@scriptc/compiler 0.3.2 → 0.3.4

package/dist/frontend/lowering/surfaces.js

@@ -1,7 +1,10 @@
 import * as ts from "../ts7/adapter.js";
 import { UNSUPPORTED } from "../../diagnostics/diagnostic.js";
-import { BOOL, BYTES_U8, CHILD_T, CRYPTOHASH_T, CRYPTOHMAC_T, DYN, F64, FILEHANDLE_T, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf, } from "../../ir/ir.js";
+import { BOOL, BYTES_U8, CHILD_T, CRYPTOHASH_T, CRYPTOHMAC_T, DIR_T, DYN, F64, FILEHANDLE_T, SPAWNRES_T, STATS_T, STRING, URL_T, VOID, arrayOf, } from "../../ir/ir.js";
 import { isNodeTypesPath, requireSpecOf } from "../program.js";
+import { ZLIB_CONSTANTS } from "./zlib-constants.js";
+/** zlib stream instances: runtime Transform streams (scr_zlib_stream.c). */
+const ZLIB_STREAM = { kind: "object", className: "%Transform" };
 /** Statement-level constructs rejected wholesale, keyed by syntax kind. */
 export const UNSUPPORTED_STMT = {
     // DoStatement / SwitchStatement are supported; handled in lowerStmt.
@@ -67,7 +70,7 @@ export const NARROW_FIRST = "narrow first: check a discriminant field, or compar
  *     per-key fences);
  *   - keys Node DOCUMENTS for the API but this compiler cannot honor
  *     fence BY NAME at the use site — an option that changes
- *     Node-observable behavior must work or fence, never silently drop;
+ *     Node-observable behavior must work or fence instead of dropping;
  *   - undocumented keys DROP exactly as Node drops them, provided the
  *     value expression is side-effect-free (an effectful initializer
  *     fences: Node would have evaluated it, so skipping it would be
@@ -164,6 +167,7 @@ export const HTTP_CLIENT_DOCUMENTED_OPTIONS = new Set([
     "hints",
     "host",
     "hostname",
+    "httpValidation",
     "insecureHTTPParser",
     "joinDuplicateHeaders",
     "localAddress",
@@ -193,6 +197,7 @@ export const HTTP_SERVER_DOCUMENTED_OPTIONS = new Set([
     "connectionsCheckingInterval",
     "headersTimeout",
     "highWaterMark",
+    "httpValidation",
     "insecureHTTPParser",
     "joinDuplicateHeaders",
     "keepAlive",
@@ -224,11 +229,34 @@ export const AGENT_DOCUMENTED_OPTIONS = new Set([
     "noDelay",
     "path",
 ]);
+/** new https.Agent(options) also takes tls.connect's client-side options,
+ * which Node merges into every request made through the agent. None lower
+ * yet, so each fences by name. */
+export const HTTPS_AGENT_DOCUMENTED_OPTIONS = new Set([
+    ...AGENT_DOCUMENTED_OPTIONS,
+    "ca",
+    "cert",
+    "ciphers",
+    "crl",
+    "ecdhCurve",
+    "key",
+    "maxCachedSessions",
+    "maxVersion",
+    "minVersion",
+    "passphrase",
+    "pfx",
+    "rejectUnauthorized",
+    "secureOptions",
+    "secureProtocol",
+    "servername",
+    "sessionIdContext",
+]);
 /** https.request adds tls.connect's client-side TLS knobs. */
 export const HTTPS_CLIENT_DOCUMENTED_OPTIONS = new Set([
     ...HTTP_CLIENT_DOCUMENTED_OPTIONS,
     "ca",
     "cert",
+    "certificateCompression",
     "checkServerIdentity",
     "ciphers",
     "clientCertEngine",
@@ -264,6 +292,7 @@ export const TLS_SERVER_DOCUMENTED_OPTIONS = new Set([
     "allowHalfOpen",
     "ca",
     "cert",
+    "certificateCompression",
     "ciphers",
     "clientCertEngine",
     "crl",
@@ -465,7 +494,7 @@ export const COMPOUND_ASSIGN_OPS = {
  * smuggle itself in by name. `minArgs`/`maxArgs` pin the LOWERED call
  * forms: the lib declares wider signatures (optional position/fromIndex
