@scriptc/compiler 0.0.8 → 0.0.9

package/dist/frontend/lowering/lower-calls.d.ts

@@ -373,6 +373,36 @@ export declare const TIMER_MODULE_MEMBERS: ReadonlySet<string>;
    * timer function (the caller's fence machinery takes over). */
 export declare function lowerTimersMemberCall(L: Lowerer, expr: ts.CallExpression, member: string, loc: SrcLoc): IrExpr | null;
 export declare function lowerCall(L: Lowerer, expr: ts.CallExpression): IrExpr;
+/** The RUNTIME-ARITY spread call — `f(...args)`, the rest-forwarding idiom
+   * (`const f = (...args) => from(...args)`): a spread whose length is a
+   * runtime fact has no home in the compile-time completion, so the call
+   * rides a dynamic boundary instead. Two lanes, picked by the spread
+   * source's tier:
+   *
+   * - CHECKED-DYNAMIC (dyn spread sources — a JS rest binding, a dyn
+   *   value): box the callee (dynFrom; a dyn callee is already boxed),
+   *   convert every argument into dyn, and emit the spread-marked dynCall
+   *   — the emitters build one fresh DOM argument array (spreads flatten
+   *   left-to-right, non-iterables throw V8's TypeError) and apply through
+   *   it; the boxed thunk delivers JS arity exactly. Result dyn, checked
+   *   per use like every any-origin value.
+   * - ISLAND (a jsval spread source — the --dynamic rest binding is the
+   *   engine's own arguments array): marshal the callee in and emit jsOp
+   *   callSpread — the prelude helper's REAL `f(...pre, ...s)`, so
+   *   iterator protocols and the not-iterable TypeError are the engine's
+   *   own. One trailing spread after the fixed arguments is the modeled
+   *   shape (exactly the forwarding idiom).
+   *
+   * Answers null when neither lane fits (typed .ts spreads keep
+   * completeArgs' rest packing and its fences). JS sources only — the
+   * same guard as the over-arity dynCall precedent. */
+export declare function lowerSpreadArgsCall(L: Lowerer, expr: ts.CallExpression, callee: IrExpr, loc: SrcLoc): IrExpr | null;
+/** True when a spread argument lands where the compile-time completion
+   * cannot take it — a FIXED parameter position, or a dynamic rest slot
+   * (dynRest/islandRest, whose packs are built per-argument): the shapes
+   * the runtime-arity lane (lowerSpreadArgsCall) serves. Typed `rest`
+   * slots keep completeArgs' same-element spread packing. */
+export declare function spreadNeedsRuntimeArity(shapes: readonly ParamShape[], argNodes: readonly ts.Expression[]): boolean;
 /** The SHARED prototype names scr_dyn_invoke dispatches at runtime (the
  * subset of DOM_PROTO_METHOD_NAMES with a receiver-kind dispatch): the
  * runtime runs the real method for the receiver's kind, throws Node's
@@ -600,17 +630,6 @@ export declare function bindingGenericFnAliasInfoOf(L: Lowerer, decl: ts.Variabl
    * structurally identical literal with a DIFFERENT body, which static
    * resolution would silently miss. */
 export declare function requireObjLitGenericReceiver(L: Lowerer, blame: ts.Node, recvExpr: ts.Expression, literal: ts.ObjectLiteralExpression, name: string): void;
-/** `o.m(args)` where `m` is an object-literal GENERIC method (own type
-   * parameters — the member is excluded from the record shape, see
-   * isGenericCallableMemberType): monomorphized per call site against the
-   * DEFINING literal's declaration, exactly like top-level generic
-   * functions. Resolution is static, so the receiver must provably BE the
-   * defining literal: a const binding whose initializer is that literal,
-   * read directly. The receiver read is pure and the compiled instance is
-   * a plain module function (no `this`, fenced), so the call lowers to a
-   * direct `call` of the instance with the receiver unevaluated. Claims
-   * every call whose member is generic-callable — lowering it or fencing
-   * with a named message. */
 export declare function lowerObjLitGenericMethodCall(L: Lowerer, call: ts.CallExpression, access: ts.PropertyAccessExpression): IrExpr | null;
 /** `obj.method(args)` — whole-program devirtualization decides the form:
    * a method some strict subclass of the receiver's STATIC class overrides

package/dist/frontend/lowering/lower-calls.js

@@ -7,14 +7,14 @@ import { lowerGenMethodCall } from "./lower-generators.js";
 import { BOOL, CAUGHT, DYN, F64, JSVAL, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, funcOf, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/nodes.js";
 import { isJsSourceFile, locOf } from "../program.js";
