@scriptc/compiler 0.1.7 → 0.2.1

package/dist/ir/ir.js

@@ -1,4 +1,12 @@
 import { InternalCompilerError } from "../errors.js";
+import { everyModuleNode, everyExprChild, everyStmtChild } from "./traverse.js";
+export const BYTES_ELEMENT_SIZE = {
+    u8: 1, u8c: 1, i8: 1, u16: 2, i16: 2, u32: 4, i32: 4, f32: 4, f64: 8,
+};
+export const BYTES_ELEMENT_NAME = {
+    u8: "Uint8Array", u8c: "Uint8ClampedArray", i8: "Int8Array", u16: "Uint16Array", i16: "Int16Array",
+    u32: "Uint32Array", i32: "Int32Array", f32: "Float32Array", f64: "Float64Array",
+};
 const POINTER_HANDLE_KINDS = [
     "stats",
     "fileHandle",
@@ -30,7 +38,7 @@ const HANDLE_KIND_LIST = [
     "procStream",
 ];
 export const HANDLE_KINDS = irKindSet(HANDLE_KIND_LIST);
-/** The IR kinds represented as pointers in both native backends. */
+/** The IR kinds represented as pointers in native code. */
 const POINTER_KIND_LIST = [
     "string",
     "bigint",
@@ -185,18 +193,23 @@ export const NULL_T = { kind: "nullT" };
 export function isUnitType(t) {
     return t.kind === "undefinedT" || t.kind === "nullT";
 }
-/** Element kinds with a real ScrArr storage/RC representation in BOTH
- * backends. Array-producing lowerings can learn their result element from
+/** Element kinds with a real ScrArr storage/RC representation.
+ * Array-producing lowerings can learn their result element from
  * a callback rather than through mapType's ordinary T[] gate, so they must
  * share this predicate instead of reconstructing an array around an
- * otherwise-valid standalone type (Map, Set, dyn, opaque handles, ...). */
+ * otherwise-valid standalone type (Date, opaque handles, ...). */
 export function isSupportedArrayElem(t) {
     switch (t.kind) {
+        // Native collection seeds and drains retain checked values in a
+        // temporary vector. User-facing unknown[] still maps to a dyn array.
+        case "dyn":
         case "f64":
         case "bigint":
         case "bool":
         case "string":
         case "array":
+        case "map":
+        case "set":
         case "bytes":
         case "record":
         case "object":
@@ -227,35 +240,32 @@ export function mapOf(key, value) {
 export function setOf(elem) {
     return { kind: "set", elem };
 }
-/** The Map KEY fence: string (content) or number (SameValueZero) — the two
- * kinds a hash of the VALUE is honest for. Booleans, objects, and the rest
- * of JS's anything-goes keys stay out. Shared by the frontend's
- * type mapping/diagnostics and the validator. Set ELEMENTS use the same
- * fence: a set is hashed storage of its elements exactly as a map is of
- * its keys (isSupportedSetElem is this predicate under its own name). */
-export function isSupportedMapKey(t) {
-    return t.kind === "f64" || t.kind === "string";
-}
-/** The Set ELEMENT fence — Map's key fence plus the refcounted HANDLE
- * kinds stored under identity hashing (SameValueZero for JS objects IS
- * reference identity, so a Set of server handles — portless's auxiliary-
- * server registry — is honest hashed storage; SCR_MAP_KEY_REF in the
- * runtime). netServer is the one handle admitted so far: it drops its
- * listener closures at close, so a set-in-listener cycle is temporary —
- * the child precedent's story. Symbols are identity values by DESIGN —
- * SameValueZero on a symbol IS pointer identity, so a Set of symbols (the
- * sentinel-registry idiom) is the same honest hashed storage with no
- * cycle risk at all (symbols hold only strings). */
-export function isSupportedSetElem(t) {
-    return isSupportedMapKey(t) || t.kind === "netServer" || t.kind === "symbol";
-}
-/** The Map VALUE fence: scalars plus every refcounted kind EXCEPT
- * func/promise/dyn/jsval (and map itself — no maps of maps).
+/** Values whose native reference represents JavaScript identity. Records,
+ * classes and arrays can point back at their collection, so constructors
+ * must carry key tracing as well as retain/release adapters. */
+export function isIdentityCollectionKey(t) {
+    return t.kind === "record" || t.kind === "object" || t.kind === "array" ||
+        t.kind === "netServer" || t.kind === "symbol";
+}
+/** Numbers use SameValueZero, strings use content, and reference keys use
+ * identity. A union of identity arms hashes its payload, never its temporary
+ * wrapper. Mixed scalar/reference unions remain outside this contract. */
+export function isSupportedMapKey(t, unionArms) {
+    return t.kind === "f64" || t.kind === "string" || t.kind === "dyn" || isIdentityCollectionKey(t) ||
+        (t.kind === "union" && unionArms !== undefined && unionArms.length > 0 && unionArms.every(isIdentityCollectionKey));
+}
+/** Set elements and Map keys share storage, equality and ownership rules. */
+export function isSupportedSetElem(t, unionArms) {
+    return isSupportedMapKey(t, unionArms);
+}
+/** The Map VALUE fence: scalars, supported native references and checked
+ * values. Functions require checked-value boxing; jsval has no native slot.
  * Record/object/union values can point back at the map holding them, which
  * is exactly why ref-valued maps are cycle-capable (see the backend's
  * cycle analysis and docs/memory.md). Shared frontend/validator. */
 export function isSupportedMapValue(t) {
     switch (t.kind) {
+        case "dyn":
         case "f64":
         case "bigint":
         case "string":
@@ -264,6 +274,10 @@ export function isSupportedMapValue(t) {
         case "object":
         case "union":
         case "array":
+        // Nested collections use the existing ref slot and scr_map adapters.
+        // Their key/value tracing participates in the cycle-analysis fixpoint.
+        case "map":
+        case "set":
             return true;
         // A spawned child handle (Map<string, ChildProcess> — the mdns
         // publisher registry): an ordinary refcounted pointer value (the
@@ -305,37 +319,26 @@ export function isSupportedMapValue(t) {
 /** The INDEX-SIGNATURE value fence (`{ [k: string]: V }` shapes): the map
  * VALUE kinds — the overflow portion IS a string-keyed map — plus dyn
  * (`unknown`, an unknown-valued pricing-table shape: overflow reads surface ordinary
- * dyn values validated by the usual checked casts) and three kinds the
- * overflow store carries that user Maps don't admit yet:
+ * dyn values validated by the usual checked casts) and callable values:
  *   func — `Record<string, () => void>`, the command-registry pattern
  *          (scr_closure adapters; closures are cycle-headered and traced,
  *          so a handler capturing its own registry collects)
- *   map/set — `Record<string, Map<K, V>>`/`Record<string, Set<T>>`
- *          nested-container tables (scr_map adapters; a map value's own
- *          cycle capability propagates through the trace fixpoint)
  * Nested index-signature RECORDS ride the record kind like any other.
  * Shared frontend (mapType) / validator. */
 export function isSupportedIndexValue(t) {
     return (t.kind === "dyn" ||
         t.kind === "func" ||
-        t.kind === "map" ||
-        t.kind === "set" ||
         isSupportedMapValue(t));
 }
 export function funcOf(params, ret) {
     return { kind: "func", params, ret };
 }
-/** The union FUNC/SET-arm sibling rule, shared by the frontend's union
- * builders and the validator: FUNC arms are valid beside ANY sibling —
- * `typeof x === "function"` narrows against data arms, unit tag tests
- * cover the nullable-callback shape, and between func arms closures
- * compare by pointer identity per tag (unionEq), so `x === String` is the
- * narrowing (the primitive-constructor tables' `StringConstructor |
- * NumberConstructor` field, and LinkOptions' `false | ((s: string) =>
- * string)`). A SET arm keeps the unit-only rule (no narrowing test
- * against data arms). */
-export function unionFuncSetArmsOk(arms) {
-    return arms.every((a, i) => a.kind !== "set" || arms.every((b, j) => j === i || isUnitType(b)));
+/** Maps, sets and promises may share a union with null/undefined only.
+ * Unit tag tests can narrow nullable containers without losing identity;
+ * arbitrary data siblings require a separate runtime narrowing operation.
+ * Share this rule across checker mapping, synthesized unions and validation. */
+export function unionContainerArmsOk(arms) {
+    return arms.every((a, i) => (a.kind !== "map" && a.kind !== "set" && a.kind !== "promise") || arms.every((b, j) => j === i || isUnitType(b)));
 }
 /** Canonical, injective text form of an IrType — the building block of
  * shape/union identity keys, generic-function instantiation keys, and the
@@ -397,47 +400,36 @@ export function typeKey(t) {
     }
 }
 export function typeEquals(a, b) {
-    if (a.kind === "array")
-        return b.kind === "array" && typeEquals(a.elem, b.elem);
-    if (a.kind === "bytes")
-        return b.kind === "bytes" && a.elem === b.elem;
-    if (a.kind === "map") {
-        return b.kind === "map" && typeEquals(a.key, b.key) && typeEquals(a.value, b.value);
-    }
-    if (a.kind === "set")
-        return b.kind === "set" && typeEquals(a.elem, b.elem);
-    if (a.kind === "func") {
-        return (b.kind === "func" &&
-            a.params.length === b.params.length &&
-            (a.rest === true) === (b.rest === true) &&
-            a.restAbi === b.restAbi &&
-            a.argumentsAll === b.argumentsAll &&
-            a.params.every((p, i) => typeEquals(p, b.params[i])) &&
-            typeEquals(a.ret, b.ret));
-    }
-    if (a.kind === "object")
-        return b.kind === "object" && a.className === b.className;
-    if (a.kind === "classval")
-        return b.kind === "classval" && a.className === b.className;
-    if (a.kind === "moduleNs")
-        return b.kind === "moduleNs" && a.moduleId === b.moduleId;
-    // The frontend deduplicates shapes structurally (one shapeId per canonical
-    // field list), so id equality IS structural equality.
-    if (a.kind === "record")
-        return b.kind === "record" && a.shapeId === b.shapeId;
-    // Unions are interned like shapes: one unionId per canonical arm list.
-    if (a.kind === "union")
-        return b.kind === "union" && a.unionId === b.unionId;
-    if (a.kind === "promise")
-        return b.kind === "promise" && typeEquals(a.inner, b.inner);
-    if (a.kind === "generator") {
-        return (b.kind === "generator" &&
-            (a.async === true) === (b.async === true) &&
-            typeEquals(a.yieldT, b.yieldT) &&
-            typeEquals(a.retT, b.retT) &&
-            typeEquals(a.nextT, b.nextT));
+    // Dispatch once: a chain of negative narrowing checks repeatedly retags
+    // the remaining variants when this comparator runs in the native compiler.
