@scriptc/compiler 0.3.6 → 0.4.0

package/dist/frontend/lowering/lower-server.js

@@ -4,7 +4,7 @@ import { ladderFenceExpr } from "./lowerer.js";
 import { isJsSourceFile, locOf } from "../program.js";
 import { arrayOf, BOOL, BYTES_U8, canBoxFuncIntoDyn, canConvertToDyn, DYN, DYN_HANDLE_KINDS, F64, funcOf, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, NETSERVER_T, NETSOCKET_T, NULL_T, SECURECTX_T, STRING, UNDEFINED_T, typeKey, VOID, } from "../../ir/ir.js";
 import { AGENT_DOCUMENTED_OPTIONS, HTTPS_AGENT_DOCUMENTED_OPTIONS, builtinFenceHintOf, builtinModuleFnOf, fenceOrDropOptionKey, HTTP_CLIENT_DOCUMENTED_OPTIONS, HTTP_SERVER_DOCUMENTED_OPTIONS, HTTP2_SECURE_SERVER_DOCUMENTED_OPTIONS, HTTPS_CLIENT_DOCUMENTED_OPTIONS, sideEffectFreeOptionValue, TLS_SERVER_DOCUMENTED_OPTIONS, } from "./surfaces.js";
-import { conditionalSpreadOf } from "./expressions/object-literals.js";
+import { conditionalSpreadOf, lowerDynObjectLiteral } from "./expressions/object-literals.js";
 import { resultIsDiscarded } from "./call-position.js";
 import { lowerCallbackArg as lowerCallbackArgShared } from "./callback-arg.js";
 import { pairsSnapshotHelper } from "./pairs-snapshot.js";
@@ -583,7 +583,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
     // budget pair) ride the generic path — null hands the dispatch back.
     if (builtinModuleFnOf(lowerer, "net", bi.member))
         return null;
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length === 0) {
             return { kind: "libCall", fn: "net.createServer", args: [], type: NETSERVER_T, loc };
@@ -594,7 +594,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
             // ERR_INVALID_ARG_TYPE on 'options' before any server exists. DYN
             // result — the checked-dynamic lane's concise arrows box it, and
             // the throw means it never materializes.
-            if (isJsSourceFile(expr.getSourceFile())) {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr))) {
                 const t = lowerer.mapTypeOf(lowerer.typeOf(args[0]));
                 if (t !== null && (t.kind === "string" || t.kind === "f64" || t.kind === "bool")) {
                     const raw = lowerer.lowerExpr(args[0]);
@@ -633,7 +633,7 @@ export function lowerNetModuleCall(lowerer, expr, bi, loc) {
         // invalid-input probes build theirs with computed keys): the
         // checked-dynamic walk validates Node-order and the compiler-rendered
         // fence is the post-validation tail.
-        if (args.length === 1 && isJsSourceFile(expr.getSourceFile())) {
+        if (args.length === 1 && isJsSourceFile(ts.getSourceFileOfNode(expr))) {
             const t = lowerer.mapTypeOf(lowerer.typeOf(args[0]));
             if (t !== null && (t.kind === "dyn" || t.kind === "record")) {
                 const raw = lowerer.lowerExpr(args[0]);
@@ -722,9 +722,9 @@ function lookupFnShapeOk(lowerer, t) {
  * name; a connect listener argument is supported on the no-lookup form
  * only. */
 function lowerNetConnectOptions(lowerer, expr, member, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     const optsNode = args[0];
-    const isJs = isJsSourceFile(expr.getSourceFile());
+    const isJs = isJsSourceFile(ts.getSourceFileOfNode(expr));
     // The checked-dynamic option-bag route (JS sources): a literal with
     // computed keys (the invalid-input probes' spelling) or an objectMode-
     // trio member rides WHOLE to the runtime walk — Node's Socket-ctor
@@ -732,7 +732,7 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
     // port/host/autoSelectFamily), with the compiler-rendered fence as the
     // post-validation tail.
     if (isJs) {
-        const needsBag = optsNode.properties.some((p) => (!ts.isPropertyAssignment(p) && !ts.isShorthandPropertyAssignment(p)) ||
+        const needsBag = optsNode.properties.nodes.some((p) => (!ts.isPropertyAssignment(p) && !ts.isShorthandPropertyAssignment(p)) ||
             (ts.isPropertyAssignment(p) && ts.isComputedPropertyName(p.name)) ||
             ["objectMode", "readableObjectMode", "writableObjectMode"].includes((ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
                 (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name))
@@ -772,7 +772,7 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
         type: NETSOCKET_T,
         loc,
     });
-    for (const prop of optsNode.properties) {
+    for (const prop of optsNode.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -916,8 +916,8 @@ function lowerServerCloseBind(lowerer, call, access) {
         return null;
     const loc = locOf(call);
     const recvNode = closeAccess.expression;
-    const thisArg = call.arguments[0];
-    if (call.arguments.length !== 1 ||
+    const thisArg = call.arguments.nodes[0];
+    if (call.arguments.nodes.length !== 1 ||
         !thisArg ||
         !ts.isIdentifier(recvNode) ||
         !ts.isIdentifier(thisArg) ||
@@ -1083,7 +1083,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "getConnections") {
         // cb(null, count) on the next tick; answers the server.
         if (args.length !== 1) {
@@ -1155,7 +1155,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
             let host = null;
             let v6only = null;
             let reusePort = null;
-            for (const prop of args[0].properties) {
+            for (const prop of args[0].properties.nodes) {
                 let initializer;
                 if (ts.isPropertyAssignment(prop) &&
                     (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -1213,7 +1213,7 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 }
                 else if (key === "signal" &&
                     ts.isPropertyAssignment(prop) &&
-                    isJsSourceFile(call.getSourceFile())) {
+                    isJsSourceFile(ts.getSourceFileOfNode(call))) {
                     // A provably-non-AbortSignal signal (the invalid-input probes:
                     // strings, numbers, plain records) throws Node's
                     // validateAbortSignal ladder; plausible signal values keep the
@@ -1287,6 +1287,18 @@ function lowerNetServerMethodCall(lowerer, call, access) {
                 ? [receiver, port, host, v6only, cbV]
                 : [receiver, port, host, v6only, reusePort, cbV]);
         }
+        // listen(path[, cb]): a string first argument names a Unix socket
+        // (the runtime takes a numeric string as a port, Node's isPipeName).
