@scriptc/compiler 0.0.8 → 0.0.10

package/dist/frontend/lowering/lower-stmts.js

@@ -8,12 +8,12 @@ import { BOOL, BYTES_U8, CAUGHT, DYN, F64, JSVAL, STRING, UNDEFINED_T, VOID, arr
 import { PoisonError, boundIdentifiersOf, dynFallbackType, dynUndefinedExpr, importCallHandleType, neverTaintedJsType, stmtUsesIsland, uncheckedOverloadHandleCall } from "./lowerer.js";
 import { enforceLibBoundary } from "./lib-boundary.js";
 import { cjsExportAssignmentOf, cjsExportDiscardReason, cjsExportTargetLiteral, isCjsJsFile, isJsSourceFile, locOf, requireSpecOf } from "../program.js";
-import { COMPOUND_ASSIGN_OPS, UNSUPPORTED_STMT, isStdlibMember, sideEffectFreeOptionValue, stdlibGlobalAliasDecl, stdlibGlobalNameOf } from "./surfaces.js";
+import { COMPOUND_ASSIGN_OPS, STR_METHODS, UNSUPPORTED_STMT, isStdlibMember, sideEffectFreeOptionValue, stdlibGlobalAliasDecl, stdlibGlobalNameOf } from "./surfaces.js";
 import { isProvenanceSourceFile } from "../provenance-registry.js";
-import { lowerImportEquals, nsWritableTarget } from "./lower-namespaces.js";
+import { ambientUndefVarRootOf, lowerImportEquals, nsUndefRead, nsWritableTarget } from "./lower-namespaces.js";
 import { expandoWritableTarget, lowerExpandoAssignStmt } from "./lower-expando.js";
-import { lowerForOfMap, lowerForOfSearchParams, lowerForOfSet, objectIterOverIndexShape } from "./lower-containers.js";
-import { bindingContextualGenericFnNodeOf, bindingGenericFnAliasInfoOf, bindingGenericFnInfoOf, bindingGenericFnNodeOf, implicitLocalFnInfoOf, implicitLocalFnNodeOf, recordKeysArrayCall } from "./lower-calls.js";
+import { lowerForOfArrayIter, lowerForOfMap, lowerForOfSearchParams, lowerForOfSet, objectIterOverIndexShape, strCharsCall } from "./lower-containers.js";
+import { bindingContextualGenericFnNodeOf, bindingGenericFnAliasInfoOf, bindingGenericFnInfoOf, bindingGenericFnNodeOf, deadUnmappableBinding, implicitLocalFnInfoOf, implicitLocalFnNodeOf, nullishExprUnitOf, nullishGenericBindingUnitOf, recordKeysArrayCall } from "./lower-calls.js";
 import { isMixinFnBinding, mixinResultBindingClassOf } from "./lower-mixins.js";
 import { genericIfaceBindingKeepsClass } from "./lower-classes.js";
 import { lowerStreamUnderscoreAssign, streamClassAliasDecl, streamSidesOf } from "./lower-stream.js";
@@ -1002,6 +1002,19 @@ export function lowerDestructuringDecl(L, decl, isLet) {
         // tsc already rejects this (TS1182); defensive.
         L.unsupported("SC1031", decl);
     }
+    // A STDLIB-GLOBAL source in a JavaScript file (`const { subtle } =
+    // globalThis.crypto`, `const { Console } = console` — the suite's
+    // webcrypto/console prologues): each element binds a member IDENTITY
+    // TOKEN, the identifier chokepoint's rule one member deep — see
+    // stdlibGlobalTokenDestructure. Checked before the initializer
+    // lowers: the whole-global spelling would answer the global's own
+    // token (a string), and the pattern would meet the string fences
+    // below blaming the token's carrier type instead of the global.
+    {
+        const tokenBound = stdlibGlobalTokenDestructure(L, decl, isLet);
+        if (tokenBound !== null)
+            return tokenBound;
+    }
     let init = L.lowerExpr(decl.initializer);
     // A TS `any`-origin source whose lowered value is NOT a destructurable
     // shape (`var { x } = <any>0` — the cast erases to the f64; a dyn
@@ -1016,6 +1029,20 @@ export function lowerDestructuringDecl(L, decl, isLet) {
         init.type.kind !== "record" && init.type.kind !== "array" && init.type.kind !== "jsval") {
         L.anyOpFence("destructuring", decl);
     }
+    // An IR-string source the CHECKER does not type as a string is a
+    // builtin identity token that leaked through a JS local (`const c =
+    // globalThis.crypto; const { x } = c` — the local adopted the token's
+    // carrier type): the value is a token, not a string — the string
+    // lowerings below would read the CARRIER (its length, its code
+    // points), numbers and characters Node never sees. The fence names
+    // the checker's own type instead of the carrier.
+    if (init.type.kind === "string" &&
+        isJsSourceFile(decl.getSourceFile()) &&
+        !checkerStringSource(L, decl.initializer)) {
+        L.unsupported("SC1031", decl.name, ts.isArrayBindingPattern(decl.name)
+            ? `array destructuring of non-array values (the source is '${L.checker.typeToString(L.typeOf(decl.initializer))}'-typed)`
+            : `object destructuring of non-record values (the source is '${L.checker.typeToString(L.typeOf(decl.initializer))}'-typed)`);
+    }
     // PRIMITIVE and unit sources (`let { toString } = 1`, `const [c] =
     // "xy"`, `var [] = null`): JS destructures any value by reading
     // through its wrapper object — prototype members included — or throws
@@ -1023,9 +1050,18 @@ export function lowerDestructuringDecl(L, decl, isLet) {
     // pattern has an engine form, --dynamic marshals the value in and
     // runs the REAL pattern (lowerJsvalBindingPattern); a static build
     // reports the dynamic-family choice instead of the dead-end type
-    // recitation.
