@scriptc/compiler 0.4.2 → 0.4.4

package/dist/frontend/lowering/lower-calls.js

@@ -1,4 +1,5 @@
 import { keyedHelperName } from "./stable-names.js";
+import { perKeyOrder } from "./key-order-witness.js";
 import { isForwardedTupleSpread, lowerForwardingApply } from "./typed-arguments.js";
 import { guardNullProto, nullProtoRecordShape } from "./null-prototype.js";
 import { lowerDynStreamMemberCall } from "./dyn-streams.js";
@@ -29,9 +30,10 @@ import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
 import { lowerReadlineDisposeCall } from "./builtins/readline.js";
 import { errorToStringCall } from "./error-methods.js";
 import { lowerClassPrototypeAssign, lowerClassPrototypeDescriptors } from "./class-prototypes.js";
-import { BYTES_ELEMENT_NAME, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
+import { BYTES_ELEMENT_NAME, BYTES_U8, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, shapeKeyOrders, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
 import { lowerProtocolMethodCall } from "./class-protocol-dispatch.js";
 import { isJsSourceFile, locOf, requireSpecOf } from "../program.js";
+import { isPackageShimFile, isShimIntrinsicName } from "../package-shims.js";
 import { lowerJsonRequireCall } from "./json-require.js";
 import { lowerAssertInstanceCall } from "./assert-instances.js";
 import { isGenericCallableMemberType, isOverloadedCallableMemberType, typeKey, } from "../type-mapper.js";
@@ -46,7 +48,7 @@ import { lowerGeneratorHelperCall, lowerHelperReturnCall, lowerIteratorFromCall,
 import { lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, } from "./containers/indexed-objects.js";
 import { lowerTupleReadMethodCall } from "./containers/array-methods.js";
 import { tryFuseIndexRead } from "./array-values.js";
-import { lowerBytesStaticCall } from "./containers/bytes.js";
+import { lowerBufferConstruct, lowerBytesPrototypeSetCall, lowerBytesStaticCall, } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall, isDynPrimitiveKindMethod, lowerDynPrimitiveMethodCall, lowerExtraNumberMethodCall, } from "./containers/string-and-regexp.js";
 import { createRequireSpecOf } from "./builtins/module-bindings.js";
 import { lowerChildStreamMethodCall, lowerChildWriterMethodCall, } from "./builtins/child-process-methods.js";
@@ -82,19 +84,72 @@ import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedA
 import { fenceSymbolFieldCopy } from "./symbol-fields.js";
 import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
 import { lowerClassFieldDefine, lowerClassIntegrity } from "./class-attributes.js";
+import { freezableRecordType, lowerNativeFreeze } from "./frozen-records.js";
 import { classStaticDataFor } from "./class-static-data.js";
 import { lowerUrlFactory } from "./lower-url.js";
 import { nullishValueUnitOf } from "./binding-analysis.js";
 import { spreadNeedsRuntimeArity, completeFuncValueArgs, lowerSpreadArgsCall, completeArgs, } from "./call-arguments.js";
 import { isThisParameter } from "./call-signatures.js";
+import { dynamicOverloadChoice } from "./overload-choice.js";
 import { lowerStringIteratorValue } from "./iterator-adapters.js";
 import { checkedArmExtraction } from "./coercions/unions.js";
 import { maybePromiseReturnStmt, promiseArmedUnionOf } from "./maybe-promise.js";
 import { requireObjLitGenericReceiver, objLitGenericFnNodeOf, objLitGenericFnInfoOf, genericCallInstance, } from "./generic-functions.js";
 import { codeGenerationCalleeOf, lowerCodeGenerationCall } from "./code-generation.js";
 const ZLIB_STREAM_METHODS = new Set(["flush", "params", "close", "reset"]);
+/** `Object.defineProperty(target, ...)`, `Object.defineProperties`,
+ * `Reflect.defineProperty`, and `target.__defineGetter__/__defineSetter__`
+ * over a target that may hold an Error can install an accessor over an
+ * error's `name` or `message` (error-methods.ts). */
+function noteErrorAccessorReflection(lowerer, expr) {
+    const callee = expr.expression;
+    if (!ts.isPropertyAccessExpression(callee))
+        return;
+    const member = callee.name.text;
+    const target = member === "defineProperty" || member === "defineProperties"
+        ? expr.arguments.nodes[0]
+        : member === "__defineGetter__" || member === "__defineSetter__"
+            ? callee.expression
+            : undefined;
+    if (!target)
+        return;
+    const error = lowerer.checker.resolveName("Error", ts.SymbolFlags.Type, target, false);
+    const errorType = error ? lowerer.checker.getDeclaredTypeOfSymbol(error) : null;
+    if (mayHoldError(lowerer, lowerer.checker.getTypeAtLocation(target), errorType))
+        lowerer.errorAccessorReflection = locOf(expr);
+}
+/** An untyped or generic type, a type Error is assignable to (`object`,
+ * `{}`, `Object`, `{ message?: string }`), or
+ * an Error-shaped type with both `name` and `message`, alone or in a
+ * union or intersection. */
+function mayHoldError(lowerer, type, errorType) {
+    if (type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown | ts.TypeFlags.Instantiable))
+        return true;
+    if (type.flags & (ts.TypeFlags.Union | ts.TypeFlags.Intersection))
+        return ts.constituentTypes(type).some((part) => mayHoldError(lowerer, part, errorType));
+    return ((lowerer.checker.getPropertyOfType(type, "message") !== undefined &&
+        lowerer.checker.getPropertyOfType(type, "name") !== undefined) ||
+        (errorType !== null && lowerer.checker.isTypeAssignableTo(errorType, type)));
+}
+/** The `f` of a `(0, f)` callee (a numeric left operand, so dropping it
+ * changes only the call's receiver), or null. */
+function receiverlessCalleeOf(callee) {
+    let e = callee;
+    while (ts.isParenthesizedExpression(e))
+        e = e.expression;
+    if (!ts.isBinaryExpression(e) ||
+        e.operatorToken.kind !== ts.SyntaxKind.CommaToken ||
+        !ts.isNumericLiteral(e.left))
+        return null;
+    let right = e.right;
+    while (ts.isParenthesizedExpression(right))
+        right = right.expression;
+    return right;
+}
 export function lowerCall(lowerer, expr) {
     const loc = locOf(expr);
+    if (lowerer.errorAccessorReflection === null)
+        noteErrorAccessorReflection(lowerer, expr);
     // Object's checker return type is `any`. Claim known object inputs
     // before generic checked-dynamic dispatch tries to load the constructor.