+        if (lowerer.mapTypeOf(lowerer.typeOf(args[0]))?.kind === "string") {
+            if (args.length > 2) {
+                lowerer.noLowering(`listen(path) with ${args.length} arguments`, call, "the supported form is listen(path[, callback])");
+            }
+            const path = lowerer.lowerExprExpecting(args[0], STRING);
+            if (args.length === 1)
+                return listenResult("net.listenPath", [receiver, path]);
+            const { cb } = lowerCallbackArg(lowerer, args[1], "listen callbacks", 0, () => false, "use ()", []);
+            return listenResult("net.listenPathCb", [receiver, path, cb]);
+        }
         const port = lowerer.lowerExprExpecting(args[0], F64);
         // The optional middle host — listen(port, '127.0.0.1'[, cb]): a
         // string-typed second argument is the bind address (the net.connect
@@ -1326,6 +1338,19 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         if (args.length === 0) {
             return { kind: "libCall", fn: "net.serverClose", args: [receiver], type: VOID, loc };
         }
+        if (lowerer.checker
+            .getCallSignatures(lowerer.typeOf(args[0]))
+            .some((sig) => sig.getParameters().length > 0)) {
+            // close((err) => ...): undefined once the server closes, or Node's
+            // ERR_SERVER_NOT_RUNNING when it was not listening.
+            return {
+                kind: "libCall",
+                fn: "net.serverCloseDyn",
+                args: [receiver, lowerSocketDynListener(lowerer, args[0], "close callbacks")],
+                type: VOID,
+                loc,
+            };
+        }
         const { cb } = lowerCallbackArg(lowerer, args[0], "close callbacks", 0, () => false, "use ()", []);
         return { kind: "libCall", fn: "net.serverCloseCb", args: [receiver, cb], type: VOID, loc };
     }
@@ -1583,6 +1608,32 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         const result = lowerer.mapTypeOf(lowerer.typeOf(call));
         if (result && isAddressInfoRecord(lowerer, result)) {
             const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
+            if (unixListenReachable(lowerer)) {
+                // A Unix-socket server's address() is its path, which this record
+                // cannot hold: the check throws for one before the record reads.
+                const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
+                const server = () => varRef(local.id, NETSERVER_T, loc);
+                return {
+                    kind: "seqExpr",
+                    stmts: [
+                        { kind: "varDecl", localId: local.id, init: receiver, loc },
+                        {
+                            kind: "exprStmt",
+                            expr: {
+                                kind: "libCall",
+                                fn: "net.serverAddressCheck",
+                                args: [server()],
+                                type: VOID,
+                                loc,
+                            },
+                            loc,
+                        },
+                    ],
+                    result: { kind: "libCall", fn: "net.serverAddress", args: [server()], type: result, loc },
+                    type: result,
+                    loc,
+                };
+            }
             return { kind: "libCall", fn: "net.serverAddress", args: [receiver], type: result, loc };
         }
         // @types/node's `string | AddressInfo | null`: the record while the
@@ -1598,20 +1649,50 @@ function lowerNetServerMethodCall(lowerer, call, access) {
         const receiver = coerceToHandle(lowerer, access.expression, NETSERVER_T);
         const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
         const server = varRef(local.id, NETSERVER_T, loc);
+        const recordArm = {
+            kind: "unionWrap",
+            unionId,
+            tag: lowerer.armTag(unionId, record),
+            value: { kind: "libCall", fn: "net.serverAddress", args: [server], type: record, loc },
+            type: result,
+            loc,
+        };
+        const stringTag = lowerer.armTag(unionId, STRING);
+        let listeningArm = recordArm;
+        const stmts = [{ kind: "varDecl", localId: local.id, init: receiver, loc }];
+        if (stringTag >= 0 && unixListenReachable(lowerer)) {
+            // Node answers a Unix-socket server's address() with its path.
+            const pathLocal = lowerer.declareHiddenLocal("%addressPath", STRING);
+            const path = () => varRef(pathLocal.id, STRING, loc);
+            stmts.push({
+                kind: "varDecl",
+                localId: pathLocal.id,
+                init: { kind: "libCall", fn: "net.serverUnixPath", args: [server], type: STRING, loc },
+                loc,
+            });
+            listeningArm = {
+                kind: "ternary",
+                cond: {
+                    kind: "strEq",
+                    negated: true,
+                    left: path(),
+                    right: strLit("", loc),
+                    type: BOOL,
+                    loc,
+                },
+                then: { kind: "unionWrap", unionId, tag: stringTag, value: path(), type: result, loc },
+                else_: recordArm,
+                type: result,
+                loc,
+            };
+        }
         return {
             kind: "seqExpr",
-            stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }],
+            stmts,
             result: {
                 kind: "ternary",
                 cond: { kind: "libCall", fn: "net.serverListening", args: [server], type: BOOL, loc },
-                then: {
-                    kind: "unionWrap",
-                    unionId,
-                    tag: lowerer.armTag(unionId, record),
-                    value: { kind: "libCall", fn: "net.serverAddress", args: [server], type: record, loc },
-                    type: result,
-                    loc,
-                },
+                then: listeningArm,
                 else_: {
                     kind: "unionWrap",
                     unionId,
@@ -1629,6 +1710,114 @@ function lowerNetServerMethodCall(lowerer, call, access) {
     }
     lowerer.noLowering(`Server.${name}`, call, 'listen, close, address().port, emit("connection", socket), and on/once of connection/request/upgrade/error/close/listening/sessionError are the supported Server members', lowerer.checker.getSymbolAtLocation(access.name));
 }
+/** Whether a setEncoding call can reach some net.Socket in this program:
+ * `x.setEncoding(...)` or `x["setEncoding"](...)` where `x` is a socket
+ * or an untyped value. Sockets that never get an encoding keep the Buffer
+ * chunk path; with one, Node's 'data' chunks are strings. */
+function socketEncodingReachable(lowerer) {
+    if (lowerer.socketEncodingReachable !== null)
+        return lowerer.socketEncodingReachable;
+    let reachable = false;
+    for (const file of lowerer.program.getSourceFiles()) {
+        if (file.isDeclarationFile || !file.text.includes("setEncoding"))
+            continue;
+        ts.walkPreorder(file, (node) => {
+            if (reachable)
+                return "skip";
+            if (!ts.isCallExpression(node))
+                return undefined;
+            const callee = node.expression;
+            const receiver = ts.isPropertyAccessExpression(callee) && callee.name.text === "setEncoding"
+                ? callee.expression
+                : ts.isElementAccessExpression(callee) &&
+                    ts.isStringLiteralLike(callee.argumentExpression) &&
+                    callee.argumentExpression.text === "setEncoding"
+                    ? callee.expression
+                    : null;
+            if (receiver === null)
+                return undefined;
+            const kind = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(receiver))?.kind;
+            if (kind === undefined || kind === "netSocket" || kind === "dyn")
+                reachable = true;
+            return undefined;
+        });
+        if (reachable)
+            break;
+    }
+    lowerer.socketEncodingReachable = reachable;
+    return reachable;
+}
+/** Whether some server in the program may listen on a Unix socket: a
+ * `.listen(x, ...)` call on a server (or an untyped value) whose first
+ * argument is string-typed. Only then does address() check for the socket
+ * path, so other programs keep the record-only lowering. */
+function unixListenReachable(lowerer) {
+    if (lowerer.unixListenReachable !== null)
+        return lowerer.unixListenReachable;
+    let reachable = false;
+    for (const file of lowerer.program.getSourceFiles()) {
+        if (file.isDeclarationFile || !file.text.includes("listen"))
+            continue;
+        ts.walkPreorder(file, (node) => {
+            if (reachable)
+                return "skip";
+            if (!ts.isCallExpression(node) || node.arguments.nodes.length === 0)
+                return undefined;
+            const callee = node.expression;
+            if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== "listen")
+                return undefined;
+            const kind = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(callee.expression))?.kind;
+            if (kind !== undefined && kind !== "netServer" && kind !== "dyn")
+                return undefined;
+            const arg = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(node.arguments.nodes[0]));
+            // Only a string-typed argument lowers to listen(path) (an untyped
+            // one checks into a port).
