@scriptc/compiler 0.3.1 → 0.3.3

package/dist/frontend/lowering/surfaces.js

@@ -1,6 +1,6 @@
 import * as ts from "../ts7/adapter.js";
 import { UNSUPPORTED } from "../../diagnostics/diagnostic.js";
-import { BOOL, BYTES_U8, CHILD_T, CRYPTOHASH_T, CRYPTOHMAC_T, DYN, F64, FILEHANDLE_T, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf, } from "../../ir/ir.js";
+import { BOOL, BYTES_U8, CHILD_T, CRYPTOHASH_T, CRYPTOHMAC_T, DIR_T, DYN, F64, FILEHANDLE_T, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf, } from "../../ir/ir.js";
 import { isNodeTypesPath, requireSpecOf } from "../program.js";
 /** Statement-level constructs rejected wholesale, keyed by syntax kind. */
 export const UNSUPPORTED_STMT = {
@@ -67,7 +67,7 @@ export const NARROW_FIRST = "narrow first: check a discriminant field, or compar
  *     per-key fences);
  *   - keys Node DOCUMENTS for the API but this compiler cannot honor
  *     fence BY NAME at the use site — an option that changes
- *     Node-observable behavior must work or fence, never silently drop;
+ *     Node-observable behavior must work or fence instead of dropping;
  *   - undocumented keys DROP exactly as Node drops them, provided the
  *     value expression is side-effect-free (an effectful initializer
  *     fences: Node would have evaluated it, so skipping it would be
@@ -164,6 +164,7 @@ export const HTTP_CLIENT_DOCUMENTED_OPTIONS = new Set([
     "hints",
     "host",
     "hostname",
+    "httpValidation",
     "insecureHTTPParser",
     "joinDuplicateHeaders",
     "localAddress",
@@ -193,6 +194,7 @@ export const HTTP_SERVER_DOCUMENTED_OPTIONS = new Set([
     "connectionsCheckingInterval",
     "headersTimeout",
     "highWaterMark",
+    "httpValidation",
     "insecureHTTPParser",
     "joinDuplicateHeaders",
     "keepAlive",
@@ -229,6 +231,7 @@ export const HTTPS_CLIENT_DOCUMENTED_OPTIONS = new Set([
     ...HTTP_CLIENT_DOCUMENTED_OPTIONS,
     "ca",
     "cert",
+    "certificateCompression",
     "checkServerIdentity",
     "ciphers",
     "clientCertEngine",
@@ -264,6 +267,7 @@ export const TLS_SERVER_DOCUMENTED_OPTIONS = new Set([
     "allowHalfOpen",
     "ca",
     "cert",
+    "certificateCompression",
     "ciphers",
     "clientCertEngine",
     "crl",
@@ -465,7 +469,7 @@ export const COMPOUND_ASSIGN_OPS = {
  * smuggle itself in by name. `minArgs`/`maxArgs` pin the LOWERED call
  * forms: the lib declares wider signatures (optional position/fromIndex
  * parameters) that typecheck but have no lowering — those forms are fenced
- * per site instead of silently dropping arguments. */
+ * per site instead of dropping arguments without a diagnostic. */
 export const STR_METHODS = {
     charCodeAt: { method: "charCodeAt", result: F64, minArgs: 0, maxArgs: 1 },
     charAt: { method: "charAt", result: STRING, minArgs: 0, maxArgs: 1 },
@@ -492,7 +496,7 @@ export const STR_METHODS = {
     // regexIntrinsic). The optional limit is completed to 2^32-1 by the
     // lowering so the IR/runtime always see the spec's effective value.
     // Empty separator splits per UTF-16 code unit —
-    // astral halves become U+FFFD (SEMANTICS.md divergence 2, the same
+    // astral halves become lone surrogates.
     split: { method: "split", result: arrayOf(STRING), minArgs: 0, maxArgs: 2 },
     // Padding completes omitted lengths and fill strings in its lowering.
     padStart: { method: "padStart", result: STRING, minArgs: 0, maxArgs: 2 },
@@ -501,10 +505,8 @@ export const STR_METHODS = {
     toLowerCase: { method: "toLowerCase", result: STRING, minArgs: 0, maxArgs: 0 },
     toUpperCase: { method: "toUpperCase", result: STRING, minArgs: 0, maxArgs: 0 },
     normalize: { method: "normalize", result: STRING, minArgs: 0, maxArgs: 1 },
-    // The ES2024 well-formedness pair — no-ops over the runtime's
-    // well-formed storage (constant true / the identity, per spec on
-    // well-formed input; where Node would answer false the program already
-    // diverged at the string's creation, SEMANTICS.md 2).
