@scriptc/compiler 0.1.7 → 0.2.0

package/dist/ir/ir.d.ts

@@ -4,10 +4,11 @@ export interface SrcLoc {
     start: number;
     end: number;
 }
-/** Typed-array element kinds with a runtime representation: Uint8Array/Buffer,
- * Uint32Array, Int32Array, Float32Array, and Float64Array. Other flavors stay
- * frontend-fenced. */
-export type IrBytesElem = "u8" | "u32" | "i32" | "f32" | "f64";
+/** Numeric typed-array element kinds with a native representation. Float16
+ * and BigInt typed arrays remain frontend-fenced. */
+export type IrBytesElem = "u8" | "u8c" | "i8" | "u16" | "i16" | "u32" | "i32" | "f32" | "f64";
+export declare const BYTES_ELEMENT_SIZE: Record<IrBytesElem, number>;
+export declare const BYTES_ELEMENT_NAME: Record<IrBytesElem, string>;
 export type IrType = {
     kind: "f64";
 }
@@ -36,10 +37,10 @@ export type IrType = {
 }
 /** ES `Map<K, V>` — heap, refcounted, insertion-ordered hash map with ONE
  * runtime representation (ScrMap) and type-directed key/value handling,
- * exactly the array pattern (never per-instantiation structs). Keys are
- * f64 or string (SameValueZero); values are f64, string, bool, record,
- * object, union, or array — anything isRefCounted or scalar EXCEPT
- * func/promise/dyn/jsval/map (frontend-fenced, validator-checked). */
+ * exactly the array pattern (never per-instantiation structs). Keys use
+ * numeric SameValueZero, string content, or reference identity, including
+ * payload identity for unions of reference keys. isSupportedMapKey and
+ * isSupportedMapValue define the frontend/validator storage fences. */
  | {
     kind: "map";
     key: IrType;
@@ -48,10 +49,8 @@ export type IrType = {
 /** ES `Set<T>` — heap, refcounted, insertion-ordered. Map's sibling with
  * the value slot removed: ONE runtime representation (the backend lowers
  * sets onto the map runtime with a constant unit value), elements are
- * exactly Map's KEY types — f64 or string, SameValueZero. Same container
- * fences as map (no union arms, no array elements, no map values, no sets
- * of sets, not JSON-safe) and never cycle-capable: elements are scalars
- * or strings, which cannot point back. */
+ * exactly Map's KEY types and use the same equality. Reference elements
+ * carry retain/release and, when cycle-capable, tracing adapters. */
  | {
     kind: "set";
     elem: IrType;
@@ -293,11 +292,9 @@ export type IrType = {
 }
 /** The class STATIC side as a value — `typeof C`, the type of the class
  * name itself and of `new (…) => T` constructor-typed slots. Runtime
- * representation is the per-class IMMORTAL class object (ScrClassObj:
- * preorder interval, construct thunk, .name string) emitted once per
- * classRef-referenced class — so identity `===` is one pointer compare
- * and retains/releases are no-ops on the immortal (the regex-literal
- * discipline; isRefCounted says true for container/RC uniformity).
+ * representation is ScrClassObj: an immortal top-level template or a fresh
+ * function-local object owning captured binding boxes. Identity is one
+ * pointer comparison; local instances retain their constructor object.
  * Values of `classval:C` are C's class object or a STRICT DESCENDANT's —
  * the object kind's nominal, upcast-only story — and every legal flow
  * preserves the constructor ABI (upcast requires the descendant's
@@ -305,7 +302,8 @@ export type IrType = {
  * completion against C's one signature sound. Allowed in locals,
  * globals, params, returns, class/record fields, capture boxes, array
  * elements, Map VALUES, and union arms; fenced out of Map keys, Set
- * elements, JSON, dyn/jsval conversion, and ToString. */
+ * elements, JSON, jsval conversion, and ToString. Unknown slots retain
+ * class identity and allow an exact typed constructor round trip. */
  | {
     kind: "classval";
     className: string;
@@ -424,7 +422,7 @@ interface IrKindSet<K extends IrType["kind"]> extends ReadonlySet<IrType["kind"]
 declare const HANDLE_KIND_LIST: readonly ["stats", "fileHandle", "spawnRes", "child", "netServer", "netSocket", "http2Session", "http2Stream", "dgramSocket", "testCtx", "httpReq", "httpRes", "httpClientReq", "secureCtx", "cryptoHash", "cryptoHmac", "fsWatcher", "childStream", "childWriter", "procStream"];
 export type HandleKind = typeof HANDLE_KIND_LIST[number];
 export declare const HANDLE_KINDS: IrKindSet<"child" | "childStream" | "childWriter" | "cryptoHash" | "cryptoHmac" | "dgramSocket" | "fileHandle" | "fsWatcher" | "http2Session" | "http2Stream" | "httpClientReq" | "httpReq" | "httpRes" | "netServer" | "netSocket" | "procStream" | "secureCtx" | "spawnRes" | "stats" | "testCtx">;
-/** The IR kinds represented as pointers in both native backends. */
+/** The IR kinds represented as pointers in native code. */
 declare const POINTER_KIND_LIST: readonly ["string", "bigint", "array", "map", "set", "regex", "bytes", "url", "searchParams", "symbol", "stats", "fileHandle", "spawnRes", "child", "netServer", "netSocket", "http2Session", "http2Stream", "dgramSocket", "testCtx", "httpReq", "httpRes", "httpClientReq", "secureCtx", "cryptoHash", "cryptoHmac", "fsWatcher", "childStream", "childWriter", "func", "object", "classval", "moduleNs", "record", "union", "dyn", "jsval", "caught", "promise", "generator"];
 export type PointerKind = typeof POINTER_KIND_LIST[number];
 export declare const POINTER_KINDS: IrKindSet<"array" | "bigint" | "bytes" | "caught" | "child" | "childStream" | "childWriter" | "classval" | "cryptoHash" | "cryptoHmac" | "dgramSocket" | "dyn" | "fileHandle" | "fsWatcher" | "func" | "generator" | "http2Session" | "http2Stream" | "httpClientReq" | "httpReq" | "httpRes" | "jsval" | "map" | "moduleNs" | "netServer" | "netSocket" | "object" | "promise" | "record" | "regex" | "searchParams" | "secureCtx" | "set" | "spawnRes" | "stats" | "string" | "symbol" | "testCtx" | "union" | "url">;
@@ -482,36 +480,28 @@ export declare const NULL_T: IrType;
  * wrapping allocates no payload, narrowing to a unit arm produces no value
  * (the frontend never emits it), and releasing has nothing to release. */
 export declare function isUnitType(t: IrType): boolean;
-/** Element kinds with a real ScrArr storage/RC representation in BOTH
- * backends. Array-producing lowerings can learn their result element from
+/** Element kinds with a real ScrArr storage/RC representation.
+ * Array-producing lowerings can learn their result element from
  * a callback rather than through mapType's ordinary T[] gate, so they must
  * share this predicate instead of reconstructing an array around an
- * otherwise-valid standalone type (Map, Set, dyn, opaque handles, ...). */
+ * otherwise-valid standalone type (Date, opaque handles, ...). */
 export declare function isSupportedArrayElem(t: IrType): boolean;
 export declare function arrayOf(elem: IrType): IrType;
 export declare function bytesOf(elem: IrBytesElem): IrType;
 export declare function mapOf(key: IrType, value: IrType): IrType;
 export declare function setOf(elem: IrType): IrType;
-/** The Map KEY fence: string (content) or number (SameValueZero) — the two
- * kinds a hash of the VALUE is honest for. Booleans, objects, and the rest
- * of JS's anything-goes keys stay out. Shared by the frontend's
- * type mapping/diagnostics and the validator. Set ELEMENTS use the same
- * fence: a set is hashed storage of its elements exactly as a map is of
- * its keys (isSupportedSetElem is this predicate under its own name). */
-export declare function isSupportedMapKey(t: IrType): boolean;
-/** The Set ELEMENT fence — Map's key fence plus the refcounted HANDLE
- * kinds stored under identity hashing (SameValueZero for JS objects IS
- * reference identity, so a Set of server handles — portless's auxiliary-
- * server registry — is honest hashed storage; SCR_MAP_KEY_REF in the
- * runtime). netServer is the one handle admitted so far: it drops its
- * listener closures at close, so a set-in-listener cycle is temporary —
- * the child precedent's story. Symbols are identity values by DESIGN —
- * SameValueZero on a symbol IS pointer identity, so a Set of symbols (the
- * sentinel-registry idiom) is the same honest hashed storage with no
- * cycle risk at all (symbols hold only strings). */
-export declare function isSupportedSetElem(t: IrType): boolean;
-/** The Map VALUE fence: scalars plus every refcounted kind EXCEPT
- * func/promise/dyn/jsval (and map itself — no maps of maps).
