@scriptc/compiler 0.0.9 → 0.0.11

package/dist/frontend/lowering/lower-calls.js

@@ -13,7 +13,7 @@ import { NARROW_FIRST, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.
 import { requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
 import { bufEncoding, dynStringReceiver, lowerArrayFromCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerRegexMethodCall, lowerStringMethodCall, lowerTupleReadMethodCall } from "./lower-containers.js";
-import { lowerChildStreamMethodCall, lowerDirentMethodCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerWatcherMethodCall } from "./lower-builtins.js";
+import { lowerChildStreamMethodCall, lowerCreateRequireCall, lowerDirentMethodCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerWatcherMethodCall } from "./lower-builtins.js";
 import { droppableStatic, lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerHttpClientFnCall } from "./lower-server.js";
 import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
@@ -2273,6 +2273,58 @@ export function lowerTimersMemberCall(L, expr, member, loc) {
 }
 export function lowerCall(L, expr) {
     const loc = locOf(expr);
+    // A call whose chain ROOTS at an ambient-undefined name (`declare
+    // const value: Y | undefined; value?.foo("a")`, `declare function
+    // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
+    // Node evaluates the root FIRST and throws the catchable
+    // ReferenceError before any member, type argument, or argument runs —
+    // the whole call IS that throw, typed by the use site (arguments
+    // never lower; Node never evaluates them). Claimed before every
+    // intrinsic and dispatch path: no lowering can answer differently
+    // when the root read itself is the crash.
+    {
+        const root = ambientUndefVarRootOf(L, expr);
+        if (root !== null) {
+            const mapped = L.mapTypeOf(L.typeOf(expr));
+            const t = mapped && mapped.kind !== "void" && !L.typeNamesUnregisteredClass(mapped)
+                ? mapped
+                : (contextualUndefReadType(L, expr) ?? F64);
+            return nsUndefRead(L, root.text, expr, t);
+        }
+    }
+    // A method call through a NULLISH binding (`const i: I<A & B> = null
+    // as any; i.fn(...)` — the receiver provably holds null/undefined
+    // forever): the member READ throws Node's exact TypeError before any
+    // argument evaluates — the whole call lowers to that throw. Claimed
+    // when the receiver's type has no mapping (no other story exists) or
+    // the member is a generic signature (the alternative is the
+    // interface-dispatch fence — the runtime truth is this throw).
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        ts.isIdentifier(expr.expression.expression) &&
+        expr.expression.questionDotToken === undefined) {
+        const recvSym = L.resolveValueSymbol(expr.expression.expression);
+        const unit = nullishValueUnitOf(L, recvSym);
+        if (unit !== null) {
+            const recvUnmappable = recvSym !== null && L.mapTypeOf(L.checker.getTypeOfSymbol(recvSym)) === null;
+            const propSym = L.checker.getPropertyOfType(L.typeOf(expr.expression.expression), expr.expression.name.text);
+            const genericMember = propSym !== undefined && propSym !== null &&
+                isGenericCallableMemberType(L.checker.getTypeOfSymbol(propSym), L.checker);
+            if (recvUnmappable || genericMember) {
+                const mapped = L.mapTypeOf(L.typeOf(expr));
+                const t = mapped && mapped.kind !== "void" && !L.typeNamesUnregisteredClass(mapped) ? mapped : F64;
+                return nodeThrowExpr(1, "", `Cannot read properties of ${unit} (reading '${expr.expression.name.text}')`, t, loc);
+            }
+        }
+    }
+    // `require("spec")` through a createRequire binding (and the inline
+    // `createRequire(import.meta.url)("spec")` spelling — a CallExpression
+    // callee no other dispatch path serves): the static erasure —
+    // builtins/json/npm per lowerCreateRequireCall's arms.