+    switch (a.kind) {
+        case "array": return b.kind === "array" && typeEquals(a.elem, b.elem);
+        case "bytes": return b.kind === "bytes" && a.elem === b.elem;
+        case "map": return b.kind === "map" && typeEquals(a.key, b.key) && typeEquals(a.value, b.value);
+        case "set": return b.kind === "set" && typeEquals(a.elem, b.elem);
+        case "func":
+            return (b.kind === "func" &&
+                a.params.length === b.params.length &&
+                (a.rest === true) === (b.rest === true) &&
+                a.restAbi === b.restAbi &&
+                a.argumentsAll === b.argumentsAll &&
+                a.params.every((p, i) => typeEquals(p, b.params[i])) &&
+                typeEquals(a.ret, b.ret));
+        case "object": return b.kind === "object" && a.className === b.className;
+        case "classval": return b.kind === "classval" && a.className === b.className;
+        case "moduleNs": return b.kind === "moduleNs" && a.moduleId === b.moduleId;
+        // Shapes and unions are interned, so their ids determine equality.
+        case "record": return b.kind === "record" && a.shapeId === b.shapeId;
+        case "union": return b.kind === "union" && a.unionId === b.unionId;
+        case "promise": return b.kind === "promise" && typeEquals(a.inner, b.inner);
+        case "generator":
+            return (b.kind === "generator" &&
+                (a.async === true) === (b.async === true) &&
+                typeEquals(a.yieldT, b.yieldT) &&
+                typeEquals(a.retT, b.retT) &&
+                typeEquals(a.nextT, b.nextT));
+        default: return a.kind === b.kind;
     }
-    return a.kind === b.kind;
 }
 /** True for types whose values are heap-allocated and reference-counted.
  * The single dispatch point for the backend's RC machinery: retains,
@@ -459,12 +451,17 @@ export function isFfiContextParam(param) {
 /** Script-side type represented by one scalar/span FFI class. */
 export function ffiClassType(cls) {
     switch (cls) {
+        case "i64":
+        case "u64":
+        case "pointer":
+            return BIGINT_T;
         case "bool":
             return BOOL;
         case "cstring":
         case "string":
             return STRING;
         case "bytes":
+        case "mutable-bytes":
             return BYTES_U8;
         case "void":
             return VOID;
@@ -474,11 +471,14 @@ export function ffiClassType(cls) {
 }
 /** The ordinary TypeScript function type a native callback descriptor consumes. */
 export function ffiCallbackType(callback) {
+    const params = [];
+    for (const param of callback.params) {
+        if (!isFfiContextParam(param))
+            params.push(ffiClassType(param));
+    }
     return {
         kind: "func",
-        params: callback.params
-            .filter((param) => !isFfiContextParam(param))
-            .map(ffiClassType),
+        params,
         ret: ffiClassType(callback.returns),
     };
 }
@@ -499,7 +499,7 @@ export function ffiSourceParamTypes(params) {
  * `class Error` can never collide). `lib` is the standard-library name the
  * frontend recognizes; `kind` is the runtime's SCR_ERR_* index (backends
  * stamp scr_error_vts[kind] and pick constructor kinds by it). Every
- * emitted module carries all four class defs (flagged `runtime`) so the
+ * emitted module carries the builtin class defs (flagged `runtime`) so the
  * program's preorder numbering always covers them — the runtime's own
  * throws (JSON/dynCheck/regex) mint instances of these classes whether or
  * not user code mentions Error. */
@@ -513,8 +513,11 @@ export const RUNTIME_ERROR_CLASSES = new Map([
     // cause) lives in runtime-side slots BEYOND the ScrError prefix the IR
     // fields describe, reached only through the error.dom* libCalls — so
     // user `extends DOMException` is fenced (the subclass layout would
-    // overlap the hidden slots), where the other four extend freely.
+    // overlap the hidden slots), while the standard Error classes extend freely.
     ["%DOMException", { lib: "DOMException", kind: 4, base: "%Error" }],
+    ["%ReferenceError", { lib: "ReferenceError", kind: 5, base: "%Error" }],
+    ["%EvalError", { lib: "EvalError", kind: 6, base: "%Error" }],
+    ["%URIError", { lib: "URIError", kind: 7, base: "%Error" }],
 ]);
 /** The runtime-provided node:events EventEmitter class (ScrEmitter /
  * scr_emitter_*, scr_events_emitter.c — link-gated by moduleUsesEmitter,
@@ -548,6 +551,15 @@ export const RUNTIME_STREAM_CLASSES = new Map([
     ["%Transform", { lib: "Transform", base: "%Duplex", sides: "rw" }],
     ["%PassThrough", { lib: "PassThrough", base: "%Transform", sides: "rw" }],
 ]);
+/** Codec records have private native state, not a structurally checkable
+ * data surface. Reserve the same '%' namespace as other internal slots. */
+export function recordTextCodecClass(shape) {
+    if (shape.fields.some((f) => f.name === "%TextEncoder"))
+        return "TextEncoder";
+    if (shape.fields.some((f) => f.name === "%TextDecoder"))
+        return "TextDecoder";
+    return null;
+}
 /** Object-literal ACCESSOR properties (`{ get x() {...}, set x(v) {...} }`)
  * live on the shape as reserved '%'-fields holding closures: `%get:x` a
  * `() => T` invoked once per property READ (side effects and all — JS's
@@ -583,6 +595,7 @@ export const MAY_THROW_BYTES_METHODS = new Set([
     "toStringVar",
     "with",
     "setFrom",
+    "setFromDyn",
     "readNum",
     "writeNum",
     "readNumVar",
@@ -704,38 +717,53 @@ export function isJsonSafeType(t, getRecord, getUnion) {
 export function isJsonStringifySafeType(t, getRecord, getUnion) {
     return isJsonSafeAt(t, getRecord, getUnion, true, false, new Set());
 }
+/** A JSON-shaped container with unknown payloads needs the runtime JSON
+ * traversal. Its declared structure can be boxed, but payloads may carry
+ * omitted values, toJSON methods, or cycles. This predicate does not widen
+ * the type-directed serializer, checked-island boundary, or root-undefined
+ * contract; callers must select the checked runtime traversal explicitly. */
+export function isJsonStringifyDynamicType(t, getRecord, getUnion) {
+    return (t.kind === "record" || t.kind === "array" || t.kind === "union") &&
+        isJsonSafeAt(t, getRecord, getUnion, true, false, new Set(), true) &&
+        !isJsonStringifySafeType(t, getRecord, getUnion);
+}
 /** The recursion shared by checked JSON conversion and stringification.
  * Ordinary record fields always admit undefined by dropping the key. Array
- * and tuple slots admit it only for stringification, which writes null. */
-function isJsonSafeAt(t, getRecord, getUnion, stringify, undefinedAllowed, visiting) {
+ * and tuple slots admit it only for stringification, which writes null.
+ * Direct loops avoid allocating captured callbacks at each recursive edge. */
+function isJsonSafeAt(t, getRecord, getUnion, stringify, undefinedAllowed, visiting, nativeFields = false) {
     if (HANDLE_KINDS.has(t.kind))
         return false;
     switch (t.kind) {
+        case "dyn":
+            return nativeFields;
         case "f64":
         case "string":
         case "bool":
             return true;
         case "array":
-            return isJsonSafeAt(t.elem, getRecord, getUnion, stringify, stringify, visiting);
+            return isJsonSafeAt(t.elem, getRecord, getUnion, stringify, stringify, visiting, nativeFields);
         case "record": {
             const shape = getRecord(t.shapeId);
             if (!shape)
                 return false;
+            if (recordTextCodecClass(shape) !== null)
+                return false;
             // The recursive knot: answer true and let the rest of the graph
-            // decide (any unsafe constituent is found on its own path; a false
-            // short-circuits every `every` up the walk).
+            // decide (any unsafe constituent ends the traversal immediately).
             if (visiting.has(t.shapeId))
                 return true;
             visiting.add(t.shapeId);
-            if (!shape.fields.every((f) => isJsonSafeAt(f.type, getRecord, getUnion, stringify, !shape.tuple || stringify, visiting))) {
-                return false;
+            for (const field of shape.fields) {
+                if (!isJsonSafeAt(field.type, getRecord, getUnion, stringify, !shape.tuple || stringify, visiting, nativeFields))
+                    return false;
             }
             // Overflow values sit in record-key position too: dyn is JSON-safe
             // HERE (the checked-dynamic tree serializes itself; undefined-valued entries drop
             // like any undefined-valued key), everything else follows the
             // record-field rule.
             if (shape.indexValue && shape.indexValue.kind !== "dyn") {
-                return isJsonSafeAt(shape.indexValue, getRecord, getUnion, stringify, true, visiting);
+                return isJsonSafeAt(shape.indexValue, getRecord, getUnion, stringify, true, visiting, nativeFields);
             }
             return true;
         }
@@ -747,8 +775,20 @@ function isJsonSafeAt(t, getRecord, getUnion, stringify, undefinedAllowed, visit
             if (visiting.has(key))
                 return true; // the recursive knot, union-flavored
             visiting.add(key);
-            return def.arms.every((a) => a.kind === "undefinedT" ? undefinedAllowed : isJsonSafeAt(a, getRecord, getUnion, stringify, undefinedAllowed, visiting));
+            for (const arm of def.arms) {
+                if (!(arm.kind === "undefinedT" ? undefinedAllowed : isJsonSafeAt(arm, getRecord, getUnion, stringify, undefinedAllowed, visiting, nativeFields)))
+                    return false;
+            }
+            return true;
         }
+        case "set":
+            return nativeFields && !stringify && t.elem.kind === "dyn";
+        case "bigint":
+        case "regex":
+        case "url":
+            return nativeFields && !stringify;
+        case "bytes":
+            return nativeFields;
         case "func":
         case "object":
         // Class values stringify as "{}" husks in Node (own enumerable statics
@@ -757,27 +797,13 @@ function isJsonSafeAt(t, getRecord, getUnion, stringify, undefinedAllowed, visit
         // Maps are not JSON (JSON.stringify(new Map()) is "{}" in Node — an
         // empty-object husk nobody wants; stringify/dynCheck reject instead).
         case "map":
-        // Sets stringify as the same "{}" husk — rejected like Maps.
-        case "set":
-        // Regexes are not JSON (JSON.stringify(/a/) is "{}" in Node — the same
-        // empty-object husk as Maps; stringify/dynCheck reject instead).
-        case "regex":
         case "date":
-        // URLs stringify as "{}" husks in Node too (data properties live on
-        // internal slots) — rejected the same way; use url.href instead.