+/** Values whose native reference represents JavaScript identity. Records,
+ * classes and arrays can point back at their collection, so constructors
+ * must carry key tracing as well as retain/release adapters. */
+export declare function isIdentityCollectionKey(t: IrType): boolean;
+/** Numbers use SameValueZero, strings use content, and reference keys use
+ * identity. A union of identity arms hashes its payload, never its temporary
+ * wrapper. Mixed scalar/reference unions remain outside this contract. */
+export declare function isSupportedMapKey(t: IrType, unionArms?: IrType[]): boolean;
+/** Set elements and Map keys share storage, equality and ownership rules. */
+export declare function isSupportedSetElem(t: IrType, unionArms?: IrType[]): boolean;
+/** The Map VALUE fence: scalars, supported native references and checked
+ * values. Functions require checked-value boxing; jsval has no native slot.
  * Record/object/union values can point back at the map holding them, which
  * is exactly why ref-valued maps are cycle-capable (see the backend's
  * cycle analysis and docs/memory.md). Shared frontend/validator. */
@@ -519,28 +509,19 @@ export declare function isSupportedMapValue(t: IrType): boolean;
 /** The INDEX-SIGNATURE value fence (`{ [k: string]: V }` shapes): the map
  * VALUE kinds — the overflow portion IS a string-keyed map — plus dyn
  * (`unknown`, an unknown-valued pricing-table shape: overflow reads surface ordinary
- * dyn values validated by the usual checked casts) and three kinds the
- * overflow store carries that user Maps don't admit yet:
+ * dyn values validated by the usual checked casts) and callable values:
  *   func — `Record<string, () => void>`, the command-registry pattern
  *          (scr_closure adapters; closures are cycle-headered and traced,
  *          so a handler capturing its own registry collects)
- *   map/set — `Record<string, Map<K, V>>`/`Record<string, Set<T>>`
- *          nested-container tables (scr_map adapters; a map value's own
- *          cycle capability propagates through the trace fixpoint)
  * Nested index-signature RECORDS ride the record kind like any other.
  * Shared frontend (mapType) / validator. */
 export declare function isSupportedIndexValue(t: IrType): boolean;
 export declare function funcOf(params: IrType[], ret: IrType): IrType;
-/** The union FUNC/SET-arm sibling rule, shared by the frontend's union
- * builders and the validator: FUNC arms are valid beside ANY sibling —
- * `typeof x === "function"` narrows against data arms, unit tag tests
- * cover the nullable-callback shape, and between func arms closures
- * compare by pointer identity per tag (unionEq), so `x === String` is the
- * narrowing (the primitive-constructor tables' `StringConstructor |
- * NumberConstructor` field, and LinkOptions' `false | ((s: string) =>
- * string)`). A SET arm keeps the unit-only rule (no narrowing test
- * against data arms). */
-export declare function unionFuncSetArmsOk(arms: IrType[]): boolean;
+/** Maps, sets and promises may share a union with null/undefined only.
+ * Unit tag tests can narrow nullable containers without losing identity;
+ * arbitrary data siblings require a separate runtime narrowing operation.
+ * Share this rule across checker mapping, synthesized unions and validation. */
+export declare function unionContainerArmsOk(arms: IrType[]): boolean;
 /** Canonical, injective text form of an IrType — the building block of
  * shape/union identity keys, generic-function instantiation keys, and the
  * backend's per-type helper interning (jsonStringify/dynCheck walkers).
@@ -557,7 +538,7 @@ export declare function typeEquals(a: IrType, b: IrType): boolean;
 export declare function isRefCounted(t: IrType): boolean;
 export interface IrModule {
     /** Bumped on any breaking IR change; serialize.ts refuses mismatches. */
-    irVersion: 11;
+    irVersion: 13;
     sourceFile: string;
     functions: IrFunction[];
     /** Class shapes. Constructors and methods are ordinary module functions
@@ -624,15 +605,15 @@ export interface IrModule {
      * and system-library inputs. Absent when the build has no FFI manifest. */
     ffiImports?: IrFfiImport[];
     /** LIBRARY mode: the profile's resolved export map plus the
-     * mode-provided symbol names, landed ON the IR so both backends emit the
+     * mode-provided symbol names, landed ON the IR so the backend emits the
      * external-linkage wrappers and entries from the same facts — the two
      * emissions stay conformance-identical by construction. Absent on every
      * executable build (the backends emit main() exactly as always). */
     lib?: IrLibSection;
 }
-export type IrFfiValueParamClass = "f64" | "bool" | "u8" | "u32" | "i32" | "string" | "bytes";
-export type IrFfiCallbackParamClass = "f64" | "bool" | "u8" | "u32" | "i32" | "cstring" | "string" | "bytes";
-export type IrFfiReturnClass = "f64" | "bool" | "u8" | "u32" | "i32" | "void";
+export type IrFfiValueParamClass = "f64" | "f32" | "bool" | "u8" | "i8" | "u16" | "i16" | "u32" | "i32" | "i64" | "u64" | "pointer" | "string" | "bytes" | "mutable-bytes";
+export type IrFfiCallbackParamClass = "f64" | "f32" | "bool" | "u8" | "i8" | "u16" | "i16" | "u32" | "i32" | "i64" | "u64" | "pointer" | "cstring" | "string" | "bytes";
+export type IrFfiReturnClass = "f64" | "f32" | "bool" | "u8" | "i8" | "u16" | "i16" | "u32" | "i32" | "i64" | "u64" | "pointer" | "void";
 export interface IrFfiContextParam {
     /** Manifest-local id of the callback whose ScrClosure* occupies this ABI slot. */
     context: string;
@@ -680,6 +661,10 @@ export interface IrFfiImport {
     name: string;
     /** The external C symbol. */
     symbol: string;
+    /** Exact node:ffi.dlopen library name when exposed as a checked callable. */
+    library?: string;
+    callbackOperation?: "register" | "release";
+    callbackTarget?: string;
     params: IrFfiParam[];
     returns: IrFfiReturnClass;
 }
@@ -723,7 +708,7 @@ export interface IrLibTrapOverlay {
 }
 /** One resolved host-callback channel (the profile's `callbacks` entry
  * landed on the IR): compiled call sites of the channel's ambient binding
- * lower as ffiCall nodes carrying the channel name, and both backends emit
+ * lower as ffiCall nodes carrying the channel name, and the backend emits
  * the same dispatch — fetch the slot's registered pointer through
  * scr_library_cb_require (which delivers `unregisteredTrap` through the
  * library funnel when the host never registered), then the typed indirect
@@ -735,11 +720,11 @@ export interface IrLibCallback {
     /** The runtime channel slot (profile declaration order). */
     slot: number;
     params: ("f64" | "bool" | "string" | "bytes" | "u8" | "u32" | "i32")[];
-    returns: "f64" | "bool" | "u8" | "u32" | "i32" | "void";
+    returns: "f64" | "bool" | "u8" | "u32" | "i32" | "i64" | "u64" | "pointer" | "void";
     /** The unregistered-call trap text (a DETECTED trap: plain bytes the
      * library funnel classifies SC4025 and assembles with the current
      * entry's symbol — unlike the SC4012 wrapper traps, the entry is only
-     * known at runtime). Built once at export resolution so both backends
+     * known at runtime). Built once at export resolution so generated wrappers
      * emit identical constants by construction. */
     unregisteredTrap: string;
 }
@@ -798,6 +783,12 @@ export interface IrLibIdentity {
 }
 export interface IrClassDef {
     name: string;
+    /** Present for a class evaluated inside a function. Each evaluation owns
+     * fresh identity and these shared binding boxes; instance layouts carry a
+     * private class-object pointer after their source fields. */
+    localCaptures?: IrParam[];
+    /** Capture holding the evaluated local base constructor, if any. */
+    localBaseCapture?: number;
     /** The JS-observable `.name` of the class (the runtime class object's
      * name string, and what `C.name` folds to). Differs from `name` because
      * IR names are program-qualified (`%m1.C`, `%cx…` for class
@@ -805,6 +796,11 @@ export interface IrClassDef {
      * binding name for `const x = class {}`, or "" for truly anonymous
      * expressions. Absent on the runtime-provided defs (never valuable). */
     jsName?: string;
+    /** JavaScript constructor arity, ending before the first default or rest parameter. */
+    jsLength?: number;
+    /** Zero-argument native helper returning the shared prototype data object.
