@scriptc/compiler 0.1.2 → 0.1.4

package/dist/frontend/lowering/surfaces.d.ts

@@ -198,7 +198,24 @@ export interface BuiltinModuleFn {
     result: IrType;
     variadicPack?: boolean;
     defaults?: string[];
+    /** The source-level function-value signature. Each admitted entry
+     * materializes as an interned zero-capture adapter over the fixed runtime
+     * libCall ABI. Optional parameters name the string default selected for
+     * omission or explicit undefined; rest parameters pack into one typed
+     * array slot. Entries with call-site-specific validation remain absent. */
+    valueParams?: BuiltinValueParam[];
 }
+export type BuiltinValueParam = {
+    mode: "required";
+    type: IrType;
+} | {
+    mode: "optional";
+    type: IrType;
+    defaultValue: string;
+} | {
+    mode: "rest";
+    type: IrType;
+};
 export declare const BUILTIN_MODULE_FNS: Record<string, Record<string, BuiltinModuleFn | undefined> | undefined>;
 /** Builtin-module CONSTANTS (value reads of named imports): each lowers to
  * a literal of its value's kind. The bare-module values are the TARGET
@@ -254,6 +271,14 @@ export declare function builtinConstLit(value: string | number | boolean, loc: {
     start: number;
     end: number;
 }): IrExpr;
+/** node:module's builtinModules, BAKED — Node v24's exact list (verbatim
+ * order: the bare names, then the node:-prefix-only tails), pinned to
+ * the compat target rather than read from the COMPILING host's Node so
+ * emitted programs are host-independent (the cache-identity contract).
+ * Node ships one frozen singleton; each read here mints a fresh string
+ * array — a divergence only mutation could observe, and mutating Node's
+ * frozen array throws anyway. */
+export declare const NODE_BUILTIN_MODULES_V24: readonly string[];
 /** The array-literal read of module.builtinModules — both value paths
  * (the named-import binding and the namespace member read) mint the
  * same fresh string[]. */
@@ -288,9 +313,11 @@ export declare function isChildSurfaceMember(lowerer: Lowerer, access: ts.Proper
    * user's own declaration is in neither, so shadowing never matches. */
 export declare function isStdlibSymbol(lowerer: Lowerer, symbol: ts.Symbol | undefined): boolean;
 /** The canonical stdlib-global name `expr` denotes, or null. Three
-   * spellings reach the same global (Node's own aliasing):
-   *   - the bare identifier (`process`), name + provenance checked;
-   *   - the `global` identifier — Node's alias of globalThis — and
+ * spellings reach the same global (Node's own aliasing):
+ *   - the bare identifier (`process`), name + provenance checked;
+ *   - the default import from `process`/`node:process`, whose value is
+ *     exactly the global process object;
+ *   - the `global` identifier — Node's alias of globalThis — and
    *     `globalThis` itself both canonicalize to "globalThis";
    *   - a property read off globalThis (`globalThis.process`,
    *     `global.process`) — `declare var` globals ARE properties of
@@ -319,6 +346,7 @@ export declare function stdlibGlobalMember(lowerer: Lowerer, access: ts.Property
    * nothing. Only the globals with lowered member surfaces alias this
    * way; aliasing, say, `Math` would change nothing (its members lower
    * by receiver too). Returns true when recognized. */
+export declare function stdlibGlobalAliasNameOf(lowerer: Lowerer, init: ts.Expression | undefined): string | null;
 export declare function stdlibGlobalAliasDecl(lowerer: Lowerer, nameNode: ts.Node, init: ts.Expression | undefined): boolean;
 /** True iff the symbol is declared ONLY by the adopted @types/node
    * surface (no es-lib or shipped-ambient declaration merges in) — chooses

package/dist/frontend/lowering/surfaces.js

@@ -5,7 +5,7 @@
  * diagnostic tables, and the "which world declared this symbol" predicates
  * (ambient scriptc.d.ts / standard lib / @types/node provenance). */
 import * as ts from "../ts7/adapter.js";
-import { BOOL, BYTES_U8, CHILD_T, DYN, F64, FILEHANDLE_T, RUNTIME_ERROR_CLASSES, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf } from "../../ir/ir.js";
+import { BOOL, BYTES_U8, CHILD_T, CRYPTOHASH_T, CRYPTOHMAC_T, DYN, F64, FILEHANDLE_T, RUNTIME_ERROR_CLASSES, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf } from "../../ir/ir.js";
 import { isNodeTypesPath, requireSpecOf } from "../program.js";
 /** Statement-level constructs rejected wholesale, keyed by syntax kind. */
 export const UNSUPPORTED_STMT = {
@@ -485,6 +485,13 @@ export const STATIC_MATH_FNS = {
 export const STATIC_NUMBER_METHODS = {
     toFixed: { fns: ["num.toFixed0", "num.toFixed"], minArgs: 0, maxArgs: 1 },
 };
+/** The common first-class shape for builtin functions whose supported
+ * source signature is already exactly the fixed native ABI. Keeping the
+ * opt-in on each table row is deliberate: dispatch sentinels and functions
+ * with call-site validation must provide a real adapter instead. */
+function exactValueParams(...types) {
