@scriptc/compiler 0.3.5 → 0.4.0

package/dist/frontend/lowering/lower-server.js

@@ -4,7 +4,7 @@ import { ladderFenceExpr } from "./lowerer.js";
 import { isJsSourceFile, locOf } from "../program.js";
 import { arrayOf, BOOL, BYTES_U8, canBoxFuncIntoDyn, canConvertToDyn, DYN, DYN_HANDLE_KINDS, F64, funcOf, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, NETSERVER_T, NETSOCKET_T, NULL_T, SECURECTX_T, STRING, UNDEFINED_T, typeKey, VOID, } from "../../ir/ir.js";
 import { AGENT_DOCUMENTED_OPTIONS, HTTPS_AGENT_DOCUMENTED_OPTIONS, builtinFenceHintOf, builtinModuleFnOf, fenceOrDropOptionKey, HTTP_CLIENT_DOCUMENTED_OPTIONS, HTTP_SERVER_DOCUMENTED_OPTIONS, HTTP2_SECURE_SERVER_DOCUMENTED_OPTIONS, HTTPS_CLIENT_DOCUMENTED_OPTIONS, sideEffectFreeOptionValue, TLS_SERVER_DOCUMENTED_OPTIONS, } from "./surfaces.js";
-import { conditionalSpreadOf } from "./expressions/object-literals.js";
+import { conditionalSpreadOf, lowerDynObjectLiteral } from "./expressions/object-literals.js";
 import { resultIsDiscarded } from "./call-position.js";
 import { lowerCallbackArg as lowerCallbackArgShared } from "./callback-arg.js";
 import { pairsSnapshotHelper } from "./pairs-snapshot.js";
@@ -583,7 +583,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
     // budget pair) ride the generic path — null hands the dispatch back.
     if (builtinModuleFnOf(lowerer, "net", bi.member))
         return null;
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length === 0) {
             return { kind: "libCall", fn: "net.createServer", args: [], type: NETSERVER_T, loc };
@@ -594,7 +594,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
             // ERR_INVALID_ARG_TYPE on 'options' before any server exists. DYN
             // result — the checked-dynamic lane's concise arrows box it, and
             // the throw means it never materializes.
-            if (isJsSourceFile(expr.getSourceFile())) {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr))) {
                 const t = lowerer.mapTypeOf(lowerer.typeOf(args[0]));
                 if (t !== null && (t.kind === "string" || t.kind === "f64" || t.kind === "bool")) {
                     const raw = lowerer.lowerExpr(args[0]);
@@ -633,7 +633,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
         // invalid-input probes build theirs with computed keys): the
         // checked-dynamic walk validates Node-order and the compiler-rendered
         // fence is the post-validation tail.
-        if (args.length === 1 && isJsSourceFile(expr.getSourceFile())) {
+        if (args.length === 1 && isJsSourceFile(ts.getSourceFileOfNode(expr))) {
             const t = lowerer.mapTypeOf(lowerer.typeOf(args[0]));
             if (t !== null && (t.kind === "dyn" || t.kind === "record")) {
                 const raw = lowerer.lowerExpr(args[0]);
@@ -722,9 +722,9 @@ function lookupFnShapeOk(lowerer, t) {
  * name; a connect listener argument is supported on the no-lookup form
  * only. */
 function lowerNetConnectOptions(lowerer, expr, member, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     const optsNode = args[0];
-    const isJs = isJsSourceFile(expr.getSourceFile());
+    const isJs = isJsSourceFile(ts.getSourceFileOfNode(expr));
     // The checked-dynamic option-bag route (JS sources): a literal with
     // computed keys (the invalid-input probes' spelling) or an objectMode-
     // trio member rides WHOLE to the runtime walk — Node's Socket-ctor
@@ -732,7 +732,7 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
     // port/host/autoSelectFamily), with the compiler-rendered fence as the
     // post-validation tail.
     if (isJs) {
-        const needsBag = optsNode.properties.some((p) => (!ts.isPropertyAssignment(p) && !ts.isShorthandPropertyAssignment(p)) ||
+        const needsBag = optsNode.properties.nodes.some((p) => (!ts.isPropertyAssignment(p) && !ts.isShorthandPropertyAssignment(p)) ||
             (ts.isPropertyAssignment(p) && ts.isComputedPropertyName(p.name)) ||
             ["objectMode", "readableObjectMode", "writableObjectMode"].includes((ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
                 (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name))
@@ -772,7 +772,7 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
         type: NETSOCKET_T,
         loc,
     });
-    for (const prop of optsNode.properties) {
+    for (const prop of optsNode.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -916,8 +916,8 @@ function lowerServerCloseBind(lowerer, call, access) {
         return null;
     const loc = locOf(call);
     const recvNode = closeAccess.expression;
-    const thisArg = call.arguments[0];
-    if (call.arguments.length !== 1 ||
+    const thisArg = call.arguments.nodes[0];
+    if (call.arguments.nodes.length !== 1 ||
         !thisArg ||
         !ts.isIdentifier(recvNode) ||
         !ts.isIdentifier(thisArg) ||
@@ -1083,7 +1083,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "getConnections") {
         // cb(null, count) on the next tick; answers the server.
         if (args.length !== 1) {
@@ -1155,7 +1155,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
             let host = null;
             let v6only = null;
             let reusePort = null;
-            for (const prop of args[0].properties) {
+            for (const prop of args[0].properties.nodes) {
                 let initializer;
                 if (ts.isPropertyAssignment(prop) &&
                     (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -1213,7 +1213,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 }
                 else if (key === "signal" &&
                     ts.isPropertyAssignment(prop) &&
-                    isJsSourceFile(call.getSourceFile())) {
+                    isJsSourceFile(ts.getSourceFileOfNode(call))) {
                     // A provably-non-AbortSignal signal (the invalid-input probes:
                     // strings, numbers, plain records) throws Node's
                     // validateAbortSignal ladder; plausible signal values keep the
@@ -1287,6 +1287,18 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 ? [receiver, port, host, v6only, cbV]
                 : [receiver, port, host, v6only, reusePort, cbV]);
         }
+        // listen(path[, cb]): a string first argument names a Unix socket
+        // (the runtime takes a numeric string as a port, Node's isPipeName).
+        if (lowerer.mapTypeOf(lowerer.typeOf(args[0]))?.kind === "string") {
+            if (args.length > 2) {
+                lowerer.noLowering(`listen(path) with ${args.length} arguments`, call, "the supported form is listen(path[, callback])");
+            }
+            const path = lowerer.lowerExprExpecting(args[0], STRING);
+            if (args.length === 1)
+                return listenResult("net.listenPath", [receiver, path]);
+            const { cb } = lowerCallbackArg(lowerer, args[1], "listen callbacks", 0, () => false, "use ()", []);
+            return listenResult("net.listenPathCb", [receiver, path, cb]);
+        }
         const port = lowerer.lowerExprExpecting(args[0], F64);
         // The optional middle host — listen(port, '127.0.0.1'[, cb]): a
         // string-typed second argument is the bind address (the net.connect
@@ -1326,6 +1338,19 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         if (args.length === 0) {
             return { kind: "libCall", fn: "net.serverClose", args: [receiver], type: VOID, loc };
         }
+        if (lowerer.checker
+            .getCallSignatures(lowerer.typeOf(args[0]))
+            .some((sig) => sig.getParameters().length > 0)) {
+            // close((err) => ...): undefined once the server closes, or Node's
+            // ERR_SERVER_NOT_RUNNING when it was not listening.
+            return {
+                kind: "libCall",
+                fn: "net.serverCloseDyn",
+                args: [receiver, lowerSocketDynListener(lowerer, args[0], "close callbacks")],
+                type: VOID,
+                loc,
+            };
+        }
         const { cb } = lowerCallbackArg(lowerer, args[0], "close callbacks", 0, () => false, "use ()", []);
         return { kind: "libCall", fn: "net.serverCloseCb", args: [receiver, cb], type: VOID, loc };
     }
@@ -1389,6 +1414,18 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 loc,
             };
         }
+        if (event === "checkContinue" || event === "checkExpectation") {
+            // Expect handling: these listeners take the request instead of
+            // 'request' (checkContinue answers with res.writeContinue()).