 import { isGenericCallableMemberType, typeKey } from "../types.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx } from "./lowerer.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr } from "./lowerer.js";
 import { enforceLibBoundary } from "./lib-boundary.js";
-import { builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { NARROW_FIRST, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
 import { requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
 import { bufEncoding, dynStringReceiver, lowerArrayFromCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerRegexMethodCall, lowerStringMethodCall, lowerTupleReadMethodCall } from "./lower-containers.js";
 import { lowerChildStreamMethodCall, lowerDirentMethodCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
+import { droppableStatic, lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerHttpClientFnCall } from "./lower-server.js";
 import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-emitter.js";
@@ -2804,6 +2804,9 @@ export function lowerCall(L, expr) {
             const streamServed = lowerStreamModuleCall(L, expr, bi, loc);
             if (streamServed)
                 return streamServed;
+            const fsTs = L.lowerFsToUnixTimestampCall(expr, bi, loc);
+            if (fsTs)
+                return fsTs;
             const builtinFn = builtinModuleFnOf(L, bi.module, bi.member);
             if (!builtinFn) {
                 // Typed by @types/node (the fallback declarations only declare
@@ -3033,15 +3036,24 @@ export function lowerCall(L, expr) {
     // closure object, plain C call). Generic functions route through
     // monomorphization (the call targets a per-instantiation instance).
     if (ts.isIdentifier(expr.expression) && !L.isSelfReference(expr.expression)) {
+        // A JS spread argument the compile-time completion cannot take (a
+        // fixed position, a dynamic rest slot) sends the call down the
+        // VALUE path — the runtime-arity lane (lowerSpreadArgsCall) boxes
+        // the declaration's value and applies through a runtime-built
+        // argument list. Typed .ts spreads keep completeArgs' rest packing.
+        const jsSpreadArgs = expr.arguments.some((a) => ts.isSpreadElement(a)) && isJsSourceFile(expr.getSourceFile());
         if (L.isTopLevelFnSymbol(expr.expression) && !L.peekLocal(expr.expression)) {
             // `import g = N.f; g()` — the alias's own source-order guards
             // (a no-op for every non-import= binding).
             fenceEarlyAliasUse(L, expr.expression, expr);
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            // An implicit-any JS function spread-forwarded into: per-site
+            // monomorphization has no slot for a runtime-length argument
+            // list — the value path's boxed thunk delivers JS arity instead.
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
-            const sig = L.fnSigOf(expr.expression);
-            if (sig) {
+            const sig = generic ? null : L.fnSigOf(expr.expression);
+            if (sig && !(jsSpreadArgs && spreadNeedsRuntimeArity(sig.params, expr.arguments))) {
                 L.noteEdge(sig.name);
                 const args = L.completeArgs(expr.arguments, sig.params, loc, expr);
                 return reconcileOverloadReturn(L, expr, { kind: "call", callee: sig.name, args, type: sig.returnType, loc });
@@ -3065,10 +3077,12 @@ export function lowerCall(L, expr) {
         // the call monomorphizes against it exactly like a generic function
         // declaration and the binding is never read. Symbol identity does
         // the discrimination — a shadowing local has its own symbol, and
-        // registered bindings never declare locals or globals.
+        // registered bindings never declare locals or globals. Implicit-any
+        // JS bindings spread-forwarded into skip to the value path (the
+        // runtime-arity lane), like the declaration form above.
         {
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
         }
     }
@@ -3277,6 +3291,9 @@ export function lowerCall(L, expr) {
             // island path (bytes never cross the boundary).
             L.lowerBytesMethodCall(expr, expr.expression) ??
             L.lowerBufferStaticCall(expr, expr.expression) ??
+            // URL.revokeObjectURL's zero-argument contract (the one-argument
+            // form keeps the fence — createObjectURL does too).