+    // recitation. STRING sources whose pattern the static path claims
+    // whole (staticStringPattern — code-point positions, `length`
+    // bindings) skip the gate in STATIC builds: lowerBindingPattern's
+    // string branches are exact there, and the diagnostic would report a
+    // dynamic-engine dependency the program does not have. --dynamic
+    // keeps the engine route for every string pattern — the engine binds
+    // undefined past the last code point where the static chars array
+    // inherits the array divergence's trap.
     if ((init.type.kind === "f64" || init.type.kind === "bool" || init.type.kind === "string" || isUnitType(init.type)) &&
         !isJsSourceFile(decl.getSourceFile()) &&
+        !(!L.dynamic && init.type.kind === "string" &&
+            staticStringPattern(L, decl.name)) &&
         enginePatternSpec(L, decl.name) !== null) {
         if (!L.dynamic) {
             L.pushDiag(requiresDynamicDiag(`destructuring '${L.fmt(init.type)}' values (the engine reads through JS's wrapper coercion)`, locOf(decl)));
@@ -1069,12 +1105,24 @@ export function lowerDestructuringDecl(L, decl, isLet) {
     }
     const tmp = L.declareHiddenLocal("%destr", init.type);
     out.push({ kind: "varDecl", localId: tmp.id, init, loc });
-    L.lowerBindingPattern(decl.name, () => ({ kind: "varRef", localId: tmp.id, type: init.type, loc }), init.type, isLet, out);
+    // V8's destructuring TypeError spells STATIC sources: an identifier
+    // source reads "<name> is not iterable", an identifier-callee call
+    // "<name> is not a function or its return value is not iterable";
+    // everything else (property reads, method calls, parameters) gets the
+    // runtime kind wording — exactly V8's CallPrinter behavior. Only the
+    // DYN pattern arm consumes this.
+    const src = decl.initializer;
+    const dynSpell = ts.isIdentifier(src)
+        ? `${src.text} is not iterable`
+        : ts.isCallExpression(src) && ts.isIdentifier(src.expression)
+            ? `${src.expression.text} is not a function or its return value is not iterable`
+            : undefined;
+    L.lowerBindingPattern(decl.name, () => ({ kind: "varRef", localId: tmp.id, type: init.type, loc }), init.type, isLet, out, dynSpell);
     return out;
 }
 /** One pattern level: emits a declaration (or global assignment) per
    * bound name, recursing through hidden temps for nested patterns. */
-export function lowerBindingPattern(L, pattern, srcRef, srcType, isLet, out) {
+export function lowerBindingPattern(L, pattern, srcRef, srcType, isLet, out, dynSpell) {
     if (ts.isArrayBindingPattern(pattern)) {
         // Tuple sources: each position is a field read of the tuple's record
         // shape — the positional twin of object destructuring below.
@@ -1173,6 +1221,90 @@ export function lowerBindingPattern(L, pattern, srcRef, srcType, isLet, out) {
                 return;
             }
         }
+        // STRING sources (`const [a, b] = str`): array destructuring walks
+        // the STRING ITERATOR — code points, astral characters whole —
+        // which is Array.from(string)'s own machinery (%str.chars), so the
+        // source splits once into a hidden chars array and the pattern
+        // lowers as an array pattern over string[]. Positions, holes,
+        // defaults (with the bounds test), rest (the remaining code points
+        // pack fresh — JS's surplus packing builds a new array too), and
+        // nested patterns all ride the array machinery below — which also
+        // means a position past the LAST code point inherits the array
+        // divergence (the read traps where JS binds undefined; a DEFAULTED
+        // position carries its bounds test and fires exactly there).
+        // Callers vetted the source as a checker-typed string: builtin
+        // identity tokens (IR strings the checker types otherwise) fence
+        // before reaching here.
+        if (srcType.kind === "string") {
+            const loc = locOf(pattern);
+            const charsT = arrayOf(STRING);
+            const chars = L.declareHiddenLocal("%dchars", charsT);
+            out.push({ kind: "varDecl", localId: chars.id, init: strCharsCall(L, srcRef(), loc), loc });
+            L.lowerBindingPattern(pattern, () => ({ kind: "varRef", localId: chars.id, type: charsT, loc }), charsT, isLet, out);
+            return;
+        }
+        // DYN sources (`const [a, b] = d` over a DOM value, `([_, code]) =>`
+        // params destructuring dyn callback arguments — the suite harness's
+        // _expectWarning shapes): the source packs ONCE through the spread
+        // walk (dyn.iterPack — arrays element-by-element, strings by code
+        // point, bytes by byte; every other kind throws V8's destructuring
+        // TypeError, the compile-time spelling when the source has one),
+        // then positions bind the pack's index keys as dyn values — reads
+        // past the end bind undefined, exactly JS. Defaults fire on the DOM
+        // undefined (JS's rule); rest elements keep the fence (surplus
+        // packing over the DOM needs a slice the IR does not spell yet).
+        if (srcType.kind === "dyn") {
+            const loc = locOf(pattern);
+            const pack = L.declareHiddenLocal("%dpack", DYN);
+            out.push({
+                kind: "varDecl",
+                localId: pack.id,
+                init: {
+                    kind: "libCall",
+                    fn: "dyn.iterPack",
+                    args: [srcRef(), { kind: "strLit", value: dynSpell ?? "", type: STRING, loc }],
+                    type: DYN,
+                    loc,
+                },
+                loc,
+            });
+            pattern.elements.forEach((el, i) => {
+                if (ts.isOmittedExpression(el) || el.name === undefined)
+                    return; // hole: the position skips
+                const elLoc = locOf(el);
+                if (el.dotDotDotToken) {
+                    L.unsupported("SC1031", el, "rest elements over checked-dynamic sources");
+                }
+                let value = {
+                    kind: "dynKeyGet",
+                    key: { kind: "strLit", value: String(i), type: STRING, loc: elLoc },
+                    value: { kind: "varRef", localId: pack.id, type: DYN, loc: elLoc },
+                    type: DYN,
+                    loc: elLoc,
+                };
+                if (el.initializer) {
+                    // The default fires exactly on the DOM undefined (JS's rule),
+                    // its value converting into the DOM like any dyn-slot value.