+            const cb = lowerRequestHandlerArg(lowerer, args[1]);
+            return {
+                kind: "libCall",
+                fn: "http.serverOnCheck",
+                args: [receiver, cb, once, boolLit(event === "checkExpectation", loc)],
+                type: VOID,
+                loc,
+            };
+        }
         if (event === "request") {
             // The 'request' event — http.createServer(handler)'s event twin, and
             // the way an http2 allowHTTP1 server (created handler-less) gets its
@@ -1522,7 +1559,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 loc,
             };
         }
-        lowerer.noLowering(`server.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"connection", "request", "drop", "stream", "session", "upgrade", "connect", "error", "close", "listening", and "sessionError" are the supported server events (as literals)');
+        lowerer.noLowering(`server.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"connection", "request", "checkContinue", "checkExpectation", "drop", "stream", "session", "upgrade", "connect", "error", "close", "listening", and "sessionError" are the supported server events (as literals)');
     }
     if (name === "emit") {
         // The demux route: emit("connection", socket) hands an accepted
@@ -1571,6 +1608,32 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         const result = lowerer.mapTypeOf(lowerer.typeOf(call));
         if (result && isAddressInfoRecord(lowerer, result)) {
             const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
+            if (unixListenReachable(lowerer)) {
+                // A Unix-socket server's address() is its path, which this record
+                // cannot hold: the check throws for one before the record reads.
+                const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
+                const server = () => varRef(local.id, NETSERVER_T, loc);
+                return {
+                    kind: "seqExpr",
+                    stmts: [
+                        { kind: "varDecl", localId: local.id, init: receiver, loc },
+                        {
+                            kind: "exprStmt",
+                            expr: {
+                                kind: "libCall",
+                                fn: "net.serverAddressCheck",
+                                args: [server()],
+                                type: VOID,
+                                loc,
+                            },
+                            loc,
+                        },
+                    ],
+                    result: { kind: "libCall", fn: "net.serverAddress", args: [server()], type: result, loc },
+                    type: result,
+                    loc,
+                };
+            }
             return { kind: "libCall", fn: "net.serverAddress", args: [receiver], type: result, loc };
         }
         // @types/node's `string | AddressInfo | null`: the record while the
@@ -1586,20 +1649,50 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
         const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
         const server = varRef(local.id, NETSERVER_T, loc);
+        const recordArm = {
+            kind: "unionWrap",
+            unionId,
+            tag: lowerer.armTag(unionId, record),
+            value: { kind: "libCall", fn: "net.serverAddress", args: [server], type: record, loc },
+            type: result,
+            loc,
+        };
+        const stringTag = lowerer.armTag(unionId, STRING);
+        let listeningArm = recordArm;
+        const stmts = [{ kind: "varDecl", localId: local.id, init: receiver, loc }];
+        if (stringTag >= 0 && unixListenReachable(lowerer)) {
+            // Node answers a Unix-socket server's address() with its path.
+            const pathLocal = lowerer.declareHiddenLocal("%addressPath", STRING);
+            const path = () => varRef(pathLocal.id, STRING, loc);
+            stmts.push({
+                kind: "varDecl",
+                localId: pathLocal.id,
+                init: { kind: "libCall", fn: "net.serverUnixPath", args: [server], type: STRING, loc },
+                loc,
+            });
+            listeningArm = {
+                kind: "ternary",
+                cond: {
+                    kind: "strEq",
+                    negated: true,
+                    left: path(),
+                    right: strLit("", loc),
+                    type: BOOL,
+                    loc,
+                },
+                then: { kind: "unionWrap", unionId, tag: stringTag, value: path(), type: result, loc },
+                else_: recordArm,
+                type: result,
+                loc,
+            };
+        }
         return {
             kind: "seqExpr",
-            stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }],
+            stmts,
             result: {
                 kind: "ternary",
                 cond: { kind: "libCall", fn: "net.serverListening", args: [server], type: BOOL, loc },
-                then: {
-                    kind: "unionWrap",
-                    unionId,
-                    tag: lowerer.armTag(unionId, record),
-                    value: { kind: "libCall", fn: "net.serverAddress", args: [server], type: record, loc },
-                    type: result,
-                    loc,
-                },
+                then: listeningArm,
                 else_: {
                     kind: "unionWrap",
                     unionId,
@@ -1617,6 +1710,114 @@ function lowerNetServerMethodCall(lowerer, call, access) {
     }
     lowerer.noLowering(`Server.${name}`, call, 'listen, close, address().port, emit("connection", socket), and on/once of connection/request/upgrade/error/close/listening/sessionError are the supported Server members', lowerer.checker.getSymbolAtLocation(access.name));
 }
+/** Whether a setEncoding call can reach some net.Socket in this program:
+ * `x.setEncoding(...)` or `x["setEncoding"](...)` where `x` is a socket
+ * or an untyped value. Sockets that never get an encoding keep the Buffer
+ * chunk path; with one, Node's 'data' chunks are strings. */
+function socketEncodingReachable(lowerer) {
+    if (lowerer.socketEncodingReachable !== null)
+        return lowerer.socketEncodingReachable;
+    let reachable = false;
+    for (const file of lowerer.program.getSourceFiles()) {
+        if (file.isDeclarationFile || !file.text.includes("setEncoding"))
+            continue;
+        ts.walkPreorder(file, (node) => {
+            if (reachable)
+                return "skip";
+            if (!ts.isCallExpression(node))
+                return undefined;
+            const callee = node.expression;
+            const receiver = ts.isPropertyAccessExpression(callee) && callee.name.text === "setEncoding"
+                ? callee.expression
+                : ts.isElementAccessExpression(callee) &&
+                    ts.isStringLiteralLike(callee.argumentExpression) &&
+                    callee.argumentExpression.text === "setEncoding"
+                    ? callee.expression
+                    : null;
+            if (receiver === null)
+                return undefined;
+            const kind = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(receiver))?.kind;
+            if (kind === undefined || kind === "netSocket" || kind === "dyn")
+                reachable = true;
+            return undefined;
+        });
+        if (reachable)
+            break;
+    }
+    lowerer.socketEncodingReachable = reachable;
+    return reachable;
+}
+/** Whether some server in the program may listen on a Unix socket: a
+ * `.listen(x, ...)` call on a server (or an untyped value) whose first
+ * argument is string-typed. Only then does address() check for the socket
+ * path, so other programs keep the record-only lowering. */
+function unixListenReachable(lowerer) {
+    if (lowerer.unixListenReachable !== null)
+        return lowerer.unixListenReachable;
+    let reachable = false;
+    for (const file of lowerer.program.getSourceFiles()) {
+        if (file.isDeclarationFile || !file.text.includes("listen"))
+            continue;
+        ts.walkPreorder(file, (node) => {
+            if (reachable)
+                return "skip";
+            if (!ts.isCallExpression(node) || node.arguments.nodes.length === 0)
+                return undefined;
+            const callee = node.expression;
+            if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== "listen")
+                return undefined;
+            const kind = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(callee.expression))?.kind;
+            if (kind !== undefined && kind !== "netServer" && kind !== "dyn")
+                return undefined;
+            const arg = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(node.arguments.nodes[0]));
+            // Only a string-typed argument lowers to listen(path) (an untyped
+            // one checks into a port).