+    {
+        const crServed = lowerCreateRequireCall(L, expr, loc);
+        if (crServed)
+            return crServed;
+    }
     // `process.getuid?.()` — intercepted BEFORE the optional-chain
     // machinery (the member always exists on a POSIX target, so the
     // optional call IS the call; `process.getuid` itself has no value
@@ -2685,12 +2737,37 @@ export function lowerCall(L, expr) {
         return islandPrimitiveExit(L, expr, result);
     }
     if (L.isIslandExpr(expr.expression)) {
+        // `o.m(...)` where o LOWERS checked-dynamic and the checker types
+        // `o.m` 'any' (a member read behind an 'object'/'unknown'-typed
+        // bag): METHOD-CALL semantics — receiver-kind dispatch (dynInvoke),
+        // so `this` binds and a WRAPPED island receiver runs the ENGINE's
+        // own method (the routed-ops lane). A stored-member dynCall would
+        // call engine prototype methods receiverless — the this-less
+        // `list.slice()` ToObject TypeError. Spread arguments keep the
+        // stored-member path below (the runtime-arity lane owns them).
+        if (ts.isPropertyAccessExpression(expr.expression) &&
+            !expr.expression.questionDotToken &&
+            !expr.questionDotToken &&
+            !expr.arguments.some((a) => ts.isSpreadElement(a))) {
+            const recvProbe = probeLower(L, expr.expression.expression);
+            if (recvProbe?.type.kind === "dyn") {
+                const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
+                return {
+                    kind: "dynInvoke",
+                    recv: recvProbe,
+                    method: expr.expression.name.text,
+                    calleeName: expr.expression.getText(),
+                    args,
+                    type: DYN,
+                    loc,
+                };
+            }
+        }
         const callee = L.lowerExpr(expr.expression);
         // A checker-`any` callee that LOWERED checked-dynamic (a dyn member
         // chain's stored function): the DOM's own call — dynCall reads and
         // calls the stored member with Node's is-not-a-function TypeError
-        // on refusal. Island-typed arguments meet the boundary pass's
-        // dynCall rule (no jsval→DOM bridge exists — the named fence).
+        // on refusal.
         if (callee.type.kind === "dyn") {
             const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
             const calleeName = ts.isPropertyAccessExpression(expr.expression)
@@ -2807,6 +2884,12 @@ export function lowerCall(L, expr) {
             const fsTs = L.lowerFsToUnixTimestampCall(expr, bi, loc);
             if (fsTs)
                 return fsTs;
+            // The fs validation-ladder spoke (checked-dynamic lane): misuse
+            // of implemented-namespace members throws Node's typed errors
+            // instead of meeting the table fence.
+            const fsLadder = L.lowerFsLadderCall(expr, bi, loc);
+            if (fsLadder)
+                return fsLadder;
             const builtinFn = builtinModuleFnOf(L, bi.module, bi.member);
             if (!builtinFn) {
                 // Typed by @types/node (the fallback declarations only declare
@@ -3704,10 +3787,17 @@ function lowerDynReceiverMethodCall(L, call, access) {
         const enc = call.arguments[0]
             ? bufEncoding(L, "toString", call.arguments[0])
             : "utf8";
+        // The source spelling rides along for the ONE receiver whose
+        // prototype lacks toString: a null-prototype dictionary throws
+        // Node's "<spelling> is not a function" at runtime.
         return {
             kind: "libCall",
             fn: "dyn.toString",
-            args: [recv, { kind: "strLit", value: enc, type: STRING, loc: locOf(call) }],
+            args: [
+                recv,
+                { kind: "strLit", value: enc, type: STRING, loc: locOf(call) },
+                { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
+            ],
             type: STRING,
             loc: locOf(call),
         };
@@ -6152,6 +6242,57 @@ function lowerObjectStaticCall(L, call, access) {
         }
         L.noLowering(`Object.is over '${L.fmt(left.type)}' and '${L.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
     }
+    // Object.create — the null-prototype DICTIONARY (`Object.create(null)`
+    // then keyed assignment, the memo-table idiom prettier's index/
+    // group-mode maps spell) and, under --dynamic, the engine's own
+    // Object.create for engine-held prototypes. Everything else is a
+    // NAMED fence: the compiled representations have no prototype chain,
+    // and the own-copy stand-in would answer WRONG observably — Node's
+    // Object.keys/inspect/JSON of the created object list NO own keys,
+    // and mutating the prototype afterwards is visible through the
+    // created object (live delegation), which no copy can honor.