+     * Used when materializing an instance's own-property view. */
+    prototypeDataHelper?: string;
     /** RUNTIME-PROVIDED class (the builtin Error hierarchy): the struct, RC
      * helpers, and vtable live in the runtime (ScrError / scr_error_*), so
      * backends emit no definitions for it — only the preorder-interval
@@ -860,7 +856,7 @@ export interface IrClassDef {
  * `class Error` can never collide). `lib` is the standard-library name the
  * frontend recognizes; `kind` is the runtime's SCR_ERR_* index (backends
  * stamp scr_error_vts[kind] and pick constructor kinds by it). Every
- * emitted module carries all four class defs (flagged `runtime`) so the
+ * emitted module carries the builtin class defs (flagged `runtime`) so the
  * program's preorder numbering always covers them — the runtime's own
  * throws (JSON/dynCheck/regex) mint instances of these classes whether or
  * not user code mentions Error. */
@@ -942,6 +938,9 @@ export interface IrRecordShape {
      * %dtype) — hidden from every key-order surface, JSON included. */
     declaredOrder?: string[];
 }
+/** Codec records have private native state, not a structurally checkable
+ * data surface. Reserve the same '%' namespace as other internal slots. */
+export declare function recordTextCodecClass(shape: IrRecordShape): "TextEncoder" | "TextDecoder" | null;
 /** Object-literal ACCESSOR properties (`{ get x() {...}, set x(v) {...} }`)
  * live on the shape as reserved '%'-fields holding closures: `%get:x` a
  * `() => T` invoked once per property READ (side effects and all — JS's
@@ -960,6 +959,16 @@ export declare function accessorSlotProp(fieldName: string): {
  * accessorSlotProp) — the predicate behind every enumeration-surface
  * fence. */
 export declare function shapeHasAccessorSlots(shape: IrRecordShape): boolean;
+/** Literal fields that select a record layout at a checked-dynamic boundary.
+ * These are part of union identity: equal storage arms can have different
+ * discriminator contracts. Several source variants can share one layout. */
+export interface IrUnionDiscriminant {
+    field: string;
+    cases: {
+        tag: number;
+        values: (string | number | boolean)[];
+    }[];
+}
 export interface IrUnionDef {
     /** Frontend-assigned union id (`u0`, `u1`, ...). */
     id: string;
@@ -967,6 +976,7 @@ export interface IrUnionDef {
      * an arm's index here is its runtime tag. Never void/func/union; the
      * unit kinds (undefinedT/nullT) are payload-less arms. */
     arms: IrType[];
+    discriminant?: IrUnionDiscriminant;
 }
 export interface IrFunction {
     /** Original TS name (mangling is a backend concern). Lifted lambdas get
@@ -982,6 +992,12 @@ export interface IrFunction {
      * variables received through the closure environment, in caps[] order.
      * Each is also listed in `locals` (with boxed: true); it is NOT a param. */
     captures?: IrParam[];
+    /** Instance methods/constructors of local classes borrow captures through
+     * their first (`this`) parameter. The slot indexes the class object's
+     * capture array; no closure parameter is added to the method ABI. */
+    classCaptures?: (IrParam & {
+        slot: number;
+    })[];
     /** Async: the body runs on a fiber; `returnType` is the INNER type T (a
      * `return v` fulfills with v) while ordinary call sites receive
      * Promise<T>. With `generator` present, call sites receive the lazy
@@ -1014,6 +1030,10 @@ export interface IrFunction {
             kind: "record";
         };
     };
+    /** Source function name for native error stack frames. */
+    sourceName?: string;
+    /** Ordinary authored function declarations/expressions own a prototype. */
+    ownsPrototype?: true;
     body: IrStmt[];
     loc: SrcLoc;
 }
@@ -1028,6 +1048,9 @@ export interface IrGlobal {
     name: string;
     type: IrType;
     mutable: boolean;
+    /** Lexical record/function/checked-value bindings use their initially-null
+     * pointer as a TDZ sentinel. Reads and later writes throw until initializing assign. */
+    tdz?: true;
     /** Original declaration and lexical scope, when this is a source binding. */
     source?: IrBindingSource;
 }
@@ -1046,14 +1069,15 @@ export interface IrLocal {
      * (a shared binding — mutations are visible through every capture). All
      * access, including in the declaring function, goes through the box. */
     boxed?: true;
-    /** A forward-captured const (a function declared BEFORE the const it
+    /** A forward-captured lexical binding (a function declared BEFORE the binding it
      * captures): the box is allocated TDZ-empty at scope entry (a `varDecl`
      * with `init: null`) so earlier closures can capture it, and the source
-     * declaration initializes it via `assign`. Every read tests the box —
+     * declaration initializes it via `assign` with `initializes: true`.
+     * Every read and non-initializing write tests the box —
      * empty throws JS's catchable ReferenceError ("Cannot access 'name'
      * before initialization"), exactly Node's temporal dead zone. Always
-     * paired with `boxed`; restricted to pointer-backed types (the NULL slot
-     * IS the TDZ sentinel). Capture entries inherit the flag. */
+     * paired with `boxed`; scalar payloads use a one-element array cell so
+     * the NULL slot remains the TDZ sentinel. Capture entries inherit the flag. */
     tdz?: true;
 }
 export type IrStmt = 
@@ -1069,10 +1093,14 @@ export type IrStmt =
     localId: string;
     init: IrExpr | null;
     loc: SrcLoc;
-} | {
+}
+/** `initializes` marks a TDZ binding's declaration, whose store may
+ * initialize an empty box. Ordinary assignments must check it first. */
+ | {
     kind: "assign";
     localId: string;
     value: IrExpr;
+    initializes?: true;
     loc: SrcLoc;
 } | {
     kind: "exprStmt";
@@ -1468,7 +1496,10 @@ export type IrStrIntrinsicMethod = "length" | "charCodeAt" | "charAt" | "indexOf
  * constant RangeError on any bad offset; values coerce JS-exactly
  * (integer kinds by modular truncation, Float32 by double→float
  * rounding). No BIG setters exist — bigint arguments never lower. */
-export type IrBytesIntrinsicMethod = "length" | "byteLength" | "get" | "slice" | "subarray"
+export type IrBytesIntrinsicMethod = "buffer" | "length" | "byteLength" | "get" | "slice" | "subarray"
+/** In-place overlapping copy, [target, start, end] relative indices;
+ * returns the receiver (+1). */
+ | "copyWithin"
 /** Fresh Uint8Array copying methods. `with` takes [index, value] and
  * throws a catchable RangeError for an invalid relative index. */
  | "toReversed" | "with"
@@ -1477,7 +1508,7 @@ export type IrBytesIntrinsicMethod = "length" | "byteLength" | "get" | "slice" |
  | "join"
 /** Drain numeric typed-array elements into a fresh number[]. Used by
  * array spread and typed-array destructuring rest. */
- | "toArray" | "setFrom" | "toString"
+ | "toArray" | "setFrom" | "setFromDyn" | "toString"
 /** Buffer.toString with a runtime-valued encoding. Same signature as
  * toString, but canonicalizes aliases/case and may throw
  * ERR_UNKNOWN_ENCODING. */
@@ -1543,24 +1574,25 @@ export type IrRegexIntrinsicMethod = "test" | "match"
  * neither reads nor writes lastIndex (a fresh exec from position 0), so
  * no g/y fence applies: /g is irrelevant and /y anchors at 0 — exactly
  * Node. Never throws. */
- | "search" | "source" | "flags" | "replace" | "replaceAll" | "split";
+ | "search" | "source" | "flags" | "toString" | "replace" | "replaceAll" | "split";
 /** The complete standard-library surface (mirrors ambient/scriptc.d.ts: the
  * `process` and `JSON` globals and `declare module "node:fs"`). A closed
  * union — every member has a signature in the validator's LIB_FN_SIGS and a
  * scr_* implementation in the runtime (scr_lib.c / scr_json.c). fs.*
  * failures and json.parse syntax errors THROW (catchable, via the runtime
- * exception cell); process.* members never throw. JSON.stringify is NOT a
- * libCall — it lowers to the type-directed `jsonStringify` node below.