+            if (arg?.kind === "string")
+                reachable = true;
+            return undefined;
+        });
+        if (reachable)
+            break;
+    }
+    lowerer.unixListenReachable = reachable;
+    return reachable;
+}
+/** An inline 'data' listener whose chunk parameter is typed Buffer, for a
+ * socket that may have an encoding set: the chunk binds as a checked
+ * dynamic value, so the body sees what Node passes (a string after
+ * setEncoding, a Buffer otherwise) whatever the annotation says. Null
+ * for other listener shapes. */
+function lowerEncodedDataListener(lowerer, node) {
+    let fn = node;
+    while (ts.isParenthesizedExpression(fn))
+        fn = fn.expression;
+    if (!ts.isArrowFunction(fn) && !ts.isFunctionExpression(fn))
+        return null;
+    if (fn.parameters.nodes.length !== 1)
+        return null;
+    const param = fn.parameters.nodes[0];
+    if (!ts.isIdentifier(param.name) || param.initializer || param.dotDotDotToken)
+        return null;
+    const symbol = lowerer.checker.getSymbolAtLocation(param.name);
+    if (symbol === undefined)
+        return null;
+    const previousBinding = lowerer.runtimeOptionalBindingTypes.get(symbol);
+    const previousImplicit = lowerer.implicitParamTypes;
+    const implicit = new Map(previousImplicit ?? []);
+    implicit.set(symbol, lowerer.checker.getUnknownType());
+    lowerer.runtimeOptionalBindingTypes.set(symbol, DYN);
+    lowerer.implicitParamTypes = implicit;
+    try {
+        return lowerer.lowerExpr(fn);
+    }
+    finally {
+        if (previousBinding === undefined)
+            lowerer.runtimeOptionalBindingTypes.delete(symbol);
+        else
+            lowerer.runtimeOptionalBindingTypes.set(symbol, previousBinding);
+        lowerer.implicitParamTypes = previousImplicit;
+    }
+}
 /** Method calls on net.Socket receivers: write/end/destroy/pipe and
  * on/once("data" | "end" | "close" | "error" | "connect"). Null for
  * other receivers. */
@@ -1627,7 +1828,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if ((name === "ref" || name === "unref") && args.length === 0) {
         // Whether the socket keeps the event loop alive.
         requireStatementPosition(lowerer, call, `socket.${name}()`);
@@ -1654,7 +1855,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             if (encT.isStringLiteralType() && chunkT !== null) {
                 if (encT.value === "buffer" &&
                     chunkT.kind === "string" &&
-                    isJsSourceFile(call.getSourceFile())) {
+                    isJsSourceFile(ts.getSourceFileOfNode(call))) {
                     lowerer.lowerExpr(args[0]); // evaluation order (effect-free in practice)
                     return nodeThrowExpr(1, "ERR_UNKNOWN_ENCODING", "Unknown encoding: buffer", VOID, loc);
                 }
@@ -1871,6 +2072,20 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             ? value
             : lowerer.coerceInto(call, value, declared);
     }
+    if (name === "isSessionReused" && args.length === 0) {
+        // TLSSocket.isSessionReused(): the client never offers a cached
+        // session (no session resumption, a documented TLS divergence), so
+        // no handshake resumes one. A plain socket asserted to be a
+        // TLSSocket answers false too, where Node has no such method.
+        const receiver = coerceToHandle(lowerer, access.expression, NETSOCKET_T);
+        return {
+            kind: "seqExpr",
+            stmts: [{ kind: "exprStmt", expr: receiver, loc }],
+            result: boolLit(false, loc),
+            type: BOOL,
+            loc,
+        };
+    }
     if (name === "resetAndDestroy") {
         // An RST close; a connecting socket resets once it connects. Answers
         // the socket, Node's chaining.
@@ -1981,6 +2196,26 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                     loc,
                 };
             }
+            if (param !== null && param.kind === "bytes" && socketEncodingReachable(lowerer)) {
+                const encoded = lowerEncodedDataListener(lowerer, args[1]);
+                // A listener defined elsewhere keeps its Buffer parameter; it takes
+                // the chunk through the checked boundary, so a string chunk fails
+                // the check instead of arriving as a Buffer.
+                const cb = encoded ??
+                    {
+                        kind: "dynCheck",
+                        value: lowerSocketDynListener(lowerer, args[1], "data listeners"),
+                        type: funcOf([DYN], VOID),
+                        loc,
+                    };
+                return {
+                    kind: "libCall",
+                    fn: "net.sockOnData",
+                    args: [receiver, cb, once],
+                    type: VOID,
+                    loc,
+                };
+            }
             const { cb } = lowerCallbackArg(lowerer, args[1], "data listeners", 1, (p) => p.kind === "bytes" && p.elem === "u8", "use (chunk: Buffer) or ()", [DYN]);
             return { kind: "libCall", fn: "net.sockOnData", args: [receiver, cb, once], type: VOID, loc };
         }
@@ -2027,6 +2262,17 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                                 : "net.sockOnConnect";
             return { kind: "libCall", fn, args: [receiver, cb, once], type: VOID, loc };
         }
+        if (event === "lookup") {
+            // (err, address, family, host) after the host name resolves, before
+            // the connect: once per resolved address, or once with the error.
+            return {
+                kind: "libCall",
+                fn: "net.sockOnLookup",
+                args: [receiver, lowerSocketDynListener(lowerer, args[1], "lookup listeners"), once],
+                type: VOID,
+                loc,
+            };
+        }
         if (event === "finish") {
             // Fires once when the FIN goes out — once either way (the event
             // happens at most once per socket).
@@ -2059,7 +2305,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                 loc,
             };
         }
-        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "ready", "timeout", "readable", "secureConnect", and "session" are the supported socket events (as literals)');
+        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "lookup", "ready", "timeout", "readable", "secureConnect", and "session" are the supported socket events (as literals)');
     }
     lowerer.noLowering(`Socket.${name}`, call, "write, end, destroy, pipe, setTimeout, setKeepAlive, setNoDelay, the address fields, read, unshift, and on/once of data/end/close/error/connect/ready/timeout/readable are the supported Socket members", lowerer.checker.getSymbolAtLocation(access.name));
 }
@@ -2120,7 +2366,7 @@ function h2EndStreamOption(lowerer, node) {
         lowerer.noLowering("h2 options argument", node, "pass the options as an object literal ({ endStream: true })");
     }
     let end;
-    for (const prop of node.properties) {
+    for (const prop of node.properties.nodes) {
         if (!ts.isPropertyAssignment(prop) || !ts.isIdentifier(prop.name)) {
             lowerer.noLowering("h2 options with spreads or computed keys", prop, "use plain `name: value` entries");
         }
@@ -2148,7 +2394,7 @@ function lowerH2SessionMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     const receiver = () => coerceToHandle(lowerer, access.expression, HTTP2SESSION_T);
     if (name === "request") {
         const pairs = args.length >= 1 && !ts.isObjectLiteralExpression(args[0]) === false && args.length >= 1
@@ -2328,7 +2574,7 @@ function lowerH2StreamMethodCall(lowerer, call, access, receiverOverride) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     const receiver = () => receiverOverride ?? coerceToHandle(lowerer, access.expression, HTTP2STREAM_T);
     if (name === "respond") {
         requireStatementPosition(lowerer, call, "stream.respond(...)");
@@ -2991,7 +3237,7 @@ export function lowerServerProperty(lowerer, expr) {
     if (expr.name.text !== "port")
         return null;
     const recv = expr.expression;
-    if (!ts.isCallExpression(recv) || recv.questionDotToken || recv.arguments.length !== 0)
+    if (!ts.isCallExpression(recv) || recv.questionDotToken || recv.arguments.nodes.length !== 0)
         return null;
     if (!ts.isPropertyAccessExpression(recv.expression))
         return null;
@@ -3003,6 +3249,30 @@ export function lowerServerProperty(lowerer, expr) {
     if (!lowerer.isStdlibMember(inner))
         return null;
     const receiver = coerceToHandle(lowerer, inner.expression, NETSERVER_T);
+    if (unixListenReachable(lowerer)) {
+        const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
+        const server = () => varRef(local.id, NETSERVER_T, loc);
+        return {
+            kind: "seqExpr",
+            stmts: [
+                { kind: "varDecl", localId: local.id, init: receiver, loc },
+                {
+                    kind: "exprStmt",
+                    expr: {
+                        kind: "libCall",
+                        fn: "net.serverAddressCheck",
+                        args: [server()],
+                        type: VOID,
+                        loc,
+                    },
+                    loc,
+                },
+            ],
+            result: { kind: "libCall", fn: "net.serverPort", args: [server()], type: F64, loc },
+            type: F64,
+            loc,
+        };
+    }
     return { kind: "libCall", fn: "net.serverPort", args: [receiver], type: F64, loc };
 }
 /** The (req, res) request-handler argument — http.createServer's, https
@@ -3067,7 +3337,8 @@ function lowerHttpServerOptions(lowerer, node, what) {
     let joinDup = false;
     let allowMissingHost = false;
     let keepAliveTimeoutBuffer = null;
-    for (const prop of node.properties) {
+    let maxHeaderSize = null;
+    for (const prop of node.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -3105,6 +3376,17 @@ function lowerHttpServerOptions(lowerer, node, what) {
             }
             lowerer.noLowering(`${what} with a non-literal joinDuplicateHeaders option`, prop, 'the lowered forms are the literals joinDuplicateHeaders: true (repeats join ", ") and false (the keep-first default)');
         }
+        if (key === "maxHeaderSize") {
+            // The header size bound (Node's validateInteger runs in the runtime).