+    if (member === "create") {
+        if (call.arguments.some((a) => ts.isSpreadElement(a))) {
+            L.noLowering("Object.create with spread arguments", call);
+        }
+        if (call.arguments.length >= 2) {
+            L.noLowering("Object.create with a properties-descriptor argument", call, "create first, then assign: const o = Object.create(null); o.k = v");
+        }
+        if (call.arguments.length !== 1) {
+            L.noLowering(`Object.create with ${call.arguments.length} arguments`, call);
+        }
+        const loc = locOf(call);
+        let protoNode = call.arguments[0];
+        while (ts.isParenthesizedExpression(protoNode))
+            protoNode = protoNode.expression;
+        const nullProto = protoNode.kind === ts.SyntaxKind.NullKeyword;
+        if (L.dynamic) {
+            // The checker types the result `any` — an ENGINE value under
+            // --dynamic — and the engine's own Object.create answers with
+            // REAL prototype semantics: reads delegate LIVE, writes shadow,
+            // and inspect renders Node's exact shapes ("[Object: null
+            // prototype]" included). null and engine-held (jsval) prototypes
+            // route; checked-dynamic (DOM) prototypes keep the named fence —
+            // their marshal into the engine is a DEEP COPY, so a later
+            // prototype mutation would be invisible through the created
+            // object where Node delegates live.
+            const objectGlobal = () => ({ kind: "jsOp", op: "globalGet", name: "Object", args: [], type: JSVAL, loc });
+            if (nullProto) {
+                const nullIn = { kind: "jsOp", op: "nullLit", args: [], type: JSVAL, loc };
+                return { kind: "jsOp", op: "callMethod", name: "create", args: [objectGlobal(), nullIn], type: JSVAL, loc };
+            }
+            const proto = L.lowerExpr(protoNode);
+            if (proto.type.kind === "jsval") {
+                return { kind: "jsOp", op: "callMethod", name: "create", args: [objectGlobal(), proto], type: JSVAL, loc };
+            }
+            L.noLowering(`Object.create over '${L.fmt(proto.type)}' prototypes`, call, "prototype reads delegate LIVE in Node (mutating the prototype shows through the created object), which the boundary's deep copy cannot honor — only null and engine-held ('any') prototypes lower");
+        }
+        if (nullProto) {
+            return { kind: "libCall", fn: "dyn.objCreateNullProto", args: [], type: DYN, loc };
+        }
+        const proto = L.lowerExpr(protoNode);
+        L.noLowering(`Object.create over '${L.fmt(proto.type)}' prototypes`, call, "the compiled representations have no prototype chain, and an own-copy would answer wrong observably (Node lists NO own keys on the created object, and prototype mutations show through it live) — only Object.create(null) lowers");
+    }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
@@ -6228,6 +6369,91 @@ function lowerObjectStaticCall(L, call, access) {
                 }
             }
         }
+        // `Object.assign(target, ...sources)` over a CHECKED-DYNAMIC target
+        // — the n-ary/spread form (`Object.assign({}, ...plugins.map(p =>
+        // p.options), coreOptions)`, support.js's option-table merge). The
+        // sources pack into one fresh DOM array FIRST — plain sources
+        // retain in, spread sources flatten through the spread-call walk
+        // (V8's exact TypeError texts, the source spelling carried for the
+        // nullish form) — so every source evaluates and flattens before any
+        // copying (JS's ArgumentListEvaluation: a throwing spread leaves
+        // the target untouched), then one runtime walk copies each source's
+        // own enumerable keys left to right and answers the TARGET
+        // (identity, like JS). Each source must enter the dyn world (dyn
+        // already, or dynFrom's JSON-safe conversion — a STATIC array
+        // spread copies in at the boundary, the documented aliasing
+        // stance); anything else keeps the fence. Targets: dyn values, a
+        // FRESH object-literal target (`Object.assign({}, ...)` — no alias
+        // exists, so building it as a DOM object instead of a record is
+        // unobservable), or a nullish unit (Node's ToObject TypeError
+        // throws at the call, catchably); aliased record targets keep the
+        // fence — their identity could not survive the conversion.