-        case "url":
         // URLSearchParams stringifies as the same "{}" husk — rejected; use
         // sp.toString() instead.
         case "searchParams":
         // Symbols are DROPPED by Node's stringify (undefined at the top level,
         // omitted as object values) — silent divergence banned; rejected.
         case "symbol":
-        case "bigint":
-        // Typed arrays stringify as index-keyed objects ({"0":1,...}) and
-        // Buffers as {type:"Buffer",data:[...]} in Node — neither shape is
-        // representable type-directedly; rejected like Maps.
-        case "bytes":
-        case "dyn":
         case "jsval":
         case "caught":
         case "promise":
@@ -830,7 +856,8 @@ export function canMarshalFuncIntoIsland(t) {
 }
 /** Parameter types a TYPED closure may declare when it crosses INTO the
  * island as a host function: jsval params take the engine argument as a
- * handle (the all-'any' shape above); every other admitted type converts
+ * handle (the all-'any' shape above); dyn params normalize scalars or retain
+ * engine objects by reference. Every other admitted type converts
  * AT CALL TIME through the validated-exit machinery — strict primitives,
  * JSON round-trip composites (the dynCheck walker: width-tolerant records,
  * path-annotated failures). On top of the jsExit set, a bare `T | undefined`
@@ -839,7 +866,7 @@ export function canMarshalFuncIntoIsland(t) {
  * commander case: `.action((text: string | undefined, opts) => ...)` sees
  * undefined when the command argument is omitted). */
 export function isIslandCallbackParamType(t, getRecord, getUnion) {
-    if (t.kind === "jsval")
+    if (t.kind === "jsval" || t.kind === "dyn")
         return true;
     if (isJsonSafeType(t, getRecord, getUnion))
         return true;
@@ -884,8 +911,8 @@ export function islandCallbackRet(t, getRecord, getUnion) {
  * closures whose params are per-argument-convertible at call time
  * (isIslandCallbackParamType) and whose return classifies
  * (islandCallbackRet). Same arity cap — the runtime's host-call argument
- * buffer. Closures taking closures and 'unknown'-typed params stay fenced
- * (no per-type extraction exists for them inside a host call). */
+ * buffer. Statically typed closure parameters stay fenced; unknown values
+ * enter as checked-dynamic values and are validated at each typed use. */
 export function canMarshalTypedFuncIntoIsland(t, getRecord, getUnion) {
     if (t.kind !== "func")
         return false;
@@ -932,7 +959,7 @@ export function canMarshalTypedFuncIntoIsland(t, getRecord, getUnion) {
  * through a dyn value), properties ON function values, and params/results
  * outside the conversion domains (Maps, class instances, ...). Promises
  * CONVERT in (canConvertToDyn's promise arm — an async dyn-boxed closure's
- * return) but do not check OUT (`u as Promise<T>` stays fenced).
+ * return); checking OUT preserves the boxed Promise<unknown> payload ABI.
  */
 /** The runtime HANDLE kinds that cross the checked-dynamic boundary as
  * the checked-dynamic tree's HANDLE kind (SCR_DYN_HANDLE): boxed by REFERENCE (identity —
@@ -946,6 +973,7 @@ export function canMarshalTypedFuncIntoIsland(t, getRecord, getUnion) {
  * (dynCheck's "expected IncomingMessage ..." texts). */
 export const DYN_HANDLE_KINDS = new Map([
     ["child", { tag: "SCR_DYNH_CHILD", cls: "ChildProcess" }],
+    ["fileHandle", { tag: "SCR_DYNH_FILE_HANDLE", cls: "FileHandle" }],
     ["httpReq", { tag: "SCR_DYNH_HTTP_REQ", cls: "IncomingMessage" }],
     ["httpRes", { tag: "SCR_DYNH_HTTP_RES", cls: "ServerResponse" }],
     ["netSocket", { tag: "SCR_DYNH_NET_SOCKET", cls: "Socket" }],
@@ -968,31 +996,51 @@ export function isDynTypedRefType(t) {
 export function isClassOwnEnumerableFieldName(name) {
     return !name.startsWith("#") && !name.startsWith("%");
 }
+/** Compiler-owned storage for properties added through untyped references. */
+export const DYN_CLASS_PROPERTIES = "%dynProperties";
+/** A class capsule can always preserve its exact native identity. Its
+ * optional property view additionally needs converters in both directions;
+ * fields such as Maps may remain opaque without preventing the round trip. */
+export function classDynViewSupported(fields, getRecord, getUnion) {
+    const checkable = (type) => {
+        if (isDynTypedRefType(type) || isUnitType(type))
+            return true;
+        if (type.kind === "union")
+            return getUnion(type.unionId)?.arms.every(checkable) ?? false;
+        return canDynCheckTo(type, getRecord, getUnion);
+    };
+    return fields.every((field) => !isClassOwnEnumerableFieldName(field.name) ||
+        (canConvertToDyn(field.type, getRecord, getUnion) && checkable(field.type)));
+}
 /** A static type that CONVERTS into a dyn value — the dynFrom domain:
- * JSON-safe data, bytes<u8> (payload copied), identity-preserving class
+ * JSON-safe data, numeric typed arrays (retained views), identity-preserving class
  * references, undefined-armed unions of those arms, boxable function types,
  * and the runtime HANDLE kinds (boxed by reference — DYN_HANDLE_KINDS). */
-export function canConvertToDyn(t, getRecord, getUnion) {
+export function canConvertToDyn(t, getRecord, getUnion, visiting = new Set()) {
     if (isJsonSafeType(t, getRecord, getUnion))
         return true;
-    // bytes<u8> and boxable functions are dyn kinds the walker boxes
-    // ANYWHERE (bytes copied, functions held by identity), including nested
+    // numeric typed arrays and boxable functions are dyn kinds the walker boxes
+    // ANYWHERE (bytes and functions held by identity), including nested
     // in records/arrays/unions. isJsonSafeType rejects them, but dynFrom
     // needs only that the walker can build the dyn value, so this composite
     // fold extends the JSON-safe core.
-    if (canBoxDynComposite(t, getRecord, getUnion))
+    if (canBoxDynComposite(t, getRecord, getUnion, visiting))
         return true;
-    if (t.kind === "bytes" && t.elem === "u8")
+    if (t.kind === "bytes")
         return true;
-    // %Error converts as the checked-dynamic tree's error encoding ({%error, name, message,
+    // Built-in errors convert as the checked-dynamic tree's error encoding ({%error, name, message,
     // code?} — the caughtToDyn shape, scr_dyn_from_error): the dyn 'error'
     // listener boundary (a mustCall-wrapped handler receiving the payload).
-    if (t.kind === "object" && t.className === "%Error")
+    if (t.kind === "object" && RUNTIME_ERROR_CLASSES.has(t.className))
         return true;
     if (isDynTypedRefType(t))
         return true;
+    if (t.kind === "generator")
+        return true;
+    if (t.kind === "classval")
+        return true;
     if (t.kind === "func")
-        return canBoxFuncIntoDyn(t, getRecord, getUnion);
+        return canBoxFuncIntoDyn(t, getRecord, getUnion, visiting);
     if (DYN_HANDLE_KINDS.has(t.kind))
         return true;
     // Promises box by REFERENCE (SCR_DYN_PROMISE): promise<dyn> carries its
@@ -1004,7 +1052,7 @@ export function canConvertToDyn(t, getRecord, getUnion) {
     if (t.kind === "promise") {
         return (t.inner.kind === "dyn" ||
             t.inner.kind === "void" ||
-            canConvertToDyn(t.inner, getRecord, getUnion));
+            canConvertToDyn(t.inner, getRecord, getUnion, visiting));
     }
     if (t.kind === "union") {
         const def = getUnion(t.unionId);
@@ -1013,44 +1061,77 @@ export function canConvertToDyn(t, getRecord, getUnion) {
         // union's func arm crosses through the checked-dynamic function
         // boundary exactly like a bare func dynFrom).
         return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion) ||
-            isDynTypedRefType(a) || DYN_HANDLE_KINDS.has(a.kind) ||
-            (a.kind === "func" && canBoxFuncIntoDyn(a, getRecord, getUnion)) ||
-            (a.kind === "promise" && canConvertToDyn(a, getRecord, getUnion)));
+            isDynTypedRefType(a) || a.kind === "classval" || DYN_HANDLE_KINDS.has(a.kind) ||
+            (a.kind === "func" && canBoxFuncIntoDyn(a, getRecord, getUnion, visiting)) ||
+            (a.kind === "promise" && canConvertToDyn(a, getRecord, getUnion, visiting)));
     }
     return false;
 }
 /** The composite extension of the dynFrom domain: JSON-safe scalars plus
- * bytes<u8> and boxable functions anywhere, recursing through records
+ * numeric typed arrays and boxable functions anywhere, recursing through records
  * (fields + index value), arrays, and unit-armed unions — exactly the
- * sc_td_* walker's capability. Returns false for a composite carrying a
- * kind the walker cannot box (Maps or handles nested in a record); those
- * still fence. */
+ * sc_td_* walker's capability. Map and Set payloads must also support
+ * checked extraction back into native storage. Other unsupported nested
+ * kinds retain their conversion fence. */
 function canBoxDynComposite(t, getRecord, getUnion, visiting = new Set()) {
+    const key = `boxed:${typeKey(t)}`;
+    if (visiting.has(key))
+        return true;
+    const result = canBoxDynCompositeAt(t, getRecord, getUnion, visiting);
+    if (result)
+        visiting.add(key);
+    else
+        clearDynConversionResults(visiting);
+    return result;
+}
+function canBoxDynCompositeAt(t, getRecord, getUnion, visiting) {
     switch (t.kind) {
         case "f64":
+        case "bigint":
+        case "symbol":
         case "string":
         case "bool":
         case "dyn":
         case "undefinedT":
         case "nullT":
+        case "classval":
             return true;
         case "bytes":
-            return t.elem === "u8";
+        case "regex":
+        case "url":
+        case "searchParams":
+            return true;
         case "func":
-            return canBoxFuncIntoDyn(t, getRecord, getUnion);
+            return canBoxFuncIntoDyn(t, getRecord, getUnion, visiting);
+        case "set":
+            return canConvertToDyn(t.elem, getRecord, getUnion, visiting) && canDynCheckTo(t.elem, getRecord, getUnion, visiting);
+        case "map":
+            return canConvertToDyn(t.key, getRecord, getUnion, visiting) && canDynCheckTo(t.key, getRecord, getUnion, visiting) &&
+                canConvertToDyn(t.value, getRecord, getUnion, visiting) && canDynCheckTo(t.value, getRecord, getUnion, visiting);
+        case "object":
+            return RUNTIME_ERROR_CLASSES.has(t.className) || isDynTypedRefType(t);
         case "array":
             return canBoxDynComposite(t.elem, getRecord, getUnion, visiting);
         case "record": {
             const shape = getRecord(t.shapeId);
             if (!shape)
                 return false;
+            if (recordTextCodecClass(shape) !== null)
+                return false;
             // Recursive shapes answer coinductively, like isJsonSafeType.
