@scriptc/compiler 0.0.36 → 0.1.2

package/dist/ir/ir.d.ts

@@ -359,6 +359,7 @@ export type IrType = {
  * array elements, and JSON. */
  | {
     kind: "generator";
+    async?: true;
     yieldT: IrType;
     retT: IrType;
     nextT: IrType;
@@ -389,11 +390,11 @@ interface IrKindSet<K extends IrType["kind"]> extends ReadonlySet<IrType["kind"]
  * every other handle has pointer representation. */
 declare const HANDLE_KIND_LIST: readonly ["stats", "fileHandle", "spawnRes", "child", "netServer", "netSocket", "http2Session", "http2Stream", "dgramSocket", "testCtx", "httpReq", "httpRes", "httpClientReq", "secureCtx", "fsWatcher", "childStream", "procStream"];
 export type HandleKind = typeof HANDLE_KIND_LIST[number];
-export declare const HANDLE_KINDS: IrKindSet<"fileHandle" | "stats" | "spawnRes" | "child" | "netServer" | "netSocket" | "http2Session" | "http2Stream" | "dgramSocket" | "testCtx" | "httpReq" | "httpRes" | "httpClientReq" | "childStream" | "procStream" | "fsWatcher" | "secureCtx">;
+export declare const HANDLE_KINDS: IrKindSet<"child" | "childStream" | "dgramSocket" | "fileHandle" | "fsWatcher" | "http2Session" | "http2Stream" | "httpClientReq" | "httpReq" | "httpRes" | "netServer" | "netSocket" | "procStream" | "secureCtx" | "spawnRes" | "stats" | "testCtx">;
 /** The IR kinds represented as pointers in both native backends. */
 declare const POINTER_KIND_LIST: readonly ["string", "array", "map", "set", "regex", "bytes", "url", "searchParams", "symbol", "stats", "fileHandle", "spawnRes", "child", "netServer", "netSocket", "http2Session", "http2Stream", "dgramSocket", "testCtx", "httpReq", "httpRes", "httpClientReq", "secureCtx", "fsWatcher", "childStream", "func", "object", "classval", "record", "union", "dyn", "jsval", "caught", "promise", "generator"];
 export type PointerKind = typeof POINTER_KIND_LIST[number];
-export declare const POINTER_KINDS: IrKindSet<"string" | "symbol" | "object" | "map" | "bytes" | "regex" | "fileHandle" | "searchParams" | "array" | "set" | "url" | "stats" | "spawnRes" | "child" | "netServer" | "netSocket" | "http2Session" | "http2Stream" | "dgramSocket" | "testCtx" | "httpReq" | "httpRes" | "httpClientReq" | "childStream" | "fsWatcher" | "secureCtx" | "func" | "jsval" | "classval" | "record" | "union" | "dyn" | "caught" | "promise" | "generator">;
+export declare const POINTER_KINDS: IrKindSet<"array" | "bytes" | "caught" | "child" | "childStream" | "classval" | "dgramSocket" | "dyn" | "fileHandle" | "fsWatcher" | "func" | "generator" | "http2Session" | "http2Stream" | "httpClientReq" | "httpReq" | "httpRes" | "jsval" | "map" | "netServer" | "netSocket" | "object" | "promise" | "record" | "regex" | "searchParams" | "secureCtx" | "set" | "spawnRes" | "stats" | "string" | "symbol" | "testCtx" | "union" | "url">;
 /** Runtime RC symbol stem for each IR type kind. An empty stem means the
  * kind is scalar/unit or uses an emitted per-shape helper (object/record).