+                    const rl = L.declareHiddenLocal("%delem", DYN);
+                    out.push({ kind: "varDecl", localId: rl.id, init: value, loc: elLoc });
+                    const ref = () => ({ kind: "varRef", localId: rl.id, type: DYN, loc: elLoc });
+                    const dflt = L.coerceToExpected(L.lowerExpr(el.initializer), DYN);
+                    if (dflt.type.kind !== "dyn") {
+                        L.unsupported("SC1031", el.initializer, `defaults of '${L.fmt(dflt.type)}' type over checked-dynamic sources (the value cannot convert into the DOM)`);
+                    }
+                    value = {
+                        kind: "ternary",
+                        cond: { kind: "dynTest", test: "undefined", value: ref(), type: BOOL, loc: elLoc },
+                        then: dflt,
+                        else_: ref(),
+                        type: DYN,
+                        loc: elLoc,
+                    };
+                }
+                L.bindPatternTarget(el.name, value, isLet, out);
+            });
+            return;
+        }
         if (srcType.kind !== "array") {
             L.unsupported("SC1031", pattern, `array destructuring of non-array values (the source is ${srcType.kind}-typed)`);
         }
@@ -1359,6 +1491,44 @@ export function lowerBindingPattern(L, pattern, srcRef, srcType, isLet, out) {
             return;
         }
     }
+    // A STRING source under an OBJECT pattern (`const { length } = str`):
+    // JS reads through the wrapper object, whose one own DATA property is
+    // `length` — the strLen intrinsic, exact, renames and (dead) defaults
+    // included (length always exists and is never undefined, so a default
+    // never evaluates — JS's rule). Everything else on the wrapper is a
+    // prototype METHOD (detached, it loses its receiver) or absent (the
+    // read is undefined, which the binding's type cannot hold) — named
+    // fences either way; rest packs the wrapper's own INDICES (JS's
+    // CopyDataProperties copies one property per code UNIT) and fences
+    // naming that. Callers vetted the source as a checker-typed string —
+    // builtin identity tokens fence before reaching here.
+    if (srcType.kind === "string") {
+        for (const el of pattern.elements) {
+            if (el.name === undefined)
+                continue;
+            const loc = locOf(el);
+            if (el.dotDotDotToken) {
+                L.unsupported("SC1031", el, "rest bindings over string sources (JS packs the wrapper's per-code-unit indices — split with [...s] instead)");
+            }
+            const prop = el.propertyName ?? el.name;
+            const propName = ts.isIdentifier(prop) || ts.isComputedPropertyName(prop) || ts.isStringLiteralLike(prop) || ts.isNumericLiteral(prop)
+                ? patternKeyNameOf(L, prop)
+                : null;
+            if (propName === null) {
+                L.unsupported("SC1031", el, "destructuring with computed keys that do not fold to one property name");
+            }
+            if (propName !== "length") {
+                L.unsupported("SC1031", el, Object.hasOwn(STR_METHODS, propName)
+                    ? `destructuring the method '${propName}' of a string (a detached method loses its receiver — call it through the value)`
+                    : `destructuring the property '${propName}' strings do not carry as data ('length' is the one own data property)`);
+            }
+            let value = { kind: "strIntrinsic", method: "length", receiver: srcRef(), args: [], type: F64, loc };
+            if (el.initializer)
+                value = applyBindingDefault(L, el, value);
+            L.bindPatternTarget(el.name, value, isLet, out);
+        }
+        return;
+    }
     if (srcType.kind !== "record") {
         L.unsupported("SC1031", pattern, srcType.kind === "object"
             ? "object destructuring of class instances (read the fields directly — accessors make the desugar observable)"
@@ -1485,6 +1655,189 @@ export function patternKeyNameOf(L, prop) {
     }
     return null;
 }
+/** True when the CHECKER types this expression as a string in every arm
+   * (unions of string-likes included). The IR carries builtin IDENTITY
+   * TOKENS as strings too (`globalThis.crypto` taken as a value in a JS
+   * file, or a local that adopted such a value's carrier type), and those
+   * must never reach the string-source destructuring lowerings — the
+   * callers fence with the checker's own type name instead. */
+function checkerStringSource(L, e) {
+    const stringLike = (t) => {
+        if ((t.flags & ts.TypeFlags.StringLike) !== 0)
+            return true;
+        if (t.isUnionType())
+            return t.getTypes().every(stringLike);
+        return false;
+    };
+    return stringLike(L.typeOf(e));
+}
+/** True when a pattern over a STRING source lowers statically whole —
+   * every element a form the chars-array/wrapper-read desugars carry.
+   * Array patterns take positions, holes, defaults, rest (a nested rest
+   * pattern must be an ARRAY pattern — it destructures the packed
+   * string[]), and nested patterns, whose elements are single code
+   * points and recurse through this same test. Object patterns take
+   * `length` bindings — shorthand, renamed, or (dead-)defaulted.
+   * Anything else — wrapper methods, computed keys, rest over the
+   * wrapper — keeps the engine gate (--dynamic runs the real pattern;
+   * a static build reports the dynamic-family choice). */
+function staticStringPattern(L, pattern) {
+    if (ts.isArrayBindingPattern(pattern)) {
+        return pattern.elements.every((el) => {
+            if (ts.isOmittedExpression(el) || el.name === undefined)
+                return true;
+            if (el.dotDotDotToken) {
+                // The rest binds string[]: identifier targets and nested ARRAY
+                // patterns ride the array machinery; an object pattern over the
+                // packed array keeps its fence.