+    return types.map((type) => ({ mode: "required", type }));
+}
 /** The lowerable surface of the supported node builtin modules, keyed by
  * CANONICAL module name (both "fs" and "node:fs" land on "fs" — see
  * canonicalBuiltinModule). Like STR_METHODS, membership is only half the
@@ -498,36 +505,40 @@ export const STATIC_NUMBER_METHODS = {
  * platform's rules on any host). toNamespacedPath is the posix identity
  * (Node: a non-op on posix systems). */
 const PATH_MODULE_FNS = {
-    join: { fn: "path.join", params: [STRING], result: STRING, variadicPack: true },
-    resolve: { fn: "path.resolve", params: [STRING], result: STRING, variadicPack: true },
-    normalize: { fn: "path.normalize", params: [STRING], result: STRING },
-    dirname: { fn: "path.dirname", params: [STRING], result: STRING },
-    basename: { fn: "path.basename", params: [STRING, STRING], result: STRING, defaults: [""] },
-    extname: { fn: "path.extname", params: [STRING], result: STRING },
-    isAbsolute: { fn: "path.isAbsolute", params: [STRING], result: BOOL },
-    relative: { fn: "path.relative", params: [STRING, STRING], result: STRING },
-    toNamespacedPath: { fn: "path.toNamespacedPath", params: [STRING], result: STRING },
+    join: { fn: "path.join", params: [STRING], result: STRING, variadicPack: true, valueParams: [{ mode: "rest", type: STRING }] },
+    resolve: { fn: "path.resolve", params: [STRING], result: STRING, variadicPack: true, valueParams: [{ mode: "rest", type: STRING }] },
+    normalize: { fn: "path.normalize", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    dirname: { fn: "path.dirname", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    basename: { fn: "path.basename", params: [STRING, STRING], result: STRING, defaults: [""], valueParams: [{ mode: "required", type: STRING }, { mode: "optional", type: STRING, defaultValue: "" }] },
+    extname: { fn: "path.extname", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    isAbsolute: { fn: "path.isAbsolute", params: [STRING], result: BOOL, valueParams: [{ mode: "required", type: STRING }] },
+    relative: { fn: "path.relative", params: [STRING, STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }, { mode: "required", type: STRING }] },
+    toNamespacedPath: { fn: "path.toNamespacedPath", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
 };
 /** The win32 twins (scr_path.c's Node-v24 path.win32 port, byte-for-byte):
  * "path/win32" everywhere, and the bare-module table when the build
  * TARGETS win32 — Node on Windows is path.win32. */
 const PATH_WIN32_MODULE_FNS = {
-    join: { fn: "path.win32Join", params: [STRING], result: STRING, variadicPack: true },
-    resolve: { fn: "path.win32Resolve", params: [STRING], result: STRING, variadicPack: true },
-    normalize: { fn: "path.win32Normalize", params: [STRING], result: STRING },
-    dirname: { fn: "path.win32Dirname", params: [STRING], result: STRING },
-    basename: { fn: "path.win32Basename", params: [STRING, STRING], result: STRING, defaults: [""] },
-    extname: { fn: "path.win32Extname", params: [STRING], result: STRING },
-    isAbsolute: { fn: "path.win32IsAbsolute", params: [STRING], result: BOOL },
-    relative: { fn: "path.win32Relative", params: [STRING, STRING], result: STRING },
-    toNamespacedPath: { fn: "path.win32ToNamespacedPath", params: [STRING], result: STRING },
+    join: { fn: "path.win32Join", params: [STRING], result: STRING, variadicPack: true, valueParams: [{ mode: "rest", type: STRING }] },
+    resolve: { fn: "path.win32Resolve", params: [STRING], result: STRING, variadicPack: true, valueParams: [{ mode: "rest", type: STRING }] },
+    normalize: { fn: "path.win32Normalize", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    dirname: { fn: "path.win32Dirname", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    basename: { fn: "path.win32Basename", params: [STRING, STRING], result: STRING, defaults: [""], valueParams: [{ mode: "required", type: STRING }, { mode: "optional", type: STRING, defaultValue: "" }] },
+    extname: { fn: "path.win32Extname", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+    isAbsolute: { fn: "path.win32IsAbsolute", params: [STRING], result: BOOL, valueParams: [{ mode: "required", type: STRING }] },
+    relative: { fn: "path.win32Relative", params: [STRING, STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }, { mode: "required", type: STRING }] },
+    toNamespacedPath: { fn: "path.win32ToNamespacedPath", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
 };
 export const BUILTIN_MODULE_FNS = {
     fs: {
         readFileSync: { fn: "fs.readFileSync", params: [STRING, STRING], result: STRING },
+        // The exact-API subset is first-class. A fixed native ABI is not enough:
+        // rows whose Node function has behavior-bearing trailing options remain
+        // call-only, or function-width adaptation could silently discard those
+        // options before entering the fixed runtime call.