  * parameters) that typecheck but have no lowering — those forms are fenced
- * per site instead of silently dropping arguments. */
+ * per site instead of dropping arguments without a diagnostic. */
 export const STR_METHODS = {
     charCodeAt: { method: "charCodeAt", result: F64, minArgs: 0, maxArgs: 1 },
     charAt: { method: "charAt", result: STRING, minArgs: 0, maxArgs: 1 },
@@ -799,7 +828,7 @@ const PATH_MODULE_FNS = {
     parse: { fn: "path.parse", params: [STRING], result: VOID },
     format: { fn: "path.format", params: [], result: STRING },
 };
-/** The win32 twins (scr_path.c's Node-v24 path.win32 port, byte-for-byte):
+/** The win32 twins (scr_path.c's exact port of Node-v24 path.win32):
  * "path/win32" everywhere, and the bare-module table when the build
  * TARGETS win32 — Node on Windows is path.win32. */
 const PATH_WIN32_MODULE_FNS = {
@@ -878,13 +907,61 @@ const PATH_WIN32_MODULE_FNS = {
     parse: { fn: "path.win32Parse", params: [STRING], result: VOID },
     format: { fn: "path.win32Format", params: [], result: STRING },
 };
+/** util.types's own keys in Node's order (Node 24.22.0). The table is the
+ * key census for Object.keys over util.types and node:util/types, including
+ * the members that do not compile yet; the corpus checks it against Node. */
+export const UTIL_TYPES_KEYS = [
+    "isArgumentsObject",
+    "isArrayBuffer",
+    "isAsyncFunction",
+    "isBigIntObject",
+    "isBooleanObject",
+    "isDate",
+    "isExternal",
+    "isGeneratorFunction",
+    "isGeneratorObject",
+    "isMap",
+    "isMapIterator",
+    "isModuleNamespaceObject",
+    "isNativeError",
+    "isNumberObject",
+    "isPromise",
+    "isProxy",
+    "isRegExp",
+    "isSet",
+    "isSetIterator",
+    "isSharedArrayBuffer",
+    "isStringObject",
+    "isSymbolObject",
+    "isWeakMap",
+    "isWeakSet",
+    "isAnyArrayBuffer",
+    "isBoxedPrimitive",
+    "isArrayBufferView",
+    "isDataView",
+    "isTypedArray",
+    "isUint8Array",
+    "isUint8ClampedArray",
+    "isUint16Array",
+    "isUint32Array",
+    "isInt8Array",
+    "isInt16Array",
+    "isInt32Array",
+    "isFloat16Array",
+    "isFloat32Array",
+    "isFloat64Array",
+    "isBigInt64Array",
+    "isBigUint64Array",
+    "isKeyObject",
+    "isCryptoKey",
+];
 export const BUILTIN_MODULE_FNS = {
     fs: {
         readFileSync: { fn: "fs.readFileSync", params: [STRING, STRING], result: STRING },
         // The exact-API subset is first-class. A fixed native ABI is not enough:
         // rows whose Node function has behavior-bearing trailing options remain
-        // call-only, or function-width adaptation could silently discard those
-        // options before entering the fixed runtime call.
+        // call-only, or function-width adaptation could discard those options
+        // without a diagnostic before entering the fixed runtime call.
         writeFileSync: { fn: "fs.writeFileSync", params: [STRING, STRING], result: VOID },
         appendFileSync: { fn: "fs.appendFileSync", params: [STRING, STRING], result: VOID },
         existsSync: {
@@ -897,6 +974,8 @@ export const BUILTIN_MODULE_FNS = {
         rmSync: { fn: "fs.rmSync", params: [STRING], result: VOID },
         rmdirSync: { fn: "fs.rmdirSync", params: [STRING], result: VOID },
         readdirSync: { fn: "fs.readdirSync", params: [STRING], result: arrayOf(STRING) },
+        // Pattern and options are checked by the runtime (lowerFsGlobSyncCall).