             if (visiting.has(t.shapeId))
                 return true;
             visiting.add(t.shapeId);
-            if (!shape.fields.every((f) => canBoxDynComposite(f.type, getRecord, getUnion, visiting)))
-                return false;
-            return !shape.indexValue || canBoxDynComposite(shape.indexValue, getRecord, getUnion, visiting);
+            try {
+                for (const field of shape.fields) {
+                    if (!canBoxDynComposite(field.type, getRecord, getUnion, visiting))
+                        return false;
+                }
+                return !shape.indexValue || canBoxDynComposite(shape.indexValue, getRecord, getUnion, visiting);
+            }
+            finally {
+                visiting.delete(t.shapeId);
+            }
         }
         case "union": {
             const def = getUnion(t.unionId);
@@ -1059,31 +1140,104 @@ function canBoxDynComposite(t, getRecord, getUnion, visiting = new Set()) {
             if (visiting.has(t.unionId))
                 return true;
             visiting.add(t.unionId);
-            return def.arms.every((a) => canBoxDynComposite(a, getRecord, getUnion, visiting));
+            try {
+                for (const arm of def.arms) {
+                    if (!canBoxDynComposite(arm, getRecord, getUnion, visiting))
+                        return false;
+                }
+                return true;
+            }
+            finally {
+                visiting.delete(t.unionId);
+            }
         }
         default:
             return false;
     }
 }
 /** A type a dyn value can be VALIDATED into — the dynCheck domain:
- * JSON-safe data, bytes<u8> (a fresh copy out), the %Error extraction,
+ * JSON-safe data, numeric typed arrays (retained views), the %Error extraction,
  * undefined-armed unions of JSON-safe arms, adaptable function types,
  * and the runtime HANDLE kinds (a tag-checked reference unwrap —
  * DYN_HANDLE_KINDS). */
-export function canDynCheckTo(t, getRecord, getUnion) {
-    if (isJsonSafeType(t, getRecord, getUnion))
+export function canDynCheckTo(t, getRecord, getUnion, visiting = new Set()) {
+    const key = `checked:${typeKey(t)}`;
+    if (visiting.has(key))
         return true;
-    if (t.kind === "bytes" && t.elem === "u8")
+    const result = canDynCheckToAt(t, getRecord, getUnion, visiting);
+    if (result)
+        visiting.add(key);
+    else
+        clearDynConversionResults(visiting);
+    return result;
+}
+/** Reuse completed subgraphs within one conversion query. A failed branch
+ * invalidates successes that may depend on a coinductive back-edge to it;
+ * active recursion keys remain until their owning calls unwind. */
+function clearDynConversionResults(visiting) {
+    for (const key of visiting) {
+        if (key.startsWith("boxed:") || key.startsWith("checked:"))
+            visiting.delete(key);
+    }
+}
+function canDynCheckToAt(t, getRecord, getUnion, visiting) {
+    // Unknown fields keep an owned dyn subtree; checking the surrounding
+    // record/array still validates its layout. This is broader than the
+    // stringify/island JSON domain, which cannot assume opaque slots are
+    // serializable. Backends already retain dyn fields and fill missing
+    // unknown record fields with the undefined value.
+    if (isJsonSafeAt(t, getRecord, getUnion, false, false, new Set(), true))
+        return true;
+    if (t.kind === "bigint" || t.kind === "symbol" || t.kind === "date" || t.kind === "searchParams")
+        return true;
+    if (t.kind === "map" || t.kind === "set")
+        return canBoxDynComposite(t, getRecord, getUnion, visiting);
+    if (t.kind === "bytes")
+        return true;
+    if (t.kind === "classval")
+        return true;
+    if (t.kind === "generator")
         return true;
+    if (t.kind === "promise")
+        return t.inner.kind === "dyn" || t.inner.kind === "void" || canDynCheckToAt(t.inner, getRecord, getUnion, visiting);
     if (t.kind === "object" && t.className === "%Error")
         return true;
+    // Native class capsules already support checked extraction at ordinary
+    // boundaries. Callable adapters use the same identity/brand check.
+    if (isDynTypedRefType(t))
+        return true;
+    if (t.kind === "array") {
+        const key = typeKey(t);
+        if (visiting.has(key))
+            return false;
+        visiting.add(key);
+        const result = canDynCheckTo(t.elem, getRecord, getUnion, visiting);
+        visiting.delete(key);
+        return result;
+    }
+    if (t.kind === "record") {
+        const key = typeKey(t);
+        if (visiting.has(key))
+            return false;
+        const shape = getRecord(t.shapeId);
+        if (!shape || shapeHasAccessorSlots(shape))
+            return false;
+        visiting.add(key);
+        const result = shape.fields.every((field) => canDynCheckTo(field.type, getRecord, getUnion, visiting)) &&
+            (!shape.indexValue || canDynCheckTo(shape.indexValue, getRecord, getUnion, visiting));
+        visiting.delete(key);
+        return result;
+    }
     if (t.kind === "func")
-        return canAdaptDynFuncTo(t, getRecord, getUnion);
+        return canAdaptDynFuncTo(t, getRecord, getUnion, visiting);
     if (DYN_HANDLE_KINDS.has(t.kind))
         return true;
     if (t.kind === "union") {
         const def = getUnion(t.unionId);
-        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion));
+        // Optional native callbacks and handles retain the same checked
+        // conversion as their bare value. The union matcher selects the arm
+        // before its adapter/extractor runs.
+        return !!def && def.arms.every((a) => isUnitType(a) || (a.kind !== "union" && canDynCheckTo(a, getRecord, getUnion, visiting)));
     }
     return false;
 }
@@ -1091,34 +1245,34 @@ export function canDynCheckTo(t, getRecord, getUnion) {
  * every param dyn or dynCheckable (the thunk validates dyn arguments into
  * them), return void, dyn, or dyn-convertible (the thunk converts it
  * back). */
-export function canBoxFuncIntoDyn(t, getRecord, getUnion) {
+export function canBoxFuncIntoDyn(t, getRecord, getUnion, visiting = new Set()) {
     return (t.kind === "func" &&
-        // Only the legacy hidden-dyn rest ABI has a checked-dynamic call thunk.
-        // Typed rest stays static (its trailing array is compiler-packed), and
-        // island rest has its separate engine host-callback adapter.
-        (t.rest !== true || t.restAbi === undefined) &&
+        // Typed rest occupies the final native array parameter; its thunk
+        // checks a fresh array containing all remaining call arguments.
+        // Island rest keeps its separate engine host-callback adapter.
+        (t.rest !== true || t.restAbi === undefined ||
+            (t.restAbi === "typed" && t.params.at(-1)?.kind === "array")) &&
         // A jsval (island) param converts through scr_jsval_from_dyn in the
         // thunk (wrapped cells unwrap by reference, dyn data deep-copies) —
         // the checker-'any' callback params of the routed-dispatch lane
         // (`bag.list.map((x) => ...)` with x typed any).
-        t.params.every((p) => p.kind === "dyn" || p.kind === "jsval" || canDynCheckTo(p, getRecord, getUnion)) &&
+        t.params.every((p) => p.kind === "dyn" || p.kind === "jsval" || canDynCheckTo(p, getRecord, getUnion, visiting)) &&
         // A jsval return converts through the by-reference wrap
         // (dynFromJsval — the thunk's result conversion), so engine-returning
         // callbacks box too: the routed-dispatch lane's flatMap shape.
-        (t.ret.kind === "void" || t.ret.kind === "dyn" || t.ret.kind === "jsval" || canConvertToDyn(t.ret, getRecord, getUnion)));
+        (t.ret.kind === "void" || t.ret.kind === "dyn" || t.ret.kind === "jsval" || canConvertToDyn(t.ret, getRecord, getUnion, visiting)));
 }
 /** A closure type a dyn function value can ADAPT to (dynCheck): every
  * param dyn or dyn-convertible (the adapter converts typed arguments into
  * dyn), return void, dyn, or dynCheckable (the adapter validates the dyn
  * result). */
-export function canAdaptDynFuncTo(t, getRecord, getUnion) {
+export function canAdaptDynFuncTo(t, getRecord, getUnion, visiting = new Set()) {
     return (t.kind === "func" &&
-        // A variadic (rest-marked) target would need the trailing rest-array
-        // param synthesized by the adapter — no adapter models that; variadic
-        // values live boxed and are called through their own thunks.
-        t.rest !== true &&
-        t.params.every((p) => p.kind === "dyn" || canConvertToDyn(p, getRecord, getUnion)) &&
-        (t.ret.kind === "void" || t.ret.kind === "dyn" || canDynCheckTo(t.ret, getRecord, getUnion)));
+        // Checked rest and arguments packs retain all actual arguments. Typed
+        // and island rest ABIs still require their own conversion plan.
+        (t.rest !== true || t.restAbi === undefined) &&
+        t.params.every((p) => p.kind === "dyn" || canConvertToDyn(p, getRecord, getUnion, visiting)) &&
+        (t.ret.kind === "void" || t.ret.kind === "dyn" || canDynCheckTo(t.ret, getRecord, getUnion, visiting)));
 }
 /** The MARSHAL-direction boundary (jsMarshal): everything that can cross
  * out and back (canCrossIslandBoundary) plus qualifying closures — those
@@ -1177,130 +1331,227 @@ export function canExitIslandToType(t, getRecord, getUnion) {
     }
     return false;
 }
+const DYN_ASYNC_LIB_FNS = new Set([
+    "fs.callbackValue", "fs.callbackCall",
+    "async.awaitDyn", "timers.immediatePromise", "crypto.native",
+    "process.onUncaughtException", "process.offUncaughtException",
+    "process.onUnhandledRejection", "process.offUnhandledRejection",
+    "process.onRejectionHandled", "process.offRejectionHandled",
+    "process.onWarning", "process.offWarning", "process.emitWarning",
+    "als.new", "als.get", "als.run", "als.exitRun", "als.enterWith", "als.disable",
+    "dc.chanBindStore", "dc.chanUnbindStore", "dc.chanRunStores",
+]);
+/** Inspect types and expressions together in one traversal. This is a fresh
+ * snapshot: callers may mutate an IR module between compilation passes. */
+export function moduleRuntimeFeatures(mod) {
+    return scanRuntimeFeatures(mod);
+}
+function scanRuntimeFeatures(mod, stopAt) {
+    const features = {
+        regex: false, copying: false, legacyTextDecoder: false, fileHandle: false,
+        fetch: mod.embedded?.modules.some((m) => m.usesFetch === true) ?? false,
+        processEvents: false, emitter: (mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS),
+        stream: (mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)),
+        zlib: mod.embedded?.edges.some((e) => e.to === "node:zlib") ?? false,
+        dc: false, assert: false, dynInvoke: false,
+        dynAsync: mod.functions.some((fn) => fn.async === true && fn.generator === undefined && fn.returnType.kind === "dyn"),
+        inspect: false,
+        childProcess: false, net: false, symbol: false, bigint: false, searchParams: false,
+        qs: false, parseArgs: false, fsWatch: false, nodeTest: false, dgram: false,
+        http: false, http2: false, tls: false, tlsCa: false,
+    };
+    const keepGoing = () => stopAt === undefined || !features[stopAt];
+    const expr = (node) => {
+        if (node.kind === "libCall") {
+            const fn = node.fn;
+            if (fn === "regexp.escape" || fn === "dyn.nativeRegexIs")
+                features.regex = true;
+            if (fn === "text.decodeLegacy" || fn === "text.decodeLegacyOptions" || fn === "text.decodeStream")
+                features.legacyTextDecoder = true;
+            if (fn.startsWith("fetch."))