+        if (call.arguments.length >= 1 && !ts.isSpreadElement(call.arguments[0])) {
+            let targetNode = call.arguments[0];
+            while (ts.isParenthesizedExpression(targetNode))
+                targetNode = targetNode.expression;
+            const freshLiteralTarget = ts.isObjectLiteralExpression(targetNode);
+            const tProbe = freshLiteralTarget ? null : probeLower(L, call.arguments[0]);
+            const tKind = tProbe?.type.kind;
+            if (freshLiteralTarget || tKind === "dyn" || tKind === "nullT" || tKind === "undefinedT") {
+                const loc = locOf(call);
+                const target = L.lowerExprExpecting(call.arguments[0], DYN);
+                if (target.type.kind === "dyn") {
+                    const t = L.declareHiddenLocal("%oat", DYN);
+                    const p = L.declareHiddenLocal("%oap", DYN);
+                    const tRef = () => ({ kind: "varRef", localId: t.id, type: DYN, loc });
+                    const pRef = () => ({ kind: "varRef", localId: p.id, type: DYN, loc });
+                    const stmts = [
+                        { kind: "varDecl", localId: t.id, init: target, loc },
+                        { kind: "varDecl", localId: p.id, init: { kind: "dynArrLit", elems: [], type: DYN, loc }, loc },
+                    ];
+                    // V8 spells the optimized apply-path texts (the expression
+                    // named for a nullish source) only when the spread is the
+                    // SINGLE LAST argument; every other spread position drives
+                    // the real iterator protocol, whose failure describes the
+                    // value — the two runtime variants, picked here by position.
+                    const sources = call.arguments.slice(1);
+                    const spreadCount = sources.filter((a) => ts.isSpreadElement(a)).length;
+                    let ok = true;
+                    for (let i = 0; i < sources.length; i++) {
+                        const argNode = sources[i];
+                        const spread = ts.isSpreadElement(argNode);
+                        const srcNode = spread ? argNode.expression : argNode;
+                        const src = L.coerceToExpected(L.lowerExpr(srcNode), DYN);
+                        if (src.type.kind !== "dyn") {
+                            ok = false;
+                            break;
+                        }
+                        const argLoc = locOf(argNode);
+                        const optimized = spreadCount === 1 && i === sources.length - 1;
+                        stmts.push({
+                            kind: "exprStmt",
+                            expr: spread
+                                ? optimized
+                                    ? {
+                                        kind: "libCall",
+                                        fn: "dyn.packPushSpread",
+                                        args: [pRef(), src, { kind: "strLit", value: srcNode.getText(), type: STRING, loc: argLoc }],
+                                        type: VOID,
+                                        loc: argLoc,
+                                    }
+                                    : { kind: "libCall", fn: "dyn.packPushSpreadIter", args: [pRef(), src], type: VOID, loc: argLoc }
+                                : { kind: "libCall", fn: "dyn.packPush", args: [pRef(), src], type: VOID, loc: argLoc },
+                            loc: argLoc,
+                        });
+                    }
+                    if (ok) {
+                        return {
+                            kind: "seqExpr",
+                            stmts,
+                            result: { kind: "libCall", fn: "dyn.assignAll", args: [tRef(), pRef()], type: DYN, loc },
+                            type: DYN,
+                            loc,
+                        };
+                    }
+                }
+            }
+        }
         return null;