     if (ts.isIdentifier(expr.expression) &&
@@ -113,6 +168,17 @@ export function lowerCall(lowerer, expr) {
     const json = lowerJsonRequireCall(lowerer, expr);
     if (json)
         return json;
+    // `(0, ns.member)(...)` over a builtin module (tsc's and esbuild's call
+    // without a receiver): Node's module functions do not read `this`, so it
+    // is the member call.
+    {
+        const member = receiverlessCalleeOf(expr.expression);
+        if (member !== null && ts.isPropertyAccessExpression(member)) {
+            const builtin = lowerer.lowerNamespaceBuiltinCall(expr, member);
+            if (builtin)
+                return builtin;
+        }
+    }
     // eval(...) and Function(...): Node's EvalError under
     // --disallow-code-generation-from-strings (code-generation.ts).
     {
@@ -120,6 +186,21 @@ export function lowerCall(lowerer, expr) {
         if (codeGeneration !== null)
             return lowerCodeGenerationCall(lowerer, expr, codeGeneration);
     }
+    // The deprecated Buffer(...) call (containers/bytes.ts). The checker
+    // types it `any`, so the bytes cross as a checked-dynamic value, which
+    // keeps the Buffer brand for inspection.
+    {
+        const buffer = lowerBufferConstruct(lowerer, expr);
+        if (buffer)
+            return { kind: "dynFrom", value: buffer, type: DYN, loc };
+    }
+    // A package shim's runtime intrinsic (a bodiless `declare function`
+    // named scriptcUnixDgram* in a shipped shim): a direct runtime call.
+    if (ts.isIdentifier(expr.expression) && isShimIntrinsicName(expr.expression.text)) {
+        const intrinsic = lowerShimIntrinsicCall(lowerer, expr, expr.expression, loc);
+        if (intrinsic)
+            return intrinsic;
+    }
     // Inline require() of a program module (cjs-inline-require.ts): a
     // member call over its export table resolves like a binding's member
     // call after the module's %init at this position; the require itself
@@ -1195,6 +1276,7 @@ export function lowerCall(lowerer, expr) {
             lowerer.lowerTestMethodCall(expr, expr.expression) ??
             lowerer.lowerTimeoutMethodCall(expr, expr.expression) ??
             lowerArrayPrototypeBorrowCall(lowerer, expr, expr.expression) ??
+            lowerBytesPrototypeSetCall(lowerer, expr, expr.expression) ??
             lowerObjectOwnPrototypeCall(lowerer, expr, expr.expression) ??
             lowerObjectPrototypeCall(lowerer, expr, expr.expression) ??
             lowerStringPrototypeCall(lowerer, expr, expr.expression) ??
@@ -1305,7 +1387,17 @@ export function lowerCall(lowerer, expr) {
         }
         const accessorTarget = lowerer.fieldTarget(expr.expression);
         if (accessorTarget?.container === "accessor") {
-            const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+            let callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+            // A getter returning a callable class instance (chalk's
+            // `chalk.red("x")`): call through its `%call` field.
+            if (callee.type.kind === "object") {
+                const direct = callableInstanceStringCall(lowerer, expr, callee, locOf(expr));
+                if (direct)
+                    return direct;
+                callee = lowerer.hybridCallUnwrap(callee);
+                if (callee.type.kind === "func")
+                    return lowerCallThroughValue(lowerer, expr, callee, locOf(expr));
+            }
             if (callee.type.kind === "func") {
                 const args = completeFuncValueArgs(lowerer, expr, callee.type, locOf(expr));
                 return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(expr) };
@@ -1522,8 +1614,47 @@ export function lowerCall(lowerer, expr) {
     // a non-func IR type was already rejected while lowering the callee.
