType(e.value.type, (id) => records.get(id), (id) => unions.get(id))) {
@@ -4272,24 +4322,24 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 expectType(e.value, DYN, "dynCheck operand");
                 // The target drives the emitted validator/builder: non-dyn,
                 // non-void, JSON-representable (closures/class instances can never
-                // be found inside a JSON DOM — the frontend rejects those casts).
+                // be found inside a JSON dyn — the frontend rejects those casts).
                 // Bare undefined-armed unions of JSON-safe arms are additionally
-                // valid: the DOM holds a first-class undefined value (overflow
+                // valid: the checked-dynamic tree holds a first-class undefined value (overflow
                 // reads), which matches exactly the undefined arm.
                 const jsonOk = (t) => isJsonSafeType(t, (id) => records.get(id), (id) => unions.get(id));
                 const undefArmedOk = e.type.kind === "union" &&
                     (unions.get(e.type.unionId)?.arms.every((a) => a.kind === "undefinedT" || jsonOk(a)) ??
                         false);
-                // bytes<u8> targets extract the DOM's bytes kind (a copy).
+                // bytes<u8> targets extract the checked-dynamic tree's bytes kind (a copy).
                 const bytesOk = e.type.kind === "bytes" && e.type.elem === "u8";
-                // The %Error root extracts the DOM's error encoding (the "%error"
+                // The %Error root extracts the checked-dynamic tree's error encoding (the "%error"
                 // marker object caughtToDyn builds) as a fresh runtime error.
                 const errorOk = e.type.kind === "object" && e.type.className === "%Error";
-                // ADAPTABLE function targets unwrap or wrap the DOM's function
+                // ADAPTABLE function targets unwrap or wrap the checked-dynamic tree's function
                 // kind (the checked-dynamic function boundary, nodes.ts).
                 const funcOk = e.type.kind === "func" &&
                     canAdaptDynFuncTo(e.type, (id) => records.get(id), (id) => unions.get(id));
-                // Runtime HANDLE targets unwrap the DOM's handle kind by tag (a
+                // Runtime HANDLE targets unwrap the checked-dynamic tree's handle kind by tag (a
                 // retained reference, no copy — DYN_HANDLE_KINDS).
                 const handleOk = DYN_HANDLE_KINDS.has(e.type.kind);
                 if (!jsonOk(e.type) && !undefArmedOk && !bytesOk && !errorOk && !funcOk && !handleOk) {
@@ -4512,7 +4562,11 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 // exactly what it produces.
                 if (src.kind !== "bytes" &&
                     src.kind !== "url" &&
-                    src.kind !== "dyn" && // DOM values deep-copy in (data kinds; the runtime throws on boxes)
+                    src.kind !== "dyn" && // dyn values deep-copy in (data kinds; the runtime throws on boxes)
+                    // A STATIC promise crosses as a real engine thenable when its
+                    // fulfillment is in the reverse bridge's payload domain
+                    // (scr_jsval_from_promise — the async-callback return bridge).
+                    !(src.kind === "promise" && islandPromisePayloadTag(src.inner) !== null) &&
                     !canMarshalIntoIsland(src, (id) => records.get(id), (id) => unions.get(id)) &&
                     !canMarshalTypedFuncIntoIsland(src, (id) => records.get(id), (id) => unions.get(id))) {
                     err(`jsMarshal of unmarshalable type ${src.kind}`, e.loc);
@@ -4570,11 +4624,15 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
             case "jsBridgePromise": {
                 checkExpr(e.value);
                 expectType(e.value, JSVAL, "jsBridgePromise operand");
-                // The settled engine value crosses as a HANDLE (or not at all):
-                // the bridge never converts payloads — typed uses exit later.
+                // The settled engine value crosses as a HANDLE (or not at all) —
+                // plus the ONE converting payload: an `any[]`-declared
+                // fulfillment exits Array.isArray-gated by reference AT THE
+                // SETTLE (SCR_ISLP_JSVAL_ARR); every other typed use exits later.
                 if (e.type.kind !== "promise" ||
-                    (e.type.inner.kind !== "jsval" && e.type.inner.kind !== "void")) {
-                    err("jsBridgePromise must be a promise of jsval or void", e.loc);
+                    (e.type.inner.kind !== "jsval" &&
+                        e.type.inner.kind !== "void" &&
+                        !(e.type.inner.kind === "array" && e.type.inner.elem.kind === "jsval"))) {
+                    err("jsBridgePromise must be a promise of jsval, void, or jsval-element array", e.loc);
                 }
                 break;
             }
@@ -4863,8 +4921,8 @@ function validateFunction(fn, functions, classes, records, unions, globals, erro
                 break;
             case "throw":
                 checkExpr(s.value);
-                // dyn throws are allowed: the DOM node rides the REF cell arm by
-                // reference (the JS-lane `throw err` of a DOM argument).
+                // dyn throws are allowed: the dyn node rides the REF cell arm by
+                // reference (the JS-lane `throw err` of a dyn argument).
                 if (s.value.type.kind === "void" || s.value.type.kind === "caught") {
                     err(`throw of a ${s.value.type.kind} value`, s.loc);
                 }