+ * exception cell); process.* members never throw. JSON.stringify without a
+ * callback lowers to the type-directed `jsonStringify` node below; callback
+ * forms use the shared native JSON walker through libCall.
  * island.eval (the internal __island_eval testing hook) exists only in
  * --dynamic builds — the frontend rejects it otherwise, so backends may
  * assume the island runtime is linked when they see it; island exceptions
  * bridge into the exception cell as catchable strings (may-throw). */
-export type IrLibFn = 
+export type IrLibFn = "ffi.argument" | "ffi.memoryModule" | "intl.segmenterNew" | "weakMap.is" | "weakSet.is" | "weakMap.new" | "weakSet.new" | "dyn.fromEntries" | "arrayBuffer.new" | "arrayBuffer.is" | "arrayBuffer.isView" | "arrayBuffer.byteLengthGetter" | "arrayBuffer.byteLengthDescriptor" | "arrayBuffer.viewU8C" | "arrayBuffer.viewI8" | "arrayBuffer.viewU16" | "arrayBuffer.viewI16" | "arrayBuffer.viewU8" | "arrayBuffer.viewU32" | "arrayBuffer.viewI32" | "arrayBuffer.viewF32" | "arrayBuffer.viewF64" | "arrayBuffer.viewDV"
 /** Native static fetch and its Web-platform companions. fetch.start
  * answers once the response head arrives; the response body readers
  * consume the native body stream. AbortSignal and ReadableStream values
  * are opaque checked-dynamic handles. */
-"fetch.start" | "fetch.responseNew" | "fetch.responseJson" | "fetch.responseText" | "fetch.responseBytes" | "fetch.abortControllerNew" | "fetch.abortTimeout" | "fetch.abortNow" | "fetch.abortAny" | "fetch.streamNew" | "fetch.streamFrom" | "fetch.readerRead" | "island.eval"
+ | "fetch.start" | "fetch.responseNew" | "fetch.responseArrayBuffer" | "fetch.responseJson" | "fetch.responseText" | "fetch.responseBytes" | "fetch.abortControllerNew" | "fetch.abortTimeout" | "fetch.abortNow" | "fetch.abortAny" | "fetch.streamNew" | "fetch.streamFrom" | "fetch.readerRead" | "island.eval"
 /** Load an embedded npm package's runtime entry in the island (cached by
  * the engine's module registry) and take one export: args are the entry
  * KEY (an embedded module's key, from IrModule.embedded) and the export
@@ -1586,7 +1618,7 @@ export type IrLibFn =
  * pending). Documented divergence: JS `as` never checks — like the dyn
  * boundary, a conversion that cannot happen throws instead of lying.
  * --dynamic only. */
- | "island.castFail" | "json.parse"
+ | "island.castFail" | "json.parse" | "json.parseReviver" | "json.stringifyReplacer" | "json.stringifyValue"
 /** Keyed WRITE on a dyn value — `h.onDone = cb` / `h["k"] = v` on a
  * checked-dynamic object (args: receiver, key string, value — all
  * borrowed; the runtime copies the key and retains the value in). An
@@ -1598,7 +1630,14 @@ export type IrLibFn =
  * (sloppy mode would silently ignore — suite tests are 'use strict';
  * SEMANTICS.md notes the sloppy divergence: loud, never silent). Void
  * result; in the may-throw seed set. */
- | "dyn.keySet"
+ | "dyn.keySet" | "dyn.keySetComputed"
+/** Delete an ordinary checked-native object's own key. Borrows both
+ * arguments; other receiver representations retain a runtime refusal. */
+ | "dyn.keyDelete" | "dyn.keyDeleteComputed" | "dyn.hasKeyComputed" | "dyn.hasOwnComputed" | "dyn.propertyIsEnumerableComputed"
+/** Native own properties on globalThis keyed by symbol identity. */
+ | "dyn.globalSymbolGet" | "dyn.globalSymbolSet" | "dyn.globalSymbolHas" | "dyn.globalSymbolDelete"
+/** Exact native class capsule identity, without materializing its fields. */
+ | "dyn.typedRefIs"
 /** Destructuring pack over a dyn source — `const [a, b] = d`, a
  * destructured dyn callback param (args: the source and the STATIC
  * TypeError spelling, "" when the source has none — both borrowed;
@@ -1608,7 +1647,7 @@ export type IrLibFn =
  * verbatim when non-empty, else the runtime kind wording ("number 5 is
  * not iterable (cannot read property Symbol(Symbol.iterator))"). In the
  * may-throw seed set. */
- | "dyn.iterPack"
+ | "dyn.iterPack" | "dyn.arrayFromIterator" | "dyn.iterator" | "dyn.iteratorResult" | "dyn.mapSeedEntries" | "dyn.mapSeedEntry"
 /** The for-of-over-dyn pack accessors — the emitted index loop drives
  * them over a dyn.iterPack result (ARR by construction). arrLen: the
  * ARR length as f64 (0 for non-ARR kinds; arg borrowed). arrAt: the
@@ -1618,17 +1657,16 @@ export type IrLibFn =
 /** `key in v` with a RUNTIME (string) key on a checked-dynamic
  * receiver (args: value dyn, key string; result bool): OBJ answers
  * own-member presence, ARR answers 'length'/a valid index — exactly
- * the compile-time dynHasKey fold, per value. Never throws. */
+ * the literal-key dynHasKey path. Proxy has traps may throw. */
  | "dyn.hasKey"
 /** Object.defineProperties over dyn values (args: target, descriptors —
  * both borrowed dyn; result: the target, +1 — JS's return value).
- * Value descriptors become plain own properties on OBJ and FUNC targets
- * (writable/enumerable/configurable accepted and IGNORED — dyn
- * properties are plain data properties, SEMANTICS.md); get/set
+ * Value descriptors become own properties on OBJ and FUNC targets;
+ * OBJ targets preserve data attributes. get/set
  * descriptors and non-object targets/descriptors throw catchably
  * (Node's TypeError texts; accessors the loud unsupported Error). In
  * the may-throw seed set. */
- | "dyn.defineProps"
+ | "dyn.defineProps" | "dyn.defineProperty" | "dyn.getOwnPropertyDescriptor" | "dyn.arrayProtoCall"
 /** Bare `typeof v` on a dyn value AS A STRING (arg: the dyn value,
  * borrowed; result: an owned string) — the dyn kind's JS answer:
  * undefined→"undefined", null/object/array/bytes→"object" (JS's oldest
@@ -1636,7 +1674,7 @@ export type IrLibFn =
  * Never throws. */
  | "dyn.typeof"
 /** Object.prototype.toString.call on a checked-dynamic value. */
- | "dyn.objectTag"
+ | "dyn.objectTag" | "dyn.freeze" | "dyn.isFrozen" | "dyn.nativeSetNew" | "dyn.nativeSetIs" | "dyn.nativeMapIs" | "dyn.nativeUrlIs" | "dyn.nativeDateIs" | "date.nativeNew" | "date.checkedValue" | "dyn.nativeRegexIs"
 /** toString() on a checked-dynamic receiver: runtime kind dispatch
  * (bytes decode per the literal encoding — utf8 default; strings,
  * numbers, booleans, arrays, objects answer JS-exactly; undefined and
@@ -1816,7 +1854,10 @@ export type IrLibFn =
  * value / string) — both THROW Node's TypeErrors on non-file schemes,
  * encoded slashes, and non-empty hosts. url.pathToFileURL resolves the
  * path (getcwd) and never throws. */
- | "url.new" | "url.protocol" | "url.origin" | "url.username" | "url.password" | "url.host" | "url.hostname" | "url.port" | "url.pathname" | "url.href" | "url.fileURLToPathUrl" | "url.fileURLToPathStr" | "url.pathToFileURL"
+ | "url.new" | "url.newBase" | "url.protocol" | "url.origin" | "url.username" | "url.password" | "url.host" | "url.hostname" | "url.port" | "url.pathname" | "url.href" | "url.fileURLToPathUrl" | "url.fileURLToPathChecked" | "url.fileURLToPathStr" | "url.pathToFileURL"
+/** Explicit path syntax from the options.windows argument, independent
+ * of the executable's host platform. Windows UNC input can throw. */
+ | "url.pathToFileURLPlatform"
 /** pathToFileURL under a win32 TARGET: the same scr_url_from_path call
  * (the runtime selects the win32 arm by _WIN32), but a distinct IR name
  * because that arm THROWS for malformed UNC inputs — may-throw seeds on
@@ -1876,7 +1917,7 @@ export type IrLibFn =
  * sym.desc / sym.keyFor answer the interned `string | undefined` union
  * (the runtime returns +1-or-NULL; the backend builds the union arms —
  * the child.stdout pattern). None of these throw. */
- | "sym.new" | "sym.newAnon" | "sym.for" | "sym.keyFor" | "sym.desc" | "sym.toString"
+ | "sym.new" | "sym.newAnon" | "sym.for" | "sym.wellKnown" | "sym.keyFor" | "sym.desc" | "sym.toString"
 /** Engine-free arbitrary-precision bigint operations (scr_bigint.c).