+        globSync: { fn: "fs.globSync", params: [DYN, DYN], result: arrayOf(STRING) },
         statSync: { fn: "fs.statSync", params: [STRING], result: STATS_T },
         mkdtempSync: { fn: "fs.mkdtempSync", params: [STRING], result: STRING },
         // accessSync's omitted mode completes to 0 (F_OK) in the special case
@@ -920,6 +999,21 @@ export const BUILTIN_MODULE_FNS = {
             result: VOID,
             valueParams: exactValueParams(STRING, F64, F64),
         },
+        lchownSync: {
+            fn: "fs.lchownSync",
+            params: [STRING, F64, F64],
+            result: VOID,
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        fchownSync: {
+            fn: "fs.fchownSync",
+            params: [F64, F64, F64],
+            result: VOID,
+            valueParams: exactValueParams(F64, F64, F64),
+        },
+        // truncateSync's omitted len completes to 0 in lowerBuiltinModuleCall,
+        // like accessSync's mode.
+        truncateSync: { fn: "fs.truncateSync", params: [STRING, F64], result: VOID },
         // The 2-argument form only: Node's mode flags (COPYFILE_EXCL, ...)
         // land on the arity fence.
         copyFileSync: { fn: "fs.copyFileSync", params: [STRING, STRING], result: VOID },
@@ -936,6 +1030,9 @@ export const BUILTIN_MODULE_FNS = {
         },
         // statSync's no-follow sibling; stats.isSymbolicLink answers what the
         // follow-free snapshot saw.
+        // opendirSync's options (a literal { bufferSize, encoding: "utf8" })
+        // lower in lowerBuiltinModuleCall; the row routes the dispatch.
+        opendirSync: { fn: "fs.opendirSync", params: [STRING, F64], result: DIR_T },
         lstatSync: { fn: "fs.lstatSync", params: [STRING], result: STATS_T },
         fstatSync: {
             fn: "fs.fstatSync",
@@ -1050,9 +1147,16 @@ export const BUILTIN_MODULE_FNS = {
             result: { kind: "promise", inner: arrayOf(STRING) },
         },
         rm: { fn: "fsp.rm", params: [STRING], result: { kind: "promise", inner: VOID } },
+        // The async iterator lowers only as a for await head (lowerFspGlobCall).
+        glob: { fn: "fsp.globStrings", params: [DYN, DYN], result: arrayOf(STRING) },
         stat: { fn: "fsp.stat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
         realpath: { fn: "fsp.realpath", params: [STRING], result: { kind: "promise", inner: STRING } },
         lstat: { fn: "fsp.lstat", params: [STRING], result: { kind: "promise", inner: STATS_T } },
+        opendir: {
+            fn: "fsp.opendir",
+            params: [STRING, F64],
+            result: { kind: "promise", inner: DIR_T },
+        },
         unlink: {
             fn: "fsp.unlink",
             params: [STRING],
@@ -1065,6 +1169,41 @@ export const BUILTIN_MODULE_FNS = {
             result: { kind: "promise", inner: VOID },
             valueParams: exactValueParams(STRING, F64),
         },
+        chown: {
+            fn: "fsp.chown",
+            params: [STRING, F64, F64],
+            result: { kind: "promise", inner: VOID },
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        lchown: {
+            fn: "fsp.lchown",
+            params: [STRING, F64, F64],
+            result: { kind: "promise", inner: VOID },
+            valueParams: exactValueParams(STRING, F64, F64),
+        },
+        // access' omitted mode and truncate's omitted len complete to 0 in
+        // lowerBuiltinModuleCall, like their sync spellings.
+        access: { fn: "fsp.access", params: [STRING, F64], result: { kind: "promise", inner: VOID } },
+        truncate: {
+            fn: "fsp.truncate",
+            params: [STRING, F64],
+            result: { kind: "promise", inner: VOID },
+        },
+        // String data; Uint8Array/Buffer data routes to fsp.appendFileBytes in
+        // lowerBuiltinModuleCall.
+        appendFile: {
+            fn: "fsp.appendFile",
+            params: [STRING, STRING],
+            result: { kind: "promise", inner: VOID },
+        },
+        // The 2-argument form only, like copyFileSync.