+            if (arg?.kind === "string")
+                reachable = true;
+            return undefined;
+        });
+        if (reachable)
+            break;
+    }
+    lowerer.unixListenReachable = reachable;
+    return reachable;
+}
+/** An inline 'data' listener whose chunk parameter is typed Buffer, for a
+ * socket that may have an encoding set: the chunk binds as a checked
+ * dynamic value, so the body sees what Node passes (a string after
+ * setEncoding, a Buffer otherwise) whatever the annotation says. Null
+ * for other listener shapes. */
+function lowerEncodedDataListener(lowerer, node) {
+    let fn = node;
+    while (ts.isParenthesizedExpression(fn))
+        fn = fn.expression;
+    if (!ts.isArrowFunction(fn) && !ts.isFunctionExpression(fn))
+        return null;
+    if (fn.parameters.nodes.length !== 1)
+        return null;
+    const param = fn.parameters.nodes[0];
+    if (!ts.isIdentifier(param.name) || param.initializer || param.dotDotDotToken)
+        return null;
+    const symbol = lowerer.checker.getSymbolAtLocation(param.name);
+    if (symbol === undefined)
+        return null;
+    const previousBinding = lowerer.runtimeOptionalBindingTypes.get(symbol);
+    const previousImplicit = lowerer.implicitParamTypes;
+    const implicit = new Map(previousImplicit ?? []);
+    implicit.set(symbol, lowerer.checker.getUnknownType());
+    lowerer.runtimeOptionalBindingTypes.set(symbol, DYN);
+    lowerer.implicitParamTypes = implicit;
+    try {
+        return lowerer.lowerExpr(fn);
+    }
+    finally {
+        if (previousBinding === undefined)
+            lowerer.runtimeOptionalBindingTypes.delete(symbol);
+        else
+            lowerer.runtimeOptionalBindingTypes.set(symbol, previousBinding);
+        lowerer.implicitParamTypes = previousImplicit;
+    }
+}
 /** Method calls on net.Socket receivers: write/end/destroy/pipe and
  * on/once("data" | "end" | "close" | "error" | "connect"). Null for
  * other receivers. */
@@ -1639,7 +1828,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if ((name === "ref" || name === "unref") && args.length === 0) {
         // Whether the socket keeps the event loop alive.
         requireStatementPosition(lowerer, call, `socket.${name}()`);
@@ -1666,7 +1855,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             if (encT.isStringLiteralType() && chunkT !== null) {
                 if (encT.value === "buffer" &&
                     chunkT.kind === "string" &&
-                    isJsSourceFile(call.getSourceFile())) {
+                    isJsSourceFile(ts.getSourceFileOfNode(call))) {
                     lowerer.lowerExpr(args[0]); // evaluation order (effect-free in practice)
                     return nodeThrowExpr(1, "ERR_UNKNOWN_ENCODING", "Unknown encoding: buffer", VOID, loc);
                 }
@@ -1883,6 +2072,20 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
             ? value
             : lowerer.coerceInto(call, value, declared);
     }
+    if (name === "isSessionReused" && args.length === 0) {
+        // TLSSocket.isSessionReused(): the client never offers a cached
+        // session (no session resumption, a documented TLS divergence), so
+        // no handshake resumes one. A plain socket asserted to be a
+        // TLSSocket answers false too, where Node has no such method.
+        const receiver = coerceToHandle(lowerer, access.expression, NETSOCKET_T);
+        return {
+            kind: "seqExpr",
+            stmts: [{ kind: "exprStmt", expr: receiver, loc }],
+            result: boolLit(false, loc),
+            type: BOOL,
+            loc,
+        };
+    }
     if (name === "resetAndDestroy") {
         // An RST close; a connecting socket resets once it connects. Answers
         // the socket, Node's chaining.
@@ -1993,6 +2196,26 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                     loc,
                 };
             }
+            if (param !== null && param.kind === "bytes" && socketEncodingReachable(lowerer)) {
+                const encoded = lowerEncodedDataListener(lowerer, args[1]);
+                // A listener defined elsewhere keeps its Buffer parameter; it takes
+                // the chunk through the checked boundary, so a string chunk fails
+                // the check instead of arriving as a Buffer.
+                const cb = encoded ??
+                    {
+                        kind: "dynCheck",
+                        value: lowerSocketDynListener(lowerer, args[1], "data listeners"),
+                        type: funcOf([DYN], VOID),
+                        loc,
+                    };
+                return {
+                    kind: "libCall",
+                    fn: "net.sockOnData",
+                    args: [receiver, cb, once],
+                    type: VOID,
+                    loc,
+                };
+            }
             const { cb } = lowerCallbackArg(lowerer, args[1], "data listeners", 1, (p) => p.kind === "bytes" && p.elem === "u8", "use (chunk: Buffer) or ()", [DYN]);
             return { kind: "libCall", fn: "net.sockOnData", args: [receiver, cb, once], type: VOID, loc };
         }
@@ -2039,6 +2262,17 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                                 : "net.sockOnConnect";
             return { kind: "libCall", fn, args: [receiver, cb, once], type: VOID, loc };
         }
+        if (event === "lookup") {
+            // (err, address, family, host) after the host name resolves, before
+            // the connect: once per resolved address, or once with the error.