+            lowerUrlStaticCall(L, expr, expr.expression) ??
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(L, expr, expr.expression) ??
@@ -3312,6 +3329,9 @@ export function lowerCall(L, expr) {
             lowerSymbolStaticCall(L, expr, expr.expression) ??
             lowerSymbolMethodCall(L, expr, expr.expression) ??
             lowerRegExpStaticCall(L, expr, expr.expression) ??
+            // The composed en-US Intl.NumberFormat form — before the member
+            // fences (the receiver's Intl.NumberFormat type has no mapping).
+            lowerIntlNumberFormatCall(L, expr, expr.expression) ??
             lowerGroupByStaticCall(L, expr, expr.expression) ??
             // Iterator-helper chains rooted at arr.values() — before the
             // array method paths (the terminal names collide with array
@@ -3420,6 +3440,12 @@ export function lowerCall(L, expr) {
     // any-origin value). Spread arguments keep their fence.
     if (callee.type.kind === "dyn") {
         if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+            // The runtime-arity lane: a dyn callee is already boxed — the
+            // spread-marked dynCall applies through a fresh DOM argument
+            // array (lowerSpreadArgsCall). Sources outside it keep the fence.
+            const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+            if (spreadServed)
+                return spreadServed;
             L.unsupported("SC1090", expr, "spread arguments in calls through 'unknown' values");
         }
         const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
@@ -3433,6 +3459,42 @@ export function lowerCall(L, expr) {
     if (callee.type.kind !== "func") {
         L.badType(expr.expression, L.typeOf(expr.expression));
     }
+    // A SPREAD argument on a func-typed callee — the rest-forwarding
+    // idiom (`(...args) => from(...args)`): the runtime-arity lane boxes
+    // or marshals the callee and applies through a runtime-built argument
+    // list (lowerSpreadArgsCall). Shapes outside its lanes fall through
+    // to the historical fences.
+    if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+        if (spreadServed)
+            return spreadServed;
+    }
+    // An ISLAND-REST func value called directly (`f(1, 2)` where f is the
+    // --dynamic `(...args) =>` lambda): the type SPELLS its trailing
+    // engine-array param — complete the call exactly like completeArgs'
+    // island pack (fixed slots positionally, missing ones with the
+    // engine's undefined, the surplus marshaled into one fresh engine
+    // array). JS arity, no runtime machinery.
+    if (callee.type.rest === true &&
+        callee.type.restAbi === "jsval" &&
+        callee.type.params.length >= 1 &&
+        callee.type.params[callee.type.params.length - 1].kind === "jsval" &&
+        !expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const fixed = callee.type.params.slice(0, -1);
+        const args = fixed.map((p, i) => {
+            const a = expr.arguments[i];
+            if (a)
+                return L.lowerExprExpecting(a, p);
+            const absent = omittedArgFor(L, p, loc);
+            if (!absent) {
+                L.unsupported("SC1090", expr, "calls omitting a non-optional parameter of the callee's type");
+            }
+            return absent;
+        });
+        const restArgs = expr.arguments.slice(fixed.length).map((a) => L.lowerExprExpecting(a, JSVAL));
+        args.push({ kind: "jsOp", op: "arrLit", args: restArgs, type: JSVAL, loc });
+        return { kind: "callValue", callee, args, type: callee.type.ret, loc };
+    }
     // A JS call with MORE arguments than the callee's lowered signature
     // (`cb(1, 'x')` where the mustCall wrapper's inferred type declared
     // fewer params — tsc's JS world doesn't police arity): ride the
@@ -3470,6 +3532,101 @@ export function lowerCall(L, expr) {
     }
     return { kind: "callValue", callee, args, type: callee.type.ret, loc };
 }
+/** The RUNTIME-ARITY spread call — `f(...args)`, the rest-forwarding idiom
+   * (`const f = (...args) => from(...args)`): a spread whose length is a
+   * runtime fact has no home in the compile-time completion, so the call
+   * rides a dynamic boundary instead. Two lanes, picked by the spread
+   * source's tier:
+   *
+   * - CHECKED-DYNAMIC (dyn spread sources — a JS rest binding, a dyn
+   *   value): box the callee (dynFrom; a dyn callee is already boxed),
+   *   convert every argument into dyn, and emit the spread-marked dynCall
+   *   — the emitters build one fresh DOM argument array (spreads flatten
+   *   left-to-right, non-iterables throw V8's TypeError) and apply through
+   *   it; the boxed thunk delivers JS arity exactly. Result dyn, checked
+   *   per use like every any-origin value.