         writeFileSync: { fn: "fs.writeFileSync", params: [STRING, STRING], result: VOID },
         appendFileSync: { fn: "fs.appendFileSync", params: [STRING, STRING], result: VOID },
-        existsSync: { fn: "fs.existsSync", params: [STRING], result: BOOL },
+        existsSync: { fn: "fs.existsSync", params: [STRING], result: BOOL, valueParams: exactValueParams(STRING) },
         mkdirSync: { fn: "fs.mkdirSync", params: [STRING], result: VOID },
         rmSync: { fn: "fs.rmSync", params: [STRING], result: VOID },
         rmdirSync: { fn: "fs.rmdirSync", params: [STRING], result: VOID },
@@ -537,9 +548,9 @@ export const BUILTIN_MODULE_FNS = {
         // accessSync's omitted mode completes to 0 (F_OK) in the special case
         // in lowerBuiltinModuleCall — string `defaults` can't spell a number.
         accessSync: { fn: "fs.accessSync", params: [STRING, F64], result: VOID },
-        unlinkSync: { fn: "fs.unlinkSync", params: [STRING], result: VOID },
-        chmodSync: { fn: "fs.chmodSync", params: [STRING, F64], result: VOID },
-        chownSync: { fn: "fs.chownSync", params: [STRING, F64, F64], result: VOID },
+        unlinkSync: { fn: "fs.unlinkSync", params: [STRING], result: VOID, valueParams: exactValueParams(STRING) },
+        chmodSync: { fn: "fs.chmodSync", params: [STRING, F64], result: VOID, valueParams: exactValueParams(STRING, F64) },
+        chownSync: { fn: "fs.chownSync", params: [STRING, F64, F64], result: VOID, valueParams: exactValueParams(STRING, F64, F64) },
         // The 2-argument form only: Node's mode flags (COPYFILE_EXCL, ...)
         // land on the arity fence.
         copyFileSync: { fn: "fs.copyFileSync", params: [STRING, STRING], result: VOID },
@@ -548,18 +559,22 @@ export const BUILTIN_MODULE_FNS = {
         // adapter. The row still projects the static surface and routes the
         // dispatch.
         rename: { fn: "fs.renameCb", params: [], result: VOID },
-        renameSync: { fn: "fs.renameSync", params: [STRING, STRING], result: VOID },
+        renameSync: { fn: "fs.renameSync", params: [STRING, STRING], result: VOID, valueParams: exactValueParams(STRING, STRING) },
         // statSync's no-follow sibling; stats.isSymbolicLink answers what the
         // follow-free snapshot saw.
         lstatSync: { fn: "fs.lstatSync", params: [STRING], result: STATS_T },
+        fstatSync: { fn: "fs.fstatSync", params: [F64], result: STATS_T, valueParams: exactValueParams(F64) },
+        fchmodSync: { fn: "fs.fchmodSync", params: [F64, F64], result: VOID, valueParams: exactValueParams(F64, F64) },
+        fsyncSync: { fn: "fs.fsyncSync", params: [F64], result: VOID, valueParams: exactValueParams(F64) },
+        linkSync: { fn: "fs.linkSync", params: [STRING, STRING], result: VOID, valueParams: exactValueParams(STRING, STRING) },
         // realpath(3) — Node's realpathSync (failures spell syscall "lstat",
         // Node's own message shape).
         realpathSync: { fn: "fs.realpathSync", params: [STRING], result: STRING },
         // The fd pair behind spawn's fd-stdio form (the daemon-log idiom:
         // openSync(logPath, "a") → spawn stdio ["ignore", fd, fd] →
-        // closeSync). openSync takes Node's string flags ("r", "w", "a", the
-        // +/x variants — unknown flags throw Node's TypeError text); the
-        // numeric-mode third argument fences by arity.