  * parse accepts the ECMAScript BigInt string grammar; fromF64 accepts
  * finite integral Numbers. Arithmetic returns fresh immutable values.
@@ -2438,7 +2479,13 @@ export type IrLibFn =
  * base64 decode Node-leniently, so it never throws. concat takes ONE
  * bytes<u8>[] arg (the list) and returns a fresh copy. `Buffer.from(u8)`
  * and `Buffer.alloc(n)` need no libFn — they lower to bytesNew. */
- | "buffer.fromStr" | "buffer.concat"
+ | "buffer.fromStr" | "buffer.brand"
+/** Buffer.from on checked-native strings, bytes, arrays and data-only
+ * array-like/Buffer-JSON objects. The encoding is a normalized literal;
+ * non-string inputs ignore it. Copies the input and may throw during
+ * element coercion or argument validation. Custom object valueOf and
+ * opaque reference inputs retain explicit runtime refusals. */
+ | "buffer.fromDyn" | "buffer.concat"
 /** Buffer.byteLength(string, enc) — enc a NORMALIZED literal like
  * fromStr's — and Buffer.isEncoding(name) over a runtime string
  * (case-insensitive against Node's alias set). Pure; never throw. */
@@ -2492,18 +2539,21 @@ export type IrLibFn =
  * naming the message slot ("setMaxListeners" for the static call,
  * "defaultMaxListeners" for the module-property assignment). */
  | "emitter.setMaxChk" | "emitter.setDefaultMaxChk"
-/** The Buffer forms of the fs quartet: readFileSync(path) with NO
- * encoding → bytes<u8> (+1), writeFileSync(path, bytes), and the
+/** The Buffer forms of fs: readFileSync(path) with NO
+ * encoding → bytes<u8> (+1), writeFileSync/appendFileSync(path, bytes), and the
  * fs/promises readFile(path) no-encoding form (an already-settled
  * promise, rejecting on failure like the other fsp members). The sync
- * pair THROWS catchably on failure exactly like the utf8 forms. */
- | "fs.readFileSyncBytes" | "fs.writeFileSyncBytes" | "fsp.readFileBytes"
+ * forms THROW catchably on failure exactly like the utf8 forms. */
+ | "fs.readFileSyncBytes" | "fs.writeFileSyncBytes" | "fs.appendFileSyncBytes" | "fsp.readFileBytes"
 /** node:zlib (scr_zlib.c — native-toolchain.ts compiles/links it ONLY when these
  * appear on the IR, the regex/libcurl gating precedent): one-shot zlib,
  * raw-DEFLATE, gzip, and auto-detect codecs over u8 bytes with Node's
- * default options. Compression never throws (OOM aborts); decompression
+ * default options, or a validated literal compression level from -1 to 9.
+ * Compression never throws (OOM aborts); decompression
  * of corrupt input THROWS Node's error catchably. */
- | "zlib.deflateSync" | "zlib.inflateSync" | "zlib.deflateRawSync" | "zlib.inflateRawSync" | "zlib.gzipSync" | "zlib.gunzipSync" | "zlib.unzipSync"
+ | "zlib.deflateSync" | "zlib.inflateSync" | "zlib.deflateRawSync"
+/** bytes, mode (0 zlib / 1 raw / 2 gzip), validated compression level. */
+ | "zlib.deflateLevelSync" | "zlib.inflateRawSync" | "zlib.gzipSync" | "zlib.gunzipSync" | "zlib.unzipSync"
 /** The default-options callback twins run on the executable's shared
  * native work pool and deliver (Error | null, Buffer) on a later loop
  * turn. crc32 validates its optional uint32 seed synchronously. */
@@ -2570,6 +2620,9 @@ export type IrLibFn =
  * "x64") — Node's answer for its own build on the same machine.
  * Interned; +1 per read. Never throws. */
  | "process.arch"
+/** Stable native version dictionary. node/openssl identify compatibility
+ * targets; components absent from the native runtime are omitted. */
+ | "process.versions" | "process.builtinId" | "process.builtinModule" | "process.builtinUnsupported" | "process.hrtimeValue"
 /** process.versions.node: the runtime's Node COMPATIBILITY TARGET —
  * there is no Node under the binary, so this reports the version whose
  * semantics the runtime implements (SEMANTICS.md divergence 60, the
@@ -2598,6 +2651,8 @@ export type IrLibFn =
 /** realpath(3) with Node's error shape (syscall "lstat" in the message,
  * Node's own spelling for realpathSync failures). +1 fresh string. */
  | "fs.realpathSync"
+/** Native realpath with syscall "realpath" on failure. +1 fresh string. */
+ | "fs.realpathNativeSync"
 /** kill(2) with Node's exact semantics and error shapes: the pid must be
  * an int32 (else the ERR_INVALID_ARG_TYPE TypeError text), the named
  * form resolves Node's signal-name table (unknown names throw the
@@ -2628,7 +2683,7 @@ export type IrLibFn =
  * shares console.log's stream, each call is submitted promptly, and
  * interleaved output keeps source order. No newline, no formatting,
  * never throws. */
- | "process.stdoutWrite" | "process.stderrWrite" | "timers.setTimeout"
+ | "process.stdoutWrite" | "process.stderrWrite" | "process.stdio" | "timers.setTimeout"
 /** The repeating timer pair. setInterval takes (callback, ms) like
  * setTimeout and RETURNS the f64 handle the fallback declarations
  * promise (ids start at 1, so truthiness narrowing works); the loop
@@ -2699,14 +2754,10 @@ export type IrLibFn =
  | "process.uptime"
 /** perf_hooks performance.now(): fractional ms since process start. */
  | "perf.now" | "process.availableMemory" | "process.constrainedMemory" | "process.cpuUser" | "process.cpuSystem" | "process.cpuUserDiff" | "process.cpuSystemDiff" | "process.threadCpuUser" | "process.threadCpuSystem" | "process.threadCpuUserDiff" | "process.threadCpuSystemDiff" | "process.cpuPrevValidate" | "process.rusage" | "process.activeResources"
-/** Process signal events — process.on/once/off("SIGINT" | "SIGTERM").
- * args: [signo f64 (the frontend bakes the POSIX number), cb, once
- * bool] for on; [signo, cb] for off (cb borrowed, removed by pointer
- * identity — Node's removeListener contract). Handlers run as
- * macrotasks at loop turns; watching replaces the default disposition
- * and removing the last listener restores it; signal listeners never
- * keep the loop alive (Node). Zero-param callbacks only (the ambient
- * shape). Never throw. */
+/** Named process signal events: [name string, callback dyn, once bool]
+ * or [name, callback] for removal. The runtime resolves platform signal
+ * numbers and delivers (name, number). Listeners do not keep the loop
+ * alive. Invalid callbacks and uncatchable signals throw. */
  | "process.onSignal" | "process.offSignal"
 /** The process 'exit' event — process.on/once/off("exit"). args: [cb,
  * once bool] / [cb]. Listeners run SYNCHRONOUSLY at termination
@@ -2740,6 +2791,15 @@ export type IrLibFn =
  * field to stamp. error.toString: borrowed `%Error`-typed receiver, +1
  * string in Node's "name: message" shape. None of the three throws. */
  | "error.new"
+/** ECMAScript constructors with raw checked-dynamic message/options.
+ * Options retain cause presence; constructor calls borrow their args.