  * Keeping this exhaustive makes a new runtime handle kind a compile error
@@ -519,7 +520,7 @@ export declare function typeEquals(a: IrType, b: IrType): boolean;
 export declare function isRefCounted(t: IrType): boolean;
 export interface IrModule {
     /** Bumped on any breaking IR change; serialize.ts refuses mismatches. */
-    irVersion: 6;
+    irVersion: 8;
     sourceFile: string;
     functions: IrFunction[];
     /** Class shapes. Constructors and methods are ordinary module functions
@@ -945,7 +946,9 @@ export interface IrFunction {
      * Each is also listed in `locals` (with boxed: true); it is NOT a param. */
     captures?: IrParam[];
     /** Async: the body runs on a fiber; `returnType` is the INNER type T (a
-     * `return v` fulfills with v) while call sites receive Promise<T>. */
+     * `return v` fulfills with v) while ordinary call sites receive
+     * Promise<T>. With `generator` present, call sites receive the lazy
+     * async-generator object instead. */
     async?: true;
     /** Async module initializers only: a module-global Promise<T> slot where
      * the spawn wrapper caches its first evaluation promise. Every later
@@ -958,17 +961,21 @@ export interface IrFunction {
      * becomes the runtime cycle root. Dynamic imports wait on this shared
      * completion verdict instead of a build-time-selected member. */
     asyncCycleCacheGlobal?: string;
-    /** Generator (`function*`): the body runs on a fiber created SUSPENDED
+    /** Generator (`function*` / `async function*`): the body runs on a fiber created SUSPENDED
      * (nothing runs until the first `.next()`); `returnType` is the
      * generator's TReturn (VOID when it carries no value — `return;`
      * completes with the undefined arm) while call sites receive the
-     * generator type `{ yieldT, retT: returnType, nextT }` from an emitted
+     * generator type `{ async?, yieldT, retT: returnType, nextT }` from an emitted
      * spawn wrapper that only allocates. `yieldT` is what `yield e` sends
      * out, `nextT` what `.next(v)` sends in (the yield expression's result
-     * type). Mutually exclusive with `async` (async generators are fenced). */
+     * type). `async` alongside this field marks an async generator: its
+     * resume methods queue requests and return promises. */
     generator?: {
         yieldT: IrType;
         nextT: IrType;
+        resultType: IrType & {
+            kind: "record";
+        };
     };
     body: IrStmt[];
     loc: SrcLoc;
@@ -1089,9 +1096,9 @@ export type IrStmt =
     loc: SrcLoc;
 }
 /** Element write `a[i] = v` — statement-only, like `assign`. Valid indices
- * are [0, length]; i == length appends (JS would create a hole past that —
- * scriptc traps instead, see SEMANTICS.md). Ownership of a refcounted
- * value MOVES into the array; the replaced element is released. */
+ * are canonical array indices; writes beyond length grow the array and
+ * leave the intervening positions as holes. Ownership of a refcounted value
+ * MOVES into the array; the replaced element is released. */
  | {
     kind: "arraySet";
     arr: IrExpr;
@@ -1099,6 +1106,29 @@ export type IrStmt =
     value: IrExpr;
     loc: SrcLoc;
 }
+/** Writable `a.length = n`: growth creates holes and truncation releases
+ * removed reference elements. Invalid array lengths raise a catchable
+ * RangeError from the runtime. */
+ | {
+    kind: "arraySetLength";
+    arr: IrExpr;
+    length: IrExpr;
+    loc: SrcLoc;
+}
+/** Write an explicit present `undefined` state without shrinking length. */
+ | {
+    kind: "arraySetUndefined";
+    arr: IrExpr;
+    index: IrExpr;
+    loc: SrcLoc;
+}
+/** Delete an indexed/property slot without changing Array.length. */
+ | {
+    kind: "arrayDelete";
+    arr: IrExpr;
+    index: IrExpr;
+    loc: SrcLoc;
+}
 /** Typed-array element write `b[i] = v` — arraySet's sibling for bytes
  * receivers: statement-only, receiver and index like bytesIntrinsic
  * `get` (any invalid index TRAPS — JS would ignore the write, a
@@ -1260,23 +1290,19 @@ export type IrStmt =
  * completion AND on the exception path (after catch, or with the
  * exception still pending when there is no catch — it keeps propagating
  * after the finally completes; a throw inside the finally replaces it).