+                return ts.isIdentifier(el.name) || ts.isArrayBindingPattern(el.name);
+            }
+            if (ts.isIdentifier(el.name))
+                return true;
+            return staticStringPattern(L, el.name);
+        });
+    }
+    return pattern.elements.every((el) => {
+        if (el.name === undefined)
+            return true;
+        if (el.dotDotDotToken || !ts.isIdentifier(el.name))
+            return false;
+        const prop = el.propertyName ?? el.name;
+        const propName = ts.isIdentifier(prop) || ts.isComputedPropertyName(prop) || ts.isStringLiteralLike(prop) || ts.isNumericLiteral(prop)
+            ? patternKeyNameOf(L, prop)
+            : null;
+        return propName === "length";
+    });
+}
+/** The stdlib globals whose members destructure to MEMBER identity
+   * tokens: the OPAQUE globals — no member of theirs has a lowered
+   * surface, so a token binding trades the eager pattern fence for the
+   * per-site token rules and loses nothing. Globals with REAL member
+   * surfaces (Math.max, JSON.stringify, process.env, console.log) stay
+   * OUT: their detached members would ride the token's quiet
+   * own-property-undefined reads where the property spelling works, so
+   * those patterns keep an eager fence naming the global. `console` is
+   * the one split surface: its five CALL members fence by name, while
+   * the rest (`Console` — the suite's constructor-identity probe) have
+   * no surface to lose and bind tokens. */
+const TOKEN_OPAQUE_GLOBALS = new Set(["crypto"]);
+const CONSOLE_CALL_MEMBERS = new Set(["log", "info", "debug", "error", "warn"]);
+/** `const { subtle } = globalThis.crypto`, `const { Console } = console`,
+   * `const { crypto } = globalThis` — an object pattern over a STDLIB
+   * GLOBAL in a JavaScript file (the suite's webcrypto/console
+   * prologues): the identifier chokepoint's identity-token rule, one
+   * member deep. The global taken as a value is an opaque token, and a
+   * member taken off an OPAQUE global is the same kind of value — one
+   * global, one member, one interned string — so plain elements bind
+   * MEMBER tokens (`[builtin crypto.subtle]`), and identity flows agree
+   * across destructures of the same member. A member of GLOBALTHIS that
+   * is itself a canonical global (`const { crypto } = globalThis` —
+   * `declare var` globals are properties of `typeof globalThis`,
+   * stdlib-provenance-checked so user script globals stay out) binds the
+   * global's OWN token, byte-equal to the bare and property spellings'
+   * answers, AND registers in stdlibGlobalAliases — the destructured
+   * twin of stdlibGlobalAliasDecl — so receiver-position uses resolve
+   * through every surface exactly like the bare global (`const { Math }
+   * = globalThis; Math.max(...)` is Math.max). What a token cannot do
+   * meets the per-site rules lazily at each USE — member reads answer
+   * the wrapper's own-property undefined, calls throw Node-shaped
+   * is-not-a-function TypeErrors — at the use's own line, where the
+   * pattern-level fence killed the program at the destructure.
+   *
+   * Everything this rule does NOT claim over a stdlib-global source
+   * fences HERE, naming the global — never the token's carrier string
+   * type: rest (the member set is not statically enumerable), defaults
+   * (member presence is not statically testable), nested patterns,
+   * computed keys, members of the SURFACED globals (detached members
+   * lose their receiver-keyed lowerings), and `var`/TDZ-predeclared/
+   * pre-registered bindings whose slots no token can inhabit. Null only
+   * when the source is not a stdlib global at all, or in TypeScript
+   * files (the identifier chokepoint fences the global there first). */
+function stdlibGlobalTokenDestructure(L, decl, isLet) {
+    if (decl.initializer === undefined || !isJsSourceFile(decl.getSourceFile()))
+        return null;
+    const globalName = stdlibGlobalNameOf(L, decl.initializer);
+    if (globalName === null)
+        return null;
+    if (!ts.isObjectBindingPattern(decl.name)) {
+        L.unsupported("SC1031", decl.name, `array destructuring of the builtin global '${globalName}' (builtin globals are not iterable)`);
+    }
+    if (isVarDeclared(decl)) {
+        L.unsupported("SC1031", decl.name, `var-declared patterns over the builtin global '${globalName}'`);
+    }
+    const srcT = L.typeOf(decl.initializer);
+    const binds = [];
+    for (const el of decl.name.elements) {
+        if (el.name === undefined)
+            continue;
+        if (el.dotDotDotToken) {
+            L.unsupported("SC1031", el, `rest bindings over the builtin global '${globalName}' (the member set is not statically enumerable)`);
+        }
+        if (el.initializer !== undefined) {
+            L.unsupported("SC1031", el, `binding defaults over the builtin global '${globalName}' (member presence is not statically testable)`);
+        }
+        if (!ts.isIdentifier(el.name)) {
+            L.unsupported("SC1031", el, `nested patterns over the builtin global '${globalName}'`);
+        }
+        const prop = el.propertyName ?? el.name;
+        const propName = ts.isIdentifier(prop) || ts.isComputedPropertyName(prop) || ts.isStringLiteralLike(prop) || ts.isNumericLiteral(prop)
+            ? patternKeyNameOf(L, prop)
+            : null;
+        if (propName === null) {
+            L.unsupported("SC1031", el, "destructuring with computed keys that do not fold to one property name");
+        }
+        let token;
+        let alias = null;
+        if (globalName === "globalThis") {
+            // The member must BE a stdlib global (user script vars are
+            // properties of `typeof globalThis` too — their values are real
+            // and this rule has none to give).