+            const raw = initializer !== null
+                ? lowerer.lowerExpr(initializer)
+                : lowerer.lowerShorthandValue(prop);
+            if (raw.type.kind !== "f64") {
+                lowerer.noLowering(`${what} with a '${lowerer.fmt(raw.type)}' maxHeaderSize option`, prop, "maxHeaderSize is a number");
+            }
+            maxHeaderSize = raw;
+            continue;
+        }
         if (key === "keepAliveTimeoutBuffer") {
             if (keepAliveTimeoutBuffer !== null) {
                 lowerer.noLowering(`${what} with duplicate keepAliveTimeoutBuffer options`, prop, "write keepAliveTimeoutBuffer once in the options literal");
@@ -3124,10 +3406,10 @@ function lowerHttpServerOptions(lowerer, node, what) {
             keepAliveTimeoutBuffer = value;
             continue;
         }
-        fenceOrDropOptionKey(lowerer, prop, key, what, HTTP_SERVER_DOCUMENTED_OPTIONS, "requireHostHeader, joinDuplicateHeaders, and keepAliveTimeoutBuffer are the supported options");
+        fenceOrDropOptionKey(lowerer, prop, key, what, HTTP_SERVER_DOCUMENTED_OPTIONS, "requireHostHeader, joinDuplicateHeaders, keepAliveTimeoutBuffer, and maxHeaderSize are the supported options");
         // An undocumented key, dropped like Node drops it.
     }
-    return { joinDup, allowMissingHost, keepAliveTimeoutBuffer };
+    return { joinDup, allowMissingHost, keepAliveTimeoutBuffer, maxHeaderSize };
 }
 /** The shared createServer([options][, handler]) shapes behind
  * http.createServer, http.Server, and `new http.Server`: no arguments
@@ -3135,7 +3417,7 @@ function lowerHttpServerOptions(lowerer, node, what) {
  * (options, handler). Modeled option values wrap the construction in an
  * interned option-setting helper. */
 function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
-    const args = expr.arguments ?? [];
+    const args = expr.arguments?.nodes ?? [];
     if (args.length > 2) {
         lowerer.noLowering(`${what} with ${args.length} arguments`, expr, `the supported forms are ${what}([options][, (req, res) => ...])`);
     }
@@ -3153,7 +3435,12 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
     }
     const opts = optsNode !== null
         ? lowerHttpServerOptions(lowerer, optsNode, what)
-        : { joinDup: false, allowMissingHost: false, keepAliveTimeoutBuffer: null };
+        : {
+            joinDup: false,
+            allowMissingHost: false,
+            keepAliveTimeoutBuffer: null,
+            maxHeaderSize: null,
+        };
     const server = handlerNode !== null
         ? {
             kind: "libCall",
@@ -3163,20 +3450,25 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
             loc,
         }
         : { kind: "libCall", fn: "http.createServerEmpty", args: [], type: NETSERVER_T, loc };
-    if (!opts.joinDup && !opts.allowMissingHost && opts.keepAliveTimeoutBuffer === null)
+    if (!opts.joinDup &&
+        !opts.allowMissingHost &&
+        opts.keepAliveTimeoutBuffer === null &&
+        opts.maxHeaderSize === null)
         return server;
     // The option-setting composition: an interned helper takes the option
     // values first (preserving Node's options-before-handler evaluation
     // order), then the fresh server, applies the modeled fields, and answers
     // the server as the constructor/factory result.
     const hasBuffer = opts.keepAliveTimeoutBuffer !== null;
-    const key = `server.opts:${opts.joinDup ? 1 : 0}:${opts.allowMissingHost ? 1 : 0}:${hasBuffer ? 1 : 0}`;
+    const hasMax = opts.maxHeaderSize !== null;
+    const key = `server.opts:${opts.joinDup ? 1 : 0}:${opts.allowMissingHost ? 1 : 0}:${hasBuffer ? 1 : 0}:${hasMax ? 1 : 0}`;
     const existing = lowerer.arrHofHelpers.get(key);
     const name = existing ?? `%server.opts.${lowerer.arrHofHelpers.size}`;
     if (!existing) {
         lowerer.arrHofHelpers.set(key, name);
         const params = [
             ...(hasBuffer ? [{ localId: "b.0", name: "buffer", type: DYN }] : []),
+            ...(hasMax ? [{ localId: "m.0", name: "maxHeaderSize", type: F64 }] : []),
             { localId: "s.0", name: "s", type: NETSERVER_T },
         ];
         const ref = { kind: "varRef", localId: "s.0", type: NETSERVER_T, loc };
@@ -3196,6 +3488,19 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
                 loc,
             });
         }
+        if (hasMax) {
+            body.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "http.serverMaxHeaderSize",
+                    args: [ref, { kind: "varRef", localId: "m.0", type: F64, loc }],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
         if (opts.joinDup) {
             body.push({
                 kind: "exprStmt",
@@ -3229,7 +3534,11 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
     return {
         kind: "call",
         callee: name,
-        args: [...(opts.keepAliveTimeoutBuffer !== null ? [opts.keepAliveTimeoutBuffer] : []), server],
+        args: [
+            ...(opts.keepAliveTimeoutBuffer !== null ? [opts.keepAliveTimeoutBuffer] : []),
+            ...(opts.maxHeaderSize !== null ? [opts.maxHeaderSize] : []),
+            server,
+        ],
         type: NETSERVER_T,
         loc,
     };
@@ -3243,12 +3552,12 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
  * getName/destroy and the sockets/requests/freeSockets counters dispatch
  * through the dyn handle ops, and the request path threads it (the
  * requestAgent rows). Options parse at the LITERAL construction site:
- * keepAlive (a boolean value — TRUE throws the runtime's named pooling
- * fence: this client dials one connection per request), keepAliveMsecs /
- * maxSockets / maxFreeSockets / timeout / port as numbers, scheduling
- * DROPS (no free pool exists, so selection order cannot observe), other
- * documented keys fence by name, and undocumented keys drop like Node
- * drops them. Null when the callee isn't the http/https Agent. */
+ * keepAlive (a boolean value: finished connections return to the free
+ * list), keepAliveMsecs / maxSockets / maxFreeSockets / timeout / port as
+ * numbers, scheduling as a value the runtime validates ('fifo' or
+ * 'lifo'), other documented keys fence by name, and undocumented keys
+ * drop like Node drops them. Null when the callee isn't the http/https
+ * Agent. */
 export function lowerHttpAgentNew(lowerer, expr) {
     const callee = expr.expression;
     const bi = ts.isPropertyAccessExpression(callee) && callee.name.text === "Agent"
@@ -3266,7 +3575,8 @@ export function lowerHttpAgentNew(lowerer, expr) {
     let maxFree = numLit(-1, loc);
     let timeout = numLit(-1, loc);
     let port = numLit(-1, loc);
-    const args = expr.arguments ?? [];
+    let scheduling = lowerer.coerceToExpected(strLit("lifo", loc), DYN);
+    const args = expr.arguments?.nodes ?? [];
     if (args.length > 1) {
         lowerer.noLowering(`${api} with ${args.length} arguments`, expr, "the supported form is new Agent(options?)");
     }
@@ -3275,7 +3585,7 @@ export function lowerHttpAgentNew(lowerer, expr) {
         if (!ts.isObjectLiteralExpression(optsNode)) {
             lowerer.noLowering(`${api} with a non-literal options value`, args[0], "spell the options as an object literal at the construction site");
         }
-        for (const prop of optsNode.properties) {
+        for (const prop of optsNode.properties.nodes) {
             if (ts.isSpreadAssignment(prop)) {
                 lowerer.noLowering(`${api} with an options spread`, prop, "write each option inline");
             }
@@ -3331,12 +3641,14 @@ export function lowerHttpAgentNew(lowerer, expr) {
                     // the settable defaultPort carries this one.