- * A `return` inside tryBody/catchBody additionally runs the finally on
- * its way out (the backend's PENDING-RETURN path: the value is computed
- * and snapshotted FIRST, every crossed finally runs inner-to-outer, then
- * the function returns — finally mutations of returned locals are
- * invisible, Node-exact; a throw inside such a finally replaces the
- * pending return, releasing the snapshot). The frontend still rejects
- * break/continue crossing a try-with-finally and ANY jump out of a
- * finally body, so normal, exception, and pending-return are the only
- * completions a finally sees; plain try/catch has no such restriction
- * (jumps out release the try scopes like any other jump). Each body is
- * its own lexical scope. */
+ * Every abrupt completion crossing the region runs the finally
+ * inner-to-outer. Return values are snapshotted first; break/continue
+ * retain their resolved targets; and a completion raised inside the
+ * finally replaces the pending one. Each body is its own lexical scope. */
  | {
     kind: "tryCatch";
     tryBody: IrStmt[];
     catchBody: IrStmt[] | null;
     catchLocalId: string | null;
     finallyBody: IrStmt[] | null;
+    /** Resource-management cleanup: if the guarded body and cleanup both
+     * throw, raise a SuppressedError instead of replacing the first error. */
+    suppressFinallyErrors?: true;
     loc: SrcLoc;
 };
 /** The complete array method/property surface (mirrors ambient/scriptc.d.ts).
@@ -1286,12 +1312,19 @@ export type IrStmt =
  * from the end, clamping; omitted args omitted from `args` — backends fill
  * 0 / +Infinity, the strIntrinsic convention); ref elements retain into
  * the fresh array. */
-export type IrArrIntrinsicMethod = "length" | "push" | "pushSpread" | "unshift" | "unshiftSpread" | "pop" | "indexOf" | "includes" | "join" | "slice" | "shift" | "splice" | "reverse"
+export type IrArrIntrinsicMethod = "length" | "push" | "pushSpread" | "concatSpread" | "unshift" | "unshiftSpread" | "pop" | "indexOf" | "includes"
+/** Internal sparse traversal: the first present index at/after start,
+ * or length when the remaining positions are holes. */
+ | "nextPresent" | "join" | "slice" | "shift" | "splice" | "reverse"
 /** ES2023 copying methods. `toSpliced` receives [start, deleteCount,
  * itemsArray], with omitted arguments completed by the frontend;
  * `with` receives [index, value] and throws Node's catchable RangeError
  * when the relative index is out of range. */
- | "toReversed" | "toSpliced" | "with";
+ | "toReversed" | "toSpliced"
+/** `.with()` replacement carrying present undefined while retaining the
+ * scalar array payload ABI; it has the same catchable index validation as
+ * the typed replacement forms. */
+ | "withUndefined" | "with";
 /** Array intrinsics whose runtime implementation can raise a catchable
  * exception (rather than the static tier's deliberate index traps). */
 export declare const MAY_THROW_ARR_METHODS: ReadonlySet<IrArrIntrinsicMethod>;
@@ -1548,7 +1581,11 @@ export type IrLibFn =
  * (bytes decode per the literal encoding — utf8 default; strings,
  * numbers, booleans, arrays, objects answer JS-exactly; undefined and
  * null throw the catchable TypeError). */
- | "dyn.toString" | "fs.readFileSync"
+ | "dyn.toString"
+/** Engine-free CommonJS module graph. Module values are scalar f64
+ * handles; generated startup defines the registry, init wrappers update
+ * loading/cache state, and the read surface answers Node's live metadata. */
+ | "module.registryInit" | "module.define" | "module.enter" | "module.link" | "module.finish" | "module.fail" | "module.filename" | "module.id" | "module.path" | "module.paths" | "module.children" | "module.parent" | "module.loaded" | "module.cacheGet" | "module.cacheHas" | "module.cacheKeys" | "fs.readFileSync"
 /** readFileSync(path) — the Buffer read (+1 bytes); throws catchably
  * like the utf8 form. */
  | "fs.readFileSyncBuf"
@@ -2825,7 +2862,11 @@ export type IrLibFn =
  * error. The Dyn twin boxes chunks by runtime tag (the JS lane).
