@scriptc/compiler 0.4.4 → 0.4.5

package/dist/frontend/lowering/lowerer.js

@@ -1,6 +1,6 @@
 import { isDeclBoundaryFile } from "../decl-projection.js";
 import { relieveHeapPressure } from "../../heap-pressure.js";
-import { moduleNamespaceObject } from "./module-namespace-elements.js";
+import { moduleNamespaceObject, moduleNamespaceValue } from "./module-namespace-elements.js";
 import { keyedHelperName } from "./stable-names.js";
 import { positionTag, StructuralPositions } from "./structural-positions.js";
 import { onlyForwarded, stripTypeWrappers } from "./typed-arguments.js";
@@ -35,6 +35,7 @@ import { discoverWasmModules } from "../../wasm/discover.js";
 import { encodeBase64 } from "../../wasm/base64.js";
 import { resolveRequireRuntime } from "../runtime-resolve.js";
 import { lowerKeyObjectCall } from "./builtins/key-object.js";
+import { lowerX509Call, refuseX509DynValues } from "./builtins/x509.js";
 import { isEcdhType, lowerEcdhCall } from "./builtins/ecdh.js";
 import { isDiffieHellmanType, lowerDiffieHellmanCall } from "./builtins/dh.js";
 import { fenceWebCryptoMember, lowerWebCryptoCall } from "./builtins/webcrypto.js";
@@ -71,7 +72,8 @@ import { InternalCompilerError } from "../../errors.js";
 import { defaultAfterUndefined, lowerStaticallyUndefinedArgument } from "./optional-arguments.js";
 import {} from "./class-protocol-dispatch.js";
 import { ClassDynamicDispatch, boxClassInstancesExactly, trackClassFieldCreation, } from "./class-dynamic-dispatch.js";
-import { guardClassAttributeWrites } from "./class-attributes.js";
+import { addUntypedIntegrityWords, guardClassAttributeWrites } from "./class-attributes.js";
+import { inferredCollectionType } from "./js-collection-types.js";
 import { guardFrozenWrites, markSloppyRecordWrites } from "./frozen-records.js";
 import { applyHandleProperties } from "./handle-properties.js";
 import { installBufferValue } from "./containers/bytes.js";
@@ -112,7 +114,7 @@ import { discriminantOwners, literalUnionArm } from "../union-discriminants.js";
 import { unsupportedAnyOperationDiag, blockedBindingUseDiag, checkerPanicDiag, componentTypeDiag, isCheckerPanic, genericSignatureTypeDiag, indexSignatureTypeDiag, intersectionTypeDiag, noLoweringDiag, overloadedSignatureTypeDiag, recordShapeMismatchDiag, unsupportedNativeApiDiag, unsupportedPackageValueDiag, unionMismatchDiag, UNSUPPORTED, unsupportedDiag, unsupportedTypeDiag, } from "../../diagnostics/diagnostic.js";
 import { arrayOf, BOOL, canAdaptDynFuncTo, canBoxFuncIntoDyn, canDynCheckTo, canConvertToDyn, DYN, DYN_HANDLE_KINDS, F64, isDynTypedRefType, isJsonSafeType, isJsonStringifySafeType, isPrimitiveCollectionKey, isSupportedMapKey, isSupportedMapValue, isUndefinedArmedUnion, isUnitType, NULL_T, RUNTIME_ERROR_CLASSES, STRING, typeEquals, UNDEFINED_T, VOID, } from "../../ir/ir.js";
 import { provenanceActive } from "../provenance-registry.js";
-import { ambientDtsPath, canonicalBuiltinModule, cjsExportAssignmentOf, cjsExportDiscardReason, fallbackDtsPath, isCheckedJsSourceFile, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isNodeEsmFile, isNodeTypesPath, locOf, orderedImportsOf, overridesDtsPath, npmStaticDepSf7, requireSpecOf, resolveImport, workspacePackageOfPath, } from "../program.js";