+    // The ES2024 well-formedness pair: whether the string holds a lone
+    // surrogate, and the copy with each one replaced by U+FFFD.
     isWellFormed: { method: "isWellFormed", result: BOOL, minArgs: 0, maxArgs: 0 },
     toWellFormed: { method: "toWellFormed", result: STRING, minArgs: 0, maxArgs: 0 },
 };
@@ -789,8 +791,19 @@ const PATH_MODULE_FNS = {
         result: STRING,
         valueParams: [{ mode: "required", type: STRING }],
     },
+    matchesGlob: {
+        fn: "path.matchesGlob",
+        params: [STRING, STRING],
+        result: BOOL,
+        valueParams: exactValueParams(STRING, STRING),
+    },
+    // Special-cased (lowerPathParseCall / lowerPathFormatCall): the
+    // ParsedPath record and the pathObject argument follow the call site's
+    // mapped shapes.
+    parse: { fn: "path.parse", params: [STRING], result: VOID },
+    format: { fn: "path.format", params: [], result: STRING },
 };
-/** The win32 twins (scr_path.c's Node-v24 path.win32 port, byte-for-byte):
+/** The win32 twins (scr_path.c's exact port of Node-v24 path.win32):
  * "path/win32" everywhere, and the bare-module table when the build
  * TARGETS win32 — Node on Windows is path.win32. */
 const PATH_WIN32_MODULE_FNS = {
@@ -857,14 +870,73 @@ const PATH_WIN32_MODULE_FNS = {
         result: STRING,
         valueParams: [{ mode: "required", type: STRING }],
     },
+    matchesGlob: {
+        fn: "path.win32MatchesGlob",
+        params: [STRING, STRING],
+        result: BOOL,
+        valueParams: exactValueParams(STRING, STRING),
+    },
+    // Special-cased (lowerPathParseCall / lowerPathFormatCall): the
+    // ParsedPath record and the pathObject argument follow the call site's
+    // mapped shapes.
+    parse: { fn: "path.win32Parse", params: [STRING], result: VOID },
+    format: { fn: "path.win32Format", params: [], result: STRING },
 };
+/** util.types's own keys in Node's order (Node 24.22.0). The table is the
+ * key census for Object.keys over util.types and node:util/types, including
+ * the members that do not compile yet; the corpus checks it against Node. */
+export const UTIL_TYPES_KEYS = [
+    "isArgumentsObject",
+    "isArrayBuffer",
+    "isAsyncFunction",
+    "isBigIntObject",
+    "isBooleanObject",
+    "isDate",
+    "isExternal",
+    "isGeneratorFunction",
+    "isGeneratorObject",
+    "isMap",
+    "isMapIterator",
+    "isModuleNamespaceObject",
+    "isNativeError",
+    "isNumberObject",
+    "isPromise",
+    "isProxy",
+    "isRegExp",
+    "isSet",
+    "isSetIterator",
+    "isSharedArrayBuffer",
+    "isStringObject",
+    "isSymbolObject",
+    "isWeakMap",
+    "isWeakSet",
+    "isAnyArrayBuffer",
+    "isBoxedPrimitive",
+    "isArrayBufferView",
+    "isDataView",
+    "isTypedArray",
+    "isUint8Array",
+    "isUint8ClampedArray",
+    "isUint16Array",
+    "isUint32Array",
+    "isInt8Array",
+    "isInt16Array",
+    "isInt32Array",
+    "isFloat16Array",
+    "isFloat32Array",
+    "isFloat64Array",
+    "isBigInt64Array",
+    "isBigUint64Array",
+    "isKeyObject",
+    "isCryptoKey",
+];
 export const BUILTIN_MODULE_FNS = {
     fs: {
         readFileSync: { fn: "fs.readFileSync", params: [STRING, STRING], result: STRING },
         // The exact-API subset is first-class. A fixed native ABI is not enough:
         // rows whose Node function has behavior-bearing trailing options remain
-        // call-only, or function-width adaptation could silently discard those
-        // options before entering the fixed runtime call.