     // HYBRID (function-with-properties) values call through their %call slot.
     let callee = lowerer.lowerExpr(expr.expression);
-    if (callee.type.kind === "record")
+    {
+        const direct = callableInstanceStringCall(lowerer, expr, callee, loc);
+        if (direct)
+            return direct;
+    }
+    if (callee.type.kind === "record" || callee.type.kind === "object")
         callee = lowerer.hybridCallUnwrap(callee);
+    return lowerCallThroughValue(lowerer, expr, callee, loc);
+}
+/** A callable class instance called with one string: its `%call1` method
+ * when the class has one (the chalk shim's typed fast path), skipping the
+ * variadic closure's checked-dynamic arguments. */
+function callableInstanceStringCall(lowerer, expr, callee, loc) {
+    if (callee.type.kind !== "object" || expr.arguments.nodes.length !== 1)
+        return null;
+    const arg = expr.arguments.nodes[0];
+    if (ts.isSpreadElement(arg))
+        return null;
+    const info = lowerer.classes.get(callee.type.className);
+    if (info === undefined || !info.fields.has("%call") || !lowerer.findMethodOn(info, "%call1"))
+        return null;
+    const value = lowerer.lowerExpr(arg);
+    if (value.type.kind === "string")
+        return lowerer.accessorCall(callee.type.className, "%call1", callee, [value], STRING, loc);
+    // Any other argument (a number behind a cast): the variadic closure,
+    // through the checked-dynamic call as lowerCallThroughValue would.
+    const closure = lowerer.hybridCallUnwrap(callee);
+    if (closure.type.kind !== "func")
+        return null;
+    return {
+        kind: "dynCall",
+        callee: { kind: "dynFrom", value: closure, type: DYN, loc },
+        calleeName: ts.isIdentifier(expr.expression) ? expr.expression.text : "value",
+        args: [lowerer.coerceToExpected(value, DYN)],
+        type: DYN,
+        loc,
+    };
+}
+/** A call through an evaluated callee value: checked-dynamic callees,
+ * function unions, typed-rest and runtime-arity closures. */
+function lowerCallThroughValue(lowerer, expr, callee, loc) {
     // A CHECKED-DYNAMIC callee — `fn(a, b)` where fn is an implicit-any
     // JS binding (the mustCall body's `fn(...args)`), a dyn capture, or a
     // keyed read off a dyn value: the dynCall boundary. Arguments convert
@@ -1917,6 +2048,20 @@ function lowerBigIntConstructorValue(lowerer, arg, loc) {
         return { kind: "libCall", fn: "bigint.parse", args: [arg], type: BIGINT_T, loc };
     if (arg.type.kind === "f64")
         return { kind: "libCall", fn: "bigint.fromF64", args: [arg], type: BIGINT_T, loc };
+    // Byte storage converts through ToPrimitive, which BigInt then parses: a
+    // typed array's text is its elements joined with "," (one element reads
+    // as that element, none as 0n, several throw the SyntaxError for the
+    // joined text), a Buffer's is its UTF-8 decoding and a DataView's is
+    // "[object DataView]". The runtime value tells them apart, as for String.
+    if (arg.type.kind === "bytes") {
+        const text = {
+            kind: "toString",
+            operand: { kind: "dynFrom", value: arg, type: DYN, loc },
+            type: STRING,
+            loc,
+        };
+        return { kind: "libCall", fn: "bigint.parse", args: [text], type: BIGINT_T, loc };
+    }
     if (arg.type.kind === "bool") {
         return {
             kind: "ternary",
@@ -1952,6 +2097,7 @@ function lowerBigIntConstructorValue(lowerer, arg, loc) {
             arm.kind === "string" ||
             arm.kind === "f64" ||
             arm.kind === "bool" ||
+            arm.kind === "bytes" ||
             isUnitType(arm)))
         return null;
     const key = `bigint.scalar:${unionId}`;
@@ -2989,6 +3135,15 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // 'unknown' slot does.
     if (checkerUntyped && DYN_HANDLE_KINDS.has(recv.type.kind))
         recv = lowerer.coerceToExpected(recv, DYN);
+    // A typed array whose checker type collapsed to `any` (a JS binding
+    // referenced in its own initializer's inference — hono's etag digest
+    // `const nextChunk = new Uint8Array(new ArrayBuffer(f(chunk)))` beside
+    // `chunk = nextChunk`) still lowered to its native bytes. The typed
+    // lowerings key on the checker type and decline it, so it boxes by
+    // reference (the box shares the native storage, so writes through the
+    // call stay visible) and the call dispatches on the runtime kind.
+    if (checkerUntyped && recv.type.kind === "bytes")
+        recv = lowerer.coerceToExpected(recv, DYN);
     // The last-resort retry (boxTypedTemporary — every other lowering
     // already declined): a checker-`any` receiver whose value is a FRESH
     // typed result of an earlier step in the chain (`out.split("\n")`
@@ -3108,17 +3263,21 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     if (access.name.text === "flatMap")
         return lowerDynArrayFlatMapCall(lowerer, call, access, recv);
     // String methods claim only names NO other dyn-representable kind's
-    // prototype declares (Array carries includes/indexOf/slice too): for
-    // these, "the receiver is a string, or the call throws V8's TypeError"
-    // IS Node's semantics for every possible dyn value. Shared names would
-    // need a receiver-kind dispatch — they keep the fence.
+    // prototype declares (Array carries includes/indexOf/slice too), so no
+    // other kind inherits them. Shared names would need a receiver-kind
+    // dispatch — they keep the fence.
     if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable) {
-        // An object-typed receiver the member is missing from (a JavaScript
-        // module object whose members are assigned in a function body,
-        // `common.repeat(" ", n)`) holds a string or an object with that
-        // member: dispatch on the receiver's runtime kind.