+        copyFile: {
+            fn: "fsp.copyFile",
+            params: [STRING, STRING],
+            result: { kind: "promise", inner: VOID },
+        },
+        mkdtemp: { fn: "fsp.mkdtemp", params: [STRING], result: { kind: "promise", inner: STRING } },
+        rmdir: { fn: "fsp.rmdir", params: [STRING], result: { kind: "promise", inner: VOID } },
         link: {
             fn: "fsp.link",
             params: [DYN, DYN],
@@ -1207,6 +1346,11 @@ export const BUILTIN_MODULE_FNS = {
         timingSafeEqual: { fn: "crypto.timingSafeEqual", params: [BYTES_U8, BYTES_U8], result: BOOL },
         randomFillSync: { fn: "crypto.randomFill", params: [BYTES_U8, F64, F64], result: BYTES_U8 },
         randomInt: { fn: "crypto.randomInt", params: [F64, F64], result: F64 },
+        randomFill: { fn: "crypto.randomFillCb", params: [], result: VOID },
+        randomUUIDv7: { fn: "crypto.randomUUIDv7", params: [DYN], result: STRING },
+        createSecretKey: { fn: "crypto.createSecretKey", params: [DYN, DYN], result: DYN },
+        generateKeySync: { fn: "crypto.generateKeySync", params: [DYN, DYN], result: DYN },
+        generateKey: { fn: "crypto.generateKeyCb", params: [], result: VOID },
         pbkdf2Sync: {
             fn: "crypto.pbkdf2",
             params: [BYTES_U8, BYTES_U8, F64, F64, STRING],
@@ -1221,6 +1365,10 @@ export const BUILTIN_MODULE_FNS = {
         hkdf: { fn: "crypto.hkdfCb", params: [], result: VOID },
         scryptSync: { fn: "crypto.scrypt", params: [BYTES_U8, BYTES_U8, F64, DYN], result: BYTES_U8 },
         scrypt: { fn: "crypto.scryptCb", params: [], result: VOID },
+        // Checked-dynamic arguments; the result is a native Cipheriv or
+        // Decipheriv handle (lowerCryptoModuleCall).
+        createCipheriv: { fn: "crypto.cipherNew", params: [BOOL, DYN, DYN, DYN, DYN], result: DYN },
+        createDecipheriv: { fn: "crypto.cipherNew", params: [BOOL, DYN, DYN, DYN, DYN], result: DYN },
     },
     zlib: {
         // The default-options convenience family is special-cased in
@@ -1242,6 +1390,15 @@ export const BUILTIN_MODULE_FNS = {
         unzip: { fn: "zlib.unzipCb", params: [], result: VOID },
         unzipSync: { fn: "zlib.unzipSync", params: [BYTES_U8], result: BYTES_U8 },
         crc32: { fn: "zlib.crc32", params: [], result: F64 },
+        // The stream factories (special-cased in lowerZlibModuleCall): each
+        // answers a runtime Transform stream over the zlib engine.
+        createDeflate: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createInflate: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createGzip: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createGunzip: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createDeflateRaw: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createInflateRaw: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
+        createUnzip: { fn: "zlib.streamNew", params: [], result: ZLIB_STREAM },
     },
     url: {
         fileURLToPath: {
@@ -1271,6 +1428,14 @@ export const BUILTIN_MODULE_FNS = {
                 { mode: "optional", type: DYN, defaultValue: undefined },
             ],
         },
+        // The legacy API and the domain pair (lowerLegacyUrlCall): arguments
+        // cross as dyn values for Node's own validators; url.parse() answers
+        // the checked-dynamic Url instance.
+        parse: { fn: "url.legacyParse", params: [DYN, DYN, DYN], result: DYN },
+        format: { fn: "url.legacyFormat", params: [DYN, DYN], result: STRING },
+        resolve: { fn: "url.legacyResolve", params: [DYN, DYN], result: STRING },
+        domainToASCII: { fn: "url.domainToASCII", params: [DYN], result: STRING },
+        domainToUnicode: { fn: "url.domainToUnicode", params: [DYN], result: STRING },
     },
     child_process: {
         // spawnSync's and spawn's call completions are entirely special-cased
@@ -1473,6 +1638,11 @@ export const BUILTIN_MODULE_FNS = {
     readline: {
         createInterface: { fn: "rl.create", params: [], result: F64 },
     },
+    // node:readline/promises: the same Interface with the promise question
+    // (lowerReadlineMethodCall tells the forms apart by the call's result).