+        // call-only, or function-width adaptation could discard those options
+        // without a diagnostic before entering the fixed runtime call.
         writeFileSync: { fn: "fs.writeFileSync", params: [STRING, STRING], result: VOID },
         appendFileSync: { fn: "fs.appendFileSync", params: [STRING, STRING], result: VOID },
         existsSync: {
@@ -877,6 +949,8 @@ export const BUILTIN_MODULE_FNS = {
         rmSync: { fn: "fs.rmSync", params: [STRING], result: VOID },
         rmdirSync: { fn: "fs.rmdirSync", params: [STRING], result: VOID },
         readdirSync: { fn: "fs.readdirSync", params: [STRING], result: arrayOf(STRING) },
+        // Pattern and options are checked by the runtime (lowerFsGlobSyncCall).
+        globSync: { fn: "fs.globSync", params: [DYN, DYN], result: arrayOf(STRING) },
         statSync: { fn: "fs.statSync", params: [STRING], result: STATS_T },
         mkdtempSync: { fn: "fs.mkdtempSync", params: [STRING], result: STRING },
         // accessSync's omitted mode completes to 0 (F_OK) in the special case
@@ -900,6 +974,21 @@ export const BUILTIN_MODULE_FNS = {
             result: VOID,
             valueParams: exactValueParams(STRING, F64, F64),
         },
+        lchownSync: {
+            fn: "fs.lchownSync",
+            params: [STRING, F64, F64],
+            result: VOID,
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        fchownSync: {
+            fn: "fs.fchownSync",
+            params: [F64, F64, F64],
+            result: VOID,
+            valueParams: exactValueParams(F64, F64, F64),
+        },
+        // truncateSync's omitted len completes to 0 in lowerBuiltinModuleCall,
+        // like accessSync's mode.
+        truncateSync: { fn: "fs.truncateSync", params: [STRING, F64], result: VOID },
         // The 2-argument form only: Node's mode flags (COPYFILE_EXCL, ...)
         // land on the arity fence.
         copyFileSync: { fn: "fs.copyFileSync", params: [STRING, STRING], result: VOID },
@@ -916,6 +1005,9 @@ export const BUILTIN_MODULE_FNS = {
         },
         // statSync's no-follow sibling; stats.isSymbolicLink answers what the
         // follow-free snapshot saw.
+        // opendirSync's options (a literal { bufferSize, encoding: "utf8" })
+        // lower in lowerBuiltinModuleCall; the row routes the dispatch.
+        opendirSync: { fn: "fs.opendirSync", params: [STRING, F64], result: DIR_T },
         lstatSync: { fn: "fs.lstatSync", params: [STRING], result: STATS_T },
         fstatSync: {
             fn: "fs.fstatSync",
@@ -1030,9 +1122,16 @@ export const BUILTIN_MODULE_FNS = {
             result: { kind: "promise", inner: arrayOf(STRING) },
         },
         rm: { fn: "fsp.rm", params: [STRING], result: { kind: "promise", inner: VOID } },
+        // The async iterator lowers only as a for await head (lowerFspGlobCall).
+        glob: { fn: "fsp.globStrings", params: [DYN, DYN], result: arrayOf(STRING) },
         stat: { fn: "fsp.stat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
         realpath: { fn: "fsp.realpath", params: [STRING], result: { kind: "promise", inner: STRING } },
         lstat: { fn: "fsp.lstat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
+        opendir: {
+            fn: "fsp.opendir",
+            params: [STRING, F64],
+            result: { kind: "promise", inner: DIR_T },
+        },
         unlink: {
             fn: "fsp.unlink",
             params: [STRING],
@@ -1045,6 +1144,41 @@ export const BUILTIN_MODULE_FNS = {
             result: { kind: "promise", inner: VOID },
             valueParams: exactValueParams(STRING, F64),
         },
+        chown: {
+            fn: "fsp.chown",
+            params: [STRING, F64, F64],
+            result: { kind: "promise", inner: VOID },
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        lchown: {
+            fn: "fsp.lchown",
+            params: [STRING, F64, F64],
+            result: { kind: "promise", inner: VOID },
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        // access' omitted mode and truncate's omitted len complete to 0 in
+        // lowerBuiltinModuleCall, like their sync spellings.