+   * - ISLAND (a jsval spread source — the --dynamic rest binding is the
+   *   engine's own arguments array): marshal the callee in and emit jsOp
+   *   callSpread — the prelude helper's REAL `f(...pre, ...s)`, so
+   *   iterator protocols and the not-iterable TypeError are the engine's
+   *   own. One trailing spread after the fixed arguments is the modeled
+   *   shape (exactly the forwarding idiom).
+   *
+   * Answers null when neither lane fits (typed .ts spreads keep
+   * completeArgs' rest packing and its fences). JS sources only — the
+   * same guard as the over-arity dynCall precedent. */
+export function lowerSpreadArgsCall(L, expr, callee, loc) {
+    if (!isJsSourceFile(expr.getSourceFile()))
+        return null;
+    if (!expr.arguments.some((a) => ts.isSpreadElement(a)))
+        return null;
+    if (callee.type.kind !== "dyn" && callee.type.kind !== "func" && callee.type.kind !== "jsval")
+        return null;
+    const calleeName = ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)
+        ? expr.expression.getText()
+        : ts.isIdentifier(expr.expression)
+            ? expr.expression.text
+            : "value";
+    // Lower every argument ONCE, in source order (the IR nests them in
+    // exactly this order, so runtime evaluation order is JS's).
+    const parts = expr.arguments.map((a) => ts.isSpreadElement(a)
+        ? { spreadOf: a.expression, node: null, v: L.lowerExpr(a.expression) }
+        : { spreadOf: null, node: a, v: L.lowerExpr(a) });
+    const spreadParts = parts.filter((p) => p.spreadOf !== null);
+    const getR = (id) => L.shapes.get(id);
+    const getU = (id) => L.unions.get(id);
+    const anyJsvalSpread = spreadParts.some((p) => p.v.type.kind === "jsval");
+    if (!anyJsvalSpread &&
+        (callee.type.kind === "dyn" || (callee.type.kind === "func" && canBoxFuncIntoDyn(callee.type, getR, getU))) &&
+        spreadParts.every((p) => p.v.type.kind === "dyn" || canConvertToDyn(p.v.type, getR, getU))) {
+        const args = [];
+        const spreads = [];
+        for (const p of parts) {
+            if (p.spreadOf !== null) {
+                // The spelling rides along for V8's nullish spread-call
+                // TypeError ("v is not iterable (cannot read property ...)").
+                spreads.push({ arg: args.length, what: p.spreadOf.getText() });
+                args.push(L.coerceInto(p.spreadOf, p.v, DYN));
+            }
+            else {
+                args.push(L.coerceInto(p.node, p.v, DYN));
+            }
+        }
+        const boxed = callee.type.kind === "dyn" ? callee : L.coerceInto(expr.expression, callee, DYN);
+        return { kind: "dynCall", callee: boxed, calleeName, args, spreads, type: DYN, loc };
+    }
+    if (spreadParts.length > 0 &&
+        spreadParts.every((p) => p.v.type.kind === "jsval") &&
+        (callee.type.kind === "jsval" || callee.type.kind === "func")) {
+        if (spreadParts.length !== 1 || parts[parts.length - 1].spreadOf === null) {
+            L.unsupported("SC1090", expr, "spread arguments before positional arguments in island calls (one trailing spread after the fixed arguments is the supported form)");
+        }
+        const f = L.coerceInto(expr.expression, callee, JSVAL);
+        const pre = parts
+            .slice(0, -1)
+            .map((p) => L.coerceInto(p.node, p.v, JSVAL));
+        const preArr = { kind: "jsOp", op: "arrLit", args: pre, type: JSVAL, loc };
+        const last = parts[parts.length - 1];
+        // The spelling rides in `name` for V8's nullish spread-call
+        // TypeError ("v is not iterable (cannot read property ...)").