+    "readline/promises": {
+        createInterface: { fn: "rl.create", params: [], result: F64 },
+    },
     // node:net and node:http lower ENTIRELY through the server spoke
     // (lower-server.ts — every call shape is special-cased: closures, the
     // optional connect host, writeHead's literal headers); the member list
@@ -1493,6 +1663,10 @@ export const BUILTIN_MODULE_FNS = {
             params: [F64],
             result: VOID,
         },
+        // Node's IPv4Reg / IPv6Reg tests over String(input).
+        isIP: { fn: "net.isIP", params: [DYN], result: F64 },
+        isIPv4: { fn: "net.isIPv4", params: [DYN], result: BOOL },
+        isIPv6: { fn: "net.isIPv6", params: [DYN], result: BOOL },
     },
     http: {},
     // node:tls and node:https ride the same spoke (tls.createServer's
@@ -1525,8 +1699,7 @@ export const BUILTIN_MODULE_FNS = {
     "stream/promises": {},
     // node:stream/consumers rides the stream spoke as well (text/json/
     // buffer/arrayBuffer special-case their stream argument); blob fences
-    // module-qualified with the pointed hint below — Blob has no
-    // representation in a compiled binary.
+    // module-qualified with the pointed hint below.
     "stream/consumers": {},
     // node:timers/promises — the delay-only setTimeout and bare setImmediate
     // (void promises the shared timer heap settles). The arity completion
@@ -1567,6 +1740,9 @@ export const BUILTIN_MODULE_CONSTS = {
     os: { EOL: "\n", devNull: "/dev/null" },
     worker_threads: { isMainThread: true, threadId: 0 },
     cluster: { isPrimary: true, isMaster: true, isWorker: false },
+    // zlib's module-level copies of its constants (every member outside
+    // BROTLI_*, Node's own loop over zlib.constants).
+    zlib: Object.fromEntries(Object.entries(ZLIB_CONSTANTS).filter(([name]) => !name.startsWith("BROTLI"))),
 };
 /** ALTERNATE libCall spellings of tabled builtin members: lowerings the
  * dispatch special-cases around the table row (Buffer/fd/options forms,
@@ -1607,6 +1783,7 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         rmSync: ["fs.rmOptsSync", "fs.rmRetrySync"],
         // The { withFileTypes: true } Dirent form.
         readdirSync: ["fs.readdirTypesSync"],
+        globSync: ["fs.globTypesSync"],
         // The JS-source validation-ladder variant (lowerFsLadderCall): the
         // real mkdtemp runs when the options leave utf8 semantics.
         mkdtempSync: ["fs.mkdtempSyncChk"],
@@ -1619,13 +1796,16 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         watch: ["fs.watchCb"],
     },
     "fs/promises": {
-        // The Buffer form (no encoding).
-        readFile: ["fsp.readFileBytes"],
+        // The Buffer form (no encoding) and the runtime-encoding forms.
+        readFile: ["fsp.readFileBytes", "fsp.readFileEncoded"],
         readlink: ["fsp.readlinkStr", "fsp.readlinkBuffer"],
         // The string-data { mode } options form.
         writeFile: ["fsp.writeFileMode"],
         // The { withFileTypes: true } Dirent form.
         readdir: ["fsp.readdirTypes"],
+        glob: ["fsp.globTypes"],
+        // The Uint8Array/Buffer-data form.
+        appendFile: ["fsp.appendFileBytes"],
     },
     crypto: {
         // The composed randomBytes(n).toString(enc) chain keeps its one-libCall
@@ -1634,7 +1814,17 @@ export const BUILTIN_MODULE_FN_ALIASES = {
         randomBytes: ["crypto.randomBytesToString", "crypto.randomBytesCb"],
         // Omitting size fills from offset through the rest of the Buffer and
         // uses a separate runtime entry point for Node's exact bounds checks.
-        randomFillSync: ["crypto.randomFillRest"],
+        // Views of every kind return themselves; other buffers take the Dyn form.