+        // closeSync). String flags use the established two-argument path;
+        // inline numeric O_* expressions route through openNumericSync, with
+        // an optional creation mode as the third argument.
         openSync: { fn: "fs.openSync", params: [STRING, STRING], result: F64 },
         // The buffer forms (fd, buffer, offset, length[, position]). The
         // lowering completes an omitted or literal-null position to -1 (the
@@ -570,7 +585,7 @@ export const BUILTIN_MODULE_FNS = {
         // overloads lower to separate fixed-width runtime ABIs. As with
         // readSync, -1 is the current-offset sentinel.
         writeSync: { fn: "fs.writeSync", params: [F64, BYTES_U8, F64, F64, F64], result: F64 },
-        closeSync: { fn: "fs.closeSync", params: [F64], result: VOID },
+        closeSync: { fn: "fs.closeSync", params: [F64], result: VOID, valueParams: exactValueParams(F64) },
         // Entirely special-cased (lowerFsWatchCall — the callback needs an
         // adapter per listener shape); this entry only routes the dispatch.
         watch: { fn: "fs.watch", params: [], result: VOID },
@@ -585,9 +600,11 @@ export const BUILTIN_MODULE_FNS = {
         readdir: { fn: "fsp.readdir", params: [STRING], result: { kind: "promise", inner: arrayOf(STRING) } },
         rm: { fn: "fsp.rm", params: [STRING], result: { kind: "promise", inner: VOID } },
         stat: { fn: "fsp.stat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
-        unlink: { fn: "fsp.unlink", params: [STRING], result: { kind: "promise", inner: VOID } },
-        chmod: { fn: "fsp.chmod", params: [STRING, F64], result: { kind: "promise", inner: VOID } },
-        rename: { fn: "fsp.rename", params: [STRING, STRING], result: { kind: "promise", inner: VOID } },
+        realpath: { fn: "fsp.realpath", params: [STRING], result: { kind: "promise", inner: STRING } },
+        lstat: { fn: "fsp.lstat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
+        unlink: { fn: "fsp.unlink", params: [STRING], result: { kind: "promise", inner: VOID }, valueParams: exactValueParams(STRING) },
+        chmod: { fn: "fsp.chmod", params: [STRING, F64], result: { kind: "promise", inner: VOID }, valueParams: exactValueParams(STRING, F64) },
+        rename: { fn: "fsp.rename", params: [STRING, STRING], result: { kind: "promise", inner: VOID }, valueParams: exactValueParams(STRING, STRING) },
         // open's optional flags/mode completion is special-cased in
         // lowerBuiltinModuleCall; this row routes all import spellings and
         // gives coverage the static member.
@@ -605,18 +622,18 @@ export const BUILTIN_MODULE_FNS = {
     "path/win32": PATH_WIN32_MODULE_FNS,
     os: {
         // One platform implementation: os.platform() === process.platform.
-        platform: { fn: "process.platform", params: [], result: STRING },
-        homedir: { fn: "os.homedir", params: [], result: STRING },
-        tmpdir: { fn: "os.tmpdir", params: [], result: STRING },
+        platform: { fn: "process.platform", params: [], result: STRING, valueParams: [] },
+        homedir: { fn: "os.homedir", params: [], result: STRING, valueParams: [] },
+        tmpdir: { fn: "os.tmpdir", params: [], result: STRING, valueParams: [] },
         // uname(2)'s release field — Node's own implementation.
-        release: { fn: "os.release", params: [], result: STRING },
+        release: { fn: "os.release", params: [], result: STRING, valueParams: [] },
         // uname(2)'s sysname field ("Darwin", "Linux", "Windows_NT") — the
         // libFn/runtime pair predates this entry (the portless surface used
         // them); this row makes the MODULE call reach them (test/common's
         // isAIX/isIBMi getters are the canonical callers).
-        type: { fn: "os.type", params: [], result: STRING },
+        type: { fn: "os.type", params: [], result: STRING, valueParams: [] },
         // Total physical memory in bytes — same predating-pair story.
-        totalmem: { fn: "os.totalmem", params: [], result: F64 },
+        totalmem: { fn: "os.totalmem", params: [], result: F64, valueParams: [] },
         // Entirely special-cased (lowerOsNetworkInterfacesCall): the result is
         // the call site's mapped Dict<NetworkInterfaceInfo[]> shape, verified
         // structurally there — this entry only routes the dispatch.
@@ -632,13 +649,38 @@ export const BUILTIN_MODULE_FNS = {
         // first and the Buffer never materializes there); this entry covers
         // the bare calls and non-composed uses.
         randomBytes: { fn: "crypto.randomBytes", params: [F64], result: BYTES_U8 },
+        // The crypto utility surface is special-cased for overloads and
+        // string/Buffer splits in lowerCryptoModuleCall. These rows carry the
+        // canonical signatures for manifest projection and fallback dispatch.