+        return { kind: "jsOp", op: "callSpread", name: last.spreadOf.getText(), args: [f, preArr, last.v], type: JSVAL, loc };
+    }
+    // No lane fits (a spread source outside both tiers, a callee neither
+    // boxable nor marshalable, mixed dyn/jsval spreads): fence HERE — the
+    // arguments are already lowered, and falling back to the historical
+    // per-site fences would lower them a second time (duplicate lambda
+    // lifts, duplicated diagnostics).
+    L.unsupported("SC1090", expr, "spread arguments");
+}
+/** True when a spread argument lands where the compile-time completion
+   * cannot take it — a FIXED parameter position, or a dynamic rest slot
+   * (dynRest/islandRest, whose packs are built per-argument): the shapes
+   * the runtime-arity lane (lowerSpreadArgsCall) serves. Typed `rest`
+   * slots keep completeArgs' same-element spread packing. */
+export function spreadNeedsRuntimeArity(shapes, argNodes) {
+    const restAt = shapes.findIndex((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
+    return argNodes.some((a, i) => ts.isSpreadElement(a) && (restAt < 0 || i < restAt || shapes[restAt].mode !== "rest"));
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's DOM kind, extract, and ride the STATIC method machinery — the
@@ -4008,6 +4165,32 @@ export function lowerPrimitiveProtoCall(L, call, recv, name, memberSym) {
         const fn = name === "toExponential" ? "num.toExponential" : "num.toFixed0";
         return { kind: "libCall", fn, args: [operand], type: STRING, loc };
     }
+    // Number.prototype.toLocaleString("en-US") — the spec makes it
+    // NumberFormat(locale).format(this), so the en-US embedded formatter
+    // answers exactly. The unlowered forms fence by NAME: no locale (the
+    // host environment's default, which a compiled binary cannot carry),
+    // other locales (ICU data the binary does not embed), options bags.
+    if (name === "toLocaleString" && recvKind === "f64") {
+        if (call.arguments.length === 0) {
+            L.noLowering("Number.prototype.toLocaleString without a locale", call, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+                'pass it explicitly: x.toLocaleString("en-US")');
+        }
+        if (call.arguments.length > 1) {
+            L.noLowering("Number.prototype.toLocaleString with an options bag", call, "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction " +
+                'digits, grouping) — x.toLocaleString("en-US")');
+        }
+        const locNode = call.arguments[0];
+        if (ts.isSpreadElement(locNode) || !ts.isStringLiteralLike(locNode) || locNode.text !== "en-US") {
+            L.noLowering(!ts.isSpreadElement(locNode) && ts.isStringLiteralLike(locNode)
+                ? `Number.prototype.toLocaleString at locale "${locNode.text}"`
+                : "Number.prototype.toLocaleString with a non-literal locale", locNode, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+                "everything else is ICU data the binary does not carry");
+        }
+        const operand = L.lowerExpr(recv);
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "intl.numFormatEnUs", args: [operand], type: STRING, loc };
+    }
     if (name === "charAt" && recvKind === "string" && call.arguments.length === 1 &&
         !ts.isSpreadElement(call.arguments[0])) {
         const receiver = L.lowerExpr(recv);
@@ -4602,6 +4785,15 @@ export function lowerLambda(L, node) {
         const first = captured[0];
         const pos = ts.getLineAndCharacterOfPosition(L.program.getSourceFile(first.loc.file) ?? node.getSourceFile(), first.loc.start);
         const params = funcType.params.map((t, i) => ({ localId: `%pf${i}`, name: `%pf${i}`, type: t }));
+        // A REST-MARKED value type hides one synthetic trailing DOM-array
+        // param in the lifted function (the boxed call thunk fills it) —
+        // the fence lambda must spell that slot too or the validator's
+        // closure-signature check trips (SC9001). Island rest types SPELL
+        // their trailing engine-array param, so funcType.params already
+        // covers those.