-        if (!checkerUntyped &&
-            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0 &&
+        // A checked-dynamic object can still carry its OWN member of that
+        // name: zod's schemas assign `trim`, `toLowerCase` and `startsWith`
+        // in their constructors (`z.string().trim().min(1)`), an object's
+        // prototype can define `trim`, and a JavaScript module object can
+        // assign `repeat` in a function body (`common.repeat(" ", n)`, an
+        // object-typed receiver the member is missing from). An untyped
+        // receiver, or a member the checker cannot type, dispatches on the
+        // receiver's runtime kind: a string runs the string lowering, anything
+        // else calls its member as Node does.
+        if ((checkerUntyped ||
+            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) &&
             !call.questionDotToken &&
             !access.questionDotToken &&
             !call.arguments.nodes.some(ts.isSpreadElement))
@@ -3142,7 +3301,12 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     }
     // The argument is a radix for bigint and an encoding for Buffer.
     // Preserve its runtime value so receiver dispatch can choose correctly.
-    if (access.name.text === "toString" && call.arguments.nodes.length <= 1) {
+    // An authored own `toString` member (zod's `errorUtil.toString`, which
+    // answers string | undefined) is an ordinary method call instead.
+    if (access.name.text === "toString" &&
+        call.arguments.nodes.length <= 1 &&
+        !ownCallable &&
+        !(checkerUntyped && jsAssignsOwnToString(lowerer, access.expression))) {
         const argument = call.arguments.nodes[0];
         return {
             kind: "libCall",
@@ -3244,11 +3408,17 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // The same holds when only the MEMBER is checker-untyped: TypeScript
     // importing chalk's JavaScript source types the default export as a
     // plain function, so `chalk.bold` reads as `any` on a typed receiver.
+    const ownToString = access.name.text === "toString" &&
+        checkerUntyped &&
+        jsAssignsOwnToString(lowerer, access.expression);
     const stringOnlyName = (checkerUntyped ||
         (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) &&
         !ownCallable &&
         DYN_STRING_PROTO_ONLY_NAMES.has(access.name.text);
-    if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable && !stringOnlyName)
+    if (DYN_PROTO_METHOD_NAMES.has(access.name.text) &&
+        !ownCallable &&
+        !ownToString &&
+        !stringOnlyName)
         return null;
     // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
     // machinery's short-circuit semantics — not modeled here yet.
@@ -3509,6 +3679,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "shift",
     "unshift",
     "slice",
+    "splice",
     "at",
     "indexOf",
     "lastIndexOf",
@@ -3650,6 +3821,9 @@ const DYN_DISPATCH_METHODS = new Set([
     "additionalHeaders",
     "altsvc",
     "origin",
+    // FinalizationRegistry's methods (scr_finalization_registry_new).
+    "register",
+    "unregister",
     // Worker and MessagePort methods use the owning context's handle adapter.
     "postMessage",
     "terminate",
@@ -3661,6 +3835,15 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
     if ((!DYN_DISPATCH_METHODS.has(method) && !isJsSourceFile(ts.getSourceFileOfNode(call))) ||
         lowerer.chainBlocked(call, access))
         return null;
+    // readable.compose lowers its stages from their syntax, so it needs the
+    // stream's class: a stream a JavaScript function returns untyped has none.
+    if (method === "compose") {
+        const recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+        if (recvT?.kind === "object" &&
+            streamSidesOf(lowerer, lowerer.classes.get(recvT.className)) !== null) {
+            lowerer.noLowering("readable.compose on a stream held as a checked-dynamic value", call, "type the stream where it comes from, such as a JSDoc @returns {Readable} on the function that returns it");
+        }
+    }
     if (call.arguments.nodes.some((arg) => ts.isSpreadElement(arg))) {
         const loc = locOf(call);
         const local = lowerer.declareHiddenLocal("%spreadReceiver", DYN);
@@ -4531,6 +4714,10 @@ function isSoleAbstractMethod(decl) {
     return !owner.members.nodes.some((member) => member !== decl && ts.isMethodDeclaration(member) && ts.getTextOfNode(member.name) === name);
 }
 function reconcileOverloadReturn(lowerer, expr, call) {
+    // The checker's overload is a guess for a checked-dynamic argument
+    // another overload accepts: the implementation's value stands.
+    if (ts.isCallExpression(expr) && dynamicOverloadChoice(lowerer, expr))
+        return call;
     const rsig = lowerer.checker.getResolvedSignature(expr);
     const rdecl = rsig ? rsig.declaration : undefined;
     // Nominal covariant overrides share the base's return ABI, but retain
@@ -5315,7 +5502,19 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             !(param.kind === "dyn" && (inner.kind === "void" || lowerer.dynConvertible(inner)))) {
             lowerer.unsupported("SC1090", call.arguments.nodes[0], `then handlers whose parameter is not the settled value's type (expected '${lowerer.fmt(inner)}', got '${lowerer.fmt(param)}')`);
         }
-        const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+        let resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+        // JavaScript whose declared result type has no mapping (zod's
+        // `Promise.all(items).then((r) => ParseStatus.mergeArray(status, r))`,
+        // typed by a .d.ts union): the handler's value settles the promise as
+        // a checked-dynamic value, checked where it is used.