+        createHash: { fn: "crypto.hashNew", params: [STRING], result: CRYPTOHASH_T },
+        createHmac: { fn: "crypto.hmacNewStr", params: [STRING, STRING], result: CRYPTOHMAC_T },
+        hash: { fn: "crypto.hashDigestStr", params: [STRING, STRING, STRING], result: STRING },
+        timingSafeEqual: { fn: "crypto.timingSafeEqual", params: [BYTES_U8, BYTES_U8], result: BOOL },
+        randomFillSync: { fn: "crypto.randomFill", params: [BYTES_U8, F64, F64], result: BYTES_U8 },
+        randomInt: { fn: "crypto.randomInt", params: [F64, F64], result: F64 },
+        pbkdf2Sync: { fn: "crypto.pbkdf2", params: [BYTES_U8, BYTES_U8, F64, F64, STRING], result: BYTES_U8 },
+        pbkdf2: { fn: "crypto.pbkdf2Cb", params: [], result: VOID },
     },
     zlib: {
-        // Buffer in, Buffer out, Node's default options; string inputs fence
-        // per site (see the zlib special case in lowerBuiltinModuleCall).
+        // The default-options convenience family is special-cased in
+        // lowerBuiltinModuleCall: string inputs UTF-8 encode, callback forms
+        // carry program-shaped closures, and explicit options fence per site.
         // native-toolchain.ts links libz only when these appear on the IR.
+        deflate: { fn: "zlib.deflateCb", params: [], result: VOID },
         deflateSync: { fn: "zlib.deflateSync", params: [BYTES_U8], result: BYTES_U8 },
+        inflate: { fn: "zlib.inflateCb", params: [], result: VOID },
         inflateSync: { fn: "zlib.inflateSync", params: [BYTES_U8], result: BYTES_U8 },
+        deflateRaw: { fn: "zlib.deflateRawCb", params: [], result: VOID },
+        deflateRawSync: { fn: "zlib.deflateRawSync", params: [BYTES_U8], result: BYTES_U8 },
+        inflateRaw: { fn: "zlib.inflateRawCb", params: [], result: VOID },
+        inflateRawSync: { fn: "zlib.inflateRawSync", params: [BYTES_U8], result: BYTES_U8 },
+        gzip: { fn: "zlib.gzipCb", params: [], result: VOID },
+        gzipSync: { fn: "zlib.gzipSync", params: [BYTES_U8], result: BYTES_U8 },
+        gunzip: { fn: "zlib.gunzipCb", params: [], result: VOID },
+        gunzipSync: { fn: "zlib.gunzipSync", params: [BYTES_U8], result: BYTES_U8 },
+        unzip: { fn: "zlib.unzipCb", params: [], result: VOID },
+        unzipSync: { fn: "zlib.unzipSync", params: [BYTES_U8], result: BYTES_U8 },
+        crc32: { fn: "zlib.crc32", params: [], result: F64 },
     },
     url: {
         // fileURLToPath accepts a URL value OR a string — the call lowering
@@ -650,11 +692,13 @@ export const BUILTIN_MODULE_FNS = {
     child_process: {
         // spawnSync's and spawn's call completions are entirely special-cased
         // (an omitted args list completes to an empty string[]; spawnSync
-        // accepts exactly { encoding: "utf8" } as options, spawn requires
-        // exactly { stdio: "ignore" } — see lowerBuiltinModuleCall); the
+        // accepts its documented literal options, while spawn supports the
+        // stdio/detached/env/cwd/windowsHide/shell subset — see
+        // lowerBuiltinModuleCall); the
         // entries carry the canonical shapes.
         spawnSync: { fn: "cp.spawnSync", params: [STRING, arrayOf(STRING)], result: SPAWNRES_T },
         spawn: { fn: "cp.spawn", params: [STRING, arrayOf(STRING)], result: CHILD_T },
+        fork: { fn: "cp.fork", params: [STRING, arrayOf(STRING)], result: CHILD_T },
         // execFileSync(file, args?, options?) and execSync(command, options?)
         // share the cp.execSync runtime entry (execSync sets the shell flag);
         // both call completions are special-cased in lowerBuiltinModuleCall.
@@ -693,8 +737,8 @@ export const BUILTIN_MODULE_FNS = {
         decode: { fn: "qs.parse", params: [STRING], result: VOID },
         stringify: { fn: "qs.stringify", params: [DYN], result: STRING },
         encode: { fn: "qs.stringify", params: [DYN], result: STRING },
-        escape: { fn: "qs.escape", params: [STRING], result: STRING },
-        unescape: { fn: "qs.unescape", params: [STRING], result: STRING },
+        escape: { fn: "qs.escape", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
+        unescape: { fn: "qs.unescape", params: [STRING], result: STRING, valueParams: [{ mode: "required", type: STRING }] },
     },
     // node:readline: createInterface's options are entirely special-cased
     // (exactly { input: process.stdin, output?: process.stdout } — see
@@ -801,6 +845,8 @@ export const BUILTIN_MODULE_CONSTS = {
  * (library/fence-eval.ts) and the attestation-parity test. */
 export const BUILTIN_MODULE_FN_ALIASES = {
     fs: {
+        // Inline numeric O_* flags use a target-neutral runtime entry point.