+        randomFillSync: [
+            "crypto.randomFillRest",
+            "crypto.randomFillView",
+            "crypto.randomFillViewRest",
+            "crypto.randomFillSyncDyn",
+        ],
+        randomFill: ["crypto.randomFillCbDyn"],
+        timingSafeEqual: ["crypto.timingSafeEqualDyn"],
+        randomInt: ["crypto.randomIntMax", "crypto.randomIntCb"],
+        randomUUID: ["crypto.randomUUIDOpts"],
     },
     os: {
         // lowerOsUserInfoCall assembles the record from scalar libCalls.
@@ -1665,6 +1855,20 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["sharedArrayBuffer.new"],
         note: "fixed shared storage with context-local typed-array and DataView wrappers",
     },
+    {
+        id: "stdlib.blob",
+        kind: "stdlib",
+        name: "Blob",
+        fns: ["blob.new", "blob.slice", "blob.text", "blob.bytes", "blob.arrayBuffer", "blob.is"],
+        note: "immutable bytes with size, type, slice(), text(), bytes(), arrayBuffer() and structured cloning",
+    },
+    {
+        id: "stdlib.file",
+        kind: "stdlib",
+        name: "File",
+        fns: ["blob.fileNew"],
+        note: "a Blob with name and lastModified (Date.now() when absent)",
+    },
     {
         id: "stdlib.atomics",
         kind: "stdlib",
@@ -1676,7 +1880,7 @@ export const AMBIENT_SURFACE_FNS = [
         id: "node-builtin.fs.callbacks",
         kind: "node-builtin",
         name: "fs error-first callbacks",
-        fns: ["fs.callbackValue", "fs.callbackCall"],
+        fns: ["fs.callbackValue", "fs.callbackCall", "fs.callbackGlob"],
         note: "native filesystem callbacks, including stored platform adapter functions",
     },
     // ── the Date slice (lowerDateCall/lowerNew): statics, construction,
@@ -1835,6 +2039,48 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["perf.now"],
         note: "the global performance object and the performance.now.bind(performance) function value reach the same clock",
     },
+    {
+        id: "node-builtin.perf_hooks.performance.mark",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.mark",
+        fns: [
+            "perf.mark",
+            "perf.entryName",
+            "perf.entryType",
+            "perf.entryStart",
+            "perf.entryDuration",
+            "perf.entryDetail",
+            "perf.entryKeep",
+            "perf.entryRef",
+        ],
+        note: "records a mark in the thread's performance timeline at the live clock or the given startTime",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.measure",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.measure",
+        fns: ["perf.measure"],
+        note: "the mark-name, timestamp, and options forms are one surface",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.getEntries",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.getEntries",
+        fns: ["perf.entries"],
+        note: "getEntries, getEntriesByName, and getEntriesByType read the same timeline",
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.clearMarks",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.clearMarks",
+        fns: ["perf.clearMarks"],
+    },
+    {
+        id: "node-builtin.perf_hooks.performance.clearMeasures",
+        kind: "node-builtin",
+        name: "perf_hooks.performance.clearMeasures",
+        fns: ["perf.clearMeasures"],
+    },
     // ── the process global's ambient reads and authority calls
     // (lowerProcessProperty/lowerProcessMethodCall — process is a
     // provenance-checked global here, not an importable module).