+            return {
+                kind: "libCall",
+                fn: "net.sockOnLookup",
+                args: [receiver, lowerSocketDynListener(lowerer, args[1], "lookup listeners"), once],
+                type: VOID,
+                loc,
+            };
+        }
         if (event === "finish") {
             // Fires once when the FIN goes out — once either way (the event
             // happens at most once per socket).
@@ -2071,7 +2305,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                 loc,
             };
         }
-        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "ready", "timeout", "readable", "secureConnect", and "session" are the supported socket events (as literals)');
+        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "lookup", "ready", "timeout", "readable", "secureConnect", and "session" are the supported socket events (as literals)');
     }
     lowerer.noLowering(`Socket.${name}`, call, "write, end, destroy, pipe, setTimeout, setKeepAlive, setNoDelay, the address fields, read, unshift, and on/once of data/end/close/error/connect/ready/timeout/readable are the supported Socket members", lowerer.checker.getSymbolAtLocation(access.name));
 }
@@ -2132,7 +2366,7 @@ function h2EndStreamOption(lowerer, node) {
         lowerer.noLowering("h2 options argument", node, "pass the options as an object literal ({ endStream: true })");
     }
     let end;
-    for (const prop of node.properties) {
+    for (const prop of node.properties.nodes) {
         if (!ts.isPropertyAssignment(prop) || !ts.isIdentifier(prop.name)) {
             lowerer.noLowering("h2 options with spreads or computed keys", prop, "use plain `name: value` entries");
         }
@@ -2160,7 +2394,7 @@ function lowerH2SessionMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     const receiver = () => coerceToHandle(lowerer, access.expression, HTTP2SESSION_T);
     if (name === "request") {
         const pairs = args.length >= 1 && !ts.isObjectLiteralExpression(args[0]) === false && args.length >= 1
@@ -2340,7 +2574,7 @@ function lowerH2StreamMethodCall(lowerer, call, access, receiverOverride) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     const receiver = () => receiverOverride ?? coerceToHandle(lowerer, access.expression, HTTP2STREAM_T);
     if (name === "respond") {
         requireStatementPosition(lowerer, call, "stream.respond(...)");
@@ -3003,7 +3237,7 @@ export function lowerServerProperty(lowerer, expr) {
     if (expr.name.text !== "port")
         return null;
     const recv = expr.expression;
-    if (!ts.isCallExpression(recv) || recv.questionDotToken || recv.arguments.length !== 0)
+    if (!ts.isCallExpression(recv) || recv.questionDotToken || recv.arguments.nodes.length !== 0)
         return null;
     if (!ts.isPropertyAccessExpression(recv.expression))
         return null;
@@ -3015,6 +3249,30 @@ export function lowerServerProperty(lowerer, expr) {
     if (!lowerer.isStdlibMember(inner))
         return null;
     const receiver = coerceToHandle(lowerer, inner.expression, NETSERVER_T);
+    if (unixListenReachable(lowerer)) {
+        const local = lowerer.declareHiddenLocal("%addressServer", NETSERVER_T);
+        const server = () => varRef(local.id, NETSERVER_T, loc);
+        return {
+            kind: "seqExpr",
+            stmts: [
+                { kind: "varDecl", localId: local.id, init: receiver, loc },
+                {
+                    kind: "exprStmt",
+                    expr: {
+                        kind: "libCall",
+                        fn: "net.serverAddressCheck",
+                        args: [server()],
+                        type: VOID,
+                        loc,
+                    },
+                    loc,
+                },
+            ],
+            result: { kind: "libCall", fn: "net.serverPort", args: [server()], type: F64, loc },
+            type: F64,
+            loc,
+        };
+    }
     return { kind: "libCall", fn: "net.serverPort", args: [receiver], type: F64, loc };
 }
 /** The (req, res) request-handler argument — http.createServer's, https
@@ -3080,7 +3338,7 @@ function lowerHttpServerOptions(lowerer, node, what) {
     let allowMissingHost = false;
     let keepAliveTimeoutBuffer = null;
     let maxHeaderSize = null;
-    for (const prop of node.properties) {
+    for (const prop of node.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -3159,7 +3417,7 @@ function lowerHttpServerOptions(lowerer, node, what) {
  * (options, handler). Modeled option values wrap the construction in an
  * interned option-setting helper. */
 function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
-    const args = expr.arguments ?? [];
+    const args = expr.arguments?.nodes ?? [];
     if (args.length > 2) {
         lowerer.noLowering(`${what} with ${args.length} arguments`, expr, `the supported forms are ${what}([options][, (req, res) => ...])`);
     }
@@ -3294,12 +3552,12 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
  * getName/destroy and the sockets/requests/freeSockets counters dispatch
  * through the dyn handle ops, and the request path threads it (the
  * requestAgent rows). Options parse at the LITERAL construction site:
- * keepAlive (a boolean value — TRUE throws the runtime's named pooling
- * fence: this client dials one connection per request), keepAliveMsecs /
- * maxSockets / maxFreeSockets / timeout / port as numbers, scheduling
- * DROPS (no free pool exists, so selection order cannot observe), other
- * documented keys fence by name, and undocumented keys drop like Node
- * drops them. Null when the callee isn't the http/https Agent. */
+ * keepAlive (a boolean value: finished connections return to the free
+ * list), keepAliveMsecs / maxSockets / maxFreeSockets / timeout / port as
+ * numbers, scheduling as a value the runtime validates ('fifo' or
+ * 'lifo'), other documented keys fence by name, and undocumented keys
+ * drop like Node drops them. Null when the callee isn't the http/https
+ * Agent. */
 export function lowerHttpAgentNew(lowerer, expr) {
     const callee = expr.expression;
     const bi = ts.isPropertyAccessExpression(callee) && callee.name.text === "Agent"
@@ -3317,7 +3575,8 @@ export function lowerHttpAgentNew(lowerer, expr) {
     let maxFree = numLit(-1, loc);
     let timeout = numLit(-1, loc);
     let port = numLit(-1, loc);
-    const args = expr.arguments ?? [];
+    let scheduling = lowerer.coerceToExpected(strLit("lifo", loc), DYN);
+    const args = expr.arguments?.nodes ?? [];
     if (args.length > 1) {
         lowerer.noLowering(`${api} with ${args.length} arguments`, expr, "the supported form is new Agent(options?)");
     }
@@ -3326,7 +3585,7 @@ export function lowerHttpAgentNew(lowerer, expr) {
         if (!ts.isObjectLiteralExpression(optsNode)) {
             lowerer.noLowering(`${api} with a non-literal options value`, args[0], "spell the options as an object literal at the construction site");
         }
-        for (const prop of optsNode.properties) {
+        for (const prop of optsNode.properties.nodes) {
             if (ts.isSpreadAssignment(prop)) {
                 lowerer.noLowering(`${api} with an options spread`, prop, "write each option inline");
             }
@@ -3382,12 +3641,14 @@ export function lowerHttpAgentNew(lowerer, expr) {
                     // the settable defaultPort carries this one.
                     port = lowerVal("f64");
                     break;
-                case "scheduling":
-                    // Free-socket selection order: no free pool exists here (no
-                    // keep-alive reuse), so the choice cannot observe — dropped.