+        if (funcType.rest === true && funcType.restAbi !== "jsval") {
+            params.push({ localId: "%pfrest", name: "%pfrest", type: DYN });
+        }
         const lifted = {
             name: fnName,
             params,
@@ -5782,12 +5974,184 @@ function lowerRegExpStaticCall(L, call, access) {
         L.badType(call.arguments[0], L.typeOf(call.arguments[0]));
     return { kind: "libCall", fn: "regexp.escape", args: [arg], type: STRING, loc: locOf(call) };
 }
+/** The composed en-US Intl.NumberFormat form: `new Intl.NumberFormat(
+ * "en-US").format(x)` (and the callable spelling without `new` — the
+ * spec makes them the same formatter). Only the COMPOSED form lowers —
+ * formatter values have no representation — and only the one locale
+ * whose data the runtime embeds, with default options: decimal
+ * notation, 0–3 fraction digits rounded half-up on the shortest
+ * round-tripping decimal (ICU's rounding input — format(1.0005) is
+ * "1.001" though toFixed(3) answers "1.000"), "," grouping. The
+ * unlowered forms fence by NAME (no locale — the host environment's
+ * default, which a compiled binary cannot carry; other locales — ICU
+ * data the binary does not embed; options bags; non-number arguments).
+ * Null when the callee isn't a NumberFormat-construction .format. */
+function lowerIntlNumberFormatCall(L, call, access) {
+    if (call.questionDotToken || access.questionDotToken)
+        return null;
+    if (access.name.text !== "format")
+        return null;
+    let recv = access.expression;
+    while (ts.isParenthesizedExpression(recv))
+        recv = recv.expression;
+    let ctorArgs;
+    if (ts.isNewExpression(recv) || (ts.isCallExpression(recv) && !recv.questionDotToken)) {
+        const ctor = recv.expression;
+        if (!ts.isPropertyAccessExpression(ctor) || ctor.questionDotToken ||
+            ctor.name.text !== "NumberFormat" || !L.isStdlibGlobal(ctor.expression, "Intl")) {
+            return null;
+        }
+        ctorArgs = recv.arguments ?? [];
+    }
+    else {
+        return null;
+    }
+    const loc = locOf(call);
+    if (ctorArgs.length === 0) {
+        L.noLowering("Intl.NumberFormat without a locale", recv, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+            'pass it explicitly: new Intl.NumberFormat("en-US").format(x)');
+    }
+    if (ctorArgs.length > 1) {
+        L.noLowering("Intl.NumberFormat with an options bag", ctorArgs[1], "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction digits, " +
+            'grouping) — new Intl.NumberFormat("en-US").format(x)');
+    }
+    const locArg = ctorArgs[0];
+    if (ts.isSpreadElement(locArg) || !ts.isStringLiteralLike(locArg) || locArg.text !== "en-US") {
+        L.noLowering(!ts.isSpreadElement(locArg) && ts.isStringLiteralLike(locArg)
+            ? `Intl.NumberFormat at locale "${locArg.text}"`
+            : "Intl.NumberFormat with a non-literal locale", locArg, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+            "everything else is ICU data the binary does not carry");
+    }
+    if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0])) {
+        L.noLowering(`Intl.NumberFormat("en-US").format with ${call.arguments.length} arguments`, call);
+    }
+    const argNode = call.arguments[0];
+    if (L.mapTypeOf(L.typeOf(argNode))?.kind !== "f64") {
+        L.noLowering(`Intl.NumberFormat("en-US").format over a '${L.checker.typeToString(L.typeOf(argNode))}'`, argNode, "a number argument is the lowered form (bigint and numeric-string inputs have no representation)");
+    }
+    const arg = L.lowerExprExpecting(argNode, F64);
+    if (arg.type.kind !== "f64")
+        L.badType(argNode, L.typeOf(argNode));
+    return { kind: "libCall", fn: "intl.numFormatEnUs", args: [arg], type: STRING, loc };
+}
+/** Object.is over statically disjoint kinds: the constant false, with
+ * both operands still evaluated for their effects (droppable statics
+ * fold away — JS evaluates arguments, but nothing observes a pure one). */
+function objectIsDisjointFalse(left, right, loc) {
+    const stmts = [];
+    for (const e of [left, right]) {
+        if (!droppableStatic(e))
+            stmts.push({ kind: "exprStmt", expr: e, loc });
+    }
+    const answer = { kind: "boolLit", value: false, type: BOOL, loc };
+    if (stmts.length === 0)
+        return answer;
+    return { kind: "seqExpr", stmts, result: answer, type: BOOL, loc };
+}
 function lowerObjectStaticCall(L, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     if (!L.isStdlibGlobal(access.expression, "Object"))
         return null;
     const member = access.name.text;
+    // Object.is — the spec's SameValue over the static kinds. Number
+    // pairs take the runtime SameValue (NaN equals NaN, +0 differs from
+    // -0 — the two divergences from ===); every other supported pair
+    // rides exactly the strict-equality machinery, whose answers
+    // SameValue shares: strings by bytes, bools by value, unit literals
+    // by tag, unions per arm (a number arm's payload compare upgrades to
+    // SameValue via unionEq's flag), and the reference kinds by pointer
+    // identity. Statically DISJOINT kind pairs answer the constant false
+    // with the operands still evaluated (tsc admits any pair — Object.is
+    // is (any, any) — and JS evaluates the arguments either way).