+        access: { fn: "fsp.access", params: [STRING, F64], result: { kind: "promise", inner: VOID } },
+        truncate: {
+            fn: "fsp.truncate",
+            params: [STRING, F64],
+            result: { kind: "promise", inner: VOID },
+        },
+        // String data; Uint8Array/Buffer data routes to fsp.appendFileBytes in
+        // lowerBuiltinModuleCall.
+        appendFile: {
+            fn: "fsp.appendFile",
+            params: [STRING, STRING],
+            result: { kind: "promise", inner: VOID },
+        },
+        // The 2-argument form only, like copyFileSync.
+        copyFile: {
+            fn: "fsp.copyFile",
+            params: [STRING, STRING],
+            result: { kind: "promise", inner: VOID },
+        },
+        mkdtemp: { fn: "fsp.mkdtemp", params: [STRING], result: { kind: "promise", inner: STRING } },
+        rmdir: { fn: "fsp.rmdir", params: [STRING], result: { kind: "promise", inner: VOID } },
         link: {
             fn: "fsp.link",
             params: [DYN, DYN],
@@ -1136,6 +1270,28 @@ export const BUILTIN_MODULE_FNS = {
             result: F64,
             valueParams: [],
         },
+        // os.arch() IS process.arch, like platform().
+        arch: { fn: "process.arch", params: [], result: STRING, valueParams: [] },
+        hostname: { fn: "os.hostname", params: [], result: STRING, valueParams: [] },
+        // uv_os_uname's machine and version fields, read once at module load
+        // in Node (they never change while a process runs).
+        machine: { fn: "os.machine", params: [], result: STRING, valueParams: [] },
+        version: { fn: "os.version", params: [], result: STRING, valueParams: [] },
+        endianness: { fn: "os.endianness", params: [], result: STRING, valueParams: [] },
+        freemem: { fn: "os.freemem", params: [], result: F64, valueParams: [] },
+        uptime: { fn: "os.uptime", params: [], result: F64, valueParams: [] },
+        loadavg: { fn: "os.loadavg", params: [], result: arrayOf(F64), valueParams: [] },
+        // An omitted (or undefined) pid is 0, the current process
+        // (lowerOsGetPriorityCall completes it).
+        getPriority: {
+            fn: "os.getPriority",
+            params: [F64],
+            result: F64,
+            valueParams: [{ mode: "optional", type: F64, defaultValue: 0 }],
+        },
+        // Special-cased (lowerOsCpusCall): the call site's CpuInfo[] assembles
+        // from one uv_cpu_info snapshot.
+        cpus: { fn: "os.cpusTake", params: [], result: VOID },
         // Entirely special-cased (lowerOsNetworkInterfacesCall): the result is
         // the call site's mapped Dict<NetworkInterfaceInfo[]> shape, verified
         // structurally there — this entry only routes the dispatch.
@@ -1165,6 +1321,11 @@ export const BUILTIN_MODULE_FNS = {
         timingSafeEqual: { fn: "crypto.timingSafeEqual", params: [BYTES_U8, BYTES_U8], result: BOOL },
         randomFillSync: { fn: "crypto.randomFill", params: [BYTES_U8, F64, F64], result: BYTES_U8 },
         randomInt: { fn: "crypto.randomInt", params: [F64, F64], result: F64 },
+        randomFill: { fn: "crypto.randomFillCb", params: [], result: VOID },
+        randomUUIDv7: { fn: "crypto.randomUUIDv7", params: [DYN], result: STRING },
+        createSecretKey: { fn: "crypto.createSecretKey", params: [DYN, DYN], result: DYN },
+        generateKeySync: { fn: "crypto.generateKeySync", params: [DYN, DYN], result: DYN },
+        generateKey: { fn: "crypto.generateKeyCb", params: [], result: VOID },
         pbkdf2Sync: {
             fn: "crypto.pbkdf2",
             params: [BYTES_U8, BYTES_U8, F64, F64, STRING],
@@ -1229,6 +1390,14 @@ export const BUILTIN_MODULE_FNS = {
                 { mode: "optional", type: DYN, defaultValue: undefined },
             ],
         },
+        // The legacy API and the domain pair (lowerLegacyUrlCall): arguments
+        // cross as dyn values for Node's own validators; url.parse() answers
+        // the checked-dynamic Url instance.