                     port = lowerVal("f64");
                     break;
-                case "scheduling":
-                    // Free-socket selection order: no free pool exists here (no
-                    // keep-alive reuse), so the choice cannot observe — dropped.
-                    if (initializer !== null)
-                        lowerer.lowerExpr(initializer); // evaluate, like Node
+                case "scheduling": {
+                    // 'fifo' | 'lifo' (falsy = 'lifo'), validated by the runtime
+                    const v = initializer !== null
+                        ? lowerer.lowerExpr(initializer)
+                        : lowerer.lowerShorthandValue(prop);
+                    scheduling = lowerer.coerceToExpected(v, DYN);
                     break;
+                }
                 default:
                     fenceOrDropOptionKey(lowerer, prop, key, api, bi.module === "https" ? HTTPS_AGENT_DOCUMENTED_OPTIONS : AGENT_DOCUMENTED_OPTIONS, bi.module === "https"
                         ? "keepAlive, keepAliveMsecs, maxSockets, maxFreeSockets, timeout, port, and scheduling are the supported options; pass TLS options such as ca and rejectUnauthorized on each https.request"
@@ -3355,6 +3667,7 @@ export function lowerHttpAgentNew(lowerer, expr) {
             maxFree,
             timeout,
             port,
+            scheduling,
         ],
         type: DYN,
         loc,
@@ -3380,24 +3693,24 @@ export function lowerHttpServerNew(lowerer, expr) {
 function lowerHttpModuleCall(lowerer, expr, bi, loc) {
     if (bi.member === "validateHeaderName") {
         requireStatementPosition(lowerer, expr, "http.validateHeaderName(...)");
-        if (expr.arguments.length < 1 ||
-            expr.arguments.length > 2 ||
-            expr.arguments.some(ts.isSpreadElement)) {
+        if (expr.arguments.nodes.length < 1 ||
+            expr.arguments.nodes.length > 2 ||
+            expr.arguments.nodes.some(ts.isSpreadElement)) {
             lowerer.noLowering("http.validateHeaderName arguments", expr, "pass a header name and an optional label");
         }
-        const name = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
-        const label = expr.arguments.length === 2
-            ? lowerer.lowerExprExpecting(expr.arguments[1], STRING)
+        const name = lowerer.lowerExprExpecting(expr.arguments.nodes[0], STRING);
+        const label = expr.arguments.nodes.length === 2
+            ? lowerer.lowerExprExpecting(expr.arguments.nodes[1], STRING)
             : strLit("Header name", loc);
         return { kind: "libCall", fn: "http.validateHeaderName", args: [name, label], type: VOID, loc };
     }
     if (bi.member === "validateHeaderValue") {
         requireStatementPosition(lowerer, expr, "http.validateHeaderValue(...)");
-        if (expr.arguments.length !== 2 || expr.arguments.some(ts.isSpreadElement)) {
+        if (expr.arguments.nodes.length !== 2 || expr.arguments.nodes.some(ts.isSpreadElement)) {
             lowerer.noLowering("http.validateHeaderValue arguments", expr, "pass a header name and a value");
         }
-        const name = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
-        const value = lowerer.lowerExprExpecting(expr.arguments[1], DYN);
+        const name = lowerer.lowerExprExpecting(expr.arguments.nodes[0], STRING);
+        const value = lowerer.lowerExprExpecting(expr.arguments.nodes[1], DYN);
         return {
             kind: "libCall",
             fn: "http.validateHeaderValue",
@@ -3427,7 +3740,7 @@ function lowerTlsServerOptions(lowerer, node, what) {
     const loc = locOf(node);
     let cert = null;
     let key = null;
-    for (const prop of node.properties) {
+    for (const prop of node.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -3523,8 +3836,8 @@ const TLS_VALIDATED_OPTIONS = new Set([
  * keepAliveTimeoutBuffer so the HTTP option is consumed without losing
  * the literal's evaluation order. */
 function tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions = false) {
-    const jsSource = isJsSourceFile(node.getSourceFile());
-    return node.properties.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
+    const jsSource = isJsSourceFile(ts.getSourceFileOfNode(node));
+    return node.properties.nodes.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
         (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) &&
         ((includeHttpTimeoutOptions && p.name.text === "keepAliveTimeoutBuffer") ||
             (jsSource && TLS_VALIDATED_OPTIONS.has(p.name.text))));
@@ -3557,7 +3870,7 @@ function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptio
  * callback (and 'secureConnect'/'connect' listeners) fires
  * post-handshake — Node's secureConnect timing. */
 function lowerTlsConnectCall(lowerer, expr, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/rejectUnauthorized/ca/servername";
     if (args.length < 1 || args.length > 4 || args.some(ts.isSpreadElement)) {
         lowerer.noLowering(`tls.connect with ${args.length} arguments`, expr, FORMS_HINT);
@@ -3649,7 +3962,7 @@ function lowerTlsConnectCall(lowerer, expr, loc) {
  * module declares fences qualified (createSecureContext and connect
  * carry pointed hints from the fence-hint table). */
 function lowerTlsModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, socket => ...)");
@@ -3689,7 +4002,7 @@ function lowerTlsModuleCall(lowerer, expr, bi, loc) {
     if (bi.member === "getCACertificates" &&
         args.length === 1 &&
         !args.some(ts.isSpreadElement) &&
-        isJsSourceFile(expr.getSourceFile())) {
+        isJsSourceFile(ts.getSourceFileOfNode(expr))) {
         // The type-argument ladder (validateString + the documented name
         // set); the real CA list has no lowering, so a valid name meets the
         // compiler-rendered fence after the validation.