  * readable.fromArr is Readable.from(array): a fully-seeded object-
  * entry stream (one whole chunk per element; strings per the flag). */
- | "readable.nextChunk" | "readable.nextChunkDyn" | "readable.fromArr" | "readable.isPaused" | "readable.pipe" | "readable.unpipe" | "readable.flowing" | "writable.write" | "writable.writeStr" | "writable.writeU" | "writable.writeDyn" | "writable.end" | "writable.cork" | "writable.uncork" | "stream.destroy" | "stream.destroyErr" | "stream.prop" | "stream.errored"
+ | "readable.nextChunk" | "readable.nextChunkDyn" | "readable.fromArr" | "readable.isPaused" | "readable.pipe" | "readable.unpipe" | "readable.flowing" | "writable.write" | "writable.writeStr" | "writable.writeU" | "writable.writeDyn" | "writable.end" | "writable.cork" | "writable.uncork" | "stream.destroy" | "stream.destroyErr"
+/** AsyncIteratorClose for Readable[Symbol.asyncIterator](): destroy with
+ * Node's AbortError/ABORT_ERR payload while the iterator's internal error
+ * consumer prevents an unhandled-error crash. */
+ | "stream.iteratorClose" | "stream.prop" | "stream.errored"
 /** The underscore-method assignment surface (`r._read = fn` after
  * construction — Node's own-property shadow of the prototype method):
  * args [stream receiver (borrowed), callback closure (+1 moves)]. The
@@ -3593,9 +3634,9 @@ export type IrExpr =
     type: IrType;
     loc: SrcLoc;
 }
-/** Element read `a[i]`. Index is f64; a non-integer or out-of-bounds index
- * traps at runtime (JS returns undefined — documented divergence). For
- * refcounted elements the result is a fresh owned (+1) reference. */
+/** Element read `a[i]`. Index is f64; the low-level accessors require a
+ * proven present slot and trap on a hole. For refcounted elements the result
+ * is a fresh owned (+1) reference. */
  | {
     kind: "arrayGet";
     arr: IrExpr;
@@ -3603,6 +3644,25 @@ export type IrExpr =
     type: IrType;
     loc: SrcLoc;
 }
+/** Presence query for an array index. Invalid/non-index keys and holes
+ * answer false without reading the slot; present undefined answers true.
+ * The ordinary-read lowering must use arrayState before selecting its
+ * undefined arm. */
+ | {
+    kind: "arrayHas";
+    arr: IrExpr;
+    index: IrExpr;
+    type: IrType;
+    loc: SrcLoc;
+}
+/** Array slot state as f64: HOLE=0, VALUE=1, UNDEFINED=2. */
+ | {
+    kind: "arrayState";
+    arr: IrExpr;
+    index: IrExpr;
+    type: IrType;
+    loc: SrcLoc;
+}
 /** Array method/property on an array receiver: `length` (f64), `push`
  * (VARIADIC like JS — zero or more elem-typed args; every argument
  * evaluates before any appends, then each appends in order; returns the
@@ -3613,8 +3673,8 @@ export type IrExpr =
  * exactly like JS; returns the new length), `unshift` (the matching
  * variadic front insertion; all arguments evaluate before mutation and
  * ref ownership moves in), `unshiftSpread` (one borrowed same-typed array,
- * with self-spread snapshot semantics), `pop` (returns elem — traps on an
- * empty array; ownership moves OUT to the caller), `indexOf` (one
+ * with self-spread snapshot semantics), `pop` (returns `elem | undefined`
+ * and leaves an empty array unchanged; ownership moves OUT to the caller), `indexOf` (one
  * elem-typed arg, BORROWED; strict equality — NaN never matches; → f64),
  * `includes` (one elem-typed arg, borrowed; SameValueZero — NaN DOES
  * match; → bool), `join` (one string arg, borrowed; f64/bool/string
@@ -3810,6 +3870,7 @@ export type IrExpr =
  | {
     kind: "yieldExpr";
     value: IrExpr | null;
+    awaited?: true;
     type: IrType;
     loc: SrcLoc;
 }
@@ -3828,8 +3889,9 @@ export type IrExpr =
  * unless suspended (then the GENRET unwind runs finallys; a finally
  * yield answers done:false and parks the return value) / throw on a
  * non-suspended generator marks it done and re-throws at the call site.