+ * Message coercion may throw before the cause is installed. */
+ | "error.newOptions" | "error.ctorOptions"
+/** Borrowed Error receiver. cause returns an owned dyn value (undefined
+ * when absent); hasCause distinguishes absence from present undefined. */
+ | "error.cause" | "error.hasCause"
+/** Assignment borrows both operands and retains the new cause. */
+ | "error.setCause" | "error.deleteCause"
 /** The compiler-resolved Node-parity throw for always-throwing lowered
  * arms (ERR_INVALID_THIS receivers, ERR_MISSING_ARGS arity ladders,
  * the symbol-to-string TypeError): args are [error-kind f64 (the
@@ -2753,24 +2813,26 @@ export type IrLibFn =
  * exhaustion throws "Cannot convert object to primitive value"; units
  * render "null"/"undefined") — the WHATWG USVString conversions
  * (URLSearchParams names/values). Borrowed dyn; +1 string. May-throw. */
- | "dyn.toStringCoerce"
+ | "dyn.toStringCoerce" | "dyn.stringConstructor" | "dyn.propertyKey" | "dyn.toNumeric" | "dyn.increment"
 /** JS ToNumber over a dyn value WITH the object protocol (number-hint
  * valueOf/toString ordering; user throws propagate). Borrowed dyn;
  * f64 result, or a throw. Used by statically lowered numeric coercions
  * whose checker type remained any. */
- | "dyn.toNumberCoerce"
+ | "dyn.numberConstructor" | "dyn.toNumberCoerce" | "dyn.add" | "dyn.arithmetic" | "dyn.bitwise" | "dyn.proxyNew"
 /** A read of a `declare`d const NOTHING defines (the bundler-define
  * pattern — __VERSION__): always throws the catchable ReferenceError
  * Node raises at the access ("<name> is not defined"). args[0] is the
  * name; the result type is the read's declared type (a typed dummy the
  * unwind abandons — the value never exists). */
  | "global.undefRead"
+/** A native reference to the global object; known names retain value fences. */
+ | "global.native" | "console.native"
 /** `X.name` through a class VALUE (scr_object.c): args[0] is a borrowed
  * classval; the result is the class object's stored .name string,
  * retained (+1 — the string is an interned immortal, so the retain is a
  * no-op, kept for ownership uniformity). Never throws. A direct
  * `C.name` on the class name itself folds to a strLit instead. */
- | "class.name" | "error.ctor" | "error.toString"
+ | "class.name" | "error.ctor" | "error.toString" | "error.stack" | "error.stackLimitGet" | "error.stackLimitSet"
 /** `new DOMException(message?, nameOrOptions?)` (scr_error.c): both args
  * are borrowed dyn values (the lowering passes the dyn undefined for an
  * absent argument, so WebIDL's optionality lives in one place). The
@@ -2813,7 +2875,7 @@ export type IrLibFn =
  * JS). Strings/arrays/bytes answer their index keys; other scalars an
  * empty array; null/undefined throw Node's catchable TypeError
  * ("Cannot convert undefined or null to object"). */
- | "dyn.objKeys" | "dyn.hasOwn" | "dyn.assign"
+ | "dyn.objKeys" | "dyn.forInKeys" | "dyn.hasOwn" | "dyn.propertyIsEnumerable" | "dyn.assign" | "dyn.copyDataProperties"
 /** Variadic Object.assign over CHECKED-DYNAMIC targets (`Object.assign(
  * {}, ...arr.map(f), tail)` — the option-table merge): the lowering
  * builds one fresh dyn pack of sources (packPush retains a plain source
@@ -2838,7 +2900,7 @@ export type IrLibFn =
  * that SEE the prototype: inspect's "[Object: null prototype]" prefix
  * and deepStrictEqual's prototype gate. Never throws. Static builds
  * only; --dynamic routes Object.create through the engine instead. */
- | "dyn.objCreateNullProto" | "dyn.objValues" | "dyn.objEntries"
+ | "dyn.objCreateNullProto" | "dyn.arrayPrototype" | "dyn.classPrototype" | "dyn.classBasePrototype" | "dyn.classSuper" | "dyn.assignPrototype" | "dyn.objCreate" | "dyn.objCreateWithProperties" | "dyn.getPrototype" | "dyn.setPrototype" | "dyn.getOwnPropertyNames" | "dyn.getOwnPropertySymbols" | "dyn.getOwnPropertyDescriptors" | "dyn.preventExtensions" | "dyn.isExtensible" | "dyn.seal" | "dyn.isSealed" | "dyn.objValues" | "dyn.objEntries"
 /** structuredClone over the checked-dynamic tree (scr_json.c): the JSON-safe subset plus
  * bytes (a fresh copy — a Buffer clones as a plain Uint8Array, like
  * Node), deep. Functions and handle kinds throw the spec's catchable
@@ -2859,7 +2921,7 @@ export type IrLibFn =
  * strings (the lowering completes an absent flags to ""); result +1.
  * The result TYPE is the regex kind, so the link switch pulls the
  * engine exactly like a literal. */
- | "regex.new"
+ | "regex.new" | "regex.newChecked"
 /** structuredClone with a NON-EMPTY transfer array of static values:
  * nothing static is transferable, so the call always throws Node's
  * catchable DataCloneError ("Found invalid value in transferList.") —
@@ -2885,7 +2947,7 @@ export type IrLibFn =
  * the had-listeners bool. emitter.emitError: emit('error', err) —
  * throws err when unhandled. count/countFn/names/listeners/getMax/
  * setMax/setDefaultMax/getDefaultMax are the introspection surface. */
- | "emitter.new" | "emitter.ctor" | "emitter.on" | "emitter.off" | "emitter.checkListener" | "emitter.onDyn" | "emitter.onFlex" | "emitter.offDyn" | "emitter.removeAll" | "emitter.emit" | "emitter.emitFlex" | "emitter.emitError" | "emitter.count" | "emitter.countFn" | "emitter.names" | "emitter.listeners" | "emitter.setMax" | "emitter.getMax"
+ | "emitter.new" | "emitter.ctor" | "emitter.on" | "emitter.off" | "emitter.checkListener" | "emitter.onDyn" | "emitter.onFlex" | "emitter.offDyn" | "emitter.removeAll" | "emitter.emit" | "emitter.emitFlex" | "emitter.emitError" | "emitter.count" | "emitter.countFn" | "emitter.countDyn" | "emitter.names" | "emitter.listeners" | "emitter.setMax" | "emitter.getMax"
 /** Stream-'data' registration twins of emitter.on/onDyn (same args):
  * chosen at registration sites whose receiver is stream-rooted, so the
  * backend emits DATA thunks — the runtime's 'data' emission carries
@@ -3179,7 +3241,8 @@ export type IrLibFn =
  * Node's once); off/removeListener remove by closure identity, the
  * offWarning stance. Throws Node's ERR_INVALID_ARG_TYPE on a
  * non-function. */
- | "process.onUnhandledRejection" | "process.offUnhandledRejection"
+/** Uncaught exception handlers and monitors: [callback dyn, once, monitor]. */
+ | "process.onUncaughtException" | "process.offUncaughtException" | "process.onUnhandledRejection" | "process.offUnhandledRejection"
 /** process.on/once/off('rejectionHandled', fn): the sibling registry.
  * A handler attached after unhandledRejection delivery fires the event
  * once. Dispatch is synchronous at the attach, with the promise,
@@ -3265,6 +3328,9 @@ export type IrLibFn =
  * from UTF-16 code units. Adjacent surrogate pairs combine; lone
  * surrogates follow the runtime's replacement policy. */
  | "string.fromCharCode"
+/** Numeric code points, with catchable RangeError for non-integers or
+ * values outside 0..0x10ffff. Uses the same UTF-8 surrogate policy. */
+ | "string.fromCodePoint"
 /** lastIndexOf returns the last UTF-16 start index, or -1. The two-arg
  * form searches at or before its numeric position; NaN starts at the end.
  * String arguments are borrowed and neither form throws. */
@@ -3279,10 +3345,9 @@ export type IrLibFn =
 /** WHATWG TextDecoder.decode over u8 bytes (scr_bytes.c): utf-8 with
  * default options — the same maximal-subpart replacement decode as
  * Buffer.toString("utf8"), with the leading BOM stripped (the one
- * behavioral difference; ignoreBOM defaults to false). The composed
- * `new TextDecoder().decode(bytes)` form and its same-scope const
- * store-then-call twin lower — decoder values still have no general
- * representation. TextEncoder.encode needs no libFn: its matching forms
+ * behavioral difference; ignoreBOM defaults to false). Inline calls
+ * lower directly; stored decoder records dispatch by encoding id.