@@ -1872,6 +2118,13 @@ export const AMBIENT_SURFACE_FNS = [
         fns: ["process.versions"],
         note: "shared version dictionary containing node and openssl; other components are absent unless defined by the program",
     },
+    {
+        id: "node-builtin.process.release",
+        kind: "node-builtin",
+        name: "process.release",
+        fns: ["process.release"],
+        note: "the compatibility target's release metadata as one stable read-only object",
+    },
     {
         id: "node-builtin.process.cwd",
         kind: "node-builtin",
@@ -1902,6 +2155,43 @@ export const AMBIENT_SURFACE_FNS = [
         name: "process.getgid",
         fns: ["process.getgid"],
     },
+    {
+        id: "node-builtin.process.geteuid",
+        kind: "node-builtin",
+        name: "process.geteuid",
+        fns: ["process.geteuid"],
+    },
+    {
+        id: "node-builtin.process.getegid",
+        kind: "node-builtin",
+        name: "process.getegid",
+        fns: ["process.getegid"],
+    },
+    {
+        id: "node-builtin.process.getgroups",
+        kind: "node-builtin",
+        name: "process.getgroups",
+        fns: ["process.getgroups"],
+    },
+    {
+        id: "node-builtin.process.ppid",
+        kind: "node-builtin",
+        name: "process.ppid",
+        fns: ["process.ppid"],
+    },
+    {
+        id: "node-builtin.process.title",
+        kind: "node-builtin",
+        name: "process.title",
+        fns: ["process.title", "process.setTitle"],
+        note: "reads and writes of the process title are one surface",
+    },
+    {
+        id: "node-builtin.process.argv0",
+        kind: "node-builtin",
+        name: "process.argv0",
+        fns: ["process.argv0"],
+    },
     {
         id: "node-builtin.process.execPath",
         kind: "node-builtin",
@@ -1926,6 +2216,13 @@ export const AMBIENT_SURFACE_FNS = [
         name: "process.constrainedMemory",
         fns: ["process.constrainedMemory"],
     },
+    {
+        id: "node-builtin.process.memoryUsage",
+        kind: "node-builtin",
+        name: "process.memoryUsage",
+        fns: ["process.memoryUsageTake", "process.memoryUsageField", "process.rss"],
+        note: "the record and memoryUsage.rss() read live memory state; external and arrayBuffers are 0",
+    },
     {
         id: "node-builtin.process.resourceUsage",
         kind: "node-builtin",
@@ -2086,6 +2383,8 @@ export const FS_CALLBACK_MEMBERS = new Set([
     "copyFile",
     "chmod",
     "chown",
+    "lchown",
+    "fchown",
     "glob",
     "link",
     "mkdir",
@@ -2248,21 +2547,17 @@ export function builtinModulesArrayLit(loc) {
 /** Member-specific hints for RECOGNIZED builtin modules whose member has
  * no lowering. The default-options one-shot zlib/deflate-raw/gzip codecs
  * lower for strings and Buffers; the remaining surface points at them. */
-const ZLIB_HINT = "the default-options deflate/inflate, raw, gzip/gunzip, and unzip sync/callback forms plus crc32 are the lowered zlib surface";
-/** The legacy deep pair remains fenced. The shallow equal/notEqual pair
- * lowers through the static Abstract Equality kernel in lower-assert. */
-const ASSERT_LOOSE_DEEP_HINT = "legacy deep equality has no lowering yet — deepStrictEqual and " +
-    "notDeepStrictEqual compare structures with Node's modern semantics";
+const ZLIB_HINT = "the default-options deflate/inflate, raw, gzip/gunzip, and unzip sync/callback forms, crc32, " +
+    "and the Deflate/Inflate/Gzip/Gunzip/DeflateRaw/InflateRaw/Unzip streams are the lowered zlib surface";
+/** Brotli has no codec in the static runtime (zlib is the only vendored
+ * compression library). */
+const BROTLI_HINT = "Brotli needs a Brotli codec, which the static runtime does not vendor — " + ZLIB_HINT;
 const ASSERT_MODULE_HINTS = {
-    deepEqual: ASSERT_LOOSE_DEEP_HINT,
-    notDeepEqual: ASSERT_LOOSE_DEEP_HINT,
     ifError: "test explicitly instead: assert.strictEqual(err, null) / " +
         "assert.strictEqual(err, undefined)",
     rejects: "await the promise inside assert.throws's callback story instead: " +
         'try { await p; assert.fail("expected rejection") } catch { ... }',
     doesNotReject: "await the promise directly — an unexpected rejection already fails the test",
-    AssertionError: "the class itself has no lowering — catch and test err.name === " +
-        '"AssertionError" or err.code === "ERR_ASSERTION"',
 };
 export const BUILTIN_MODULE_FENCE_HINTS = {