-                    if (initializer !== null)
-                        lowerer.lowerExpr(initializer); // evaluate, like Node
+                case "scheduling": {
+                    // 'fifo' | 'lifo' (falsy = 'lifo'), validated by the runtime
+                    const v = initializer !== null
+                        ? lowerer.lowerExpr(initializer)
+                        : lowerer.lowerShorthandValue(prop);
+                    scheduling = lowerer.coerceToExpected(v, DYN);
                     break;
+                }
                 default:
                     fenceOrDropOptionKey(lowerer, prop, key, api, bi.module === "https" ? HTTPS_AGENT_DOCUMENTED_OPTIONS : AGENT_DOCUMENTED_OPTIONS, bi.module === "https"
                         ? "keepAlive, keepAliveMsecs, maxSockets, maxFreeSockets, timeout, port, and scheduling are the supported options; pass TLS options such as ca and rejectUnauthorized on each https.request"
@@ -3406,6 +3667,7 @@ export function lowerHttpAgentNew(lowerer, expr) {
             maxFree,
             timeout,
             port,
+            scheduling,
         ],
         type: DYN,
         loc,
@@ -3431,24 +3693,24 @@ export function lowerHttpServerNew(lowerer, expr) {
 function lowerHttpModuleCall(lowerer, expr, bi, loc) {
     if (bi.member === "validateHeaderName") {
         requireStatementPosition(lowerer, expr, "http.validateHeaderName(...)");
-        if (expr.arguments.length < 1 ||
-            expr.arguments.length > 2 ||
-            expr.arguments.some(ts.isSpreadElement)) {
+        if (expr.arguments.nodes.length < 1 ||
+            expr.arguments.nodes.length > 2 ||
+            expr.arguments.nodes.some(ts.isSpreadElement)) {
             lowerer.noLowering("http.validateHeaderName arguments", expr, "pass a header name and an optional label");
         }
-        const name = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
-        const label = expr.arguments.length === 2
-            ? lowerer.lowerExprExpecting(expr.arguments[1], STRING)
+        const name = lowerer.lowerExprExpecting(expr.arguments.nodes[0], STRING);
+        const label = expr.arguments.nodes.length === 2
+            ? lowerer.lowerExprExpecting(expr.arguments.nodes[1], STRING)
             : strLit("Header name", loc);
         return { kind: "libCall", fn: "http.validateHeaderName", args: [name, label], type: VOID, loc };
     }
     if (bi.member === "validateHeaderValue") {
         requireStatementPosition(lowerer, expr, "http.validateHeaderValue(...)");
-        if (expr.arguments.length !== 2 || expr.arguments.some(ts.isSpreadElement)) {
+        if (expr.arguments.nodes.length !== 2 || expr.arguments.nodes.some(ts.isSpreadElement)) {
             lowerer.noLowering("http.validateHeaderValue arguments", expr, "pass a header name and a value");
         }
-        const name = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
-        const value = lowerer.lowerExprExpecting(expr.arguments[1], DYN);
+        const name = lowerer.lowerExprExpecting(expr.arguments.nodes[0], STRING);
+        const value = lowerer.lowerExprExpecting(expr.arguments.nodes[1], DYN);
         return {
             kind: "libCall",
             fn: "http.validateHeaderValue",
@@ -3478,7 +3740,7 @@ function lowerTlsServerOptions(lowerer, node, what) {
     const loc = locOf(node);
     let cert = null;
     let key = null;
-    for (const prop of node.properties) {
+    for (const prop of node.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
             (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))) {
@@ -3574,8 +3836,8 @@ const TLS_VALIDATED_OPTIONS = new Set([
  * keepAliveTimeoutBuffer so the HTTP option is consumed without losing
  * the literal's evaluation order. */
 function tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions = false) {
-    const jsSource = isJsSourceFile(node.getSourceFile());
-    return node.properties.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
+    const jsSource = isJsSourceFile(ts.getSourceFileOfNode(node));
+    return node.properties.nodes.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
         (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) &&
         ((includeHttpTimeoutOptions && p.name.text === "keepAliveTimeoutBuffer") ||
             (jsSource && TLS_VALIDATED_OPTIONS.has(p.name.text))));
@@ -3608,7 +3870,7 @@ function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptio
  * callback (and 'secureConnect'/'connect' listeners) fires
  * post-handshake — Node's secureConnect timing. */
 function lowerTlsConnectCall(lowerer, expr, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/rejectUnauthorized/ca/servername";
     if (args.length < 1 || args.length > 4 || args.some(ts.isSpreadElement)) {
         lowerer.noLowering(`tls.connect with ${args.length} arguments`, expr, FORMS_HINT);
@@ -3700,7 +3962,7 @@ function lowerTlsConnectCall(lowerer, expr, loc) {
  * module declares fences qualified (createSecureContext and connect
  * carry pointed hints from the fence-hint table). */
 function lowerTlsModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, socket => ...)");
@@ -3740,7 +4002,7 @@ function lowerTlsModuleCall(lowerer, expr, bi, loc) {
     if (bi.member === "getCACertificates" &&
         args.length === 1 &&
         !args.some(ts.isSpreadElement) &&
-        isJsSourceFile(expr.getSourceFile())) {
+        isJsSourceFile(ts.getSourceFileOfNode(expr))) {
         // The type-argument ladder (validateString + the documented name
         // set); the real CA list has no lowering, so a valid name meets the
         // compiler-rendered fence after the validation.