- * MAY-THROW SEED: a body exception (or the injected throw) propagates
- * into the caller synchronously. */
+ * Sync generators return that record directly and propagate body errors
+ * synchronously. Async generators return Promise<record>; requests queue,
+ * and body errors reject the corresponding promise. */
  | {
     kind: "genResume";
     mode: "next" | "return" | "throw";
@@ -4109,12 +4171,13 @@ export type IrExpr =
  * TypeError), the interned signature key (dynCheck's exact-unwrap fast
  * path), and `fnName` — the best-effort static spelling for inspect
  * ([Function: name]) and Node-shaped call errors. The operand is
- * borrowed; the result is owned (+1). Never throws. `liveRef` is the
- * narrow Web-platform exception for record/array/bytes values (including
- * mutable arms selected at runtime from a union) whose API contract
- * exposes the same reference again (stream chunks and abort reasons): it
- * emits a typed capsule with a live materializer instead of the ordinary
- * deep copy. */
+ * borrowed; the result is owned (+1). Never throws. Program class
+ * instances always use a typed capsule so an exact checked cast recovers
+ * the original identity. `liveRef` requests the same capsule form for
+ * record/array/bytes values (including mutable arms selected at runtime
+ * from a union) whose Web API contract exposes the reference again, such
+ * as stream chunks and abort reasons; ordinary JSON-shaped values retain
+ * the documented deep-copy boundary. */
  | {
     kind: "dynFrom";
     value: IrExpr;
@@ -4817,6 +4880,11 @@ export declare function isUndefinedArmedUnion(t: IrType, getUnion: (unionId: str
  * every reachable constituent is; a cyclic VALUE of such a type throws
  * Node's circular-structure TypeError at runtime instead. */
 export declare function isJsonSafeType(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
+/** The JSON.stringify-only domain additionally admits undefined arms in
+ * array and tuple positions, where Node emits null. A bare undefined-armed
+ * root remains outside the domain because JSON.stringify returns the
+ * undefined value instead of a string. */
+export declare function isJsonStringifySafeType(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** THE island boundary predicate: true when a static type can cross into
  * the island (jsMarshal — primitives by value, composites as deep JSON
  * copies) and back out (jsExit — strict primitive extraction, composites
@@ -4881,10 +4949,22 @@ export declare const DYN_HANDLE_KINDS: ReadonlyMap<string, {
     tag: string;
     cls: string;
 }>;
+/** A class value that crosses an `unknown` slot as a compiler-owned typed
+ * reference. %Error keeps its dedicated error encoding; every other class
+ * preserves the original object identity and exposes a materialized own-field
+ * view only when a checked-dynamic operation actually needs one. */
+export declare function isDynTypedRefType(t: IrType): t is Extract<IrType, {
+    kind: "object";
+}>;
+/** Whether a class layout field is an ECMAScript own enumerable property.
+ * `#private` slots and `%`-prefixed compiler storage exist only in the native
+ * layout; TypeScript `private`/`protected` fields keep ordinary names and are
+ * observable properties at runtime. */
+export declare function isClassOwnEnumerableFieldName(name: string): boolean;
 /** A static type that CONVERTS into a dyn value — the dynFrom domain:
- * JSON-safe data, bytes<u8> (payload copied), undefined-armed unions of
- * JSON-safe arms, boxable function types, and the runtime HANDLE kinds
- * (boxed by reference — DYN_HANDLE_KINDS). */
+ * JSON-safe data, bytes<u8> (payload copied), identity-preserving class
+ * references, undefined-armed unions of those arms, boxable function types,
+ * and the runtime HANDLE kinds (boxed by reference — DYN_HANDLE_KINDS). */
 export declare function canConvertToDyn(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** A type a dyn value can be VALIDATED into — the dynCheck domain:
  * JSON-safe data, bytes<u8> (a fresh copy out), the %Error extraction,
@@ -5026,6 +5106,10 @@ export declare function moduleUsesDynInvoke(mod: IrModule): boolean;
  * walk shape as moduleUsesZlib. */
 export declare function moduleUsesDynAsync(mod: IrModule): boolean;
 export declare function moduleUsesInspect(mod: IrModule): boolean;
+/** True when the module reaches child_process or carries one of its runtime
+ * handle/result types. Besides the existing link consequence, this gates the
+ * checked-dynamic ChildProcess handle table installed from scr_child.c. */
+export declare function moduleUsesChildProcess(mod: IrModule): boolean;
 /** True when the module contains any net libCall — the link switch that
  * pulls scr_net.c into the binary and has the emitted main call
  * scr_net_install (native-toolchain.ts + emitter; the scr_events gating precedent).