     assert: ASSERT_MODULE_HINTS,
@@ -2273,14 +2568,13 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
         ifError: ASSERT_MODULE_HINTS["ifError"],
         rejects: ASSERT_MODULE_HINTS["rejects"],
         doesNotReject: ASSERT_MODULE_HINTS["doesNotReject"],
-        AssertionError: ASSERT_MODULE_HINTS["AssertionError"],
     },
     util: {
         promisify: "the lowered shapes are const bindings over child_process.execFile and fs.readFile; call the bound function directly",
     },
     "stream/consumers": {
-        blob: "Blob values have no representation in a compiled binary — " +
-            "buffer(stream) collects the same bytes as a Buffer, text(stream) the decoded text",
+        blob: "collecting a stream into a Blob is not supported yet — " +
+            "buffer(stream) collects the same bytes as a Buffer (new Blob([buffer]) wraps them), text(stream) the decoded text",
     },
     module: {
         createRequire: "the lowered shape is a const binding (or a proven stable top-level let/var) over createRequire(import.meta.url) (or __filename) " +
@@ -2298,11 +2592,8 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
         ...Object.fromEntries([
             "generateKeyPair",
             "generateKeyPairSync",
-            "generateKey",
-            "generateKeySync",
             "createPrivateKey",
             "createPublicKey",
-            "createSecretKey",
             "createSign",
             "createVerify",
             "sign",
@@ -2318,14 +2609,14 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
             "privateDecrypt",
         ].map((m) => [
             m,
-            "asymmetric-key operations need a public-key stack (bignum, RSA/EC/EdDSA math) and a " +
-                "KeyObject value model — neither exists in the static runtime, so no faithful lowering " +
-                "can be small; the lowered crypto surface is hashing, randomness, and the introspection statics",
+            "asymmetric-key operations need a public-key stack (bignum, RSA/EC/EdDSA math) and " +
+                "public and private KeyObjects — neither exists in the static runtime, so no faithful lowering " +
+                "can be small; the lowered crypto surface is hashing, randomness, secret KeyObjects, and the introspection statics",
         ])),
-        ...Object.fromEntries(["createCipheriv", "createDecipheriv", "getCipherInfo"].map((m) => [
+        ...Object.fromEntries(["getCipherInfo"].map((m) => [
             m,
-            "symmetric ciphers need a cipher stack the static runtime does not vendor — " +
-                "the lowered crypto surface is hashing, randomness, and the introspection statics",
+            "cipher metadata has no lowering — createCipheriv and createDecipheriv support " +
+                "aes-128/192/256 in cbc, ctr, and gcm modes and chacha20-poly1305",
         ])),
         setFips: "a compiled binary has no FIPS provider to enable, and Node itself throws on setFips(true) " +
             "in a non-FIPS build — getFips() answers 0 here",
@@ -2333,8 +2624,14 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
             "randomBytes, and the createHash chain",
     },
     zlib: {
-        brotliCompressSync: ZLIB_HINT,
-        brotliDecompressSync: ZLIB_HINT,
+        brotliCompressSync: BROTLI_HINT,
+        brotliDecompressSync: BROTLI_HINT,
+        brotliCompress: BROTLI_HINT,
+        brotliDecompress: BROTLI_HINT,
+        createBrotliCompress: BROTLI_HINT,
+        createBrotliDecompress: BROTLI_HINT,
+        BrotliCompress: BROTLI_HINT,
+        BrotliDecompress: BROTLI_HINT,
     },
     http2: {
         connect: "HTTP/2 client sessions have no lowering — the lowered http2 surface is the SERVER side: " +
@@ -2356,8 +2653,8 @@ export const BUILTIN_MODULE_FENCE_HINTS = {
  * accessed member is stdlib-declared, the use is standard-library surface
  * with no lowering — report SC2020 naming `<container>.<member>` (the
  * receiver's global name when it IS a stdlib global like Math or Promise,
- * its widened type text otherwise). Returns silently for non-stdlib
- * members so the caller's generic rejection applies. */
+ * its widened type text otherwise). Returns without reporting for
+ * non-stdlib members so the caller's generic rejection applies. */
 export function stdlibMemberFence(lowerer, access) {
     const sym = lowerer.checker.getSymbolAtLocation(access.name);
     if (!sym || !lowerer.isStdlibSymbol(sym))