+            const member = L.checker.getPropertyOfType(srcT, propName);
+            if (member === undefined || !L.isStdlibSymbol(member)) {
+                L.unsupported("SC1031", el, `destructuring the non-builtin member '${propName}' of 'globalThis'`);
+            }
+            const canonical = member.name === "global" ? "globalThis" : member.name;
+            token = `[builtin ${canonical}]`;
+            alias = canonical;
+        }
+        else if (globalName === "console" && !CONSOLE_CALL_MEMBERS.has(propName)) {
+            token = `[builtin console.${propName}]`;
+        }
+        else if (TOKEN_OPAQUE_GLOBALS.has(globalName)) {
+            token = `[builtin ${globalName}.${propName}]`;
+        }
+        else {
+            L.unsupported("SC1031", el, `destructuring the member '${propName}' of the builtin global '${globalName}' (a detached member loses its receiver-keyed lowering — call it through the global)`);
+        }
+        const symbol = L.checker.getSymbolAtLocation(el.name);
+        if (!symbol || L.tdzPredeclared.has(symbol)) {
+            L.unsupported("SC1031", el, `bindings with predeclared slots over the builtin global '${globalName}'`);
+        }
+        const g = L.globalsBySymbol.get(symbol);
+        if (g !== undefined && g.type.kind !== "string" && g.type.kind !== "dyn") {
+            L.unsupported("SC1031", el, `bindings with '${L.fmt(g.type)}' storage over the builtin global '${globalName}'`);
+        }
+        binds.push({ name: el.name, token, alias, g });
+    }
+    const out = [];
+    for (const b of binds) {
+        const loc = locOf(b.name);
+        const token = { kind: "strLit", value: b.token, type: STRING, loc };
+        if (b.alias !== null) {
+            const symbol = L.checker.getSymbolAtLocation(b.name);
+            if (symbol)
+                L.stdlibGlobalAliases.set(symbol, b.alias);
+        }
+        if (b.g !== undefined) {
+            out.push({ kind: "assign", localId: b.g.id, value: L.coerceInto(b.name, token, b.g.type), loc });
+        }
+        else {
+            const local = L.declareLocal(b.name, b.name.text, STRING, isLet);
+            out.push({ kind: "varDecl", localId: local.id, init: token, loc });
+        }
+    }
+    return out;
+}
 /** `x = dflt` on a pattern position whose source value always EXISTS
    * (tuple positions, record fields): JS evaluates the default exactly
    * when the value is undefined — the undefined-arm ternary, lazy, so
@@ -2097,6 +2450,13 @@ export function lowerJsvalBindingPattern(L, pattern, srcRef, isLet, out) {
    * lowerVarDecl (module-global assignment for pre-registered file-scope
    * names, declareLocal otherwise), or a nested pattern through its own
    * hidden temp. */
+/** An island-world ('any'-flavored) checker spelling: bare jsval or an
+ * array of jsvals (`(string | object)[]` absorbed by its jsval arm) —
+ * the shapes the runtime-world local rule keeps DYN when the value
+ * lowered checked-dynamic. */
+function jsvalFlavoredType(t) {
+    return t.kind === "jsval" || (t.kind === "array" && t.elem.kind === "jsval");
+}
 export function bindPatternTarget(L, name, value, isLet, out) {
     const loc = value.loc;
     if (ts.isIdentifier(name)) {
@@ -2117,7 +2477,21 @@ export function bindPatternTarget(L, name, value, isLet, out) {
             out.push({ kind: "assign", localId: hoisted.id, value: L.coerceInto(name, value, hoisted.type), loc });
             return;
         }
-        const type = L.irTypeOf(name);
+        // The runtime-world local rule, dyn side (383(d)'s dispatch stance):
+        // a pattern binding whose VALUE lowered checked-dynamic stays dyn
+        // where the checker spells an island-world type (`function f({
+        // plugins = [] } = {})` over a JSDoc '(string | object)[]=' member —
+        // the read is a DOM keyed read whose members may be wrapped island
+        // values) or a type with no mapping at all (the varDecl rule's
+        // unmappable-declared-type stance, `string | object` bindings
+        // included). Marshaling here would fence or deep-copy; the value's
+        // world is the honest dispatch.
+        const dynStays = value.type.kind === "dyn" &&
+            (() => {
+                const mapped = L.mapTypeOf(L.typeOf(name));
+                return mapped === null || (L.dynamic && jsvalFlavoredType(mapped));
+            })();
+        const type = dynStays ? DYN : L.irTypeOf(name);
         if (type.kind === "void")
             L.badType(name, L.typeOf(name));
         const coerced = L.coerceInto(name, value, type);
@@ -2184,8 +2558,48 @@ export function lowerVarDecl(L, decl, isLet) {
     // put its fences on the build.
     if (provenanceElidedConstDecl(L, decl))
         return null;
+    // A TRAP declaration — the initializer's chain roots at an
+    // ambient-undefined name (`declare function factory...; const make =
+    // factory<T>()`): Node throws the root's ReferenceError while
+    // evaluating the initializer, module init unwinds THERE, and nothing
+    // after — including every reference to this binding — ever runs. The
+    // statement lowers to exactly that throw; the binding registers as a
+    // trap (references lower to the same never-reached shape), and no
+    // storage or type mapping is needed for a value that never exists.
+    if (decl.initializer !== undefined) {
+        const root = ambientUndefVarRootOf(L, decl.initializer);
+        if (root !== null) {
+            for (const nameNode of boundIdentifiersOf(decl.name)) {
+                const sym = L.checker.getSymbolAtLocation(nameNode);
+                if (sym)
+                    L.trapBindings.add(sym);
+            }
+            return {
+                kind: "exprStmt",
+                expr: nsUndefRead(L, root.text, decl.initializer, F64),
+                loc: locOf(decl),
+            };
+        }
+    }
     if (!ts.isIdentifier(decl.name))
         L.unsupported("SC1031", decl.name);
+    // A NULLISH generic binding (`const i: I<A & B> = null as any` — the
+    // declared type has no mapping, the value is provably null/undefined
+    // forever): no storage exists; reads know the value (member reads and
+    // method calls lower to Node's exact TypeError, nullish-to-nullish
+    // flows to nothing), so the declaration emits nothing.
+    if (nullishGenericBindingUnitOf(L, L.checker.getSymbolAtLocation(decl.name) ?? null) !== null) {
+        return null;
+    }
+    // A DEAD unmappable binding (`var xs2: typeof Array;`, the write-only
+    // `var f2: { <T, U>(x: T, y: U): T }`): never read anywhere in the
+    // program, its initializer (if any) a side-effect-free value — Node
+    // materializes the value and drops it, zero observable effect — so
+    // the declaration emits nothing instead of fencing on a type the
+    // program never consumes.
+    if (deadUnmappableBinding(L, L.checker.getSymbolAtLocation(decl.name) ?? null, decl)) {
+        return null;
+    }
     // An initializer-LESS declaration named `module` or `exports` at the
     // top level of an import/export-free TS file shadows the CommonJS
     // wrapper binding: Node hosts such a file as CJS, where
@@ -2407,6 +2821,16 @@ export function lowerVarDecl(L, decl, isLet) {
             // uncheckedOverloadHandleCall.
             (init.type.kind === "jsval" && uncheckedOverloadHandleCall(L, decl.initializer) ? JSVAL : null))
         : null) ??
+        // The runtime-world local rule, dyn side (383(d)'s dispatch stance —
+        // the island-HANDLE local rule's mirror): a binding whose
+        // INITIALIZER lowered checked-dynamic stays dyn even where the
+        // checker spells 'any' (`const parsers = options.parsers ?? {}` over
+        // an 'object'-typed bag — the read is a DOM keyed read). Marshaling
+        // into the engine here would deep-copy data and sever aliasing; the
+        // value's world is the honest dispatch, and every use site already
+        // handles dyn (validated exits, routed engine ops for wrapped
+        // island members).