+                features.fetch = true;
+            if (PROCESS_EVENT_LIB_FNS.has(fn))
+                features.processEvents = true;
+            if (fn.startsWith("emitter."))
+                features.emitter = true;
+            if (fn.startsWith("readable.") || fn.startsWith("writable.") || fn.startsWith("duplex.") ||
+                fn.startsWith("transform.") || fn.startsWith("passthrough.") || fn.startsWith("sc.") ||
+                fn.startsWith("stream.set") || fn === "stream.destroy" || fn === "stream.destroyErr" ||
+                fn === "stream.prop" || fn === "stream.errored" || fn === "sp.finished" || fn === "sp.pipeline")
+                features.stream = true;
+            if (fn.startsWith("zlib."))
+                features.zlib = true;
+            if (fn.startsWith("dc."))
+                features.dc = true;
+            if (fn.startsWith("assert."))
+                features.assert = true;
+            if (fn === "dyn.defineProps" || fn === "dyn.defineProperty" || fn === "dyn.objCreateWithProperties" || fn === "dyn.arrayProtoCall" || fn === "dyn.arrayPrototype" || fn === "dyn.functionApply" || fn === "dyn.builtinMethod")
+                features.dynInvoke = true;
+            if (DYN_ASYNC_LIB_FNS.has(fn))
+                features.dynAsync = true;
+            if (fn.startsWith("insp.") || fn === "console.native" || fn === "global.native")
+                features.inspect = true;
+            if (fn.startsWith("cp.") || fn.startsWith("child.") || fn.startsWith("writer.") || fn.startsWith("spawnRes.") ||
+                fn === "process.forkTarget" || fn === "process.connected" || fn === "process.send" || fn === "process.sendCb" ||
+                fn === "process.disconnect" || fn === "process.onMessage" || fn === "process.onDisconnect")
+                features.childProcess = true;
+            if (fn.startsWith("net."))
+                features.net = true;
+            if (fn.startsWith("http.")) {
+                features.net = true;
+                features.http = true;
+            }
+            if (fn.startsWith("tls.") || fn.startsWith("https.") || fn.startsWith("http2.")) {
+                features.net = true;
+                features.http = true;
+                features.tls = true;
+            }
+            if (fn.startsWith("http2.") && !HTTP2_LEGACY_FNS.has(fn))
+                features.http2 = true;
+            if (fn.startsWith("sym."))
+                features.symbol = true;
+            if (fn === "process.hrtimeValue")
+                features.bigint = true;
+            if (fn.startsWith("bigint."))
+                features.bigint = true;
+            if (fn.startsWith("sp.") || fn === "url.searchParams")
+                features.searchParams = true;
+            if (fn === "qs.parse" || fn === "qs.stringify" || fn === "qs.unescape")
+                features.qs = true;
+            if (fn === "util.parseArgs")
+                features.parseArgs = true;
+            if (fn.startsWith("fs.watch") || fn.startsWith("watcher."))
+                features.fsWatch = true;
+            if (fn.startsWith("test."))
+                features.nodeTest = true;
+            if (fn.startsWith("dgram.") || fn.startsWith("dns."))
+                features.dgram = true;
+            if (fn.startsWith("tlsca."))
+                features.tlsCa = true;
+        }
+        else {
+            switch (node.kind) {
+                case "regexLit":
+                case "regexIntrinsic":
+                    features.regex = true;
+                    break;
+                case "strIntrinsic":
+                    if (node.method === "toLowerCase" || node.method === "toUpperCase")
+                        features.regex = true;
+                    break;
+                case "arrIntrinsic":
+                    if (node.method === "toReversed" || node.method === "toSpliced" || node.method === "with" || node.method === "withUndefined")
+                        features.copying = true;
+                    break;
+                case "bytesIntrinsic":
+                    if (node.method === "toReversed" || node.method === "with" || node.method === "join" || node.method === "toArray")
+                        features.copying = true;
+                    break;
+                case "jsOp":
+                    if (node.op === "globalGet" && node.name === "fetch")
+                        features.fetch = true;
+                    break;
+                case "dynInvoke":
+                    features.dynInvoke = true;
+                    break;
+                case "awaitExpr":
+                    if (node.type.kind === "dyn")
+                        features.dynAsync = true;
+                    break;
+                case "dynFrom": {
+                    const boxed = node.value.type;
+                    if (boxed.kind === "promise" || (boxed.kind === "func" && boxed.ret.kind === "promise"))
+                        features.dynAsync = true;
+                    break;
+                }
+            }
+        }
+        return keepGoing();
+    };
+    const type = (node) => {
+        switch (node.kind) {
+            case "regex":
+                features.regex = true;
+                break;
+            case "fileHandle":
+                features.fileHandle = true;
+                break;
+            case "child":
+            case "childStream":
+            case "childWriter":
+            case "spawnRes":
+                features.childProcess = true;
+                break;
+            case "netServer":
+            case "netSocket":
+                features.net = true;
+                break;
+            case "http2Session":
+            case "http2Stream":
+                features.net = true;
+                features.http2 = true;
+                break;
+            case "httpReq":
+            case "httpRes":
+            case "httpClientReq":
+                features.net = true;
+                features.http = true;
+                break;
+            case "secureCtx":
+                features.net = true;
+                features.http = true;
+                features.tls = true;
+                break;
+            case "symbol":
+                features.symbol = true;
+                break;
+            case "bigint":
+                features.bigint = true;
+                break;
+            case "searchParams":
+                features.searchParams = true;
+                break;
+            case "fsWatcher":
+                features.fsWatch = true;
+                break;
+            case "testCtx":
+                features.nodeTest = true;
+                break;
+            case "dgramSocket":
+                features.dgram = true;
+                break;
+        }
+        return keepGoing();
+    };
+    if (keepGoing())
+        everyModuleNode(mod, { expr, stmt: keepGoing, type });
+    return features;
+}
 /** True when the module contains any regex construct — a regexLit /
  * regexIntrinsic node or a regex-typed slot anywhere. This is the link
  * switch that pulls scr_regex.c + the vendored libregexp into the binary
- * (native-toolchain.ts); regex-free programs keep the historical command line. A generic
- * JSON walk: `kind` discriminants live only on IR objects, so user string
- * VALUES can never false-positive. */
+ * (native-toolchain.ts); regex-free programs keep the historical command line. The
+ * typed traversal visits type slots as well as executable nodes. */
 export function moduleUsesRegex(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const kind = v.kind;
-        if (kind === "regex" || kind === "regexLit" || kind === "regexIntrinsic") {
-            found = true;
-            return;
-        }
-        // The lre-backed case conversions live in scr_regex.c (libunicode's
-        // case tables): they ride the same link switch as regex nodes.
-        if (kind === "strIntrinsic") {
-            const method = v.method;
-            if (method === "toLowerCase" || method === "toUpperCase") {
-                found = true;
-                return;
-            }
-        }
-        // RegExp.escape lives in scr_regex.c too (needing no engine — it
-        // keeps the always-linked string TU out of hello-world's size class).
-        if (kind === "libCall" && v.fn === "regexp.escape") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "regex").regex;
 }
 /** True when the module contains an intrinsic whose implementation lives
  * in scr_copying.c. This is the link switch that keeps the optional
  * Array-copying and typed-array bridge TU out of unrelated binaries. */
 export function moduleUsesCopying(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "arrIntrinsic" &&
-            (node.method === "toReversed" ||
-                node.method === "toSpliced" ||
-                node.method === "with" ||
-                node.method === "withUndefined")) {
-            found = true;
-            return;
-        }
-        if (node.kind === "bytesIntrinsic" &&
-            (node.method === "toReversed" ||
-                node.method === "with" ||
-                node.method === "join" ||
-                node.method === "toArray")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "copying").copying;
 }
 /** True when a non-UTF-8 TextDecoder call survives lowering. This gates the
  * generated legacy mapping tables inside scr_bytes.c; the default UTF-8
  * decoder and unrelated Buffer users keep their prior runtime object. */
 export function moduleUsesLegacyTextDecoder(mod) {
-    let found = false;
-    const visit = (value) => {
-        if (found || value === null || typeof value !== "object")
-            return;
-        if (Array.isArray(value)) {
-            for (const item of value)
-                visit(item);
-            return;
-        }
-        const node = value;
-        if (node.kind === "libCall" && node.fn === "text.decodeLegacy") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(value))
-            visit(value[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "legacyTextDecoder").legacyTextDecoder;
 }
 /** True when a FileHandle type survives in the module. This is the link
  * switch for scr_file_handle.c; fs/promises.open carries the type inside its
  * promise result even when no handle method is called. */
 export function moduleUsesFileHandle(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        if (v.kind === "fileHandle") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "fileHandle").fileHandle;
 }
 /** True when user code lowers static fetch or the embedded npm graph
  * reaches the engine's global fetch — the link switch that pulls scr_fetch.c +
@@ -1310,35 +1561,12 @@ export function moduleUsesFileHandle(mod) {
  * and local `fetch` bindings do not change the link or target capability.
  * Fetch-free graphs keep their exact historical link lines. */
 export function moduleUsesFetch(mod) {
-    const embedded = mod.embedded;
-    if (embedded && embedded.modules.some((m) => m.usesFetch === true))
-        return true;
-    // User-code fetch is either the engine global or the static libCall pair.