+        if (resultT?.kind !== "promise" &&
+            isJsSourceFile(ts.getSourceFileOfNode(call)) &&
+            cb.type.kind === "func" &&
+            cb.type.ret.kind !== "promise" &&
+            cb.type.ret.kind !== "void" &&
+            (cb.type.ret.kind === "dyn" || lowerer.dynConvertible(cb.type.ret))) {
+            resultT = { kind: "promise", inner: DYN };
+        }
         if (resultT?.kind !== "promise") {
             lowerer.noLowering("then with this handler's result type", call, "the combined result must be a representable promise");
         }
@@ -5790,6 +5989,13 @@ export function lowerFilterNarrowCall(lowerer, call, access) {
     const narrowed = outElem !== null && !typeEquals(outElem, elem);
     if (!narrowed && !isBooleanArg)
         return null;
+    // A written predicate (`(p): p is Cat => ...`, a guard function value)
+    // proves nothing at run time: the generic array HOF path filters the
+    // receiver's elements and converts the kept ones checked
+    // (filterResultElem).
+    if (!isBooleanArg &&
+        ((!ts.isArrowFunction(argNode) && !ts.isFunctionExpression(argNode)) || argNode.type))
+        return null;
     const annotateEscape = "keep the receiver's element type instead — annotate the callback's return ': boolean' " +
         "(the checker then skips the predicate) or annotate the result with the receiver's own " +
         "element type — and narrow the elements after";
@@ -5799,6 +6005,10 @@ export function lowerFilterNarrowCall(lowerer, call, access) {
             lowerer.badType(call, callT); // defensive: a narrowed non-union receiver
         }
         tag = lowerer.armTag(elem.unionId, outElem);
+        // Several kept arms: the generic path converts the kept elements to
+        // the narrower union (filterResultElem).
+        if (tag < 0 && !isBooleanArg)
+            return null;
         if (tag < 0) {
             lowerer.unsupported("SC1090", call, `'.filter' narrowing '${lowerer.fmt(elem)}' elements to the multi-arm '${lowerer.fmt(outElem)}' ` +
                 `(only a SINGLE arm re-tags — ${annotateEscape})`);
@@ -5815,17 +6025,8 @@ export function lowerFilterNarrowCall(lowerer, call, access) {
         const helper = filterNarrowHelper(lowerer, "truthy", elem, outElem ?? elem, tag, loc);
         return { kind: "call", callee: helper, args: [receiver], type: arrayOf(outElem ?? elem), loc };
     }
-    // Inferred type predicate: inline function literal, NO return
-    // annotation (a written one is an unchecked assertion), and the
-    // checker reports a predicate over parameter 0.
-    if (!ts.isArrowFunction(argNode) && !ts.isFunctionExpression(argNode)) {
-        lowerer.unsupported("SC1090", argNode, `narrowing '.filter' through a callback VALUE ` +
-            `(only an inline callback whose predicate the checker inferred can re-tag — ${annotateEscape})`);
-    }
-    if (argNode.type) {
-        lowerer.unsupported("SC1090", argNode, `narrowing '.filter' with a hand-written type predicate ` +
-            `(a written 'x is T' is an unchecked assertion nothing validates at runtime — ${annotateEscape})`);
-    }
+    // An inferred type predicate: an inline function literal with no return
+    // annotation, over parameter 0 (written predicates returned above).
     // The receiver evaluates FIRST, in the enclosing function, like JS.
     const receiver = lowerer.lowerExpr(access.expression);
     const fnArg = lowerer.lowerExpr(argNode);
@@ -6103,8 +6304,10 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
                     loc,
                 },
             ];
-            const order = current.declaredOrder ?? current.fields.map((f) => f.name);
-            for (const name of order) {
+            // One walk per key order (see perKeyOrder).
+            const orders = shapeKeyOrders(current);
+            const walks = orders.map(() => []);
+            for (const [k, name] of orders.flatMap((order, k) => order.map((name) => [k, name]))) {
                 const f = current.fields.find((x) => x.name === name);
                 const pushStmt = {
                     kind: "exprStmt",
@@ -6121,10 +6324,11 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
                 // Fields that can be absent push behind their presence test (the
                 // key exists exactly when Object.keys would list it).
                 const present = lowerer.recordFieldPresent(ref, argIr.shapeId, f.name, loc);
-                body.push(present.kind === "recordHas"
+                walks[k].push(present.kind === "recordHas"
                     ? { kind: "if", cond: present, then: [pushStmt], else_: null, loc }
                     : pushStmt);
             }
+            body.push(...perKeyOrder(current, ref, walks, loc));
             body.push({ kind: "return", value: outRef, loc });
             fn.body = body;
         };
@@ -6140,7 +6344,7 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
  * (a key is own exactly when Object.keys would list it — the two share
  * the test), everything else true. Unmatched keys probe the overflow
  * map when present, so explicit undefined values remain own keys. */
-function recordHasOwnHelper(lowerer, shapeId, loc) {
+export function recordHasOwnHelper(lowerer, shapeId, loc) {
     const key = `obj.hasOwn:${shapeId}`;
     const existing = lowerer.arrHofHelpers.get(key);
     if (existing)
@@ -7107,6 +7311,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 ...(fnName !== null ? { fnName } : {}),
             };
         }
+        // A class value (`Object.defineProperty(Definition, "name", { value })`)
+        // boxes to its constructor function, whose own-property table holds the
+        // definition for every alias of the class.