+        openSync: ["fs.openNumericSync"],
         // The Buffer form (no encoding), the fd forms (readFileSync(fd[,
         // "utf8"])), and the checked-dynamic encoding form.
         readFileSync: ["fs.readFileSyncBuf", "fs.readFileSyncBytes", "fs.readFileSyncDyn", "fs.readFdSync", "fs.readFdSyncBytes"],
@@ -830,11 +876,17 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         readFile: ["fsp.readFileBytes"],
         // The string-data { mode } options form.
         writeFile: ["fsp.writeFileMode"],
+        // The { withFileTypes: true } Dirent form.
+        readdir: ["fsp.readdirTypes"],
     },
     crypto: {
         // The composed randomBytes(n).toString(enc) chain keeps its one-libCall
-        // lowering (lowerCryptoComposedCall) — same surface, no Buffer.
-        randomBytes: ["crypto.randomBytesToString"],
+        // lowering (lowerCryptoComposedCall), while the callback overload has
+        // its own adapter spelling. Both remain the randomBytes surface.
+        randomBytes: ["crypto.randomBytesToString", "crypto.randomBytesCb"],
+        // Omitting size fills from offset through the rest of the Buffer and
+        // uses a separate runtime entry point for Node's exact bounds checks.
+        randomFillSync: ["crypto.randomFillRest"],
     },
     os: {
         // lowerOsUserInfoCall assembles the record from scalar libCalls.
@@ -851,6 +903,13 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["date.now"],
         note: "the live clock",
     },
+    {
+        id: "stdlib.date.parse",
+        kind: "stdlib",
+        name: "Date.parse",
+        fns: ["date.parse"],
+        note: "one date string, using the bounded parser shared with new Date(dateString).getTime()",
+    },
     {
         id: "stdlib.date.constructor",
         kind: "stdlib",
@@ -991,6 +1050,13 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["process.exit", "process.exiting"],
         note: "process.exit and the process._exiting flag read are one surface",
     },
+    {
+        id: "node-builtin.process.exitCode",
+        kind: "node-builtin",
+        name: "process.exitCode",
+        fns: ["process.setExitCode"],
+        note: "numeric writes in statement position set the implicit exit status; process.exit() reads it",
+    },
     // ── the tls CA store (lowerTlsCaCall / lowerTlsRootCertificates): the
     // host's trust anchors, read and replaced. Dedicated paths, and
     // rootCertificates is a VALUE read with no call form at all, so none of
@@ -1098,7 +1164,7 @@ export function builtinConstLit(value, loc) {
  * Node ships one frozen singleton; each read here mints a fresh string
  * array — a divergence only mutation could observe, and mutating Node's
  * frozen array throws anyway. */
-const NODE_BUILTIN_MODULES_V24 = [
+export const NODE_BUILTIN_MODULES_V24 = [
     "_http_agent", "_http_client", "_http_common", "_http_incoming",
     "_http_outgoing", "_http_server", "_stream_duplex", "_stream_passthrough",
     "_stream_readable", "_stream_transform", "_stream_wrap", "_stream_writable",
@@ -1126,19 +1192,16 @@ export function builtinModulesArrayLit(loc) {
     };
 }
 /** Member-specific hints for RECOGNIZED builtin modules whose member has
- * no lowering. deflateSync/inflateSync lower now (Buffers are real);
- * the rest of the zlib surface points at the lowered pair. */
-const ZLIB_HINT = "deflateSync and inflateSync are the lowered zlib surface";
-/** The loose-equality quartet's shared hint: == coercion has no lowering
- * anywhere in this compiler, and Node itself points at the strict forms. */
-const ASSERT_LOOSE_HINT = "loose == equality has no lowering — the strict forms compare with " +
-    "Object.is/structural equality like Node's assert/strict module, where " +
-    "equal IS strictEqual";
+ * no lowering. The default-options one-shot zlib/deflate-raw/gzip codecs
+ * lower for strings and Buffers; the remaining surface points at them. */
+const ZLIB_HINT = "the default-options deflate/inflate, raw, gzip/gunzip, and unzip sync/callback forms plus crc32 are the lowered zlib surface";
+/** The legacy deep pair remains fenced. The shallow equal/notEqual pair
+ * lowers through the static Abstract Equality kernel in lower-assert. */
+const ASSERT_LOOSE_DEEP_HINT = "legacy deep equality has no lowering yet — deepStrictEqual and " +
+    "notDeepStrictEqual compare structures with Node's modern semantics";
 const ASSERT_MODULE_HINTS = {
-    equal: ASSERT_LOOSE_HINT,
-    notEqual: ASSERT_LOOSE_HINT,
-    deepEqual: ASSERT_LOOSE_HINT,
-    notDeepEqual: ASSERT_LOOSE_HINT,
+    deepEqual: ASSERT_LOOSE_DEEP_HINT,
+    notDeepEqual: ASSERT_LOOSE_DEEP_HINT,
     ifError: "test explicitly instead: assert.strictEqual(err, null) / " +
         "assert.strictEqual(err, undefined)",
     rejects: "await the promise inside assert.throws's callback story instead: " +
@@ -1161,10 +1224,7 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
         AssertionError: ASSERT_MODULE_HINTS["AssertionError"],
     },
     util: {
-        promisify: "the one lowered shape is a const binding over child_process.execFile: " +
-            "const execFileAsync = promisify(execFile), then call execFileAsync directly",
-        // child_process.execFile itself exists to be promisified — the same
-        // story from the other end.