     }
     // Object.defineProperties over a CHECKED-DYNAMIC target (test/common's
@@ -6864,6 +7090,305 @@ export function bindingNeverReassigned(L, sym, decl) {
     L.neverReassignedCache.set(sym, !written);
     return !written;
 }
+/** Strips the value-preserving wrappers off an expression: parens,
+   * non-null assertions, `as`/`satisfies`/angle-bracket casts. What
+   * remains is the expression that actually evaluates. */
+export function stripValueWrappers(e) {
+    let v = e;
+    for (;;) {
+        if (ts.isParenthesizedExpression(v) || ts.isNonNullExpression(v) ||
+            ts.isAsExpression(v) || ts.isSatisfiesExpression(v) || ts.isTypeAssertion(v)) {
+            v = v.expression;
+            continue;
+        }
+        return v;
+    }
+}
+/** The nullish unit `e` provably evaluates to: a bare null/undefined
+   * literal (assertion-wrapped — `null as any`, `null!`), or a read of a
+   * registered NULLISH binding (nullishGenericBindingUnitOf). Null when
+   * the value could be anything else. */
+export function nullishExprUnitOf(L, e) {
+    const v = stripValueWrappers(e);
+    if (v.kind === ts.SyntaxKind.NullKeyword)
+        return "null";
+    if (ts.isIdentifier(v)) {
+        if (v.text === "undefined" && (L.typeOf(v).flags & ts.TypeFlags.Undefined) !== 0) {
+            return "undefined";
+        }
+        return nullishValueUnitOf(L, L.resolveValueSymbol(v));
+    }
+    return null;
+}
+/** The nullish unit a binding provably holds FOREVER, by VALUE alone: its
+   * initializer is nullish (`const i: I<A & B> = null as any`) and every
+   * write in its declaring file is nullish too (`a = b` where b is
+   * another nullish binding). No type condition — callers add their own
+   * (nullishGenericBindingUnitOf gates the no-storage family on
+   * unmappable types; the generic-method call path rescues its fence with
+   * the value fact alone). Cached per symbol; the pre-seeded null entry
+   * guards probe cycles (mutually-assigned bindings resolve link by link,
+   * declaration order). */
+export function nullishValueUnitOf(L, sym) {
+    if (!sym)
+        return null;
+    const cached = L.nullishBindings.get(sym);
+    if (cached !== undefined)
+        return cached;
+    L.nullishBindings.set(sym, null); // cycle guard: self-referential probes answer non-qualifying
+    const decl = L.checker.valueDeclarationOf(sym);
+    // Statement-position declarators only: a for-loop head (`for (let x =
+    // null as any; ...)`) declares a LOCAL with per-iteration semantics —
+    // lowerVarDeclList's contract requires a lowered statement for it, so
+    // the no-storage family never claims it.
+    if (!decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name) ||
+        decl.getSourceFile().isDeclarationFile || decl.initializer === undefined ||
+        !ts.isVariableStatement(decl.parent.parent)) {
+        return null;
+    }
+    const unit = nullishExprUnitOf(L, decl.initializer);
+    if (unit === null)
+        return null;
+    // Bindings with a CHECKED-DYNAMIC fallback (`const maybe: any =
+    // undefined`, JS inference residue) keep that story: the dyn world
+    // already holds null/undefined correctly and serves every read form
+    // (optional chains included) — this family exists for types with NO
+    // other home.
+    if (dynFallbackType(L, decl.name, L.checker.getTypeOfSymbol(sym)) !== null)
+        return null;
+    if (!allWritesNullish(L, sym, decl))
+        return null;
+    // A use inside a class HERITAGE clause (`class X extends Mixin(...)`)
+    // declines the whole family: heritage resolution is structural (the
+    // mixin machinery can pin the instantiation from the ARGUMENT class
+    // expression without ever reading the callee binding), so a claimed
+    // nullish callee would compile a working class where Node throws
+    // "Mixin is not a function" evaluating the extends expression. The
+    // declaration keeps its type fence instead.