+        (L.dynamic && init.type.kind === "dyn" && jsvalFlavoredType(L.mapTypeOf(L.typeOf(decl.name)) ?? DYN) ? DYN : null) ??
         (bindingTainted ? null : L.mapTypeOf(L.typeOf(decl.name))) ??
         (init.type.kind === "dyn" ? DYN : null);
     // A JS `let x = {}`: TS's empty-object-literal type admits ANY later
@@ -2712,6 +3136,7 @@ export function lowerUnionSwitch(L, stmt, disc) {
                     kind: "unionEq",
                     unionId: unionType.unionId,
                     negated: false,
+                    sameValue: false,
                     left: disc,
                     right: L.coerceInto(clause.expression, test, unionType),
                     type: BOOL,
@@ -3157,6 +3582,37 @@ export function lowerExprStatement(L, expr) {
     const stmtNode = expr.parent;
     while (ts.isParenthesizedExpression(expr))
         expr = expr.expression;
+    // Assignment statements over the no-storage binding families:
+    //   - `f1 = f2` where the RHS roots at an ambient-undefined name:
+    //     Node evaluates the RHS first and dies on the root's
+    //     ReferenceError before any binding is touched — the statement IS
+    //     that throw;
+    //   - `a = b` between NULLISH generic bindings: the value is known
+    //     and the target has no storage — nothing happens;
+    //   - a write to a DEAD binding (registration proved every write's
+    //     RHS side-effect-free): Node builds the value and drops it —
+    //     nothing happens.
+    if (ts.isBinaryExpression(expr) &&
+        expr.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        ts.isIdentifier(expr.left)) {
+        const rhsRoot = ambientUndefVarRootOf(L, expr.right);
+        if (rhsRoot !== null) {
+            return {
+                kind: "exprStmt",
+                expr: nsUndefRead(L, rhsRoot.text, expr.right, F64),
+                loc: locOf(expr),
+            };
+        }
+        const targetSym = L.resolveValueSymbol(expr.left);
+        if (targetSym !== null) {
+            if (nullishGenericBindingUnitOf(L, targetSym) !== null && nullishExprUnitOf(L, expr.right) !== null) {
+                return { kind: "block", body: [], loc: locOf(expr) };
+            }
+            if (L.deadBindings.has(targetSym)) {
+                return { kind: "block", body: [], loc: locOf(expr) };
+            }
+        }
+    }
     // A bare module-namespace binding in STATEMENT position (`ns;` for
     // `import * as ns from ...` — the corpus's canonical "the import
     // linked" assertion): Node evaluates an initialized binding (namespace
@@ -3314,8 +3770,25 @@ export function lowerExprStatement(L, expr) {
                     // o.x = v on an island receiver: engine property write; the
                     // value marshals in (a static RHS crosses by value/copy).
                     const obj = L.lowerExpr(expr.left.expression);
-                    const value = L.jsvalIn(L.lowerExpr(expr.right), expr.right);
                     const loc = locOf(expr);
+                    // Dispatch follows the RUNTIME world (383(d)): a checker-'any'
+                    // receiver whose value LOWERED checked-dynamic (`bag.nested.x
+                    // = v` behind an 'object'-typed bag) takes the DOM keyed
+                    // write — the routed JSVAL arm lands it on the real engine
+                    // object.
+                    if (obj.type.kind === "dyn") {
+                        const key = { kind: "strLit", value: expr.left.name.text, type: STRING, loc: locOf(expr.left.name) };
+                        const value = L.coerceToExpected(L.lowerExpr(expr.right), DYN);
+                        if (value.type.kind !== "dyn") {
+                            L.unsupported("SC1100", expr.right, `assigning '${L.fmt(value.type)}' values through 'unknown' receivers`);
+                        }
+                        return {
+                            kind: "exprStmt",
+                            expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc },
+                            loc,
+                        };
+                    }
+                    const value = L.jsvalIn(L.lowerExpr(expr.right), expr.right);
                     return {
                         kind: "exprStmt",
                         expr: { kind: "jsOp", op: "setProp", name: expr.left.name.text, args: [obj, value], type: VOID, loc },
@@ -3415,6 +3888,31 @@ export function lowerExprStatement(L, expr) {
                         };
                     }
                 }
+                // `events.defaultMaxListeners = v` in STATEMENT position — the
+                // module-property write Node validates (the lowerBinary
+                // expression twin): the value crosses into the DOM, the runtime
+                // ladder throws Node's exact errors, valid numbers apply.
+                if (!expr.left.questionDotToken && expr.left.name.text === "defaultMaxListeners") {
+                    const bi = L.builtinMemberOf(expr.left);
+                    if (bi && bi.module === "events" && bi.member === "defaultMaxListeners") {
+                        const loc = locOf(expr);
+                        const rhs = L.lowerExpr(expr.right);
+                        if (rhs.type.kind === "dyn" || rhs.kind === "unitLit" || L.dynConvertible(rhs.type)) {
+                            const dynVal = rhs.type.kind === "dyn" ? rhs : { kind: "dynFrom", value: rhs, type: DYN, loc };
+                            return {
+                                kind: "exprStmt",
+                                expr: {
+                                    kind: "libCall",
+                                    fn: "emitter.setDefaultMaxChk",
+                                    args: [dynVal, { kind: "strLit", value: "defaultMaxListeners", type: STRING, loc }],
+                                    type: VOID,
+                                    loc,
+                                },
+                                loc,
+                            };
+                        }
+                    }
+                }
                 // `r._read = fn` / `w._write = fn` (and the other underscore
                 // methods) on a runtime-stream-rooted receiver: Node's
                 // own-property shadow of the prototype method — the runtime
@@ -3937,6 +4435,31 @@ export function lowerDestructuringAssignParts(L, target, rhs, loc) {
    * source-spelling TypeError machinery cannot apply), `blame` the node
    * fences point at. */
 function destructuringAssignInto(L, target, init, rhs, blame, loc) {
+    // IR-string sources in JS files split two ways the carrier type
+    // cannot: a STDLIB GLOBAL (`({ subtle } = globalThis.crypto)`) — the
+    // declaration path binds member identity tokens into FRESH bindings,
+    // but assignment targets carry their own checker-typed slots no token
+    // can honestly inhabit — and a LEAKED token (a local that adopted a
+    // global's carrier type), where the string lowerings below would read
+    // the carrier itself. Both keep fences naming the truth; empty
+    // patterns stay pure (RequireObjectCoercible/GetIterator hold for
+    // globals and strings alike).