+        promisify: "the lowered shapes are const bindings over child_process.execFile and fs.readFile; call the bound function directly",
     },
     "stream/consumers": {
         arrayBuffer: "no free-standing ArrayBuffer value exists here (typed arrays own their storage) — " +
@@ -1174,25 +1234,17 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
     },
     module: {
         createRequire: "the lowered shape is a const binding over createRequire(import.meta.url) (or __filename) " +
-            "whose require calls take STATIC string literals — builtins, relative .json documents, " +
-            "and installed npm packages (under --dynamic) resolve at build time; " +
+            "whose require calls take STATIC string literals — builtins, project modules (including #imports), " +
+            "relative .json documents, --npm-static packages, and installed npm packages under --dynamic resolve at build time; " +
             "dynamic specifiers cannot exist in a compiled binary's fixed module graph",
-        isBuiltin: "builtinModules.includes(name) answers the same question over the baked list " +
-            "(strip a node: prefix first; the prefix-only builtins appear with it, as node:test)",
-        syncBuiltinESMExports: "a compiled program has no live builtin ESM namespace bindings to synchronize — " +
-            "nothing a compiled surface can mutate makes the call observable; remove it",
+        isBuiltin: "the lowered call checks a string against the baked Node v24 list, including bare/node: aliases and prefix-only builtins",
+        syncBuiltinESMExports: "the direct zero-argument call is a no-op because compiled builtin exports are immutable and cannot become stale",
     },
     child_process: {
-        execFile: "the callback form has no lowering — promisify it: " +
-            "const execFileAsync = promisify(execFile) (from node:util), or use execFileSync",
+        execFile: "the callback forms execFile(file, callback), execFile(file, args, callback), and execFile(file, args, { encoding: 'utf8', maxBuffer: N }, callback) lower; " +
+            "maxBuffer is not enforced by the growing native capture; other options and reached no-callback calls remain fenced, while util.promisify(execFile) retains its wider options slice",
     },
     crypto: {
-        createHash: "the one lowered shape is the composed chain " +
-            'createHash("sha256").update(data).digest("hex") — the Hash handle itself has no lowering',
-        hash: "the one-shot digest has no lowering — the composed chain " +
-            'createHash("sha256").update(data).digest("hex") is the lowered hashing surface',
-        createHmac: "HMAC has no lowering yet — the lowered crypto surface is randomUUID, randomBytes, " +
-            'the createHash("sha256"|"sha1") chain, and the introspection statics',
         ...Object.fromEntries([
             "generateKeyPair", "generateKeyPairSync", "generateKey", "generateKeySync",
             "createPrivateKey", "createPublicKey", "createSecretKey",
@@ -1211,7 +1263,7 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
             "symmetric ciphers need a cipher stack the static runtime does not vendor — " +
                 "the lowered crypto surface is hashing, randomness, and the introspection statics",
         ])),
-        ...Object.fromEntries(["pbkdf2", "pbkdf2Sync", "scrypt", "scryptSync", "hkdf", "hkdfSync"].map((m) => [
+        ...Object.fromEntries(["scrypt", "scryptSync", "hkdf", "hkdfSync"].map((m) => [
             m,
             "key-derivation functions have no lowering yet — the lowered crypto surface is " +
                 "hashing, randomness, and the introspection statics",
@@ -1222,9 +1274,6 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
             "randomBytes, and the createHash chain",
     },
     zlib: {
-        gzipSync: ZLIB_HINT,
-        gunzipSync: ZLIB_HINT,
-        unzipSync: ZLIB_HINT,
         brotliCompressSync: ZLIB_HINT,
         brotliDecompressSync: ZLIB_HINT,
     },
@@ -1454,9 +1503,11 @@ export function isStdlibSymbol(lowerer, symbol) {
     return !!symbol && lowerer.checker.declarationsOf(symbol).some((d) => lowerer.isStdlibFile(d.getSourceFile()));
 }
 /** The canonical stdlib-global name `expr` denotes, or null. Three
-   * spellings reach the same global (Node's own aliasing):
-   *   - the bare identifier (`process`), name + provenance checked;