+    if (usedInHeritageClause(L, sym))
+        return null;
+    L.nullishBindings.set(sym, unit);
+    return unit;
+}
+/** True when any identifier resolving to `sym` sits inside a class
+   * heritage clause anywhere in the program. */
+function usedInHeritageClause(L, sym) {
+    const symText = sym.name;
+    let found = false;
+    const visit = (n) => {
+        if (found)
+            return;
+        if (ts.isIdentifier(n) && n.text === symText &&
+            L.resolveValueSymbol(n) === sym) {
+            for (let p = n.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
+                if (ts.isHeritageClause(p)) {
+                    found = true;
+                    return;
+                }
+            }
+            return;
+        }
+        n.forEachChild(visit);
+    };
+    for (const file of L.program.getSourceFiles()) {
+        if (found)
+            break;
+        if (file.isDeclarationFile)
+            continue;
+        file.forEachChild(visit);
+    }
+    return found;
+}
+/** nullishValueUnitOf gated on a declared type that CANNOT hold the
+   * value — the NO-STORAGE family: an unmappable type has no other story,
+   * and a RECORD-mapped one (`const i: I<A & B> = null as any` — an
+   * interface whose members are all generic signatures interns an empty
+   * shape) has a slot null can never inhabit, so storing would throw the
+   * representation error where Node stores null silently. Either way the
+   * declaration emits nothing and reads know the value. Null-tolerant
+   * mappings (unions with a null/undefined arm, dyn) keep their real
+   * storage and every ordinary lowering. */
+export function nullishGenericBindingUnitOf(L, sym) {
+    if (!sym)
+        return null;
+    // The VALUE probe first — it is purely syntactic, so no checker type
+    // query runs for the overwhelmingly common non-nullish declarations
+    // (a query can even panic upstream — the 1e999 checker bug).
+    const unit = nullishValueUnitOf(L, sym);
+    if (unit === null)
+        return null;
+    const mapped = L.mapTypeOf(L.checker.getTypeOfSymbol(sym));
+    if (mapped !== null) {
+        // Only the EMPTY interned shape qualifies among record mappings —
+        // the all-generic-signature interface (`I<A & B>`) whose struct has
+        // no slot at all. A record with DATA fields (`const value: { inner:
+        // number | string } = null as any`) keeps its real storage and
+        // every ordinary lowering: its reads flow through positions (comma
+        // chains, call arguments) the no-storage read paths never claim,
+        // so claiming the binding would fence working programs.
+        if (mapped.kind !== "record")
+            return null;
+        const shape = L.shapes.get(mapped.shapeId);
+        if (!shape || shape.fields.length > 0 || shape.tuple !== undefined || shape.indexValue !== undefined) {
+            return null;
+        }
+    }
+    return unit;
+}
+/** True when every write of `sym` in its declaring file is a plain `x =
+   * <nullish>` assignment — the discipline that keeps a nullish binding's
+   * value knowable. Compound assignments, ++/--, for-in/of cursors, and
+   * destructuring targets all disqualify. */
+function allWritesNullish(L, sym, decl) {
+    const symText = sym.name;
+    const namesSym = (e) => ts.isIdentifier(e) && e.text === symText && L.resolveValueSymbol(e) === sym;
+    let ok = true;
+    const visit = (n) => {
+        if (!ok)
+            return;
+        if (ts.isBinaryExpression(n)) {
+            const k = n.operatorToken.kind;
+            if (k >= ts.SyntaxKind.FirstAssignment && k <= ts.SyntaxKind.LastAssignment) {
+                let lhs = n.left;
+                while (ts.isParenthesizedExpression(lhs))
+                    lhs = lhs.expression;
+                if (namesSym(lhs)) {
+                    if (k !== ts.SyntaxKind.EqualsToken || nullishExprUnitOf(L, n.right) === null)
+                        ok = false;
+                }
+                else if (ts.isArrayLiteralExpression(lhs) || ts.isObjectLiteralExpression(lhs)) {
+                    const walk = (m) => {
+                        if (namesSym(m))
+                            ok = false;
+                        else
+                            m.forEachChild(walk);
+                    };
+                    walk(lhs);
+                }
+            }
+        }
+        else if ((ts.isPrefixUnaryExpression(n) || ts.isPostfixUnaryExpression(n)) &&
+            (n.operator === ts.SyntaxKind.PlusPlusToken || n.operator === ts.SyntaxKind.MinusMinusToken)) {
+            let op = n.operand;
+            while (ts.isParenthesizedExpression(op))
+                op = op.expression;
+            if (namesSym(op))
+                ok = false;