+import { ambientDtsPath, canonicalBuiltinModule, cjsExportAssignmentOf, cjsExportDiscardReason, cjsExportsAssignedInFunctions, cjsReexportedModules, cjsNamespaceExportNames, fallbackDtsPath, isCheckedJsSourceFile, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isNodeEsmFile, isNodeTypesPath, locOf, orderedImportsOf, overridesDtsPath, npmStaticDepSf7, requireSpecOf, resolveImport, workspacePackageOfPath, } from "../program.js";
 import { containsRecord, containsUnion, describeComponentBlocker, describeRecordMemberBlocker, erasedOverloadMemberType, formatIrType, FETCH_AMBIENT_TYPES, isOsConstantsSymbol, isOverloadedCallableMemberType, isUnitOnlyTsType, isWorkerHandleType, isFetchHandleType, jsOpenObjectType, mapType, ShapeRegistry, typeKey, UnionRegistry, withUndefinedArm as withUndefinedArmCanonical, } from "../type-mapper.js";
 import { builtinConstLit, builtinModuleConstOf, builtinModulesArrayLit, builtinFenceHintOf, builtinModuleFnOf, stdlibMemberFence, isStdlibMember, isStdlibSymbol, isStdlibGlobal, stdlibGlobalNameOf, stdlibGlobalMember, nodeTypesOnlySymbol, } from "./surfaces.js";
 import { builtinClassAliasOf, runtimeClassValueOfType, } from "./builtins/class-values.js";
@@ -122,7 +124,7 @@ import { cjsNamespaceModule, cjsWholeExportValueOf, inlineNamespaceRequireOf, in
 import { tscInteropModuleOf } from "./cjs-tsc-interop.js";
 import { usesCjsExportsIdentity } from "./cjs-exports-object.js";
 import { registerBuiltinEventTargetClasses } from "./lower-event-target.js";
-import { registerBuiltinErrorClasses, defineClassValueConstruct, runtimeClassConstructs, registerBuiltinEmitterClass, registerBuiltinStreamClasses, builtinErrorInfoOf, builtinEmitterInfoOf, builtinStreamInfoOf, analyzeClassDecoration, classIteratorDrainCall, classIteratorNextCall, classIteratorOf, classIteratorOpenCall, classIteratorRestDrainCall, classMemberNameOf, classValueRef, collectClassShape, exactClassOfReceiver, collectClassShapeInner, ctorAbiEquals, findMethodOn, findStaticOn, genericClassInstanceType, isSubclassOf, inHierarchy, overrideBelow, staticShadowBelow, upcastTo, lowerClassMembers, lowerClassCtor, lowerClassExpression, lowerClassExpressionInfo, lowerClassMethodMember, lowerClassValueProperty, lowerStaticMethod, throwingSetterFn, fieldInitStmts, lowerStaticFieldInits, lowerStaticFieldRead, lowerDerivedCtorBody, superCallStmt, lowerSuperMethodCall, superThisRef, lowerSuperAccessorRead, lowerSuperAccessorWrite, inheritsBuiltinErrorCtor, inheritsBuiltinEmitterCtor, errorConstructorArgs, lowerNew, accessorCall, } from "./lower-classes.js";
+import { registerBuiltinErrorClasses, defineClassValueConstruct, runtimeClassConstructs, registerBuiltinEmitterClass, registerBuiltinStreamClasses, builtinErrorInfoOf, builtinEmitterInfoOf, builtinStreamInfoOf, analyzeClassDecoration, classIteratorDrainCall, classIteratorMethodCall, classIteratorNextCall, classIteratorNextRead, classIteratorOf, classIteratorOpenCall, classIteratorRestDrainCall, classMemberNameOf, classValueRef, collectClassShape, exactClassOfReceiver, collectClassShapeInner, ctorAbiEquals, findMethodOn, findStaticOn, genericClassInstanceType, isSubclassOf, inHierarchy, overrideBelow, staticShadowBelow, upcastTo, lowerClassMembers, lowerClassCtor, lowerClassExpression, lowerClassExpressionInfo, lowerClassMethodMember, lowerClassValueProperty, lowerStaticMethod, throwingSetterFn, fieldInitStmts, lowerStaticFieldInits, lowerStaticFieldRead, lowerDerivedCtorBody, superCallStmt, lowerSuperMethodCall, superThisRef, lowerSuperAccessorRead, lowerSuperAccessorWrite, inheritsBuiltinErrorCtor, inheritsBuiltinEmitterCtor, errorConstructorArgs, lowerNew, accessorCall, } from "./lower-classes.js";