+    {
+        const patternEmpty = ts.isObjectLiteralExpression(target)
+            ? target.properties.length === 0
+            : target.elements.length === 0;
+        if (!patternEmpty && rhs !== null && isJsSourceFile(rhs.getSourceFile())) {
+            const globalName = stdlibGlobalNameOf(L, rhs);
+            if (globalName !== null) {
+                L.unsupported("SC1031", blame, `destructuring assignment from the builtin global '${globalName}' (bind the members with a const destructuring declaration instead)`);
+            }
+            if (init.type.kind === "string" && !checkerStringSource(L, rhs)) {
+                L.unsupported("SC1031", blame, ts.isArrayLiteralExpression(target)
+                    ? `array destructuring assignment from non-array values (the source is '${L.checker.typeToString(L.typeOf(rhs))}'-typed)`
+                    : `destructuring assignment from non-record values (the source is '${L.checker.typeToString(L.typeOf(rhs))}'-typed)`);
+            }
+        }
+    }
     const tmp = L.declareHiddenLocal("%destr", init.type);
     const out = [{ kind: "varDecl", localId: tmp.id, init, loc }];
     const tmpRef = () => ({ kind: "varRef", localId: tmp.id, type: init.type, loc });
@@ -4140,6 +4663,77 @@ function destructuringAssignInto(L, target, init, rhs, blame, loc) {
             return { stmts: out, value };
         }
     }
+    // A STRING source under an object ASSIGNMENT pattern (`({ length: n }
+    // = s)`): the declaration path's wrapper rule in assignment position —
+    // `length` is the wrapper's one own data property (the strLen
+    // intrinsic; a default is dead code — length always exists and is
+    // never undefined, so JS never evaluates it either); identifier,
+    // property, and element targets ride the shared target plumbing.
+    // Methods, unknown names, computed keys, spreads, and accessor
+    // properties keep the declaration path's named fences. Callers vetted
+    // the source as a checker-typed string.
+    if (init.type.kind === "string") {
+        for (const prop of target.properties) {
+            const propLoc = locOf(prop);
+            if (ts.isSpreadAssignment(prop)) {
+                L.unsupported("SC1031", prop, "rest bindings over string sources (JS packs the wrapper's per-code-unit indices — split with [...s] instead)");
+            }
+            let fieldName;
+            let bindTo;
+            if (ts.isShorthandPropertyAssignment(prop)) {
+                fieldName = prop.name.text;
+                bindTo = prop.name;
+            }
+            else if (ts.isPropertyAssignment(prop)) {
+                const folded = patternKeyNameOf(L, prop.name);
+                if (folded === null) {
+                    L.unsupported("SC1031", prop, "destructuring assignment with computed keys that do not fold to one property name");
+                }
+                fieldName = folded;
+                bindTo = prop.initializer;
+                // `({ length: n = 3 } = s)`: the default is dead (length always
+                // exists) — strip it, exactly the evaluation JS skips.
+                if (ts.isBinaryExpression(bindTo) && bindTo.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+                    bindTo = bindTo.left;
+                }
+            }
+            else {
+                L.unsupported("SC1031", prop, "destructuring assignment with getter/setter or method properties");
+            }
+            if (fieldName !== "length") {
+                L.unsupported("SC1031", prop, Object.hasOwn(STR_METHODS, fieldName)
+                    ? `destructuring the method '${fieldName}' of a string (a detached method loses its receiver — call it through the value)`
+                    : `destructuring the property '${fieldName}' strings do not carry as data ('length' is the one own data property)`);
+            }
+            const readOf = () => ({ kind: "strIntrinsic", method: "length", receiver: tmpRef(), args: [], type: F64, loc: propLoc });
+            while (ts.isParenthesizedExpression(bindTo))
+                bindTo = bindTo.expression;
+            if (!ts.isIdentifier(bindTo)) {
+                lowerAssignTargetInto(L, out, bindTo, prop, null, readOf);
+                continue;
+            }
+            let targetBinding;
+            if (ts.isShorthandPropertyAssignment(prop)) {
+                const valueSymbol = L.checker.getShorthandAssignmentValueSymbol(prop) ?? null;
+                const local = valueSymbol ? L.resolveKey(valueSymbol, bindTo) : null;
+                const g = valueSymbol ? L.globalsBySymbol.get(valueSymbol) : undefined;
+                targetBinding = local ? { id: local.id, type: local.type } : g ? { id: g.id, type: g.type } : null;
+            }
+            else {
+                targetBinding = L.resolveWritable(bindTo);
+            }
+            if (!targetBinding) {
+                L.rejectUnresolved(bindTo, `assignment to '${bindTo.text}' (not a writable local or module global)`);
+            }
+            out.push({
+                kind: "assign",
+                localId: targetBinding.id,
+                value: L.coerceInto(prop, readOf(), targetBinding.type),
+                loc: propLoc,
+            });
+        }
+        return { stmts: out, value };
+    }
     if (init.type.kind !== "record") {
         L.unsupported("SC1031", blame, init.type.kind === "object"
             ? "destructuring assignment from class instances (read the fields directly — accessors make the desugar observable)"
@@ -4473,7 +5067,23 @@ function destructAssignPiece(L, prop, islandSource) {
    * bounds test (JS reads undefined past the end), rest packs the tail
    * fresh (array slices, tuple tails). */
 function lowerArrayAssignInto(L, out, target, tmpRef, blame, loc) {
-    const srcType = tmpRef().type;
+    let srcType = tmpRef().type;
+    // A STRING source (`[a, b] = s`): the declaration path's rule in
+    // assignment position — the string iterator's code-point split
+    // (%str.chars, astral characters whole) into a hidden chars array,
+    // then the pattern proceeds as an array pattern over string[]
+    // (defaults with the bounds test, rest packing the remaining code
+    // points, elisions; positions past the last code point inherit the
+    // array divergence). The EMPTY pattern skips the split — GetIterator
+    // + close, nothing observable — through the iterable early-return
+    // below. Callers vetted the source as a checker-typed string.