+        if (target?.type.kind === "classval" && lowerer.dynConvertible(target.type)) {
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments.nodes[0]) };
+        }
         const descriptorPrimitive = member === "getOwnPropertyDescriptor" &&
             target &&
             (target.type.kind === "bool" || target.type.kind === "f64" || target.type.kind === "string");
@@ -7215,6 +7425,22 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const fnIntegrity = functionIntegrity(lowerer, member, value, call.arguments.nodes[0], locOf(call));
         if (fnIntegrity)
             return fnIntegrity;
+        // A Map or Set has no own properties: freeze, seal and preventExtensions
+        // all only make it not extensible.
+        if (value.type.kind === "map" || value.type.kind === "set") {
+            if (member === "preventExtensions" || member === "seal")
+                return lowerNativeFreeze(lowerer, "collection.preventExtensions", value, locOf(call));
+            const extensible = {
+                kind: "libCall",
+                fn: "collection.isExtensible",
+                args: [value],
+                type: BOOL,
+                loc: locOf(call),
+            };
+            return member === "isExtensible"
+                ? extensible
+                : { kind: "unary", op: "!", operand: extensible, type: BOOL, loc: locOf(call) };
+        }
         if (member === "preventExtensions" || member === "seal") {
             const integrity = lowerClassIntegrity(lowerer, call, member, value);
             if (integrity)
@@ -7251,10 +7477,42 @@ function lowerObjectStaticCall(lowerer, call, access) {
     // the argument — no alias exists, so the frozen bit is unobservable
     // (writes through the Readonly<T> result are compile errors, and no
     // other reference can write). Primitives pass through per ES2015.
-    // Aliased objects keep a fence: a later write through the original
-    // reference would need the runtime frozen bit (strict mode throws).
+    // Aliased records get the frozen bit of their rc word (frozen-records.ts);
+    // other aliased objects keep a fence: a later write through the original
+    // reference would need a runtime frozen bit (strict mode throws).
     if (member === "isFrozen" && call.arguments.nodes.length === 1) {
-        const value = lowerer.lowerExprExpecting(call.arguments.nodes[0], DYN);
+        const argNode = call.arguments.nodes[0];
+        const probedKind = tryLowerExpression(lowerer, argNode)?.type.kind;
+        if (probedKind === "record" ||
+            probedKind === "array" ||
+            probedKind === "map" ||
+            probedKind === "set") {
+            const native = lowerer.lowerExpr(argNode);
+            const loc = locOf(call);
+            if (native.type.kind === "record" || native.type.kind === "array")
+                return {
+                    kind: "libCall",
+                    fn: native.type.kind === "record" ? "record.isFrozen" : "array.isFrozen",
+                    args: [native],
+                    type: BOOL,
+                    loc,
+                };
+            if (native.type.kind === "map" || native.type.kind === "set")
+                return {
+                    kind: "unary",
+                    op: "!",
+                    operand: {
+                        kind: "libCall",
+                        fn: "collection.isExtensible",
+                        args: [native],
+                        type: BOOL,
+                        loc,
+                    },
+                    type: BOOL,
+                    loc,
+                };
+        }
+        const value = lowerer.lowerExprExpecting(argNode, DYN);
         return { kind: "libCall", fn: "dyn.isFrozen", args: [value], type: BOOL, loc: locOf(call) };
     }
     if (member === "freeze") {
@@ -7298,6 +7556,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const integrity = lowerClassIntegrity(lowerer, call, "freeze", value);
         if (integrity)
             return integrity;
+        if (freezableRecordType(lowerer, value.type))
+            return lowerNativeFreeze(lowerer, "record.freeze", value, locOf(call));
+        if (value.type.kind === "array")
+            return lowerNativeFreeze(lowerer, "array.freeze", value, locOf(call));
+        if (value.type.kind === "map" || value.type.kind === "set")
+            return lowerNativeFreeze(lowerer, "collection.preventExtensions", value, locOf(call));
         lowerer.noLowering("Object.freeze of a possibly-aliased value", call, "freeze of a FRESH object/array literal (and of primitives) compiles — frozen-ness is unobservable there; an aliased target's later writes would need the runtime frozen bit");
     }
     // `Object.hasOwn(r, k)` over a RECORD receiver: a record's own-key set
@@ -7418,12 +7682,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
             const moduleSymbol = source ? lowerer.checker.getSymbolAtLocation(source) : undefined;
             const names = [];
             moduleSymbol?.getExports().forEach((symbol, key) => {
+                // Internal names (`__export`) start with `__`; an exported name that
+                // does is keyed with an extra `_` (escapedSymbolName).
                 const name = String(key);
-                if (name.startsWith("__") || name === "export=")
+                if ((name.startsWith("__") && !name.startsWith("___")) || name === "export=")
                     return;
                 const target = symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
                 if (target.flags & ts.SymbolFlags.Value)
-                    names.push(name);
+                    names.push(ts.symbolName(symbol));
             });
             names.sort();
             const loc = locOf(call);
@@ -7465,10 +7731,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const isJsUnion = probed?.type.kind === "union" &&
             isJsSourceFile(ts.getSourceFileOfNode(call)) &&
             lowerer.dynConvertible(probed.type);
+        // An array walks its live view: the present indices, then its numeric
+        // and named properties.