package/dist/ir/ir.js

@@ -366,7 +366,7 @@ export function typeKey(t) {
         case "promise":
             return `promise<${typeKey(t.inner)}>`;
         case "generator":
-            return `generator<${typeKey(t.yieldT)},${typeKey(t.retT)},${typeKey(t.nextT)}>`;
+            return `${t.async ? "async-generator" : "generator"}<${typeKey(t.yieldT)},${typeKey(t.retT)},${typeKey(t.nextT)}>`;
         default: {
             const _exhaustive = t;
             void _exhaustive;
@@ -406,6 +406,7 @@ export function typeEquals(a, b) {
         return b.kind === "promise" && typeEquals(a.inner, b.inner);
     if (a.kind === "generator") {
         return (b.kind === "generator" &&
+            (a.async === true) === (b.async === true) &&
             typeEquals(a.yieldT, b.yieldT) &&
             typeEquals(a.retT, b.retT) &&
             typeEquals(a.nextT, b.nextT));
@@ -548,6 +549,7 @@ export function shapeHasAccessorSlots(shape) {
  * exception (rather than the static tier's deliberate index traps). */
 export const MAY_THROW_ARR_METHODS = new Set([
     "with",
+    "withUndefined",
 ]);
 /** The bytesIntrinsic methods that can raise a catchable error — backends'
  * may-throw analyses seed on these exactly like MAY_THROW_LIB_FNS. */
@@ -667,17 +669,19 @@ export function isUndefinedArmedUnion(t, getUnion) {
  * every reachable constituent is; a cyclic VALUE of such a type throws
  * Node's circular-structure TypeError at runtime instead. */
 export function isJsonSafeType(t, getRecord, getUnion) {
-    return isJsonSafeAt(t, getRecord, getUnion, false, new Set());
-}
-/** The recursion behind isJsonSafeType. `inRecordField` is the ONE position
- * where an undefined arm is JSON-representable: an undefined-armed union as
- * a record field (the `a?: T` spelling) serializes by DROPPING the field
- * when it holds undefined and validates a MISSING key as the undefined arm
- * — both exactly Node. Everywhere else (a bare `T | undefined` value,
- * stringified whole or cast to) exactness is unreachable: Node's stringify
- * of bare undefined is not a string at all, and JSON text can never contain
- * a value that matches the arm. */
-function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
+    return isJsonSafeAt(t, getRecord, getUnion, false, false, new Set());
+}
+/** The JSON.stringify-only domain additionally admits undefined arms in
+ * array and tuple positions, where Node emits null. A bare undefined-armed
+ * root remains outside the domain because JSON.stringify returns the
+ * undefined value instead of a string. */
+export function isJsonStringifySafeType(t, getRecord, getUnion) {
+    return isJsonSafeAt(t, getRecord, getUnion, true, false, new Set());
+}
+/** The recursion shared by checked JSON conversion and stringification.
+ * Ordinary record fields always admit undefined by dropping the key. Array
+ * and tuple slots admit it only for stringification, which writes null. */
+function isJsonSafeAt(t, getRecord, getUnion, stringify, undefinedAllowed, visiting) {
     if (HANDLE_KINDS.has(t.kind))
         return false;
     switch (t.kind) {
@@ -686,7 +690,7 @@ function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
         case "bool":
             return true;
         case "array":
-            return isJsonSafeAt(t.elem, getRecord, getUnion, false, visiting);
+            return isJsonSafeAt(t.elem, getRecord, getUnion, stringify, stringify, visiting);
         case "record": {
             const shape = getRecord(t.shapeId);
             if (!shape)
@@ -697,10 +701,7 @@ function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
             if (visiting.has(t.shapeId))
                 return true;
             visiting.add(t.shapeId);
-            // TUPLE positions are array slots, not droppable object keys: an
-            // undefined-armed position would stringify as `null` in JS (not
-            // drop), so tuples keep the array rule for their fields.