+        parse: { fn: "url.legacyParse", params: [DYN, DYN, DYN], result: DYN },
+        format: { fn: "url.legacyFormat", params: [DYN, DYN], result: STRING },
+        resolve: { fn: "url.legacyResolve", params: [DYN, DYN], result: STRING },
+        domainToASCII: { fn: "url.domainToASCII", params: [DYN], result: STRING },
+        domainToUnicode: { fn: "url.domainToUnicode", params: [DYN], result: STRING },
     },
     child_process: {
         // spawnSync's and spawn's call completions are entirely special-cased
@@ -1305,6 +1474,53 @@ export const BUILTIN_MODULE_FNS = {
             result: STRING,
             valueParams: exactValueParams(DYN),
         },
+        // The function helpers take checked-dynamic arguments and answer native
+        // dyn functions, which a static function slot checks when it receives
+        // one (lowerUtilCallableCall in the util spoke).
+        inherits: {
+            fn: "util.inherits",
+            params: [DYN, DYN],
+            result: VOID,
+            valueParams: [
+                { mode: "required", type: DYN },
+                { mode: "required", type: DYN },
+            ],
+        },
+        deprecate: {
+            fn: "util.deprecate",
+            params: [DYN, DYN, DYN, DYN],
+            result: DYN,
+            valueParams: [
+                { mode: "required", type: DYN },
+                { mode: "required", type: DYN },
+                { mode: "optional", type: DYN, defaultValue: undefined },
+                { mode: "optional", type: DYN, defaultValue: undefined },
+            ],
+        },
+        callbackify: {
+            fn: "util.callbackify",
+            params: [DYN],
+            result: DYN,
+            valueParams: [{ mode: "required", type: DYN }],
+        },
+        debuglog: {
+            fn: "util.debuglog",
+            params: [DYN, DYN],
+            result: DYN,
+            valueParams: [
+                { mode: "required", type: DYN },
+                { mode: "optional", type: DYN, defaultValue: undefined },
+            ],
+        },
+        debug: {
+            fn: "util.debuglog",
+            params: [DYN, DYN],
+            result: DYN,
+            valueParams: [
+                { mode: "required", type: DYN },
+                { mode: "optional", type: DYN, defaultValue: undefined },
+            ],
+        },
     },
     // The util/types spoke supplies the probe name to the shared brand check.
     "util/types": {
@@ -1384,6 +1600,11 @@ export const BUILTIN_MODULE_FNS = {
     readline: {
         createInterface: { fn: "rl.create", params: [], result: F64 },
     },
+    // node:readline/promises: the same Interface with the promise question
+    // (lowerReadlineMethodCall tells the forms apart by the call's result).
+    "readline/promises": {
+        createInterface: { fn: "rl.create", params: [], result: F64 },
+    },
     // node:net and node:http lower ENTIRELY through the server spoke
     // (lower-server.ts — every call shape is special-cased: closures, the
     // optional connect host, writeHead's literal headers); the member list
@@ -1436,8 +1657,7 @@ export const BUILTIN_MODULE_FNS = {
     "stream/promises": {},
     // node:stream/consumers rides the stream spoke as well (text/json/
     // buffer/arrayBuffer special-case their stream argument); blob fences
-    // module-qualified with the pointed hint below — Blob has no
-    // representation in a compiled binary.
+    // module-qualified with the pointed hint below.