+ * TextEncoder.encode needs no libFn: its matching forms
  * lower to buffer.fromStr(s, "utf8") (identical bytes — ScrStr storage
  * is well-formed UTF-8). Borrowed arg; owned (+1) string; never throws. */
  | "text.decode"
@@ -3446,8 +3511,7 @@ export type IrExpr =
 /** Numeric operands; comparisons yield bool. `===`/`!==` additionally
  * accept two same-typed arrays: reference identity (pointer compare),
  * matching JS object equality — and two same-typed CLASS VALUES, where
- * the pointer compare IS class identity (one immortal object per
- * class). */
+ * the pointer compare IS class identity. */
  | {
     kind: "bin";
     op: IrNumBinOp;
@@ -3629,11 +3693,11 @@ export type IrExpr =
     loc: SrcLoc;
 }
 /** Optional chaining `a?.b` / `a?.m(...)` / `f?.()` / `a?.[i]` — the
- * `nullish` test inverted: `receiver` is a unit-armed union with exactly
- * ONE non-unit arm, evaluated exactly once; when its runtime tag is a
+ * `nullish` test inverted: `receiver` is a unit-armed union with at least
+ * one non-unit arm, evaluated exactly once; when its runtime tag is a
  * unit arm the result is the interned undefined arm of `type` (JS-exact:
  * a null receiver still yields undefined) and `body` never evaluates —
- * argument side effects included. Otherwise the narrowed receiver binds
+ * argument side effects included. Otherwise the receiver binds
  * to `id` (read via chainRecv inside `body`, +1 per read for ref kinds)
  * and `body` produces the result: `type` when non-void (an
  * undefined-armed union; the frontend pre-wraps the member value into
@@ -3648,7 +3712,9 @@ export type IrExpr =
     loc: SrcLoc;
 }
 /** The narrowed receiver inside an enclosing optChain's `body`, by the
- * chain's `id` — typed as the union's single non-unit arm; each read is
+ * chain's `id` — typed as the single non-unit arm when there is one,
+ * or as the original union when there are several (the body can retag
+ * it to the present sub-union). Each read is
  * +1 for ref kinds (a borrowed bind temp backs it). Valid nowhere else
  * (validated against the active-chain stack). */
  | {
@@ -3818,14 +3884,17 @@ export type IrExpr =
  *   truncate; a negative/huge result THROWS Node's "Invalid typed array
  *   length" RangeError catchably — backends' may-throw analyses seed on
  *   bytesNew with a non-bytes, non-array source).
- * - bytes (same elem — frontend-fenced) — an independent COPY. Never
- *   throws.
+ * - bytes — an independent, element-coerced COPY. Never throws.
  * - array of f64 — a per-element-coerced copy (ToUint8/ToUint32/float).
  *   Never throws.
+ * - dyn — checked native input; can throw on invalid lengths/coercion.
+ *   `from` selects TypedArray.from's iterable/array-like semantics instead
+ *   of constructor length coercion (notably for strings and numbers).
  * The source is BORROWED; the result is owned (+1). */
  | {
     kind: "bytesNew";
     source: IrExpr | null;
+    from?: true;
     type: IrType;
     loc: SrcLoc;
 }
@@ -3951,10 +4020,13 @@ export type IrExpr =
 }
 /** Indirect call of a func-typed value. Args follow `call`'s convention
  * (callee owns its params, callers pass +1). The callee expression is an
- * ordinary owned temp, released at statement end. */
+ * ordinary owned temp, released at statement end. receiver supplies the
+ * call-time this value; absence means undefined. Evaluate callee, receiver,
+ * then args, and restore the ambient receiver before unwinding. */
  | {
     kind: "callValue";
     callee: IrExpr;
+    receiver?: IrExpr;
     args: IrExpr[];
     type: IrType;
     loc: SrcLoc;
@@ -3983,6 +4055,9 @@ export type IrExpr =
     kind: "yieldExpr";
     value: IrExpr | null;
     awaited?: true;
+    captureCompletion?: {
+        returnType: IrType;
+    };
     type: IrType;
     loc: SrcLoc;
 }
@@ -4066,16 +4141,16 @@ export type IrExpr =
     type: IrType;
     loc: SrcLoc;
 }
-/** The class itself as a value: a pointer to `className`'s immortal
- * class object (type `classval:className`, +1 — a no-op retain on the
- * immortal, kept for the uniform owned-temp discipline, the regexLit
- * pattern). The frontend notes an edge to `%className.constructor` at
+/** The class itself as an owned value. `captures` creates fresh identity
+ * and retains the named boxes; absent captures use an immortal template.
+ * The frontend notes an edge to `%className.constructor` at
  * every classRef, so a value's construct thunk always has a constructor
  * to call; backends emit class objects (and thunks) for exactly the
  * classes some classRef in the module names. */
  | {
     kind: "classRef";
     className: string;
+    captures?: string[];
     type: IrType;
     loc: SrcLoc;
 }
@@ -4341,6 +4416,7 @@ export type IrExpr =
  | {
     kind: "dynCall";
     callee: IrExpr;
+    receiver?: IrExpr;
     calleeName: string;
     args: IrExpr[];
     spreads?: {
@@ -4381,10 +4457,8 @@ export type IrExpr =
     type: IrType;
     loc: SrcLoc;
 }
-/** A dyn OBJECT built member-by-member. With no `fields` it is the empty
- * object (the JS stand-in for opaque container values — `new WeakMap()`
- * in harness code: the value exists for identity; every reached METHOD
- * use meets its own fence). With `fields` it is a JS object literal whose
+/** A dyn OBJECT built member-by-member. With no `fields` it is an empty
+ * object. With `fields` it is a JS object literal whose
  * keys are RUNTIME values (the computed-key idiom `{ [field]: criteria,
  * actual: 0 }` in test/common's _mustCallInner): each entry's key is a
  * string-typed expression (identifier/string keys lower to strLits;
@@ -4407,9 +4481,9 @@ export type IrExpr =
  * control flow understands on `unknown`: `typeof v === "string" |
  * "number" | "boolean" | "undefined"` and the unit comparisons `v ===
  * undefined` / `v === null` (`"nullish"` is the LOOSE `v == null` pair —
- * undefined or null in one test), and `v instanceof Uint8Array`
- * (`"bytes"` — the checked-dynamic tree's bytes kind; Node's Buffer IS a Uint8Array
- * subclass and both worlds answer true for it, SEMANTICS.md 45), plus
+ * undefined or null in one test), and `v instanceof TypedArray`
+ * (`"bytes"` plus bytesElem, default u8; Node's Buffer is a Uint8Array
+ * subclass), plus
  * the two object-family tests: `"object"` is `typeof v === "object"`
  * exactly (true for the checked-dynamic tree's object, array, bytes, AND null kinds —
  * JS's oldest wart preserved), `"array"` is `Array.isArray(v)` (the
@@ -4433,7 +4507,8 @@ export type IrExpr =
  * `"object"` test, JS-exact. */
  | {
     kind: "dynTest";
-    test: "string" | "number" | "boolean" | "undefined" | "null" | "nullish" | "bytes" | "object" | "array" | "truthy" | "error" | "function";
+    test: "promise" | "bigint" | "symbol" | "string" | "number" | "boolean" | "undefined" | "null" | "nullish" | "bytes" | "buffer" | "object" | "array" | "truthy" | "error" | "function";
+    bytesElem?: IrBytesElem;
     negated?: true;
     value: IrExpr;
     type: IrType;
@@ -4501,13 +4576,16 @@ export type IrExpr =
  * forms whose statement lowering needs temps and writes (destructuring
  * assignments in value position, keyed dyn writes yielding the RHS).
  * `type` IS result's type. Restricted on purpose: stmts must be
- * straight-line (varDecl/assign/exprStmt/field-and-record writes — no
- * control flow, no jumps; the validator enforces the subset), and any
- * varDecl-introduced local is a function local like every hidden temp. */
+ * local statements (including blocks, branches, and loops, but no jumps;
+ * the validator enforces the subset). Hidden locals retain function-wide
+ * ids, but their owned values live through the enclosing expression's
+ * frame: later call arguments may reuse a saved operand. Release them
+ * on the same path that initialized them, not an outer lexical scope. */
  | {
     kind: "seqExpr";
     stmts: IrStmt[];
     result: IrExpr;
+    generatorDelegate?: true;
     type: IrType;
     loc: SrcLoc;
 }
@@ -4560,6 +4638,18 @@ export type IrExpr =
     type: IrType;
     loc: SrcLoc;
 }
+/** Own-key presence in an index-signature record's overflow map. Unlike
+ * a keyed read, this distinguishes a missing key from a stored undefined
+ * value. Declared fields are handled separately by the lowering. Both
+ * operands are borrowed, the key is string, the result is bool. */
+ | {
+    kind: "recordOvfHas";
+    obj: IrExpr;
+    shapeId: string;
+    key: IrExpr;
+    type: IrType;
+    loc: SrcLoc;
+}
 /** Union construction: wrap an arm value into a fresh tagged box (the
  * frontend inserts these wherever a `B` flows into an `A | B` slot).