@@ -3846,7 +4108,7 @@ function clientFnRefOf(lowerer, node) {
  * `const` declaration, or a parameter/let whose enclosing scope contains
  * no assignment or ++/-- targeting it. */
 function neverReassigned(lowerer, sym) {
-    const decl = lowerer.checker.declarationsOf(sym)[0];
+    const decl = sym.declarations[0];
     if (!decl)
         return false;
     if (ts.isVariableDeclaration(decl) &&
@@ -3953,7 +4215,7 @@ export function lowerHttpClientFnCall(lowerer, expr, binding, loc) {
  * handler) and request/get — the http client lowering with the secure
  * extras (port 443 default, rejectUnauthorized, ca). */
 function lowerHttpsModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, (req, res) => ...)");
@@ -4034,7 +4296,7 @@ function stripParensAndCasts(node) {
  * createSecureServer lowers h2 over TLS, with allowHTTP1 selecting one
  * dual-ALPN server whose request/connect listeners mirror across parsers. */
 function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (bi.member === "createServer") {
         // The REAL h2c server (scr_http2.c). An options object literal is
         // accepted and ignored (h2 session-tuning knobs; the honest-defaults
@@ -4098,7 +4360,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
             !arg1IsDyn &&
             lowerer.checker.getCallSignatures(lowerer.typeOf(args[1])).length === 0) {
             if (ts.isObjectLiteralExpression(args[1])) {
-                for (const pr of args[1].properties) {
+                for (const pr of args[1].properties.nodes) {
                     // Plain `name: value` and shorthand `{ ca }` both carry the
                     // option; a shorthand's value is the same-named identifier.
                     let name;
@@ -4281,17 +4543,17 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                 if (ts.isConditionalExpression(inner)) {
                     const whenTrue = stripParensAndCasts(inner.whenTrue);
                     const whenFalse = stripParensAndCasts(inner.whenFalse);
-                    const condText = inner.condition.getText();
+                    const condText = ts.getTextOfNode(inner.condition);
                     const ok = ts.isObjectLiteralExpression(whenTrue) &&
                         ts.isObjectLiteralExpression(whenFalse) &&
-                        whenFalse.properties.length === 0 &&
-                        whenTrue.properties.length === 1 &&
-                        ts.isPropertyAssignment(whenTrue.properties[0]) &&
-                        (ts.isIdentifier(whenTrue.properties[0].name) ||
-                            ts.isStringLiteral(whenTrue.properties[0].name)) &&
-                        whenTrue.properties[0].name.text ===
+                        whenFalse.properties.nodes.length === 0 &&
+                        whenTrue.properties.nodes.length === 1 &&
+                        ts.isPropertyAssignment(whenTrue.properties.nodes[0]) &&
+                        (ts.isIdentifier(whenTrue.properties.nodes[0].name) ||
+                            ts.isStringLiteral(whenTrue.properties.nodes[0].name)) &&
+                        whenTrue.properties.nodes[0].name.text ===
                             "SNICallback" &&
-                        whenTrue.properties[0].initializer.getText() === condText;
+                        ts.getTextOfNode(whenTrue.properties.nodes[0].initializer) === condText;
                     if (!ok) {
                         lowerer.noLowering("createSecureServer options with a conditional spread", prop, "the lowered conditional spread is exactly ...(x ? { SNICallback: x } : {}) — the included value must BE the condition");
                     }
@@ -4301,7 +4563,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                 if (!ts.isObjectLiteralExpression(inner)) {
                     lowerer.noLowering("createSecureServer options with a computed spread", prop, `spreads must be inline object literals here; ${SNI_HINT}`);
                 }
-                for (const p of inner.properties)
+                for (const p of inner.properties.nodes)
                     lowerOption(p);
                 return;
             }
@@ -4367,11 +4629,11 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
                     e.kind === ts.SyntaxKind.TrueKeyword ||
                     e.kind === ts.SyntaxKind.FalseKeyword;
                 const isLiteralObjectOfLiterals = (e) => ts.isObjectLiteralExpression(e) &&
-                    e.properties.every((p) => ts.isPropertyAssignment(p) &&
+                    e.properties.nodes.every((p) => ts.isPropertyAssignment(p) &&
                         ts.isIdentifier(p.name) &&
                         isScalarLiteral(p.initializer));
                 if (k === "settings" && initializer !== null && ts.isObjectLiteralExpression(initializer)) {
-                    for (const setting of initializer.properties) {
+                    for (const setting of initializer.properties.nodes) {
                         if (ts.isPropertyAssignment(setting) &&
                             ts.isIdentifier(setting.name) &&
                             setting.name.text === "enableConnectProtocol") {
@@ -4399,7 +4661,7 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
             fenceOrDropOptionKey(lowerer, prop, k, "createSecureServer", HTTP2_SECURE_SERVER_DOCUMENTED_OPTIONS, "allowHTTP1: true, cert, key, and SNICallback are the supported options (h2 session-tuning options are accepted as literals and ignored)");
             // An undocumented key, dropped like Node drops it.
         };
-        for (const prop of optsNode.properties)
+        for (const prop of optsNode.properties.nodes)
             lowerOption(prop);
         if (cert === null || key === null) {
             lowerer.noLowering("createSecureServer without both cert and key", optsNode, "the supported options object is { allowHTTP1?, cert, key } (PEM strings or Buffers)");
@@ -4464,6 +4726,37 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
     lowerer.noLowering(`http2.${bi.member}`, expr, builtinFenceHintOf("http2", bi.member) ??
         "createSecureServer({ allowHTTP1: true, cert, key }) and the h2-only form are lowered", lowerer.resolveValueSymbol(expr.expression));
 }
+/** The checked-dynamic options value of a request whose options the
+ * runtime reads: a non-literal options value (a RequestOptions variable —
+ * checked-dynamic storage — or a record that converts to one), or a
+ * literal the static walk cannot lower because it spreads another options
+ * value or sets socketPath. Null keeps the static literal walk (and its
+ * fences), which every other literal takes unchanged. */
+function runtimeRequestOptions(lowerer, optsNode, secureish) {
+    if (ts.isObjectLiteralExpression(optsNode)) {
+        const needsRuntime = optsNode.properties.nodes.some((prop) => {
+            if (ts.isSpreadAssignment(prop)) {
+                // the static walk's one spread: `...(c ? { rejectUnauthorized } : {})` on https
+                const cs = conditionalSpreadOf(prop.expression);
+                return !(secureish &&
+                    cs !== null &&
+                    cs !== "unsupported" &&
+                    cs.props.length === 1 &&
+                    cs.props[0].name.text === "rejectUnauthorized");
+            }
+            return ((ts.isPropertyAssignment(prop) || ts.isShorthandPropertyAssignment(prop)) &&
+                (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
+                prop.name.text === "socketPath");
+        });
+        if (!needsRuntime)
+            return null;
+        return lowerDynObjectLiteral(lowerer, optsNode);
+    }
+    const t = lowerer.mapTypeOf(lowerer.typeOf(optsNode));
+    if (!t || !(t.kind === "dyn" || (t.kind === "record" && lowerer.dynConvertible(t))))
+        return null;
+    return lowerer.coerceToExpected(lowerer.lowerExpr(optsNode), DYN);
+}
 /** http.request(options[, cb]) / http.get(options[, cb]) — the client.