     "stream/consumers": {},
     // node:timers/promises — the delay-only setTimeout and bare setImmediate
     // (void promises the shared timer heap settles). The arity completion
@@ -1475,7 +1695,7 @@ export const BUILTIN_MODULE_CONSTS = {
     path: { sep: "/", delimiter: ":" },
     "path/posix": { sep: "/", delimiter: ":" },
     "path/win32": { sep: "\\", delimiter: ";" },
-    os: { EOL: "\n" },
+    os: { EOL: "\n", devNull: "/dev/null" },
     worker_threads: { isMainThread: true, threadId: 0 },
     cluster: { isPrimary: true, isMaster: true, isWorker: false },
 };
@@ -1518,6 +1738,7 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         rmSync: ["fs.rmOptsSync", "fs.rmRetrySync"],
         // The { withFileTypes: true } Dirent form.
         readdirSync: ["fs.readdirTypesSync"],
+        globSync: ["fs.globTypesSync"],
         // The JS-source validation-ladder variant (lowerFsLadderCall): the
         // real mkdtemp runs when the options leave utf8 semantics.
         mkdtempSync: ["fs.mkdtempSyncChk"],
@@ -1530,13 +1751,16 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         watch: ["fs.watchCb"],
     },
     "fs/promises": {
-        // The Buffer form (no encoding).
-        readFile: ["fsp.readFileBytes"],
+        // The Buffer form (no encoding) and the runtime-encoding forms.
+        readFile: ["fsp.readFileBytes", "fsp.readFileEncoded"],
         readlink: ["fsp.readlinkStr", "fsp.readlinkBuffer"],
         // The string-data { mode } options form.
         writeFile: ["fsp.writeFileMode"],
         // The { withFileTypes: true } Dirent form.
         readdir: ["fsp.readdirTypes"],
+        glob: ["fsp.globTypes"],
+        // The Uint8Array/Buffer-data form.
+        appendFile: ["fsp.appendFileBytes"],
     },
     crypto: {
         // The composed randomBytes(n).toString(enc) chain keeps its one-libCall
@@ -1545,11 +1769,23 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         randomBytes: ["crypto.randomBytesToString", "crypto.randomBytesCb"],
         // Omitting size fills from offset through the rest of the Buffer and
         // uses a separate runtime entry point for Node's exact bounds checks.
-        randomFillSync: ["crypto.randomFillRest"],
+        // Views of every kind return themselves; other buffers take the Dyn form.
+        randomFillSync: [
+            "crypto.randomFillRest",
+            "crypto.randomFillView",
+            "crypto.randomFillViewRest",
+            "crypto.randomFillSyncDyn",
+        ],
+        randomFill: ["crypto.randomFillCbDyn"],
+        timingSafeEqual: ["crypto.timingSafeEqualDyn"],
+        randomInt: ["crypto.randomIntMax", "crypto.randomIntCb"],
+        randomUUID: ["crypto.randomUUIDOpts"],
     },
     os: {
         // lowerOsUserInfoCall assembles the record from scalar libCalls.
         userInfo: ["os.userHomedir", "os.userShell"],
+        // lowerOsCpusCall reads the cpusTake snapshot through its accessors.
+        cpus: ["os.cpusModel", "os.cpusField"],
     },
 };
 export const AMBIENT_SURFACE_FNS = [
@@ -1574,6 +1810,20 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["sharedArrayBuffer.new"],
         note: "fixed shared storage with context-local typed-array and DataView wrappers",
     },
+    {
+        id: "stdlib.blob",
+        kind: "stdlib",
+        name: "Blob",
+        fns: ["blob.new", "blob.slice", "blob.text", "blob.bytes", "blob.arrayBuffer", "blob.is"],
+        note: "immutable bytes with size, type, slice(), text(), bytes(), arrayBuffer() and structured cloning",
+    },
+    {
+        id: "stdlib.file",
+        kind: "stdlib",
+        name: "File",
+        fns: ["blob.fileNew"],
+        note: "a Blob with name and lastModified (Date.now() when absent)",
+    },
     {
         id: "stdlib.atomics",
         kind: "stdlib",
@@ -1585,7 +1835,7 @@ export const AMBIENT_SURFACE_FNS = [
         id: "node-builtin.fs.callbacks",
         kind: "node-builtin",
         name: "fs error-first callbacks",
-        fns: ["fs.callbackValue", "fs.callbackCall"],
+        fns: ["fs.callbackValue", "fs.callbackCall", "fs.callbackGlob"],
         note: "native filesystem callbacks, including stored platform adapter functions",
     },
     // ── the Date slice (lowerDateCall/lowerNew): statics, construction,
@@ -1744,6 +1994,48 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["perf.now"],