-            if (!shape.fields.every((f) => isJsonSafeAt(f.type, getRecord, getUnion, !shape.tuple, visiting))) {
+            if (!shape.fields.every((f) => isJsonSafeAt(f.type, getRecord, getUnion, stringify, !shape.tuple || stringify, visiting))) {
                 return false;
             }
             // Overflow values sit in record-key position too: dyn is JSON-safe
@@ -708,7 +709,7 @@ function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
             // like any undefined-valued key), everything else follows the
             // record-field rule.
             if (shape.indexValue && shape.indexValue.kind !== "dyn") {
-                return isJsonSafeAt(shape.indexValue, getRecord, getUnion, true, visiting);
+                return isJsonSafeAt(shape.indexValue, getRecord, getUnion, stringify, true, visiting);
             }
             return true;
         }
@@ -716,11 +717,11 @@ function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
             const def = getUnion(t.unionId);
             if (!def)
                 return false;
-            const key = `${t.unionId}:${inRecordField}`;
+            const key = `${t.unionId}:${stringify}:${undefinedAllowed}`;
             if (visiting.has(key))
                 return true; // the recursive knot, union-flavored
             visiting.add(key);
-            return def.arms.every((a) => isJsonSafeAt(a, getRecord, getUnion, inRecordField, visiting));
+            return def.arms.every((a) => a.kind === "undefinedT" ? undefinedAllowed : isJsonSafeAt(a, getRecord, getUnion, stringify, undefinedAllowed, visiting));
         }
         case "func":
         case "object":
@@ -756,12 +757,10 @@ function isJsonSafeAt(t, getRecord, getUnion, inRecordField, visiting) {
         case "generator":
         case "void":
             return false;
-        // Representable exactly as a union arm in record-field position (the
-        // optional-field story above); bare undefined-armed unions stay fenced
-        // out of both stringify and dynCheck (narrow with '!== undefined'
-        // first, or model absence with a null arm).
+        // Record fields drop undefined. Stringification also represents it in
+        // array and tuple slots as null; bare roots remain fenced.
         case "undefinedT":
-            return inRecordField;
+            return undefinedAllowed;
         // JSON null ↔ the nullT arm: null-armed unions stringify (`null`) and
         // validate (a JSON null matches exactly the nullT arm).
         case "nullT":
@@ -918,6 +917,7 @@ export function canMarshalTypedFuncIntoIsland(t, getRecord, getUnion) {
  * entry carries the runtime tag spelling and the class display name
  * (dynCheck's "expected IncomingMessage ..." texts). */
 export const DYN_HANDLE_KINDS = new Map([
+    ["child", { tag: "SCR_DYNH_CHILD", cls: "ChildProcess" }],
     ["httpReq", { tag: "SCR_DYNH_HTTP_REQ", cls: "IncomingMessage" }],
     ["httpRes", { tag: "SCR_DYNH_HTTP_RES", cls: "ServerResponse" }],
     ["netSocket", { tag: "SCR_DYNH_NET_SOCKET", cls: "Socket" }],
@@ -926,10 +926,24 @@ export const DYN_HANDLE_KINDS = new Map([
     ["http2Stream", { tag: "SCR_DYNH_H2_STREAM", cls: "Http2Stream" }],
     ["httpClientReq", { tag: "SCR_DYNH_HTTP_CLIENT", cls: "ClientRequest" }],
 ]);
+/** A class value that crosses an `unknown` slot as a compiler-owned typed
+ * reference. %Error keeps its dedicated error encoding; every other class
+ * preserves the original object identity and exposes a materialized own-field
+ * view only when a checked-dynamic operation actually needs one. */
+export function isDynTypedRefType(t) {
+    return t.kind === "object" && !RUNTIME_ERROR_CLASSES.has(t.className);
+}
+/** Whether a class layout field is an ECMAScript own enumerable property.
+ * `#private` slots and `%`-prefixed compiler storage exist only in the native
+ * layout; TypeScript `private`/`protected` fields keep ordinary names and are
+ * observable properties at runtime. */
+export function isClassOwnEnumerableFieldName(name) {
+    return !name.startsWith("#") && !name.startsWith("%");
+}
 /** A static type that CONVERTS into a dyn value — the dynFrom domain:
- * JSON-safe data, bytes<u8> (payload copied), undefined-armed unions of
- * JSON-safe arms, boxable function types, and the runtime HANDLE kinds
- * (boxed by reference — DYN_HANDLE_KINDS). */
+ * JSON-safe data, bytes<u8> (payload copied), identity-preserving class
+ * references, undefined-armed unions of those arms, boxable function types,
+ * and the runtime HANDLE kinds (boxed by reference — DYN_HANDLE_KINDS). */
 export function canConvertToDyn(t, getRecord, getUnion) {
     if (isJsonSafeType(t, getRecord, getUnion))
         return true;
@@ -947,6 +961,8 @@ export function canConvertToDyn(t, getRecord, getUnion) {
     // listener boundary (a mustCall-wrapped handler receiving the payload).