+    if (srcType.kind === "string" && target.elements.length > 0) {
+        const charsT = arrayOf(STRING);
+        const chars = L.declareHiddenLocal("%dchars", charsT);
+        out.push({ kind: "varDecl", localId: chars.id, init: strCharsCall(L, tmpRef(), loc), loc });
+        tmpRef = () => ({ kind: "varRef", localId: chars.id, type: charsT, loc });
+        srcType = charsT;
+    }
     // A sole leading rest whose operand is ITSELF an array pattern
     // (`[...[a, b = 0]] = t`): the rest collects every element, then the
     // inner pattern destructures the collection — over arrays/tuples that
@@ -4694,6 +5304,15 @@ export function lowerForOf(L, stmt) {
             if (recv?.kind === "searchParams") {
                 return lowerForOfSearchParams(L, stmt, L.lowerExpr(src.expression.expression), proj);
             }
+            // ARRAY keys()/entries() projections: the live index walk yielding
+            // the index or the [index, element] pair (lower-containers).
+            // `values` falls through to the receiver unwrap below.
+            if (recv?.kind === "array" && (proj === "keys" || proj === "entries")) {
+                const container = L.lowerExpr(src.expression.expression);
+                if (container.type.kind === "array") {
+                    return lowerForOfArrayIter(L, stmt, container, proj);
+                }
+            }
         }
     }
     // `for (const m of s.matchAll(re))` — direct call or a stored-const
@@ -4857,6 +5476,13 @@ export function lowerForOf(L, stmt) {
         if (iterable.type.kind === "jsval") {
             return lowerForOfIsland(L, stmt, iterable, labels);
         }
+        // A CHECKED-DYNAMIC iterable (`unknown[]` and the collapsed
+        // `(string | object)[]` are DOM values now, so the TYPE maps —
+        // badType would tell a stale component story): the OPERATION is
+        // the gap — name it, with the validated-cast escape hatch.
+        if (iterable.type.kind === "dyn") {
+            L.unsupported("SC1090", stmt.expression, "for-of over checked-dynamic ('unknown') values (validate into a typed array first — `u as string[]` — or index with a counted loop: length and element reads compile)");
+        }
         if (iterable.type.kind !== "array") {
             L.badType(stmt.expression, L.typeOf(stmt.expression));
         }
@@ -5296,11 +5922,13 @@ function lowerForOfIsland(L, stmt, iterable, labels) {
 function lowerForOfString(L, stmt, iterable, labels) {
     let exprTarget = null;
     let exprTargetNode = null;
+    let exprPattern = null;
     if (!ts.isVariableDeclarationList(stmt.initializer)) {
         // `for (v of "hello")` over a PRE-DECLARED identifier: assign the
-        // existing binding per pass (the array head's rule). Member and
-        // destructuring targets keep the fence — a string yields single
-        // characters, so patterns over them stay the non-array fences.
+        // existing binding per pass (the array head's rule). PATTERN heads
+        // (`for ([a] of "xy")`) destructure the per-iteration code point
+        // through the string-source assignment lowerings; member targets
+        // keep the fence.
         let target = stmt.initializer;
         while (ts.isParenthesizedExpression(target))
             target = target.expression;
@@ -5308,7 +5936,10 @@ function lowerForOfString(L, stmt, iterable, labels) {
             exprTarget = L.resolveWritable(target);
             exprTargetNode = target;
         }
-        if (!exprTarget) {
+        else if (ts.isObjectLiteralExpression(target) || ts.isArrayLiteralExpression(target)) {
+            exprPattern = target;
+        }
+        if (!exprTarget && !exprPattern) {
             L.unsupported("SC1090", stmt.initializer, "for-of over a pre-declared variable (declare the loop variable in the loop: for (const x of ...))");
         }
     }
@@ -5318,8 +5949,6 @@ function lowerForOfString(L, stmt, iterable, labels) {
     }
     const isLet = list !== null && (list.flags & ts.NodeFlags.Let) !== 0;
     const decl = list ? list.declarations[0] : null; // the grammar allows exactly one
-    if (decl && !ts.isIdentifier(decl.name))
-        L.unsupported("SC1031", decl.name);
     const loc = locOf(stmt);
     L.scopes.push(new Map());
     try {
@@ -5331,9 +5960,15 @@ function lowerForOfString(L, stmt, iterable, labels) {
         // `for (var c of str)`: the character mechanics stay on a hidden
         // per-iteration local; the body opens by assigning it into the ONE
         // hoisted var binding (see forOfVarTarget). Pre-declared expression
-        // heads assign their existing binding the same way.
-        const varTarget = exprTarget ?? (decl ? forOfVarTarget(L, decl) : null);
-        const ch = varTarget
+        // heads assign their existing binding the same way. PATTERN heads
+        // (`for (const [half] of "😀x")`) destructure the per-iteration
+        // code point through the string-source pattern lowerings — each
+        // element is a genuine one-code-point string.
+        const declPattern = decl !== null && !ts.isIdentifier(decl.name)
+            ? decl.name
+            : null;
+        const varTarget = exprTarget ?? (decl && !declPattern ? forOfVarTarget(L, decl) : null);
+        const ch = varTarget || declPattern || exprPattern
             ? L.declareHiddenLocal("%vof", STRING)
             : L.declareLocal(decl.name, decl.name.text, STRING, isLet);
         const chRef = { kind: "varRef", localId: ch.id, type: STRING, loc };
@@ -5361,6 +5996,12 @@ function lowerForOfString(L, stmt, iterable, labels) {
                 loc,
             },
         ];
+        if (declPattern) {
+            L.lowerBindingPattern(declPattern, () => chRef, STRING, isLet, head);
+        }
+        if (exprPattern) {
+            head.push(lowerDestructuringAssign(L, exprPattern, chRef, exprPattern, loc));
+        }
         const body = L.inCtl("loop", () => L.lowerScopedBlock(stmt.statement), labels);
         return {
             kind: "block",