         note: "the global performance object and the performance.now.bind(performance) function value reach the same clock",
     },
+    {
+        id: "node-builtin.perf_hooks.performance.mark",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.mark",
+        fns: [
+            "perf.mark",
+            "perf.entryName",
+            "perf.entryType",
+            "perf.entryStart",
+            "perf.entryDuration",
+            "perf.entryDetail",
+            "perf.entryKeep",
+            "perf.entryRef",
+        ],
+        note: "records a mark in the thread's performance timeline at the live clock or the given startTime",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.measure",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.measure",
+        fns: ["perf.measure"],
+        note: "the mark-name, timestamp, and options forms are one surface",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.getEntries",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.getEntries",
+        fns: ["perf.entries"],
+        note: "getEntries, getEntriesByName, and getEntriesByType read the same timeline",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.clearMarks",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.clearMarks",
+        fns: ["perf.clearMarks"],
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.clearMeasures",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.clearMeasures",
+        fns: ["perf.clearMeasures"],
+    },
     // ── the process global's ambient reads and authority calls
     // (lowerProcessProperty/lowerProcessMethodCall — process is a
     // provenance-checked global here, not an importable module).
@@ -1781,6 +2073,13 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["process.versions"],
         note: "shared version dictionary containing node and openssl; other components are absent unless defined by the program",
     },
+    {
+        id: "node-builtin.process.release",
+        kind: "node-builtin",
+        name: "process.release",
+        fns: ["process.release"],
+        note: "the compatibility target's release metadata as one stable read-only object",
+    },
     {
         id: "node-builtin.process.cwd",
         kind: "node-builtin",
@@ -1811,6 +2110,43 @@ export const AMBIENT_SURFACE_FNS = [
         name: "process.getgid",
         fns: ["process.getgid"],
     },
+    {
+        id: "node-builtin.process.geteuid",
+        kind: "node-builtin",
+        name: "process.geteuid",
+        fns: ["process.geteuid"],
+    },
+    {
+        id: "node-builtin.process.getegid",
+        kind: "node-builtin",
+        name: "process.getegid",
+        fns: ["process.getegid"],
+    },
+    {
+        id: "node-builtin.process.getgroups",
+        kind: "node-builtin",
+        name: "process.getgroups",
+        fns: ["process.getgroups"],
+    },
+    {
+        id: "node-builtin.process.ppid",
+        kind: "node-builtin",
+        name: "process.ppid",
+        fns: ["process.ppid"],
+    },
+    {
+        id: "node-builtin.process.title",
+        kind: "node-builtin",
+        name: "process.title",
+        fns: ["process.title", "process.setTitle"],
+        note: "reads and writes of the process title are one surface",
+    },
+    {
+        id: "node-builtin.process.argv0",
+        kind: "node-builtin",
+        name: "process.argv0",
+        fns: ["process.argv0"],
+    },
     {
         id: "node-builtin.process.execPath",
         kind: "node-builtin",
@@ -1835,6 +2171,13 @@ export const AMBIENT_SURFACE_FNS = [
         name: "process.constrainedMemory",
         fns: ["process.constrainedMemory"],
     },
+    {
+        id: "node-builtin.process.memoryUsage",
+        kind: "node-builtin",
+        name: "process.memoryUsage",
+        fns: ["process.memoryUsageTake", "process.memoryUsageField", "process.rss"],
+        note: "the record and memoryUsage.rss() read live memory state; external and arrayBuffers are 0",
+    },
     {
         id: "node-builtin.process.resourceUsage",
         kind: "node-builtin",
@@ -1944,13 +2287,22 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["tlsca.set"],
         note: "replaces the default set and the client trust anchors for the rest of the process",
     },
+    // os.constants is a VALUE read (lowerNamespaceBuiltinProperty and the
+    // named-import path): the platform's null-prototype constants object.