  * The options argument must be an OBJECT LITERAL; the lowered keys are
  * hostname/host, port, path, method, timeout, and headers (a nested
@@ -4491,11 +4784,36 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
         const c = lowerer.lowerCondition(binding.cond);
         return binding.trueSecure ? c : { kind: "unary", op: "!", operand: c, type: BOOL, loc };
     };
-    const args = expr.arguments;
+    const args = expr.arguments.nodes;
     if (args.length < 1 || args.length > 2) {
         lowerer.noLowering(`${member} with ${args.length} arguments`, expr, `the supported form is ${member}(options[, callback])`);
     }
     const optsNode = args[0];
+    const runtimeOptions = binding === null ? runtimeRequestOptions(lowerer, optsNode, secureish) : null;
+    if (runtimeOptions !== null) {
+        // The options record is read at run time (the ClientRequest
+        // constructor's walk in the runtime): a RequestOptions variable, or a
+        // literal that spreads one or sets socketPath.
+        const autoEnd = boolLit(member === "get", loc);
+        const secureDyn = secure === true;
+        if (args.length === 1) {
+            return {
+                kind: "libCall",
+                fn: secureDyn ? "https.requestDyn" : "http.requestDyn",
+                args: [runtimeOptions, autoEnd],
+                type: HTTPCLIENTREQ_T,
+                loc,
+            };
+        }
+        const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
+        return {
+            kind: "libCall",
+            fn: secureDyn ? "https.requestDynCb" : "http.requestDynCb",
+            args: [runtimeOptions, autoEnd, cb],
+            type: HTTPCLIENTREQ_T,
+            loc,
+        };
+    }
     if (!ts.isObjectLiteralExpression(optsNode)) {
         const t = lowerer.mapTypeOf(lowerer.typeOf(optsNode));
         if ((t?.kind === "string" || t?.kind === "url") && binding === null) {
@@ -4562,7 +4880,7 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
     let servername = null;
     /** maxHeaderSize: the response head's size bound. */
     let maxHeaderSize = null;
-    for (const prop of optsNode.properties) {
+    for (const prop of optsNode.properties.nodes) {
         // Shorthand entries ({ port } for { port: port }) are the natural
         // spelling at these call sites — the shorthand's VALUE lowering
         // resolves the local binding (lowerShorthandValue), not the property
@@ -4657,6 +4975,9 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
                 maxHeaderSize = lowerVal("f64");
                 break;
             case "servername":
+                if (binding !== null) {
+                    lowerer.noLowering(`${member} option 'servername' through a module-function binding`, prop, "call https.request directly when passing servername");
+                }
                 if (!secureish) {
                     lowerer.noLowering(`${member} option 'servername'`, prop, "servername is an https.request option — the plain http client has no TLS layer");
                 }
@@ -4820,22 +5141,29 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
     timeout ??= numLit(0, loc);
     headers ??= { kind: "arrayLit", elems: [], type: arrayOf(STRING), loc };
     const autoEnd = boolLit(member === "get", loc);
-    // Options applied to the built request: servername before the TLS
-    // handshake starts, then options.signal (an already aborted signal
-    // destroys the request at once, like Node's constructor).
+    // options.signal is checked first: Node's constructor rejects a value
+    // that is not an AbortSignal before it dials. servername is stored just
+    // before construction (it selects the TLS name and which pooled sockets
+    // the request may reuse); maxHeaderSize and the signal then apply to the
+    // built request (an already aborted signal destroys it at once, like
+    // Node's constructor).
     const withSignal = (request) => {
         if (signal === null && servername === null && maxHeaderSize === null)
             return request;
         const local = lowerer.declareHiddenLocal("%requestOptions", HTTPCLIENTREQ_T);
         const ref = () => varRef(local.id, HTTPCLIENTREQ_T, loc);
-        const steps = [{ kind: "varDecl", localId: local.id, init: request, loc }];
-        if (maxHeaderSize !== null) {
+        const steps = [];
+        let signalRef = null;
+        if (signal !== null) {
+            const signalLocal = lowerer.declareHiddenLocal("%requestSignal", DYN);
+            signalRef = () => varRef(signalLocal.id, DYN, loc);
+            steps.push({ kind: "varDecl", localId: signalLocal.id, init: signal, loc });
             steps.push({
                 kind: "exprStmt",
                 expr: {
                     kind: "libCall",
-                    fn: "http.clientMaxHeaderSize",
-                    args: [ref(), maxHeaderSize],
+                    fn: "http.clientSignalCheck",
+                    args: [signalRef()],
                     type: VOID,
                     loc,
                 },
@@ -4847,18 +5175,38 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
                 kind: "exprStmt",
                 expr: {
                     kind: "libCall",
-                    fn: "https.clientServername",
-                    args: [ref(), servername],
+                    fn: "https.nextServername",
+                    args: [servername],
                     type: VOID,
                     loc,
                 },
                 loc,
             });
         }
-        if (signal !== null) {
+        steps.push({ kind: "varDecl", localId: local.id, init: request, loc });
+        if (maxHeaderSize !== null) {
             steps.push({
                 kind: "exprStmt",
-                expr: { kind: "libCall", fn: "http.clientSignal", args: [ref(), signal], type: VOID, loc },
+                expr: {
+                    kind: "libCall",
+                    fn: "http.clientMaxHeaderSize",
+                    args: [ref(), maxHeaderSize],
+                    type: VOID,
+                    loc,
+                },
+                loc,
+            });
+        }
+        if (signalRef !== null) {
+            steps.push({
+                kind: "exprStmt",
+                expr: {
+                    kind: "libCall",
+                    fn: "http.clientSignal",
+                    args: [ref(), signalRef()],
+                    type: VOID,
+                    loc,
+                },
                 loc,
             });
         }
@@ -4927,7 +5275,7 @@ function lowerClientHeadersOption(lowerer, node) {
     const loc = locOf(node);
     if (ts.isObjectLiteralExpression(node)) {
         const elems = [];
-        for (const prop of node.properties) {
+        for (const prop of node.properties.nodes) {
             const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
             if (!ts.isPropertyAssignment(prop) || key === null) {
                 lowerer.noLowering("request headers with dynamic keys, spreads, or shorthand entries", prop, "each header must be a `name: value` entry whose key is a literal (or a string-literal-typed const: [PORTLESS_HEADER])");
@@ -4963,13 +5311,13 @@ function lowerHttpTrailersOption(lowerer, node) {
         return lowerClientHeadersOption(lowerer, node);
     const loc = locOf(node);
     const flat = [];
-    for (const entry of node.elements) {
-        if (!ts.isArrayLiteralExpression(entry) || entry.elements.length !== 2) {
+    for (const entry of node.elements.nodes) {
+        if (!ts.isArrayLiteralExpression(entry) || entry.elements.nodes.length !== 2) {
             lowerer.noLowering("addTrailers pair list", entry, "use an object/Record or literal [name, value] pairs");
         }
         const pair = entry;
-        const name = pair.elements[0];
-        const value = pair.elements[1];
+        const name = pair.elements.nodes[0];
+        const value = pair.elements.nodes[1];
         if (ts.isSpreadElement(name) || ts.isSpreadElement(value)) {
             lowerer.noLowering("addTrailers pair with spread", entry, "use direct string name/value expressions");
         }
@@ -4987,7 +5335,7 @@ function lowerHttpClientMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setHeader") {
         requireStatementPosition(lowerer, call, "request.setHeader(...)");
         if (args.length !== 2)
@@ -5366,7 +5714,7 @@ function lowerHttpReqMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setTimeout") {
         requireStatementPosition(lowerer, call, "message.setTimeout(...)");
         if (args.length < 1 || args.length > 2)
@@ -5434,6 +5782,26 @@ function lowerHttpReqMethodCall(lowerer, call, access) {
         const event = evT.isStringLiteralType() ? evT.value : null;
         const receiver = coerceToHandle(lowerer, access.expression, HTTPREQ_T);
         if (event === "data") {
+            const sigs = lowerer.checker.getCallSignatures(lowerer.typeOf(args[1]));
+            const firstParam = sigs.length === 1 ? sigs[0].getParameters()[0] : undefined;
+            const param = firstParam !== undefined
+                ? lowerer.mapTypeOf(lowerer.checker.getTypeOfSymbol(firstParam))
+                : null;
+            if (param !== null && param.kind === "string") {
+                // A chunk typed string (the setEncoding('utf8') shape), as on a
+                // socket: the listener takes the chunk through a checked
+                // boundary, so a string arrives after setEncoding and a Buffer
+                // without it fails the check instead of being decoded.