+        }
+        else if ((ts.isForOfStatement(n) || ts.isForInStatement(n)) && !ts.isVariableDeclarationList(n.initializer)) {
+            let t = n.initializer;
+            while (ts.isParenthesizedExpression(t))
+                t = t.expression;
+            if (namesSym(t))
+                ok = false;
+        }
+        n.forEachChild(visit);
+    };
+    decl.getSourceFile().forEachChild(visit);
+    return ok;
+}
+/** A VALUE-ONLY expression: materializing it has no observable effect
+   * beyond the value itself — function/arrow literals, class-free
+   * literals, nullish units. The dead-binding rule's purity test: Node
+   * builds the value and drops it, so skipping the build entirely is
+   * unobservable. Bare identifier reads stay OUT (a read above a `let`
+   * declaration is a TDZ throw Node WOULD serve). */
+function sideEffectFreeValueExpr(L, e) {
+    const v = stripValueWrappers(e);
+    if (ts.isArrowFunction(v) || ts.isFunctionExpression(v))
+        return true;
+    if (ts.isLiteralExpression(v) || v.kind === ts.SyntaxKind.NullKeyword ||
+        v.kind === ts.SyntaxKind.TrueKeyword || v.kind === ts.SyntaxKind.FalseKeyword) {
+        return true;
+    }
+    if (ts.isIdentifier(v) && v.text === "undefined" && (L.typeOf(v).flags & ts.TypeFlags.Undefined) !== 0) {
+        return true;
+    }
+    return false;
+}
+/** True when `sym` — a binding whose type has NO static mapping — is DEAD:
+   * never read anywhere in the program, not exported through a specifier,
+   * declared with no initializer or a side-effect-free one, and written
+   * (if at all) only by plain assignments of side-effect-free values. Node
+   * materializes those values and drops them — zero observable effect —
+   * so the declaration and its writes lower to NOTHING instead of fencing
+   * on a type the program never consumes (`var xs2: typeof Array;`, the
+   * write-only `var f2: { <T, U>(x: T, y: U): T }`). TS program files
+   * only: JS bindings keep their checked-dynamic fallbacks. Positive
+   * answers register in L.deadBindings (the assignment lowering skips
+   * writes by the same set). */
+export function deadUnmappableBinding(L, sym, decl) {
+    if (!sym)
+        return false;
+    if (L.deadBindings.has(sym))
+        return true;
+    if (!ts.isIdentifier(decl.name))
+        return false;
+    // Statement-position declarators only: a for-loop head (`for (let x;
+    // false;) {}`) declares a LOCAL with per-iteration semantics —
+    // lowerVarDeclList's contract requires a lowered statement for it, so
+    // the no-storage family never claims it (catch bindings sit outside a
+    // variable statement too and stay out the same way).
+    if (!ts.isVariableStatement(decl.parent.parent))
+        return false;
+    const sf = decl.getSourceFile();
+    if (sf.isDeclarationFile || isJsSourceFile(sf))
+        return false;
+    if (decl.initializer !== undefined && !sideEffectFreeValueExpr(L, decl.initializer))
+        return false;
+    // Exported bindings stay out: a library build's exports are consumed
+    // from outside the graph, and export specifiers double as reads.
+    if (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export)
+        return false;
+    // The type gate LAST among the cheap checks: querying the checker for
+    // a type is the expensive step (and can panic upstream — the 1e999
+    // bug), so only survivors of the syntactic filters pay it. Mappable
+    // types keep their real storage.
+    if (L.mapTypeOf(L.checker.getTypeOfSymbol(sym)) !== null)
+        return false;
+    const symText = sym.name;
+    const namesSym = (e) => ts.isIdentifier(e) && e.text === symText && L.resolveValueSymbol(e) === sym;
+    let dead = true;
+    const visit = (n) => {
+        if (!dead)
+            return;
+        if (ts.isIdentifier(n) && n.text === symText) {
+            // Declaration-name occurrences are not reads.
+            if (n.parent !== undefined && ts.isVariableDeclaration(n.parent) && n.parent.name === n) {
+                n.forEachChild(visit);
+                return;
+            }
+            // A plain-assignment LHS is a WRITE — dead only when the RHS
+            // builds no observable effect (the value is dropped with the
+            // binding).
+            const p = n.parent;
+            if (p !== undefined && ts.isBinaryExpression(p) &&
+                p.operatorToken.kind === ts.SyntaxKind.EqualsToken && p.left === n) {
+                if (!namesSym(n))
+                    return;
+                if (!sideEffectFreeValueExpr(L, p.right))
+                    dead = false;
+                return;
+            }
+            // Import/export specifiers, and every other occurrence, count as
+            // reads.