@@ -3795,7 +4108,7 @@ function clientFnRefOf(lowerer, node) {
  * `const` declaration, or a parameter/let whose enclosing scope contains
  * no assignment or ++/-- targeting it. */
 function neverReassigned(lowerer, sym) {
-    const decl = lowerer.checker.declarationsOf(sym)[0];
+    const decl = sym.declarations[0];
     if (!decl)
         return false;
     if (ts.isVariableDeclaration(decl) &&
@@ -3902,7 +4215,7 @@ export function lowerHttpClientFnCall(lowerer, expr, binding, loc) {
  * handler) and request/get — the http client lowering with the secure
  * extras (port 443 default, rejectUnauthorized, ca). */
 function lowerHttpsModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, (req, res) => ...)");
@@ -3983,7 +4296,7 @@ function stripParensAndCasts(node) {
  * createSecureServer lowers h2 over TLS, with allowHTTP1 selecting one
  * dual-ALPN server whose request/connect listeners mirror across parsers. */
 function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         // The REAL h2c server (scr_http2.c). An options object literal is
         // accepted and ignored (h2 session-tuning knobs; the honest-defaults
@@ -4047,7 +4360,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
             !arg1IsDyn &&
             lowerer.checker.getCallSignatures(lowerer.typeOf(args[1])).length === 0) {
             if (ts.isObjectLiteralExpression(args[1])) {
-                for (const pr of args[1].properties) {
+                for (const pr of args[1].properties.nodes) {
                     // Plain `name: value` and shorthand `{ ca }` both carry the
                     // option; a shorthand's value is the same-named identifier.
                     let name;
@@ -4230,17 +4543,17 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                 if (ts.isConditionalExpression(inner)) {
                     const whenTrue = stripParensAndCasts(inner.whenTrue);
                     const whenFalse = stripParensAndCasts(inner.whenFalse);
-                    const condText = inner.condition.getText();
+                    const condText = ts.getTextOfNode(inner.condition);
                     const ok = ts.isObjectLiteralExpression(whenTrue) &&
                         ts.isObjectLiteralExpression(whenFalse) &&
-                        whenFalse.properties.length === 0 &&
-                        whenTrue.properties.length === 1 &&
-                        ts.isPropertyAssignment(whenTrue.properties[0]) &&
-                        (ts.isIdentifier(whenTrue.properties[0].name) ||
-                            ts.isStringLiteral(whenTrue.properties[0].name)) &&
-                        whenTrue.properties[0].name.text ===
+                        whenFalse.properties.nodes.length === 0 &&
+                        whenTrue.properties.nodes.length === 1 &&
+                        ts.isPropertyAssignment(whenTrue.properties.nodes[0]) &&
+                        (ts.isIdentifier(whenTrue.properties.nodes[0].name) ||
+                            ts.isStringLiteral(whenTrue.properties.nodes[0].name)) &&
+                        whenTrue.properties.nodes[0].name.text ===
                             "SNICallback" &&
-                        whenTrue.properties[0].initializer.getText() === condText;
+                        ts.getTextOfNode(whenTrue.properties.nodes[0].initializer) === condText;
                     if (!ok) {
                         lowerer.noLowering("createSecureServer options with a conditional spread", prop, "the lowered conditional spread is exactly ...(x ? { SNICallback: x } : {}) — the included value must BE the condition");
                     }
@@ -4250,7 +4563,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                 if (!ts.isObjectLiteralExpression(inner)) {
                     lowerer.noLowering("createSecureServer options with a computed spread", prop, `spreads must be inline object literals here; ${SNI_HINT}`);
                 }
-                for (const p of inner.properties)
+                for (const p of inner.properties.nodes)
                     lowerOption(p);
                 return;
             }
@@ -4316,11 +4629,11 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                     e.kind === ts.SyntaxKind.TrueKeyword ||
                     e.kind === ts.SyntaxKind.FalseKeyword;
                 const isLiteralObjectOfLiterals = (e) => ts.isObjectLiteralExpression(e) &&
-                    e.properties.every((p) => ts.isPropertyAssignment(p) &&
+                    e.properties.nodes.every((p) => ts.isPropertyAssignment(p) &&
                         ts.isIdentifier(p.name) &&
                         isScalarLiteral(p.initializer));
                 if (k === "settings" && initializer !== null && ts.isObjectLiteralExpression(initializer)) {
-                    for (const setting of initializer.properties) {
+                    for (const setting of initializer.properties.nodes) {
                         if (ts.isPropertyAssignment(setting) &&
                             ts.isIdentifier(setting.name) &&
                             setting.name.text === "enableConnectProtocol") {
@@ -4348,7 +4661,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
             fenceOrDropOptionKey(lowerer, prop, k, "createSecureServer", HTTP2_SECURE_SERVER_DOCUMENTED_OPTIONS, "allowHTTP1: true, cert, key, and SNICallback are the supported options (h2 session-tuning options are accepted as literals and ignored)");
             // An undocumented key, dropped like Node drops it.
         };
-        for (const prop of optsNode.properties)
+        for (const prop of optsNode.properties.nodes)
             lowerOption(prop);
         if (cert === null || key === null) {
             lowerer.noLowering("createSecureServer without both cert and key", optsNode, "the supported options object is { allowHTTP1?, cert, key } (PEM strings or Buffers)");
@@ -4413,6 +4726,37 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
     lowerer.noLowering(`http2.${bi.member}`, expr, builtinFenceHintOf("http2", bi.member) ??
         "createSecureServer({ allowHTTP1: true, cert, key }) and the h2-only form are lowered", lowerer.resolveValueSymbol(expr.expression));
 }
+/** The checked-dynamic options value of a request whose options the
+ * runtime reads: a non-literal options value (a RequestOptions variable —
+ * checked-dynamic storage — or a record that converts to one), or a
+ * literal the static walk cannot lower because it spreads another options
+ * value or sets socketPath. Null keeps the static literal walk (and its
+ * fences), which every other literal takes unchanged. */
+function runtimeRequestOptions(lowerer, optsNode, secureish) {
+    if (ts.isObjectLiteralExpression(optsNode)) {
+        const needsRuntime = optsNode.properties.nodes.some((prop) => {
+            if (ts.isSpreadAssignment(prop)) {
+                // the static walk's one spread: `...(c ? { rejectUnauthorized } : {})` on https
+                const cs = conditionalSpreadOf(prop.expression);
+                return !(secureish &&
+                    cs !== null &&
+                    cs !== "unsupported" &&
+                    cs.props.length === 1 &&
+                    cs.props[0].name.text === "rejectUnauthorized");
+            }
+            return ((ts.isPropertyAssignment(prop) || ts.isShorthandPropertyAssignment(prop)) &&
+                (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
+                prop.name.text === "socketPath");
+        });
+        if (!needsRuntime)
+            return null;
+        return lowerDynObjectLiteral(lowerer, optsNode);
+    }
+    const t = lowerer.mapTypeOf(lowerer.typeOf(optsNode));
+    if (!t || !(t.kind === "dyn" || (t.kind === "record" && lowerer.dynConvertible(t))))
+        return null;
+    return lowerer.coerceToExpected(lowerer.lowerExpr(optsNode), DYN);
+}
 /** http.request(options[, cb]) / http.get(options[, cb]) — the client.
  * The options argument must be an OBJECT LITERAL; the lowered keys are
  * hostname/host, port, path, method, timeout, and headers (a nested
@@ -4440,11 +4784,36 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
         const c = lowerer.lowerCondition(binding.cond);
         return binding.trueSecure ? c : { kind: "unary", op: "!", operand: c, type: BOOL, loc };
     };
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (args.length < 1 || args.length > 2) {
         lowerer.noLowering(`${member} with ${args.length} arguments`, expr, `the supported form is ${member}(options[, callback])`);
     }
     const optsNode = args[0];
+    const runtimeOptions = binding === null ? runtimeRequestOptions(lowerer, optsNode, secureish) : null;
+    if (runtimeOptions !== null) {
+        // The options record is read at run time (the ClientRequest
+        // constructor's walk in the runtime): a RequestOptions variable, or a
+        // literal that spreads one or sets socketPath.