+    {
+        id: "node-builtin.os.constants",
+        kind: "node-builtin",
+        name: "os.constants",
+        fns: ["os.constants"],
+        note: "the platform's dlopen, errno, signals and priority groups; members a platform lacks read as undefined",
+    },
 ];
 /** The win32-target overrides of the bare modules' constants: path's
  * constants ARE the path/win32 namespace's, and os.EOL is CRLF (Node's
  * `isWindows ? '\r\n' : '\n'`). */
 const WIN32_TARGET_CONSTS = {
     path: BUILTIN_MODULE_CONSTS["path/win32"],
-    os: { EOL: "\r\n" },
+    os: { EOL: "\r\n", devNull: "\\\\.\\nul" },
 };
 /** BUILTIN_MODULE_FNS with the platform-conditional modules bound per
  * TARGET: a win32 triple compiles Node-on-Windows semantics — `path` is
@@ -1986,6 +2338,8 @@ export const FS_CALLBACK_MEMBERS = new Set([
     "copyFile",
     "chmod",
     "chown",
+    "lchown",
+    "fchown",
     "glob",
     "link",
     "mkdir",
@@ -2179,8 +2533,8 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
         promisify: "the lowered shapes are const bindings over child_process.execFile and fs.readFile; call the bound function directly",
     },
     "stream/consumers": {
-        blob: "Blob values have no representation in a compiled binary — " +
-            "buffer(stream) collects the same bytes as a Buffer, text(stream) the decoded text",
+        blob: "collecting a stream into a Blob is not supported yet — " +
+            "buffer(stream) collects the same bytes as a Buffer (new Blob([buffer]) wraps them), text(stream) the decoded text",
     },
     module: {
         createRequire: "the lowered shape is a const binding (or a proven stable top-level let/var) over createRequire(import.meta.url) (or __filename) " +
@@ -2198,11 +2552,8 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
         ...Object.fromEntries([
             "generateKeyPair",
             "generateKeyPairSync",
-            "generateKey",
-            "generateKeySync",
             "createPrivateKey",
             "createPublicKey",
-            "createSecretKey",
             "createSign",
             "createVerify",
             "sign",
@@ -2218,9 +2569,9 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
             "privateDecrypt",
         ].map((m) => [
             m,
-            "asymmetric-key operations need a public-key stack (bignum, RSA/EC/EdDSA math) and a " +
-                "KeyObject value model — neither exists in the static runtime, so no faithful lowering " +
-                "can be small; the lowered crypto surface is hashing, randomness, and the introspection statics",
+            "asymmetric-key operations need a public-key stack (bignum, RSA/EC/EdDSA math) and " +
+                "public and private KeyObjects — neither exists in the static runtime, so no faithful lowering " +
+                "can be small; the lowered crypto surface is hashing, randomness, secret KeyObjects, and the introspection statics",
         ])),
         ...Object.fromEntries(["createCipheriv", "createDecipheriv", "getCipherInfo"].map((m) => [
             m,
@@ -2256,8 +2607,8 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
  * accessed member is stdlib-declared, the use is standard-library surface
  * with no lowering — report SC2020 naming `<container>.<member>` (the
  * receiver's global name when it IS a stdlib global like Math or Promise,
- * its widened type text otherwise). Returns silently for non-stdlib
- * members so the caller's generic rejection applies. */
+ * its widened type text otherwise). Returns without reporting for
+ * non-stdlib members so the caller's generic rejection applies. */
 export function stdlibMemberFence(lowerer, access) {
     const sym = lowerer.checker.getSymbolAtLocation(access.name);
     if (!sym || !lowerer.isStdlibSymbol(sym))
@@ -2346,9 +2697,11 @@ export function stdlibMemberFence(lowerer, access) {
     }
     else if (container === "console") {
         hint =
-            "console.log/info/debug (stdout) and console.error/warn (stderr) are the supported " +
-                "console surface (arguments render with Node's console semantics: strings verbatim, " +
-                "everything else through the static util.inspect)";
+            "console.log/info/debug (stdout), console.error/warn (stderr), assert, count, " +
+                "countReset, dir, dirxml, group, groupCollapsed, groupEnd, table, time, timeEnd, " +
+                "timeLog, clear, profile, profileEnd, and timeStamp are the supported console surface " +
+                "(arguments render with Node's console semantics: strings verbatim, everything else " +
+                "through the static util.inspect)";
     }
     else if (container === "TextEncoder") {
         hint =