+                const boxed = lowerSocketDynListener(lowerer, args[1], "data listeners");
+                const cb = { kind: "dynCheck", value: boxed, type: funcOf([DYN], VOID), loc };
+                return {
+                    kind: "libCall",
+                    fn: "http.reqOnData",
+                    args: [receiver, cb, once],
+                    type: VOID,
+                    loc,
+                };
+            }
             const { cb } = lowerCallbackArg(lowerer, args[1], "data listeners", 1, (p) => p.kind === "bytes" && p.elem === "u8", "use (chunk: Buffer) or ()", [DYN]);
             return { kind: "libCall", fn: "http.reqOnData", args: [receiver, cb, once], type: VOID, loc };
         }
@@ -5486,7 +5854,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         return null;
     const name = access.name.text;
     const loc = locOf(call);
-    const args = call.arguments;
+    const args = call.arguments.nodes;
     if (name === "setTimeout") {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`res.setTimeout with ${args.length} arguments`, call, "use setTimeout(milliseconds[, callback])");
@@ -5504,7 +5872,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
     }
     if (name === "writeContinue" || name === "writeProcessing" || name === "writeEarlyHints") {
         requireStatementPosition(lowerer, call, `res.${name}(...)`);
-        if (lowerer.typeOf(access.expression).getSymbol()?.name === "Http2ServerResponse") {
+        if (ts.symbolNameOf(lowerer.typeOf(access.expression).getSymbol()) === "Http2ServerResponse") {
             lowerer.noLowering(`Http2ServerResponse.${name}`, call, "HTTP/2 informational responses are not supported by the static runtime yet");
         }
         const receiver = coerceToHandle(lowerer, access.expression, HTTPRES_T);
@@ -5525,7 +5893,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         let pairs;
         if (ts.isObjectLiteralExpression(node)) {
             const elems = [];
-            for (const prop of node.properties) {
+            for (const prop of node.properties.nodes) {
                 const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
                 if (!ts.isPropertyAssignment(prop) || key === null) {
                     lowerer.noLowering("writeEarlyHints headers with dynamic keys, spreads, or shorthand entries", prop, "use literal header keys and string values");
@@ -5588,7 +5956,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
     }
     if (name === "addTrailers") {
         requireStatementPosition(lowerer, call, "res.addTrailers(...)");
-        if (lowerer.typeOf(access.expression).getSymbol()?.name === "Http2ServerResponse") {
+        if (ts.symbolNameOf(lowerer.typeOf(access.expression).getSymbol()) === "Http2ServerResponse") {
             lowerer.noLowering("Http2ServerResponse.addTrailers", call, "HTTP/2 response trailers are not supported by the static runtime yet");
         }
         if (args.length !== 1)
@@ -5725,7 +6093,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
         }
         const names = [];
         const values = [];
-        for (const prop of headersNode.properties) {
+        for (const prop of headersNode.properties.nodes) {
             const key = ts.isPropertyAssignment(prop) ? staticHeaderKeyOf(lowerer, prop) : null;
             if (!ts.isPropertyAssignment(prop) || key === null) {
                 lowerer.noLowering("writeHead headers with dynamic keys, spreads, or shorthand entries", prop, "each header must be a `name: value` entry whose key is a literal (or a string-literal-typed const: [PORTLESS_HEADER])");
@@ -5853,6 +6221,26 @@ function lowerHttpResMethodCall(lowerer, call, access) {
                 return endWithCb(fn, [receiver, data], cbArg);
             return { kind: "libCall", fn, args: [receiver, data], type: VOID, loc };
         }
+        // end(payload ? text : undefined): an absent chunk ends without data,
+        // as end() does. The checked-dynamic end takes each arm at run time.
+        if (name === "end" && data.type.kind === "union" && lowerer.dynConvertible(data.type)) {
+            const arms = lowerer.unions.get(data.type.unionId)?.arms ?? [];
+            if (arms.every((arm) => arm.kind === "string" ||
+                (arm.kind === "bytes" && arm.elem === "u8") ||
+                arm.kind === "undefinedT" ||
+                arm.kind === "nullT")) {
+                const dynData = { kind: "dynFrom", value: data, type: DYN, loc: locOf(dataNode) };
+                if (cbArg !== null)
+                    return endWithCb("http.resEndDyn", [receiver, dynData], cbArg);
+                return {
+                    kind: "libCall",
+                    fn: "http.resEndDyn",
+                    args: [receiver, dynData],
+                    type: VOID,
+                    loc,
+                };
+            }
+        }
         lowerer.noLowering(`${name} of '${lowerer.fmt(data.type)}' data`, dataNode ?? call, NARROW_DATA_HINT);
     }
     if (name === "getHeader" || name === "hasHeader" || name === "removeHeader") {