+        const autoEnd = boolLit(member === "get", loc);
+        const secureDyn = secure === true;
+        if (args.length === 1) {
+            return {
+                kind: "libCall",
+                fn: secureDyn ? "https.requestDyn" : "http.requestDyn",
+                args: [runtimeOptions, autoEnd],
+                type: HTTPCLIENTREQ_T,
+                loc,
+            };
+        }
+        const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
+        return {
+            kind: "libCall",
+            fn: secureDyn ? "https.requestDynCb" : "http.requestDynCb",
+            args: [runtimeOptions, autoEnd, cb],
+            type: HTTPCLIENTREQ_T,
+            loc,
+        };
+    }
     if (!ts.isObjectLiteralExpression(optsNode)) {
         const t = lowerer.mapTypeOf(lowerer.typeOf(optsNode));
         if ((t?.kind === "string" || t?.kind === "url") && binding === null) {
@@ -4505,7 +4874,13 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
     let agentClose = null;
     /** agent: <Agent value> — the requestAgent rows thread the handle. */
     let agentVal = null;
-    for (const prop of optsNode.properties) {
+    /** signal: an AbortSignal (checked at runtime) that destroys the request. */
+    let signal = null;
+    /** servername: the TLS name for SNI and certificate verification. */
+    let servername = null;
+    /** maxHeaderSize: the response head's size bound. */
+    let maxHeaderSize = null;
+    for (const prop of optsNode.properties.nodes) {
         // Shorthand entries ({ port } for { port: port }) are the natural
         // spelling at these call sites — the shorthand's VALUE lowering
         // resolves the local binding (lowerShorthandValue), not the property
@@ -4596,6 +4971,25 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
             case "timeout":
                 timeout = lowerVal("f64");
                 break;
+            case "maxHeaderSize":
+                maxHeaderSize = lowerVal("f64");
+                break;
+            case "servername":
+                if (binding !== null) {
+                    lowerer.noLowering(`${member} option 'servername' through a module-function binding`, prop, "call https.request directly when passing servername");
+                }
+                if (!secureish) {
+                    lowerer.noLowering(`${member} option 'servername'`, prop, "servername is an https.request option — the plain http client has no TLS layer");
+                }
+                servername = lowerVal("string");
+                break;
+            case "signal": {
+                const v = initializer !== null
+                    ? lowerer.lowerExpr(initializer)
+                    : lowerer.lowerShorthandValue(prop);
+                signal = lowerer.coerceToExpected(v, DYN);
+                break;
+            }
             case "headers":
                 if (initializer === null) {
                     lowerer.noLowering(`${member} with a shorthand headers option`, prop, "spell it out: headers: theHeaders");
@@ -4680,8 +5074,8 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
             }
             default:
                 fenceOrDropOptionKey(lowerer, prop, key, member, secureish ? HTTPS_CLIENT_DOCUMENTED_OPTIONS : HTTP_CLIENT_DOCUMENTED_OPTIONS, secureish
-                    ? "hostname/host, port, path, method, timeout, headers, agent, rejectUnauthorized, and ca are the supported options"
-                    : "hostname/host, port, path, method, timeout, headers, and agent are the supported options");
+                    ? "hostname/host, port, path, method, timeout, headers, agent, signal, maxHeaderSize, rejectUnauthorized, ca, and servername are the supported options"
+                    : "hostname/host, port, path, method, timeout, headers, agent, signal, and maxHeaderSize are the supported options");
         }
     }
     if (agentClose !== null) {
@@ -4747,19 +5141,96 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
     timeout ??= numLit(0, loc);
     headers ??= { kind: "arrayLit", elems: [], type: arrayOf(STRING), loc };
     const autoEnd = boolLit(member === "get", loc);
+    // options.signal is checked first: Node's constructor rejects a value
+    // that is not an AbortSignal before it dials. servername is stored just
+    // before construction (it selects the TLS name and which pooled sockets
+    // the request may reuse); maxHeaderSize and the signal then apply to the
+    // built request (an already aborted signal destroys it at once, like
+    // Node's constructor).
+    const withSignal = (request) => {
+        if (signal === null && servername === null && maxHeaderSize === null)
+            return request;
+        const local = lowerer.declareHiddenLocal("%requestOptions", HTTPCLIENTREQ_T);
+        const ref = () => varRef(local.id, HTTPCLIENTREQ_T, loc);
+        const steps = [];
+        let signalRef = null;
+        if (signal !== null) {
+            const signalLocal = lowerer.declareHiddenLocal("%requestSignal", DYN);
+            signalRef = () => varRef(signalLocal.id, DYN, loc);
+            steps.push({ kind: "varDecl", localId: signalLocal.id, init: signal, loc });
+            steps.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "http.clientSignalCheck",
+                    args: [signalRef()],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
+        if (servername !== null) {
+            steps.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "https.nextServername",
+                    args: [servername],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
+        steps.push({ kind: "varDecl", localId: local.id, init: request, loc });
+        if (maxHeaderSize !== null) {
+            steps.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "http.clientMaxHeaderSize",
+                    args: [ref(), maxHeaderSize],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
+        if (signalRef !== null) {
+            steps.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "http.clientSignal",
+                    args: [ref(), signalRef()],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
+        return { kind: "seqExpr", stmts: steps, result: ref(), type: HTTPCLIENTREQ_T, loc };
+    };
     if (connCb !== null) {
         const base = [connCb, path, method, timeout, headers, autoEnd];
         if (args.length === 1) {
-            return { kind: "libCall", fn: "http.requestConn", args: base, type: HTTPCLIENTREQ_T, loc };
+            return withSignal({
+                kind: "libCall",
+                fn: "http.requestConn",
+                args: base,
+                type: HTTPCLIENTREQ_T,
+                loc,
+            });
         }
         const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
-        return {
+        return withSignal({
             kind: "libCall",
             fn: "http.requestConnCb",
             args: [...base, cb],
             type: HTTPCLIENTREQ_T,
             loc,
-        };
+        });
     }
     const base = [host, port, path, method, timeout, headers, autoEnd];
     if (secureish) {
@@ -4781,7 +5252,7 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
                 : agentVal !== null
                     ? "http.requestAgent"
                     : "http.request";
-        return { kind: "libCall", fn, args: base, type: HTTPCLIENTREQ_T, loc };
+        return withSignal({ kind: "libCall", fn, args: base, type: HTTPCLIENTREQ_T, loc });
     }
     const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
     const fn = binding !== null
@@ -4793,7 +5264,7 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
             : agentVal !== null
                 ? "http.requestAgentCb"
                 : "http.requestCb";
-    return { kind: "libCall", fn, args: [...base, cb], type: HTTPCLIENTREQ_T, loc };
+    return withSignal({ kind: "libCall", fn, args: [...base, cb], type: HTTPCLIENTREQ_T, loc });
 }
 /** The headers option of http.request: an object literal with literal
  * keys and string values packs into the flat [k0, v0, k1, v1, ...] pairs
@@ -4804,7 +5275,7 @@ function lowerClientHeadersOption(lowerer, node) {
     const loc = locOf(node);
     if (ts.isObjectLiteralExpression(node)) {
         const elems = [];
-        for (const prop of node.properties) {
+        for (const prop of node.properties.nodes) {
             const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
             if (!ts.isPropertyAssignment(prop) || key === null) {
                 lowerer.noLowering("request headers with dynamic keys, spreads, or shorthand entries", prop, "each header must be a `name: value` entry whose key is a literal (or a string-literal-typed const: [PORTLESS_HEADER])");
@@ -4840,13 +5311,13 @@ function lowerHttpTrailersOption(lowerer, node) {
         return lowerClientHeadersOption(lowerer, node);
     const loc = locOf(node);
     const flat = [];
-    for (const entry of node.elements) {
-        if (!ts.isArrayLiteralExpression(entry) || entry.elements.length !== 2) {
+    for (const entry of node.elements.nodes) {
+        if (!ts.isArrayLiteralExpression(entry) || entry.elements.nodes.length !== 2) {
             lowerer.noLowering("addTrailers pair list", entry, "use an object/Record or literal [name, value] pairs");
         }
         const pair = entry;
-        const name = pair.elements[0];
-        const value = pair.elements[1];
+        const name = pair.elements.nodes[0];
+        const value = pair.elements.nodes[1];
         if (ts.isSpreadElement(name) || ts.isSpreadElement(value)) {
             lowerer.noLowering("addTrailers pair with spread", entry, "use direct string name/value expressions");
         }
@@ -4864,7 +5335,7 @@ function lowerHttpClientMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setHeader") {
         requireStatementPosition(lowerer, call, "request.setHeader(...)");
         if (args.length !== 2)
@@ -5009,6 +5480,22 @@ function lowerHttpClientMethodCall(lowerer, call, access) {
         }
         lowerer.noLowering(`${name} of '${lowerer.fmt(data.type)}' data`, args[0] ?? call, NARROW_DATA_HINT);
     }
+    if (name === "destroy" && args.length === 1) {
+        // destroy(err): err is the request's 'error' (an Error value here).