+    // dyn/jsval operands keep strict equality's stance: validate first.
+    if (member === "is") {
+        if (call.arguments.length !== 2 || call.arguments.some((a) => ts.isSpreadElement(a))) {
+            L.noLowering(`Object.is with ${call.arguments.length} arguments`, call, "exactly two arguments are the lowered form (JS treats a missing one as undefined — pass it explicitly)");
+        }
+        const loc = locOf(call);
+        const leftNode = call.arguments[0];
+        const rightNode = call.arguments[1];
+        const left = L.lowerExpr(leftNode);
+        const right = L.lowerExpr(rightNode);
+        const lk = left.type.kind;
+        const rk = right.type.kind;
+        if (lk === "f64" && rk === "f64") {
+            return { kind: "libCall", fn: "num.sameValue", args: [left, right], type: BOOL, loc };
+        }
+        if (left.type.kind === "string" && right.type.kind === "string") {
+            return { kind: "strEq", negated: false, left, right, type: BOOL, loc };
+        }
+        if (lk === "bool" && rk === "bool") {
+            return { kind: "bin", op: "===", left, right, type: BOOL, loc };
+        }
+        const unitTest = L.lowerUnitComparison(left, right, false, loc);
+        if (unitTest)
+            return unitTest;
+        if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
+            L.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+        }
+        if (left.type.kind === "union" || right.type.kind === "union") {
+            const ut = left.type.kind === "union" ? left.type : right.type;
+            const bothUnion = left.type.kind === "union" && right.type.kind === "union";
+            const sameUnion = bothUnion && typeEquals(left.type, right.type);
+            if ((sameUnion || !bothUnion) && L.eqComparableUnion(ut.unionId)) {
+                const plain = left.type.kind === "union" ? right : left;
+                const arms = L.unions.get(ut.unionId)?.arms ?? [];
+                // The plain side wraps into the union exactly like === when the
+                // union holds its type; a plain PRIMITIVE the union has no arm
+                // for is the disjoint constant false (coercing it would strand).
+                if (bothUnion || arms.some((a) => typeEquals(a, plain.type))) {
+                    const sameValue = arms.some((a) => a.kind === "f64");
+                    return {
+                        kind: "unionEq",
+                        unionId: ut.unionId,
+                        negated: false,
+                        sameValue,
+                        left: L.coerceInto(leftNode, left, ut),
+                        right: L.coerceInto(rightNode, right, ut),
+                        type: BOOL,
+                        loc,
+                    };
+                }
+                if (plain.type.kind === "f64" || plain.type.kind === "string" ||
+                    plain.type.kind === "bool" || isUnitType(plain.type)) {
+                    return objectIsDisjointFalse(left, right, loc);
+                }
+            }
+            L.noLowering("Object.is over these union operands", call, `union-typed comparisons need one comparable shape (${NARROW_FIRST})`);
+        }
+        // Reference kinds: pointer identity — exactly strict equality
+        // (hierarchy-related classes widen the derived side first).