-   *   - the `global` identifier — Node's alias of globalThis — and
+ * spellings reach the same global (Node's own aliasing):
+ *   - the bare identifier (`process`), name + provenance checked;
+ *   - the default import from `process`/`node:process`, whose value is
+ *     exactly the global process object;
+ *   - the `global` identifier — Node's alias of globalThis — and
    *     `globalThis` itself both canonicalize to "globalThis";
    *   - a property read off globalThis (`globalThis.process`,
    *     `global.process`) — `declare var` globals ARE properties of
@@ -1478,6 +1529,15 @@ export function stdlibGlobalNameOf(lowerer, expr) {
         const alias = lowerer.stdlibGlobalAliases.get(symbol);
         if (alias !== undefined)
             return alias;
+        const decl = lowerer.checker.declarationsOf(symbol)[0];
+        if (decl !== undefined && ts.isImportClause(decl) && decl.name !== undefined) {
+            const importDecl = decl.parent;
+            if (ts.isImportDeclaration(importDecl) && ts.isStringLiteral(importDecl.moduleSpecifier)) {
+                const spec = importDecl.moduleSpecifier.text;
+                if (spec === "process" || spec === "node:process")
+                    return "process";
+            }
+        }
         // An IMPORTED binding of a builtin module's re-exported global
         // (`import { Buffer } from "node:buffer"` — Node's module spelling
         // of the same object) resolves through the alias to the fallback
@@ -1526,27 +1586,50 @@ export function stdlibGlobalMember(lowerer, access, name) {
    * nothing. Only the globals with lowered member surfaces alias this
    * way; aliasing, say, `Math` would change nothing (its members lower
    * by receiver too). Returns true when recognized. */
-export function stdlibGlobalAliasDecl(lowerer, nameNode, init) {
-    if (!init || !ts.isIdentifier(nameNode))
-        return false;
+export function stdlibGlobalAliasNameOf(lowerer, init) {
+    if (!init)
+        return null;
+    // CommonJS packages commonly guard Node's always-present globals for
+    // browser bundlers (`let p = process || {}`). In the Node execution
+    // model the left object is unconditionally truthy, so the fallback is
+    // never evaluated and the binding is the same global snapshot as the
+    // direct spelling. Keep this deliberately to `||` with a surfaced
+    // stdlib-global left operand; arbitrary capability probes retain their
+    // runtime value semantics.
+    let aliasExpr = init;
+    while (ts.isParenthesizedExpression(aliasExpr))
+        aliasExpr = aliasExpr.expression;
+    if (ts.isBinaryExpression(aliasExpr) &&
+        aliasExpr.operatorToken.kind === ts.SyntaxKind.BarBarToken &&
+        stdlibGlobalNameOf(lowerer, aliasExpr.left) !== null) {
+        aliasExpr = aliasExpr.left;
+    }
     // `const process = require('node:process')`: Node's process MODULE is
     // the global process object (module.exports === globalThis.process),
     // so the binding aliases the global exactly like `const process =
     // globalThis.process`. Preflight admits exactly this shape
     // (processModuleAliasRequire7); commander's lib/command.js opens with
     // it.
-    const requireSpec = requireSpecOf(init);
+    const requireSpec = requireSpecOf(aliasExpr);
     const name = requireSpec === "process" || requireSpec === "node:process"
         ? "process"
-        : stdlibGlobalNameOf(lowerer, init);
+        : stdlibGlobalNameOf(lowerer, aliasExpr);
     if (name === null)
-        return false;
+        return null;
     // Only alias OBJECT-shaped globals whose members lower by receiver
     // identity (process, console, globalThis itself, and perf_hooks'
     // performance — the mockable-clock idiom snapshots it). Function-valued
     // globals (setTimeout) taken as values are a different story — the
     // ordinary value paths (and their fences) apply.
-    if (name !== "process" && name !== "console" && name !== "globalThis" && name !== "performance")
+    return name === "process" || name === "console" || name === "globalThis" || name === "performance"
+        ? name
+        : null;
+}
+export function stdlibGlobalAliasDecl(lowerer, nameNode, init) {
+    if (!ts.isIdentifier(nameNode))
+        return false;
+    const name = stdlibGlobalAliasNameOf(lowerer, init);
+    if (name === null)
         return false;
     const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
     if (!symbol)