+        requireStatementPosition(lowerer, call, "request.destroy(err)");
+        const receiver = lowerer.lowerExpr(access.expression);
+        const err = lowerer.lowerExpr(args[0]);
+        if (err.type.kind !== "object") {
+            lowerer.noLowering(`destroy with a '${lowerer.fmt(err.type)}' argument`, args[0], "pass an Error value, or call destroy() without one");
+        }
+        return {
+            kind: "libCall",
+            fn: "http.clientDestroyError",
+            args: [receiver, lowerer.coerceToExpected(err, ERROR_T)],
+            type: VOID,
+            loc,
+        };
+    }
     if (name === "destroy" || name === "abort") {
         requireStatementPosition(lowerer, call, `request.${name}()`);
         if (args.length !== 0) {
@@ -5059,7 +5546,11 @@ function lowerHttpClientMethodCall(lowerer, call, access) {
                 loc,
             };
         }
-        if (event === "timeout" || event === "close" || event === "finish" || event === "abort") {
+        if (event === "timeout" ||
+            event === "close" ||
+            event === "finish" ||
+            event === "abort" ||
+            event === "continue") {
             const { cb } = lowerCallbackArg(lowerer, args[1], `${event} listeners`, 0, () => false, "use ()", []);
             const fn = event === "timeout"
                 ? "http.clientOnTimeout"
@@ -5067,7 +5558,9 @@ function lowerHttpClientMethodCall(lowerer, call, access) {
                     ? "http.clientOnClose"
                     : event === "abort"
                         ? "http.clientOnAbort"
-                        : "http.clientOnFinish";
+                        : event === "continue"
+                            ? "http.clientOnContinue"
+                            : "http.clientOnFinish";
             return { kind: "libCall", fn, args: [receiver, cb, once], type: VOID, loc };
         }
         if (event === "upgrade") {
@@ -5221,7 +5714,7 @@ function lowerHttpReqMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setTimeout") {
         requireStatementPosition(lowerer, call, "message.setTimeout(...)");
         if (args.length < 1 || args.length > 2)
@@ -5289,6 +5782,26 @@ function lowerHttpReqMethodCall(lowerer, call, access) {
         const event = evT.isStringLiteralType() ? evT.value : null;
         const receiver = coerceToHandle(lowerer, access.expression, HTTPREQ_T);
         if (event === "data") {
+            const sigs = lowerer.checker.getCallSignatures(lowerer.typeOf(args[1]));
+            const firstParam = sigs.length === 1 ? sigs[0].getParameters()[0] : undefined;
+            const param = firstParam !== undefined
+                ? lowerer.mapTypeOf(lowerer.checker.getTypeOfSymbol(firstParam))
+                : null;
+            if (param !== null && param.kind === "string") {
+                // A chunk typed string (the setEncoding('utf8') shape), as on a
+                // socket: the listener takes the chunk through a checked
+                // boundary, so a string arrives after setEncoding and a Buffer
+                // without it fails the check instead of being decoded.
+                const boxed = lowerSocketDynListener(lowerer, args[1], "data listeners");
+                const cb = { kind: "dynCheck", value: boxed, type: funcOf([DYN], VOID), loc };
+                return {
+                    kind: "libCall",
+                    fn: "http.reqOnData",
+                    args: [receiver, cb, once],
+                    type: VOID,
+                    loc,
+                };
+            }
             const { cb } = lowerCallbackArg(lowerer, args[1], "data listeners", 1, (p) => p.kind === "bytes" && p.elem === "u8", "use (chunk: Buffer) or ()", [DYN]);
             return { kind: "libCall", fn: "http.reqOnData", args: [receiver, cb, once], type: VOID, loc };
         }
@@ -5341,7 +5854,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setTimeout") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`res.setTimeout with ${args.length} arguments`, call, "use setTimeout(milliseconds[, callback])");
@@ -5359,7 +5872,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
     }
     if (name === "writeContinue" || name === "writeProcessing" || name === "writeEarlyHints") {
         requireStatementPosition(lowerer, call, `res.${name}(...)`);
-        if (lowerer.typeOf(access.expression).getSymbol()?.name === "Http2ServerResponse") {
+        if (ts.symbolNameOf(lowerer.typeOf(access.expression).getSymbol()) === "Http2ServerResponse") {
             lowerer.noLowering(`Http2ServerResponse.${name}`, call, "HTTP/2 informational responses are not supported by the static runtime yet");
         }
         const receiver = coerceToHandle(lowerer, access.expression, HTTPRES_T);
@@ -5380,7 +5893,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         let pairs;
         if (ts.isObjectLiteralExpression(node)) {
             const elems = [];
-            for (const prop of node.properties) {
+            for (const prop of node.properties.nodes) {
                 const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
                 if (!ts.isPropertyAssignment(prop) || key === null) {
                     lowerer.noLowering("writeEarlyHints headers with dynamic keys, spreads, or shorthand entries", prop, "use literal header keys and string values");
@@ -5443,7 +5956,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
     }
     if (name === "addTrailers") {
         requireStatementPosition(lowerer, call, "res.addTrailers(...)");
-        if (lowerer.typeOf(access.expression).getSymbol()?.name === "Http2ServerResponse") {
+        if (ts.symbolNameOf(lowerer.typeOf(access.expression).getSymbol()) === "Http2ServerResponse") {
             lowerer.noLowering("Http2ServerResponse.addTrailers", call, "HTTP/2 response trailers are not supported by the static runtime yet");
         }
         if (args.length !== 1)
@@ -5580,7 +6093,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         }
         const names = [];
         const values = [];
-        for (const prop of headersNode.properties) {
+        for (const prop of headersNode.properties.nodes) {
             const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
             if (!ts.isPropertyAssignment(prop) || key === null) {
                 lowerer.noLowering("writeHead headers with dynamic keys, spreads, or shorthand entries", prop, "each header must be a `name: value` entry whose key is a literal (or a string-literal-typed const: [PORTLESS_HEADER])");
@@ -5708,6 +6221,26 @@ function lowerHttpResMethodCall(lowerer, call, access) {
                 return endWithCb(fn, [receiver, data], cbArg);
             return { kind: "libCall", fn, args: [receiver, data], type: VOID, loc };
         }
+        // end(payload ? text : undefined): an absent chunk ends without data,
+        // as end() does. The checked-dynamic end takes each arm at run time.
+        if (name === "end" && data.type.kind === "union" && lowerer.dynConvertible(data.type)) {
+            const arms = lowerer.unions.get(data.type.unionId)?.arms ?? [];
+            if (arms.every((arm) => arm.kind === "string" ||
+                (arm.kind === "bytes" && arm.elem === "u8") ||
+                arm.kind === "undefinedT" ||
+                arm.kind === "nullT")) {
+                const dynData = { kind: "dynFrom", value: data, type: DYN, loc: locOf(dataNode) };
+                if (cbArg !== null)
+                    return endWithCb("http.resEndDyn", [receiver, dynData], cbArg);
+                return {
+                    kind: "libCall",
+                    fn: "http.resEndDyn",
+                    args: [receiver, dynData],
+                    type: VOID,
+                    loc,
+                };
+            }
+        }
         lowerer.noLowering(`${name} of '${lowerer.fmt(data.type)}' data`, dataNode ?? call, NARROW_DATA_HINT);
     }
     if (name === "getHeader" || name === "hasHeader" || name === "removeHeader") {