+        const isArray = probed?.type.kind === "array" && lowerer.dynConvertible(probed.type);
         if (isDyn ||
             isPrimitive ||
             isFunction ||
             isJsUnion ||
+            isArray ||
             (probed && isDynTypedRefType(probed.type))) {
             const fn = member === "keys"
                 ? "dyn.objKeys"
@@ -7477,7 +7747,13 @@ function lowerObjectStaticCall(lowerer, call, access) {
                     : "dyn.objEntries";
             let v = lowerer.lowerExpr(argNode);
             if (v.type.kind !== "dyn")
-                v = { kind: "dynFrom", value: v, type: DYN, loc: locOf(call) };
+                v = {
+                    kind: "dynFrom",
+                    value: v,
+                    ...(isArray ? { liveRef: true } : {}),
+                    type: DYN,
+                    loc: locOf(call),
+                };
             // In TypeScript the keys come back as a native string[] and the
             // entries as a native [string, any][]: the checker keeps every later
             // write to the arrays well typed. JavaScript may store anything into
@@ -7640,8 +7916,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
                     loc,
                 },
             ];
-            const order = current.declaredOrder ?? current.fields.map((f) => f.name);
-            for (const name of order) {
+            // One walk per key order (see perKeyOrder).
+            const orders = shapeKeyOrders(current);
+            const walks = orders.map(() => []);
+            for (const [k, name] of orders.flatMap((order, k) => order.map((name) => [k, name]))) {
                 const f = current.fields.find((x) => x.name === name);
                 const raw = {
                     kind: "recordGet",
@@ -7796,8 +8074,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         loc,
                     };
                 }
-                body.push(stmt);
+                walks[k].push(stmt);
             }
+            body.push(...perKeyOrder(current, ref, walks, loc));
             body.push({ kind: "return", value: outRef, loc });
             fn.body = body;
         };
@@ -8032,7 +8311,17 @@ export function lowerRecordFieldCall(lowerer, call, access) {
     // A HYBRID (function-with-properties) field is callable through its
     // reserved %call slot — `colors.blue("x")` where blue also carries
     // `.bold` (the chalk shape).
-    if (callee.type.kind === "record")
+    if (callee.type.kind === "object" && !init) {
+        const direct = callableInstanceStringCall(lowerer, call, callee, loc);
+        if (direct)
+            return direct;
+        // Other argument counts call the %call closure through its value, as
+        // a call on the builder itself does (`theme.error("a", "b")`).
+        const closure = lowerer.hybridCallUnwrap(callee);
+        if (closure !== callee)
+            return lowerCallThroughValue(lowerer, call, closure, loc);
+    }
+    if (callee.type.kind === "record" || callee.type.kind === "object")
         callee = lowerer.hybridCallUnwrap(callee);
     // Inferred JavaScript option records can retain checked callables in
     // fields even when the checker only describes those members as any.
@@ -8608,7 +8897,9 @@ export function lowerObjectMethodCall(lowerer, call, access) {
     // so both guards would pass an emitter-named call).
     if (info &&
         !found &&
-        (STREAM_API_MEMBERS.has(access.name.text) || STREAM_OPERATORS.has(access.name.text)) &&
+        (STREAM_API_MEMBERS.has(access.name.text) ||
+            STREAM_OPERATORS.has(access.name.text) ||
+            access.name.text === "compose") &&
         streamSidesOf(lowerer, info) !== null) {
         const stream = lowerStreamMethodCall(lowerer, call, access, info);
         if (stream)
@@ -8809,7 +9100,23 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 type: found.sig.ret,
                 loc,
             };
-        const result = classCallbackCall(lowerer, value, method, call.arguments.nodes, fallback, loc, ts.getTextOfNode(access));
+        // The declaring class's original value, built with the observed slot.
+        // An override below (a virtual call) keeps the dynamic call: a slot
+        // reassigned to an ancestor's method must not reach the override. So do
+        // methods declared in unchecked JavaScript, whose results are inferred,
+        // and calls with a spread argument: the dynamic call drains the spread
+        // through the iterator's current `next`, which may be a replacement.