+            if (namesSym(n))
+                dead = false;
+            return;
+        }
+        n.forEachChild(visit);
+    };
+    for (const file of L.program.getSourceFiles()) {
+        if (!dead)
+            break;
+        if (file.isDeclarationFile)
+            continue;
+        file.forEachChild(visit);
+    }
+    if (dead)
+        L.deadBindings.add(sym);
+    return dead;
+}
 /** The generic function-like INITIALIZER behind a binding declaration —
    * `const f = <T>(x: T) => x` or `const f = function g<T>(x: T) {...}`
    * (parens stripped). Null when the declaration isn't that shape; the
@@ -6872,9 +7397,9 @@ export function bindingNeverReassigned(L, sym, decl) {
 export function bindingGenericFnNodeOf(decl) {
     if (!ts.isIdentifier(decl.name) || decl.initializer === undefined)
         return null;
-    let init = decl.initializer;
-    while (ts.isParenthesizedExpression(init))
-        init = init.expression;
+    // Assertion wrappers strip like parens: `const r = (<T>(x: T) => x) as
+    // Mapper` evaluates the arrow — the cast only renames its type.
+    const init = stripValueWrappers(decl.initializer);
     if ((ts.isArrowFunction(init) || ts.isFunctionExpression(init)) &&
         init.typeParameters !== undefined && init.body !== undefined) {
         return init;
@@ -6890,11 +7415,16 @@ export function bindingGenericFnNodeOf(decl) {
    * signature. Null when the shape doesn't match (a concrete annotation, a
    * generic arrow — the syntactic probe's case, an overloaded alias). */
 export function bindingContextualGenericFnNodeOf(L, decl) {
-    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined || decl.type === undefined)
+    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined)
         return null;
-    let init = decl.initializer;
-    while (ts.isParenthesizedExpression(init))
-        init = init.expression;
+    // The generic signature can arrive as an ANNOTATION or as a type
+    // ASSERTION on the initializer (`var r = < <T>(x: T) => T >((x) => x)`
+    // — the checker contextually types the operand's parameters by the
+    // asserted signature exactly like an annotation would).
+    const asserted = ts.isAsExpression(decl.initializer) || ts.isTypeAssertion(decl.initializer);
+    if (decl.type === undefined && !asserted)
+        return null;
+    const init = stripValueWrappers(decl.initializer);
     if (!(ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ||
         init.typeParameters !== undefined || init.body === undefined) {
         return null;
@@ -7167,6 +7697,24 @@ export function lowerObjLitGenericMethodCall(L, call, access) {
     }
     const found = objLitGenericFnNodeOf(L, propSym);
     if (!found) {
+        // Function.prototype.apply/call/bind spelled through a FUNCTION
+        // receiver: compiled functions are direct calls with no runtime
+        // `this`/arguments object to re-route — name the working spelling
+        // instead of a class-receiver hint (or an SC2020 recitation) no
+        // function value can follow. Before the stdlib decline: these ARE
+        // stdlib members (CallableFunction), but the pointed message is
+        // the honest one.
+        if ((name === "apply" || name === "call" || name === "bind") &&
+            L.checker.getCallSignatures(recvT).length > 0) {
+            L.unsupported("SC1090", call, `Function.prototype.${name} on a compiled function value (compiled calls are direct — no runtime 'this' or arguments object exists to re-route; spell the call directly: '${access.expression.getText()}(...)')`);
+        }
+        // STANDARD-LIBRARY generic members (Promise.then, Object.
+        // defineProperty, Array-augmentation methods) are the lib fence's
+        // story (SC2020, naming the member) — decline so the stdlib
+        // chokepoint downstream reports, instead of an interface-dispatch
+        // recitation about a receiver no user constructed.
+        if (L.isStdlibMember(access))
+            return null;
         // Interface-declared generic methods dispatch statically, so the
         // receiver's runtime class must be provable — name that discipline
         // instead of the object-literal wording when the method lives on an