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if ((node.kind === "jsOp" && node.op === "globalGet" && node.name === "fetch") ||
-            (node.kind === "libCall" &&
-                typeof node.fn === "string" && node.fn.startsWith("fetch."))) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "fetch").fetch;
 }
 /** The libCall fns served by the OPTIONAL events unit (scr_events.c):
  * process signal/exit listeners and the piped-stdin surface. */
 const PROCESS_EVENT_LIB_FNS = new Set([
+    "process.stdio",
     "process.onSignal",
     "process.offSignal",
     "process.onExit",
@@ -1360,25 +1588,7 @@ const PROCESS_EVENT_LIB_FNS = new Set([
  * gating precedent). Event-free programs pay zero bytes and keep their
  * exact link line. Same generic-walk shape as moduleUsesRegex. */
 export function moduleUsesProcessEvents(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && PROCESS_EVENT_LIB_FNS.has(node.fn)) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "processEvents").processEvents;
 }
 /** True when the module uses the node:events EventEmitter surface — the
  * link switch that pulls scr_events_emitter.c into the binary (native-toolchain.ts; the
@@ -1390,27 +1600,7 @@ export function moduleUsesProcessEvents(mod) {
  * no emitter-typed value). Emitter-free programs pay zero bytes and keep
  * their exact link line. */
 export function moduleUsesEmitter(mod) {
-    if ((mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS))
-        return true;
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("emitter.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "emitter").emitter;
 }
 /** True when the program touches the node:stream surface (scr_stream.c —
  * the moduleUsesEmitter story: the class defs ride the module whenever a
@@ -1420,36 +1610,7 @@ export function moduleUsesEmitter(mod) {
  * moduleUsesEmitter answers true whenever this does. Stream-free
  * programs pay zero bytes and keep their exact link line. */
 export function moduleUsesStream(mod) {
-    if ((mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)))
-        return true;
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" &&
-            typeof node.fn === "string" &&
-            (node.fn.startsWith("readable.") || node.fn.startsWith("writable.") ||
-                node.fn.startsWith("duplex.") || node.fn.startsWith("transform.") ||
-                node.fn.startsWith("passthrough.") ||
-                node.fn === "stream.destroy" || node.fn === "stream.destroyErr" ||
-                node.fn === "stream.prop" || node.fn === "stream.errored" ||
-                node.fn === "sp.finished" || node.fn === "sp.pipeline" ||
-                node.fn.startsWith("sc.") ||
-                node.fn.startsWith("stream.set"))) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "stream").stream;
 }
 /** True when the embedded npm graph has an edge into `builtin` — the
  * island shim needs the corresponding native bridge linked (zlib's is
@@ -1458,7 +1619,7 @@ export function moduleEmbedsBuiltin(mod, builtin) {
     return mod.embedded !== undefined && mod.embedded.edges.some((e) => e.to === builtin);
 }
 /** Embedded module texts at least this long are DEFLATE-compressed into
- * the emitted C (island.ts; each stays plain when deflate does not
+ * the emitted LLVM (island.ts; each stays plain when deflate does not
  * shrink it) and inflated lazily by the island's module loader at first
  * load. Below it the zlib round trip cannot pay for itself. */
 export const NPM_COMPRESS_MIN = 1024;
@@ -1478,52 +1639,14 @@ export function moduleEmbedsCompressedNpm(mod) {
  * generic-walk shape as moduleUsesRegex: `kind`/`fn` discriminants live
  * only on IR objects. */
 export function moduleUsesZlib(mod) {
-    if (moduleEmbedsBuiltin(mod, "node:zlib"))
-        return true;
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("zlib.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "zlib").zlib;
 }
 /** True when the module contains any dc.* libCall — the link switch that
  * pulls scr_dc.c (the diagnostics_channel registry and pub/sub) into the
  * binary (native-toolchain.ts). Channel-free binaries keep their exact size class.
  * Same walk shape as moduleUsesZlib. */
 export function moduleUsesDc(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("dc.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "dc").dc;
 }
 /** True when the module contains any assert libCall — the link switch
  * that pulls scr_assert.c into the binary (native-toolchain.ts). scr_regex.c calls the
@@ -1532,25 +1655,7 @@ export function moduleUsesDc(mod) {
  * the historical command line and size. Same walk shape as
  * moduleUsesZlib. */
 export function moduleUsesAssert(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("assert.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "assert").assert;
 }
 /** True when the module contains any dynInvoke node or dyn.defineProps
  * libCall — the link switch that pulls scr_dyn_invoke.c (the prototype-
@@ -1559,25 +1664,7 @@ export function moduleUsesAssert(mod) {
  * precedent — dispatch-free binaries keep their exact size class). Same
  * walk shape as moduleUsesZlib. */
 export function moduleUsesDynInvoke(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "dynInvoke" || (node.kind === "libCall" && node.fn === "dyn.defineProps")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "dynInvoke").dynInvoke;
 }
 /** True when the module contains any insp libCall — the link switch that
  * pulls scr_inspect.c into the binary (native-toolchain.ts; the assert gating
@@ -1590,96 +1677,16 @@ export function moduleUsesDynInvoke(mod) {
  * dynInvoke and dc gates (their TUs call into this one) — native-toolchain.ts. Same
  * walk shape as moduleUsesZlib. */
 export function moduleUsesDynAsync(mod) {
-    const fns = new Set([
-        "async.awaitDyn", "timers.immediatePromise",
-        "process.onUnhandledRejection", "process.offUnhandledRejection",
-        "process.onRejectionHandled", "process.offRejectionHandled",
-        "process.onWarning", "process.offWarning", "process.emitWarning",
-        "als.new", "als.get", "als.run", "als.exitRun", "als.enterWith", "als.disable",
-        "dc.chanBindStore", "dc.chanUnbindStore", "dc.chanRunStores",
-    ]);
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && fns.has(node.fn)) {
-            found = true;
-            return;
-        }
-        // A DYN-typed await reads through scr_await_dyn (the checked-dynamic tree-crossing
-        // await lives in the gated TU) — promise<dyn> receivers' awaits and
-        // the lifted then/catch helpers alike.
-        const boxed = node.value?.type;
-        if ((node.kind === "awaitExpr" && node.type?.kind === "dyn") ||
-            (node.kind === "dynFrom" && (boxed?.kind === "promise" || (boxed?.kind === "func" && boxed.ret?.kind === "promise")))) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "dynAsync").dynAsync;
 }
 export function moduleUsesInspect(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("insp.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "inspect").inspect;
 }
 /** True when the module reaches child_process or carries one of its runtime
  * handle/result types. Besides the existing link consequence, this gates the
  * checked-dynamic ChildProcess handle table installed from scr_child.c. */
 export function moduleUsesChildProcess(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" &&
-            typeof node.fn === "string" &&
-            (node.fn.startsWith("cp.") || node.fn.startsWith("child.") || node.fn.startsWith("writer.") || node.fn.startsWith("spawnRes.") ||
-                node.fn === "process.forkTarget" || node.fn === "process.connected" || node.fn === "process.send" ||
-                node.fn === "process.sendCb" || node.fn === "process.disconnect" || node.fn === "process.onMessage" ||
-                node.fn === "process.onDisconnect")) {
-            found = true;
-            return;
-        }
-        if (node.kind === "child" || node.kind === "childStream" || node.kind === "childWriter" || node.kind === "spawnRes") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "childProcess").childProcess;
 }
 /** True when the module contains any net libCall — the link switch that
  * pulls scr_net.c into the binary and has the emitted main call
@@ -1687,42 +1694,7 @@ export function moduleUsesChildProcess(mod) {
  * Net-free programs pay zero bytes and keep their exact link line. Same
  * generic-walk shape as moduleUsesZlib. */
 export function moduleUsesNet(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("net.") || node.fn.startsWith("http.") ||
-                node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
-                node.fn.startsWith("http2."))) {
-            // http/tls/https/http2 all ride ON net: their libCalls need scr_net.c
-            // linked and installed too, so the net switch answers for every
-            // server-family prefix.
-            found = true;
-            return;
-        }
-        // A net-family HANDLE TYPE anywhere in the IR (a global or local whose
-        // initializing statement compiled to a runtime fence still carries the
-        // type): its emitted release call needs the unit linked even when no
-        // libCall survived the fencing.
-        if (node.kind === "netServer" || node.kind === "netSocket" ||
-            node.kind === "http2Session" || node.kind === "http2Stream" ||
-            node.kind === "httpReq" || node.kind === "httpRes" ||
-            node.kind === "httpClientReq" || node.kind === "secureCtx") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "net").net;
 }
 /** True when the module contains any sym.* libCall or a symbol-kind type
  * anywhere in the IR — the link switch that pulls scr_symbol.c into the
@@ -1732,54 +1704,13 @@ export function moduleUsesNet(mod) {
  * fence still emits release calls that need the unit linked. Symbol-free
  * programs pay zero bytes and keep their exact link line. */
 export function moduleUsesSymbol(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("sym.")) {
-            found = true;
-            return;
-        }
-        if (node.kind === "symbol") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "symbol").symbol;
 }
 /** True when bigint runtime operations or bigint-typed storage appears in
  * the IR. The type check keeps retain/release references link-safe even
  * when a producing statement was replaced by a runtime fence. */
 export function moduleUsesBigInt(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "bigint" ||
-            (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("bigint."))) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "bigint").bigint;
 }
 /** True when the module uses the URLSearchParams surface — sp.* libCalls,
  * the url.searchParams getter, or a searchParams-kind type anywhere on
@@ -1790,30 +1721,7 @@ export function moduleUsesBigInt(mod) {
  * programs keep their exact link line; scr_url.c itself stays
  * always-linked and never references the unit. */
 export function moduleUsesSearchParams(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("sp.") || node.fn === "url.searchParams")) {
-            found = true;
-            return;
-        }
-        if (node.kind === "searchParams") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "searchParams").searchParams;
 }
 /** True when the module uses the node:querystring surface — the qs.*
  * libCalls that live in scr_qs.c (parse/stringify/unescape; qs.escape
@@ -1823,50 +1731,13 @@ export function moduleUsesSearchParams(mod) {
  * loop hooks, cross-compiles everywhere). qs-free programs keep their
  * exact link line. Same generic-walk shape as moduleUsesZlib. */
 export function moduleUsesQs(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn === "qs.parse" || node.fn === "qs.stringify" || node.fn === "qs.unescape")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "qs").qs;
 }
 /** True when the module uses native util.parseArgs — the link switch for
  * scr_util.c. The implementation is a pure checked-dynamic data transform,
  * cross-platform and independent of the island's node:util shim. */
 export function moduleUsesParseArgs(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && node.fn === "util.parseArgs") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "parseArgs").parseArgs;
 }
 /** True when the module contains any fs.watch/watcher.* libCall — the
  * link switch that pulls scr_watch.c into the binary and has the emitted
@@ -1874,32 +1745,7 @@ export function moduleUsesParseArgs(mod) {
  * precedent). Watch-free programs pay zero bytes and keep their exact
  * link line. Same generic-walk shape as moduleUsesZlib. */
 export function moduleUsesFsWatch(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("fs.watch") || node.fn.startsWith("watcher."))) {
-            found = true;
-            return;
-        }
-        // A watcher HANDLE TYPE left behind by a fenced statement still emits
-        // scr_watcher_release — the unit must link.