     if (t.kind === "object" && t.className === "%Error")
         return true;
+    if (isDynTypedRefType(t))
+        return true;
     if (t.kind === "func")
         return canBoxFuncIntoDyn(t, getRecord, getUnion);
     if (DYN_HANDLE_KINDS.has(t.kind))
@@ -964,12 +980,14 @@ export function canConvertToDyn(t, getRecord, getUnion) {
     }
     if (t.kind === "union") {
         const def = getUnion(t.unionId);
-        // JSON-safe arms box as before; BOXABLE FUNCTION arms join them (the
+        // JSON-safe arms box as before; BOXABLE FUNCTION and PROMISE arms join them (the
         // invalid-input probes iterate `[1, null, () => {}, true]` — the
         // union's func arm crosses through the checked-dynamic function
         // boundary exactly like a bare func dynFrom).
         return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion) ||
-            (a.kind === "func" && canBoxFuncIntoDyn(a, getRecord, getUnion)));
+            isDynTypedRefType(a) || DYN_HANDLE_KINDS.has(a.kind) ||
+            (a.kind === "func" && canBoxFuncIntoDyn(a, getRecord, getUnion)) ||
+            (a.kind === "promise" && canConvertToDyn(a, getRecord, getUnion)));
     }
     return false;
 }
@@ -1186,7 +1204,8 @@ export function moduleUsesCopying(mod) {
         if (node.kind === "arrIntrinsic" &&
             (node.method === "toReversed" ||
                 node.method === "toSpliced" ||
-                node.method === "with")) {
+                node.method === "with" ||
+                node.method === "withUndefined")) {
             found = true;
             return;
         }
@@ -1595,6 +1614,36 @@ export function moduleUsesInspect(mod) {
     visit(mod);
     return found;
 }
+/** True when the module reaches child_process or carries one of its runtime
+ * handle/result types. Besides the existing link consequence, this gates the
+ * checked-dynamic ChildProcess handle table installed from scr_child.c. */
+export function moduleUsesChildProcess(mod) {
+    let found = false;
+    const visit = (v) => {
+        if (found || v === null || typeof v !== "object")
+            return;
+        if (Array.isArray(v)) {
+            for (const item of v)
+                visit(item);
+            return;
+        }
+        const node = v;
+        if (node.kind === "libCall" &&
+            typeof node.fn === "string" &&
+            (node.fn.startsWith("cp.") || node.fn.startsWith("child.") || node.fn.startsWith("spawnRes."))) {
+            found = true;
+            return;
+        }
+        if (node.kind === "child" || node.kind === "childStream" || node.kind === "spawnRes") {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(v))
+            visit(v[key]);
+    };
+    visit(mod);
+    return found;
+}
 /** True when the module contains any net libCall — the link switch that
  * pulls scr_net.c into the binary and has the emitted main call
  * scr_net_install (native-toolchain.ts + emitter; the scr_events gating precedent).
@@ -2378,6 +2427,7 @@ export const MAY_THROW_LIB_FNS = new Set([
     "writable.uncork",
     "stream.destroy",
     "stream.destroyErr",
+    "stream.iteratorClose",
     // setMaxListeners(n) throws Node's ERR_OUT_OF_RANGE RangeError for
     // negative/NaN arguments; the static form's default-max write validates
     // identically (Node's validateNumber(n, "setMaxListeners", 0)).
@@ -2505,6 +2555,7 @@ export const MAY_THROW_LIB_FNS = new Set([
     "fs.statSync",
     "crypto.randomBytesToString",
     "crypto.randomBytes",
+    "buffer.concat",
     "buffer.concatLen",
     // The checked-dynamic compare/equals validators: Node's argument
     // ladders throw ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE catchably.