  * `tag` is the arm's index in the union's canonical arm list; `value` has
@@ -4807,6 +4897,7 @@ export type IrExpr =
  | {
     kind: "jsonStringify";
     value: IrExpr;
+    indent?: string;
     type: IrType;
     loc: SrcLoc;
 }
@@ -4998,6 +5089,12 @@ export declare function isJsonSafeType(t: IrType, getRecord: (shapeId: string) =
  * root remains outside the domain because JSON.stringify returns the
  * undefined value instead of a string. */
 export declare function isJsonStringifySafeType(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
+/** A JSON-shaped container with unknown payloads needs the runtime JSON
+ * traversal. Its declared structure can be boxed, but payloads may carry
+ * omitted values, toJSON methods, or cycles. This predicate does not widen
+ * the type-directed serializer, checked-island boundary, or root-undefined
+ * contract; callers must select the checked runtime traversal explicitly. */
+export declare function isJsonStringifyDynamicType(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** THE island boundary predicate: true when a static type can cross into
  * the island (jsMarshal — primitives by value, composites as deep JSON
  * copies) and back out (jsExit — strict primitive extraction, composites
@@ -5019,7 +5116,8 @@ export declare const MAX_ISLAND_CALLBACK_ARITY = 16;
 export declare function canMarshalFuncIntoIsland(t: IrType): boolean;
 /** Parameter types a TYPED closure may declare when it crosses INTO the
  * island as a host function: jsval params take the engine argument as a
- * handle (the all-'any' shape above); every other admitted type converts
+ * handle (the all-'any' shape above); dyn params normalize scalars or retain
+ * engine objects by reference. Every other admitted type converts
  * AT CALL TIME through the validated-exit machinery — strict primitives,
  * JSON round-trip composites (the dynCheck walker: width-tolerant records,
  * path-annotated failures). On top of the jsExit set, a bare `T | undefined`
@@ -5045,8 +5143,8 @@ export declare function islandCallbackRet(t: IrType, getRecord: (shapeId: string
  * closures whose params are per-argument-convertible at call time
  * (isIslandCallbackParamType) and whose return classifies
  * (islandCallbackRet). Same arity cap — the runtime's host-call argument
- * buffer. Closures taking closures and 'unknown'-typed params stay fenced
- * (no per-type extraction exists for them inside a host call). */
+ * buffer. Statically typed closure parameters stay fenced; unknown values
+ * enter as checked-dynamic values and are validated at each typed use. */
 export declare function canMarshalTypedFuncIntoIsland(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** The runtime HANDLE kinds that cross the checked-dynamic boundary as
  * the checked-dynamic tree's HANDLE kind (SCR_DYN_HANDLE): boxed by REFERENCE (identity —
@@ -5074,13 +5172,22 @@ export declare function isDynTypedRefType(t: IrType): t is Extract<IrType, {
  * layout; TypeScript `private`/`protected` fields keep ordinary names and are
  * observable properties at runtime. */
 export declare function isClassOwnEnumerableFieldName(name: string): boolean;
+/** Compiler-owned storage for properties added through untyped references. */
+export declare const DYN_CLASS_PROPERTIES = "%dynProperties";
+/** A class capsule can always preserve its exact native identity. Its
+ * optional property view additionally needs converters in both directions;
+ * fields such as Maps may remain opaque without preventing the round trip. */
+export declare function classDynViewSupported(fields: readonly {
+    name: string;
+    type: IrType;
+}[], getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** A static type that CONVERTS into a dyn value — the dynFrom domain:
- * JSON-safe data, bytes<u8> (payload copied), identity-preserving class
+ * JSON-safe data, numeric typed arrays (retained views), identity-preserving class
  * references, undefined-armed unions of those arms, boxable function types,
  * and the runtime HANDLE kinds (boxed by reference — DYN_HANDLE_KINDS). */
 export declare function canConvertToDyn(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
 /** A type a dyn value can be VALIDATED into — the dynCheck domain:
- * JSON-safe data, bytes<u8> (a fresh copy out), the %Error extraction,
+ * JSON-safe data, numeric typed arrays (retained views), the %Error extraction,
  * undefined-armed unions of JSON-safe arms, adaptable function types,
  * and the runtime HANDLE kinds (a tag-checked reference unwrap —
  * DYN_HANDLE_KINDS). */
@@ -5115,12 +5222,44 @@ export declare function canMarshalIntoIsland(t: IrType, getRecord: (shapeId: str
  * Promise.all arm). Null = outside the domain (the boundary fence). */
 export declare function islandPromisePayloadTag(inner: IrType): "void" | "f64" | "bool" | "string" | "jsval" | "jsvalArr" | null;
 export declare function canExitIslandToType(t: IrType, getRecord: (shapeId: string) => IrRecordShape | undefined, getUnion: (unionId: string) => IrUnionDef | undefined): boolean;
+export interface RuntimeFeatures {
+    regex: boolean;
+    copying: boolean;
+    legacyTextDecoder: boolean;
+    fileHandle: boolean;
+    fetch: boolean;
+    processEvents: boolean;
+    emitter: boolean;
+    stream: boolean;
+    zlib: boolean;
+    dc: boolean;
+    assert: boolean;
+    dynInvoke: boolean;
+    dynAsync: boolean;
+    inspect: boolean;
+    childProcess: boolean;
+    net: boolean;
+    symbol: boolean;
+    bigint: boolean;
+    searchParams: boolean;
+    qs: boolean;
+    parseArgs: boolean;
+    fsWatch: boolean;
+    nodeTest: boolean;
+    dgram: boolean;
+    http: boolean;
+    http2: boolean;
+    tls: boolean;
+    tlsCa: boolean;
+}
+/** Inspect types and expressions together in one traversal. This is a fresh
+ * snapshot: callers may mutate an IR module between compilation passes. */
+export declare function moduleRuntimeFeatures(mod: IrModule): RuntimeFeatures;
 /** True when the module contains any regex construct — a regexLit /
  * regexIntrinsic node or a regex-typed slot anywhere. This is the link
  * switch that pulls scr_regex.c + the vendored libregexp into the binary
- * (native-toolchain.ts); regex-free programs keep the historical command line. A generic
- * JSON walk: `kind` discriminants live only on IR objects, so user string
- * VALUES can never false-positive. */
+ * (native-toolchain.ts); regex-free programs keep the historical command line. The
+ * typed traversal visits type slots as well as executable nodes. */
 export declare function moduleUsesRegex(mod: IrModule): boolean;
 /** True when the module contains an intrinsic whose implementation lives
  * in scr_copying.c. This is the link switch that keeps the optional
@@ -5171,7 +5310,7 @@ export declare function moduleUsesStream(mod: IrModule): boolean;
  * the first; the emitted main installs it before any island entry). */
 export declare function moduleEmbedsBuiltin(mod: IrModule, builtin: string): boolean;
 /** Embedded module texts at least this long are DEFLATE-compressed into
- * the emitted C (island.ts; each stays plain when deflate does not
+ * the emitted LLVM (island.ts; each stays plain when deflate does not
  * shrink it) and inflated lazily by the island's module loader at first
  * load. Below it the zlib round trip cannot pay for itself. */
 export declare const NPM_COMPRESS_MIN = 1024;
@@ -5305,8 +5444,8 @@ export declare function moduleUsesTls(mod: IrModule): boolean;
 export declare function moduleUsesTlsCa(mod: IrModule): boolean;
 /** First async/event-loop/ambient-process surface the module graph
  * reaches, or null when the graph is async_free (the v1 library requirement).
- * The generic-walk shape of moduleUsesRegex, tracking the nearest
- * enclosing `loc` so the refusal anchors at the reaching construct; the
+ * Typed slots use their declaration location and executable nodes use their
+ * own location, so the refusal anchors at the reaching construct; the
  * coarse moduleUses* predicates are the safety net behind the fine-grained
  * table (a surface reached only through a spelling the table misses still
  * refuses, anchored at the entry). */