-        if (node.kind === "fsWatcher") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "fsWatch").fsWatch;
 }
 /** True when the module contains any test.* libCall or a testCtx handle
  * type — the link switch that pulls scr_test.c into the binary and has
@@ -1907,31 +1753,7 @@ export function moduleUsesFsWatch(mod) {
  * (native-toolchain.ts + emitter; the moduleUsesDgram shape). Test-free programs pay
  * zero bytes and keep their exact link line. */
 export function moduleUsesNodeTest(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("test.")) {
-            found = true;
-            return;
-        }
-        // A TestContext HANDLE TYPE left behind by a fenced statement still
-        // emits a release call — the unit must link (the dgram type story).
-        if (node.kind === "testCtx") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "nodeTest").nodeTest;
 }
 /** True when the module contains any dgram.* or dns.* libCall — the
  * link switch that pulls scr_dgram.c into the binary and has the emitted
@@ -1940,69 +1762,13 @@ export function moduleUsesNodeTest(mod) {
  * answers). Dgram-free programs pay zero bytes and keep their exact link
  * line. Same generic-walk shape as moduleUsesZlib. */
 export function moduleUsesDgram(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("dgram.") || node.fn.startsWith("dns."))) {
-            found = true;
-            return;
-        }
-        // A dgram HANDLE TYPE left behind by a fenced statement still emits a
-        // release call — the unit must link (the moduleUsesNet type story).
-        if (node.kind === "dgramSocket") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "dgram").dgram;
 }
 /** True when the module contains any http.* libCall — the link switch
  * that pulls scr_http.c into the binary (native-toolchain.ts; moduleUsesNet already
  * answers true for these, so scr_net.c comes along). */
 export function moduleUsesHttpServer(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("http.") || node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
-                node.fn.startsWith("http2."))) {
-            // scr_tls.c calls into scr_http.c unconditionally (the https server
-            // and client are the http ones over a transport), so any tls/https
-            // use pulls the http unit too.
-            found = true;
-            return;
-        }
-        // An http-family HANDLE TYPE left behind by a fenced statement still
-        // emits its release call — the unit must link (the moduleUsesNet type
-        // story; secureCtx rides here because scr_tls.c calls into scr_http.c).
-        if (node.kind === "httpReq" || node.kind === "httpRes" ||
-            node.kind === "httpClientReq" || node.kind === "secureCtx") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "http").http;
 }
 /** The legacy http2.* libCalls implemented by scr_http.c/scr_tls.c (the
  * allowHTTP1 compatibility slice) — they must NOT pull scr_http2.c, so
@@ -2014,30 +1780,7 @@ const HTTP2_LEGACY_FNS = new Set([
  * http2.* libCall, or an h2 handle type left behind by a fenced statement
  * (its emitted release call needs the unit — the moduleUsesNet story). */
 export function moduleUsesHttp2(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            node.fn.startsWith("http2.") && !HTTP2_LEGACY_FNS.has(node.fn)) {
-            found = true;
-            return;
-        }
-        if (node.kind === "http2Session" || node.kind === "http2Stream") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "http2").http2;
 }
 /** True when the module contains any tls.* or https.* libCall — the link
  * switch that pulls scr_tls.c and the vendored mbedTLS archive into the
@@ -2045,33 +1788,7 @@ export function moduleUsesHttp2(mod) {
  * true for these, so scr_net.c and scr_http.c come along). TLS-free
  * programs keep their exact link line and never build mbedTLS. */
 export function moduleUsesTls(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" &&
-            (node.fn.startsWith("tls.") || node.fn.startsWith("https.") ||
-                node.fn.startsWith("http2."))) {
-            found = true;
-            return;
-        }
-        // A secureCtx HANDLE TYPE left behind by a fenced statement still
-        // emits scr_secure_ctx_release — the unit must link.
-        if (node.kind === "secureCtx") {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "tls").tls;
 }
 /** True when the module contains any tlsca.* libCall — the link switch
  * for scr_tls_ca.c, the CA-store introspection unit (getCACertificates /
@@ -2081,25 +1798,7 @@ export function moduleUsesTls(mod) {
  * also compiles the unit whenever TLS itself links — scr_tls.c consults
  * the unit's default-set override for its trust anchors. */
 export function moduleUsesTlsCa(mod) {
-    let found = false;
-    const visit = (v) => {
-        if (found || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string" && node.fn.startsWith("tlsca.")) {
-            found = true;
-            return;
-        }
-        for (const key of Object.keys(v))
-            visit(v[key]);
-    };
-    visit(mod);
-    return found;
+    return scanRuntimeFeatures(mod, "tlsCa").tlsCa;
 }
 /* ── library mode's async_free gate ──────────────────────────────────────
  * v1 library mode REQUIRES an async_free module graph (ratified): no async
@@ -2118,6 +1817,7 @@ const LIB_MODE_REFUSED_PREFIXES = [
     // exclude — refuse the surface like the rest of the event-loop family.
     ["fs.existsChk", "the async fs callback surface (fs.exists)"],
     ["fs.renameCb", "the async fs callback surface (fs.rename)"],
+    ["fs.callback", "the async filesystem callback surface"],
     ["zlib.deflateCb", "the async node:zlib callback surface"],
     ["zlib.inflateCb", "the async node:zlib callback surface"],
     ["zlib.deflateRawCb", "the async node:zlib callback surface"],
@@ -2156,10 +1856,6 @@ const LIB_MODE_REFUSED_PREFIXES = [
     ["als.", "AsyncLocalStorage"],
     ["urj.", "unhandled-rejection tracking"],
     ["dc.", "the diagnostics_channel surface"],
-    // NOT the whole "dyn." family: the checked-dynamic tree (ScrDyn) is
-    // static-tier surface hosted by always-linked units; only defineProps
-    // drags the prototype-dispatch unit (scr_dyn_invoke.c → scr_async_dyn.c).
-    ["dyn.defineProps", "checked-dynamic prototype dispatch"],
 ];
 /** Value/type kinds whose mere presence means an excluded unit's code (or
  * a fiber) would have to link. */
@@ -2184,12 +1880,11 @@ const LIB_MODE_REFUSED_KINDS = new Map([
     ["httpRes", "the node:http surface"],
     ["httpClientReq", "the node:http surface"],
     ["secureCtx", "the node:tls surface"],
-    ["dynInvoke", "checked-dynamic prototype dispatch"],
 ]);
 /** First async/event-loop/ambient-process surface the module graph
  * reaches, or null when the graph is async_free (the v1 library requirement).
- * The generic-walk shape of moduleUsesRegex, tracking the nearest
- * enclosing `loc` so the refusal anchors at the reaching construct; the
+ * Typed slots use their declaration location and executable nodes use their
+ * own location, so the refusal anchors at the reaching construct; the
  * coarse moduleUses* predicates are the safety net behind the fine-grained
  * table (a surface reached only through a spelling the table misses still
  * refuses, anchored at the entry). */
@@ -2203,54 +1898,49 @@ export function moduleLibAsyncSurface(mod) {
     }
     const entryLoc = { file: mod.sourceFile, start: 0, end: 0 };
     let found = null;
-    const visit = (v, loc) => {
-        if (found !== null || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item, loc);
-            return;
-        }
-        const node = v;
-        const here = node.loc ?? loc;
-        if (typeof node.kind === "string") {
-            const bad = LIB_MODE_REFUSED_KINDS.get(node.kind);
-            if (bad !== undefined) {
-                found = { surface: bad, loc: here };
-                return;
-            }
-            if (node.kind === "libCall" && typeof node.fn === "string") {
+    const checkKind = (kind, loc) => {
+        const surface = LIB_MODE_REFUSED_KINDS.get(kind);
+        if (surface === undefined)
+            return true;
+        found = { surface, loc };
+        return false;
+    };
+    everyModuleNode(mod, {
+        type: (node, loc) => checkKind(node.kind, loc),
+        stmt: () => true,
+        expr: (node) => {
+            if (!checkKind(node.kind, node.loc))
+                return false;
+            if (node.kind === "libCall") {
                 for (const [prefix, surface] of LIB_MODE_REFUSED_PREFIXES) {
                     if (node.fn.startsWith(prefix)) {
-                        found = { surface, loc: here };
-                        return;
+                        found = { surface, loc: node.loc };
+                        return false;
                     }
                 }
             }
-        }
-        for (const key of Object.keys(v))
-            visit(v[key], here);
-    };
-    visit(mod, entryLoc);
+            return true;
+        },
+    });
     if (found !== null)
         return found;
     // Safety net: the coarse unit predicates, entry-anchored. Every one of
     // these units is excluded from library links, so a true answer that the
     // fine-grained table missed must still refuse.