+        let idLeft = left;
+        let idRight = right;
+        if (left.type.kind === "object" && right.type.kind === "object") {
+            if (L.isSubclassOf(left.type.className, right.type.className)) {
+                idLeft = L.upcastTo(left, right.type.className);
+            }
+            else if (L.isSubclassOf(right.type.className, left.type.className)) {
+                idRight = L.upcastTo(right, left.type.className);
+            }
+        }
+        if ((idLeft.type.kind === "func" && idRight.type.kind === "func") ||
+            (idLeft.type.kind === "classval" && idRight.type.kind === "classval")) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        if ((idLeft.type.kind === "array" || idLeft.type.kind === "map" ||
+            idLeft.type.kind === "set" || idLeft.type.kind === "object" ||
+            idLeft.type.kind === "record" || idLeft.type.kind === "symbol" ||
+            idLeft.type.kind === "bytes" || idLeft.type.kind === "promise") &&
+            typeEquals(idLeft.type, idRight.type)) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        // Statically disjoint pairs with a primitive/unit side: SameValue
+        // never crosses kinds, so the answer is the constant false.
+        const disjoint = new Set(["f64", "string", "bool", "undefinedT", "nullT"]);
+        if (lk !== rk && (disjoint.has(lk) || disjoint.has(rk))) {
+            return objectIsDisjointFalse(left, right, loc);
+        }
+        L.noLowering(`Object.is over '${L.fmt(left.type)}' and '${L.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
+    }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
@@ -6721,10 +7085,56 @@ export function requireObjLitGenericReceiver(L, blame, recvExpr, literal, name)
    * direct `call` of the instance with the receiver unevaluated. Claims
    * every call whose member is generic-callable — lowering it or fencing
    * with a named message. */
+/** URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
+ * throws before the registry lookup, so the zero-argument contract is
+ * exact without any blob machinery. The one-argument form (Node's
+ * silent no-op for unregistered ids) and createObjectURL keep their
+ * fences — a compiled program has no blob registry to consult. */
+function lowerUrlStaticCall(L, call, callee) {
+    if (!ts.isPropertyAccessExpression(callee) || callee.questionDotToken !== undefined)
+        return null;
+    if (!ts.isIdentifier(callee.expression) || callee.expression.text !== "URL")
+        return null;
+    if (callee.name.text !== "revokeObjectURL" || call.arguments.length !== 0)
+        return null;
+    const sym = L.resolveValueSymbol(callee.expression);
+    if (!sym || !L.isStdlibSymbol(sym))
+        return null;
+    return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
+}
+const SP_BRAND_METHODS = new Set([
+    "append", "delete", "get", "getAll", "has", "set", "sort",
+    "forEach", "keys", "values", "entries", "toString",
+]);
 export function lowerObjLitGenericMethodCall(L, call, access) {
     if (L.chainBlocked(access, call))
         return null;
     const name = access.name.text;
+    // URLSearchParams method values through Function.prototype.call/apply
+    // with a receiver that is provably NOT a URLSearchParams (the suite's
+    // `params.append.call(undefined)` probes): the WHATWG brand check
+    // throws ERR_INVALID_THIS before any argument conversion — the whole
+    // call IS that throw. A receiver that IS searchParams-typed, or one
+    // whose runtime kind is unknowable (dyn/'any'), keeps the fence.
+    if ((name === "call" || name === "apply") &&
+        ts.isPropertyAccessExpression(access.expression) &&
+        L.mapTypeOf(L.typeOf(access.expression.expression))?.kind === "searchParams" &&
+        SP_BRAND_METHODS.has(access.expression.name.text) &&
+        L.isStdlibMember(access.expression)) {
+        const thisArg = call.arguments[0];
+        const thisT = thisArg ? L.mapTypeOf(L.typeOf(thisArg)) : { kind: "undefinedT" };
+        const provablyNot = thisT !== null &&
+            thisT.kind !== "searchParams" &&
+            thisT.kind !== "dyn" &&
+            thisT.kind !== "jsval" &&
+            (!thisArg || ts.isIdentifier(thisArg) || ts.isLiteralExpression(thisArg) ||
+                thisArg.kind === ts.SyntaxKind.UndefinedKeyword ||
+                thisArg.kind === ts.SyntaxKind.NullKeyword ||
+                isUnitType(thisT));
+        if (provablyNot) {
+            return nodeThrowExpr(1, "ERR_INVALID_THIS", 'Value of "this" must be of type URLSearchParams', L.mapTypeOf(L.typeOf(call)) ?? VOID, locOf(call));
+        }
+    }
     const recvT = L.typeOf(access.expression);
     const propSym = L.checker.getPropertyOfType(recvT, name);
     if (!propSym)