+        const declarerFile = found.declarer.decl ? ts.getSourceFileOfNode(found.declarer.decl) : null;
+        const original = virtual ||
+            call.arguments.nodes.some(ts.isSpreadElement) ||
+            !declarerFile ||
+            (isJsSourceFile(declarerFile) && !lowerer.checkedJsFile(declarerFile))
+            ? undefined
+            : {
+                originalId: () => found.declarer.prototypeOriginals?.get(method),
+                directCall: () => fallback,
+            };
+        const result = classCallbackCall(lowerer, value, method, call.arguments.nodes, fallback, loc, ts.getTextOfNode(access), original);
         return {
             kind: "seqExpr",
             stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }],
@@ -9541,4 +9848,115 @@ function fenceClassCopyIntoFreshObject(lowerer, call, srcNode, rawSource) {
         return;
     lowerer.unsupported("SC1090", srcNode, `Object.assign copying a '${lowerer.fmt(rawSource.type)}' instance into a fresh object typed as the class (the copy is a plain object holding the instance's own fields, not an instance — build the object literal from the fields you need)`);
 }
+/** True when an untyped JavaScript receiver names a binding whose declaring
+ * file assigns it an own `toString` (the TypeScript namespace downlevel
+ * `errorUtil.toString = (message) => ...` in zod): its calls answer what
+ * that function returns, not Object.prototype.toString's string. */
+function jsAssignsOwnToString(lowerer, receiver) {
+    if (!ts.isIdentifier(receiver))
+        return false;
+    const decl = bindingDeclaration(lowerer, receiver);
+    if (decl === undefined)
+        return false;
+    const sf = ts.getSourceFileOfNode(decl);
+    if (!isJsSourceFile(sf))
+        return false;
+    let targets = lowerer.ownToStringTargets.get(sf);
+    if (targets === undefined) {
+        targets = ownToStringTargets(lowerer, sf);
+        lowerer.ownToStringTargets.set(sf, targets);
+    }
+    return targets.has(decl);
+}
+const unparenthesized = (e) => {
+    let out = e;
+    while (ts.isParenthesizedExpression(out))
+        out = out.expression;
+    return out;
+};
+/** The declaration of the binding an identifier names, through imports. */
+function bindingDeclaration(lowerer, id) {
+    let sym = lowerer.checker.getSymbolAtLocation(id);
+    if (sym !== undefined && (sym.flags & ts.SymbolFlags.Alias) !== 0)
+        sym = lowerer.checker.getAliasedSymbol(sym);
+    return sym?.valueDeclaration ?? sym?.declarations?.[0];
+}
+/** The declarations of the bindings a file's assignments `x.toString = ...`
+ * (or `x["toString"] = ...`) give an own `toString`. An assignment through
+ * the parameter of an immediately called function counts for the binding
+ * the call passes (`(function (ns) { ns.toString = f; })(ns || (ns = {}))`). */
+function ownToStringTargets(lowerer, sf) {
+    const targets = new Set();
+    const visit = (node) => {
+        if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+            const left = unparenthesized(node.left);
+            const named = (ts.isPropertyAccessExpression(left) && left.name.text === "toString") ||
+                (ts.isElementAccessExpression(left) &&
+                    ts.isStringLiteralLike(left.argumentExpression) &&
+                    left.argumentExpression.text === "toString");
+            const target = named
+                ? unparenthesized(left.expression)
+                : undefined;
+            if (target !== undefined && ts.isIdentifier(target)) {
+                const decl = bindingDeclaration(lowerer, target);
+                if (decl !== undefined) {
+                    targets.add(decl);
+                    const passed = iifeArgumentDeclaration(lowerer, decl);
+                    if (passed !== undefined)
+                        targets.add(passed);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+    return targets;
+}
+/** For a parameter of an immediately called function, the declaration of
+ * the binding its argument names: `x`, `x || (x = {})` or `(x = {})`. */
+function iifeArgumentDeclaration(lowerer, param) {
+    if (!ts.isParameter(param))
+        return undefined;
+    const fn = param.parent;
+    if (!ts.isFunctionExpression(fn) && !ts.isArrowFunction(fn))
+        return undefined;
+    let callee = fn;
+    while (ts.isParenthesizedExpression(callee.parent))
+        callee = callee.parent;
+    const call = callee.parent;
+    if (!ts.isCallExpression(call) || call.expression !== callee)
+        return undefined;
+    const index = fn.parameters.nodes.indexOf(param);
+    let arg = index < 0 ? undefined : call.arguments.nodes[index];
+    if (arg === undefined)
+        return undefined;
+    arg = unparenthesized(arg);
+    if (ts.isBinaryExpression(arg) && arg.operatorToken.kind === ts.SyntaxKind.BarBarToken)
+        arg = unparenthesized(arg.left);
+    if (ts.isBinaryExpression(arg) && arg.operatorToken.kind === ts.SyntaxKind.EqualsToken)
+        arg = unparenthesized(arg.left);
+    return ts.isIdentifier(arg) ? bindingDeclaration(lowerer, arg) : undefined;
+}
+/** The runtime calls package shims declare as bodiless functions. */
+const SHIM_INTRINSICS = new Map([
+    ["scriptcUnixDgramSocket", { fn: "dgram.unixSocket", args: [], ret: F64 }],
+    ["scriptcUnixDgramConnect", { fn: "dgram.unixConnect", args: [F64, STRING], ret: F64 }],
+    ["scriptcUnixDgramSend", { fn: "dgram.unixSend", args: [F64, BYTES_U8], ret: F64 }],
+    ["scriptcUnixDgramClose", { fn: "dgram.unixClose", args: [F64], ret: F64 }],
+    ["scriptcResponseLight", { fn: "fetch.responseLight", args: [DYN], ret: arrayOf(STRING) }],
+]);
+function lowerShimIntrinsicCall(lowerer, expr, callee, loc) {
+    const intrinsic = SHIM_INTRINSICS.get(callee.text);
+    if (intrinsic === undefined)
+        return null;
+    const decl = lowerer.checker.getSymbolAtLocation(callee)?.valueDeclaration;
+    if (decl === undefined ||
+        !ts.isFunctionDeclaration(decl) ||
+        decl.body ||
+        !isPackageShimFile(ts.getSourceFileOfNode(decl).fileName) ||
+        expr.arguments.nodes.length !== intrinsic.args.length)
+        return null;
+    const args = expr.arguments.nodes.map((arg, i) => lowerer.lowerExprExpecting(arg, intrinsic.args[i]));
+    return { kind: "libCall", fn: intrinsic.fn, args, type: intrinsic.ret, loc };
+}
 //# sourceMappingURL=lower-calls.js.map