+    const features = moduleRuntimeFeatures(mod);
     const coarse = [
-        [moduleUsesProcessEvents(mod), "process signal/exit listeners or the stdin event surface"],
-        [moduleUsesNet(mod), "the node:net surface"],
-        [moduleUsesHttpServer(mod), "the node:http surface"],
-        [moduleUsesHttp2(mod), "the node:http2 surface"],
-        [moduleUsesDgram(mod), "the node:dgram surface"],
-        [moduleUsesFsWatch(mod), "fs.watch"],
-        [moduleUsesStream(mod), "the node:stream surface"],
-        [moduleUsesTls(mod), "the node:tls surface"],
-        [moduleUsesFetch(mod), "fetch"],
-        [moduleUsesNodeTest(mod), "the node:test surface"],
-        [moduleUsesDynAsync(mod), "the checked-dynamic async surface"],
-        [moduleUsesDc(mod), "the diagnostics_channel surface"],
-        [moduleUsesDynInvoke(mod), "checked-dynamic prototype dispatch"],
+        [features.processEvents, "process signal/exit listeners or the stdin event surface"],
+        [features.net, "the node:net surface"],
+        [features.http, "the node:http surface"],
+        [features.http2, "the node:http2 surface"],
+        [features.dgram, "the node:dgram surface"],
+        [features.fsWatch, "fs.watch"],
+        [features.stream, "the node:stream surface"],
+        [features.tls, "the node:tls surface"],
+        [features.fetch, "fetch"],
+        [features.nodeTest, "the node:test surface"],
+        [features.dynAsync, "the checked-dynamic async surface"],
+        [features.dc, "the diagnostics_channel surface"],
     ];
     for (const [on, surface] of coarse) {
         if (on)
@@ -2321,27 +2011,22 @@ export const LIB_NONDETERMINISTIC_PREFIXES = [
  * attests `deterministic: true`). */
 export function moduleLibNondeterministicSurface(mod) {
     let found = null;
-    const visit = (v) => {
-        if (found !== null || v === null || typeof v !== "object")
-            return;
-        if (Array.isArray(v)) {
-            for (const item of v)
-                visit(item);
-            return;
-        }
-        const node = v;
-        if (node.kind === "libCall" && typeof node.fn === "string") {
+    const expr = (node) => {
+        if (node.kind === "libCall") {
             for (const [prefix, surface] of LIB_NONDETERMINISTIC_PREFIXES) {
                 if (node.fn.startsWith(prefix)) {
                     found = surface;
-                    return;
+                    return false;
                 }
             }
         }
-        for (const key of Object.keys(v))
-            visit(v[key]);
+        return everyExprChild(node, expr, stmt);
     };
-    visit(mod);
+    const stmt = (node) => everyStmtChild(node, expr, stmt);
+    for (const fn of mod.functions) {
+        if (!fn.body.every(stmt))
+            break;
+    }
     return found;
 }
 /** The may-throw seed: libCall members that can raise. Every fs.* member
@@ -2352,6 +2037,43 @@ export function moduleLibNondeterministicSurface(mod) {
  * seed on `dynCheck` and `awaitExpr` nodes, which throw on validation
  * failure / promise rejection). */
 export const MAY_THROW_LIB_FNS = new Set([
+    "cp.spawnDynamic",
+    "child.onDyn",
+    "text.decoderEncoding",
+    "dyn.construct",
+    "dyn.reflectApply",
+    "text.decodeOptions",
+    "text.decodeStream",
+    "text.decodeLegacyOptions",
+    "dyn.nativeSetNew",
+    "ffi.argument",
+    "ffi.memoryModule",
+    "process.stdoutWrite",
+    "process.stderrWrite",
+    "process.stdoutWriteBytes",
+    "process.stderrWriteBytes",
+    "procStream.write",
+    "weakMap.new",
+    "weakSet.new",
+    "dyn.fromEntries",
+    "bytes.constructor",
+    "bytes.instanceOf",
+    "buffer.byteLenDyn",
+    "bytes.construct",
+    "arrayBuffer.new",
+    "arrayBuffer.byteLengthGetter",
+    "arrayBuffer.viewU8C",
+    "arrayBuffer.viewI8",
+    "arrayBuffer.viewU16",
+    "arrayBuffer.viewI16",
+    "arrayBuffer.viewU8",
+    "arrayBuffer.viewU32",
+    "arrayBuffer.viewI32",
+    "arrayBuffer.viewF32",
+    "arrayBuffer.viewF64",
+    "arrayBuffer.viewDV",
+    "bytes.bufferSource",
+    "text.decodeBufferSource",
     "bigint.parse",
     "bigint.fromF64",
     "bigint.div",
@@ -2366,12 +2088,15 @@ export const MAY_THROW_LIB_FNS = new Set([
     "bigint.bufferWrite",
     "bigint.dataViewGet",
     "bigint.dataViewSet",
+    "fetch.requestNew",
+    "fetch.headersNew",
     "fetch.responseNew",
     "fetch.abortTimeout",
     "fetch.abortAny",
     "fetch.streamNew",
     "fetch.streamFrom",
     "num.toFixed",
+    "num.toStringRadix",
     "insp.jsonDyn",
     // diagnostics_channel: publish runs subscribers synchronously (a throw
     // propagates — the documented divergence from triggerUncaughtException);
@@ -2387,6 +2112,10 @@ export const MAY_THROW_LIB_FNS = new Set([
     "dc.tcTraceSync",
     "dc.tcTraceCallback",
     "dc.tcTracePromise",
+    "process.onUncaughtException",
+    "process.offUncaughtException",
+    "process.onSignal",
+    "process.offSignal",
     "process.onUnhandledRejection",
     "process.onRejectionHandled",
     "async.awaitDyn",
@@ -2527,6 +2256,8 @@ export const MAY_THROW_LIB_FNS = new Set([
     "readable.unshift",
     "readable.unshiftStr",
     "readable.read",
+    "readable.readDyn",
+    "stream.onDyn",
     "readable.resume",
     "readable.pipe",
     "readable.unpipe",
@@ -2567,9 +2298,32 @@ export const MAY_THROW_LIB_FNS = new Set([
     "error.nodeThrow",
     // USVString coercion runs user toString/valueOf — throws propagate.
     "dyn.toStringCoerce",
+    "dyn.stringConstructor",
+    "dyn.propertyKey",
+    "dyn.toNumeric",
+    "dyn.increment",
+    // Error messages use the same coercion protocol before installing cause.
+    "error.newOptions",
+    "error.ctorOptions",
+    "error.toString",
+    "error.stack",
+    "error.cause",
+    "error.setCause",
+    "error.deleteCause",
     "dyn.objectTag",
     // Numeric coercion runs user valueOf/toString — throws propagate.
+    "dyn.numberConstructor",
+    "dyn.bigintConstructor",
     "dyn.toNumberCoerce",
+    "dyn.add",
+    "dyn.arithmetic",
+    "dyn.compare",
+    "dyn.bitwise",
+    "dyn.proxyNew",
+    "dyn.classBasePrototype",
+    "dyn.classInherit",
+    "dyn.classSuper",
+    "dyn.hasKey",
     "child.kill",
     // The caller's lookup runs synchronously inside the connect call — a
     // throw there propagates like Node's.
@@ -2604,10 +2358,16 @@ export const MAY_THROW_LIB_FNS = new Set([
     "island.import",
     "island.castFail",
     "json.parse",
+    "json.parseReviver",
+    "json.stringifyReplacer",
+    "json.stringifyValue",
+    "date.nativeNew",
+    "date.checkedValue",
     "util.parseArgs",
     // decodeURIComponent throws the spec's URIError on bad hex/invalid
     // UTF-8 octets (encodeURIComponent never throws — see the IrLibFn doc).
     "str.decodeUriComponent",
+    "str.decodeUri",
     // The base64 globals: atob/btoa throw the catchable DOMException
     // InvalidCharacterError on malformed input; the zero-argument form
     // always throws Node's TypeError [ERR_MISSING_ARGS].
@@ -2627,26 +2387,67 @@ export const MAY_THROW_LIB_FNS = new Set([
     "dyn.cloneTransferFail",
     // the dyn Object walks throw on null/undefined receivers
     "dyn.objKeys",
+    "dyn.forInKeys",
     "dyn.hasOwn",
+    "dyn.propertyIsEnumerable",
     "dyn.assign",
+    "dyn.copyDataProperties",
+    "dyn.objectRest",
     // variadic Object.assign: spread flattening throws V8's spread-call
     // TypeErrors; the final copy throws ToObject on a nullish target
     "dyn.packPushSpread",
     "dyn.packPushSpreadIter",
     "dyn.assignAll",
+    "dyn.objCreate",
+    "dyn.objCreateWithProperties",
+    "dyn.getPrototype",
+    "dyn.setPrototype",
+    "dyn.getOwnPropertyNames",
+    "dyn.ownKeys",
+    "dyn.getOwnPropertySymbols",
+    "dyn.getOwnPropertyDescriptors",
+    "dyn.preventExtensions",
+    "dyn.isExtensible",
+    "dyn.seal",
+    "dyn.isSealed",
     "dyn.objValues",
     "dyn.objEntries",
     "error.domClone",
     // new RegExp compiles the pattern eagerly: an invalid pattern or flag
     // throws Node's catchable SyntaxError at construction.
     "regex.new",
+    "regex.resetLastIndex",
+    "regex.newChecked",
     "dyn.keySet",
+    "dyn.keySetComputed",
+    "process.builtinId",
+    "process.builtinModule",
+    "process.builtinUnsupported",
+    "fs.callbackValue",
+    "fs.callbackCall",
+    "dyn.keyDelete",
+    "dyn.keyDeleteComputed",
+    "dyn.hasKeyComputed",
+    "dyn.hasOwnComputed",
+    "dyn.propertyIsEnumerableComputed",
     // the destructuring pack throws V8's TypeError on non-iterable dyn kinds
     "dyn.iterPack",
+    "dyn.arrayFromIterator",
+    "dyn.iterator",
+    "dyn.iteratorResult",
+    "dyn.mapSeedEntries",
+    "dyn.mapSeedEntry",
+    "dyn.freeze",
+    "dyn.isFrozen",
     "dyn.toString",
+    "string.fromCodePoint",
     "dyn.defineProps",
+    "dyn.defineProperty",
+    "dyn.getOwnPropertyDescriptor",
+    "dyn.arrayProtoCall",
     "process.chdir",
     "fs.realpathSync",
+    "fs.realpathNativeSync",
     "fs.readFileSync",
     "fs.writeFileSync",
     "fs.appendFileSync",
@@ -2656,17 +2457,21 @@ export const MAY_THROW_LIB_FNS = new Set([
     "fs.readdirSync",
     "fs.readdirTypesSync",
     "url.new",
+    "url.newBase",
     "url.fileURLToPathUrl",
+    "url.fileURLToPathChecked",
     "url.fileURLToPathStr",
     // The win32-target flavor of pathToFileURL (same runtime entry point —
     // the bridge dispatches by the binary's platform): Node's win32 arm
     // raises ERR_INVALID_ARG_VALUE TypeErrors for malformed UNC inputs, so
     // only THIS flavor seeds may-throw — posix emission stays untouched.
     "url.pathToFileURLWin32",
+    "url.pathToFileURLPlatform",
     // URLSearchParams from a string[][]: Node's ERR_INVALID_TUPLE TypeError
     // on a row that is not a [name, value] pair. The rest of the sp family
     // never throws.
     "sp.fromPairs",
+    "sp.newChecked",
     "fs.statSync",
     "crypto.randomBytesToString",
     "crypto.randomBytes",
@@ -2693,6 +2498,7 @@ export const MAY_THROW_LIB_FNS = new Set([
     "crypto.pbkdf2Cb",
     "buffer.concat",
     "buffer.concatLen",
+    "buffer.fromDyn",
     // The checked-dynamic compare/equals validators: Node's argument
     // ladders throw ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE catchably.
     "buffer.compareChk",
@@ -2720,6 +2526,7 @@ export const MAY_THROW_LIB_FNS = new Set([
     "emitter.setDefaultMaxChk",
     "fs.readFileSyncBytes",
     "fs.writeFileSyncBytes",
+    "fs.appendFileSyncBytes",
     "zlib.inflateSync",
     "zlib.inflateRawSync",
     "zlib.gunzipSync",