 import { mixinCallClassInfoOf, mixinIntersectionInstanceType, } from "./lower-mixins.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { funcTypeFromParamShapes, isThisParameter, paramShape, paramShapes, checkDefaultParamBodyType, requireExactArityValue, collectSignature, collectSignatureInner, lambdaSignature, } from "./call-signatures.js";
@@ -176,7 +178,7 @@ import { fenceFetchObjectAssignment, fenceFetchObjectBinding, fenceStaticAbortCo
 import { lowerHttpHeadersElement, lowerNetModuleCall, lowerServerMethodCall, lowerServerProperty, lowerTlsRootCertificates, } from "./lower-server.js";
 import { lowerDgramDnsModuleCall, lowerDgramMethodCall } from "./lower-dgram.js";
 import { lowerNodeTestModuleCall, lowerTestDirectCall, lowerTestMethodCall, lowerTestCtxProperty, } from "./lower-test.js";
-import { lowerAssertModuleCall, lowerAssertDirectCall } from "./lower-assert.js";
+import { assertFunctionValue, lowerAssertModuleCall, lowerAssertDirectCall, } from "./lower-assert.js";
 import { lowerUtilModuleCall } from "./lower-inspect.js";
 import { lowerSystemErrorMapValue } from "./lower-system-errors.js";
 import { lowerComptime, comptimeBakeable, rejectComptimeCaptures, comptimeValueToIr, } from "./lower-comptime.js";
@@ -1584,6 +1586,9 @@ export class Lowerer {
      * Date's time value instead of a Date object (date-values.ts). */
     timeValueDateDecisions = new Map();
     timeValueDateLocals = new Set();
+    /** Declarations of those locals that a setter call writes
+     * (date-values.ts). */
+    timeValueDateWrites = new Set();
     /** Record bindings whose flow class reaches storage outside the class:
      * they keep the declared layout, so an initializer from unchecked reads
      * converts once instead of the binding adopting the widened variant. */
@@ -1592,6 +1597,9 @@ export class Lowerer {
      * every name destructured from a present source optional. */
     runtimeOptionalPatternTypes = new Map();
     runtimeOptionalReduceTypes = new Map();
+    /** Each function declaration's `arguments.length` count slot, or null
+     * (argument-counts.ts argumentCountSlot). */
+    argumentCountSlots = new Map();
     /** Non-null assertions whose value is forwarded into a slot promoted to
      * hold undefined. `x!` has no runtime effect, so these keep the stored
      * undefined state instead of trapping before any dereference. */
@@ -2031,6 +2039,9 @@ export class Lowerer {
     /** Parameters read as `any` in the error-path copy of an error-first
      * callback. */
     anySymbols = new Set();
+    /** The collection types that uses prove for untyped JavaScript bindings,
+     * by every identifier naming one (js-collection-types.ts). */
+    inferredCollectionTypes = undefined;
     /** overload-choice's answers per call, binding and function. */
     dynamicOverloadAnswers = new Map();
     /** Error parameters of an error-first callback with a known value in
@@ -2178,6 +2189,9 @@ export class Lowerer {
     builtinCallableValueFns = new Map();
     /** Each builtin function-value adapter's Node name, for boxed values. */
     builtinCallableValueNames = new Map();
+    /** Builtin function values whose `length` differs from their adapter's
+     * parameter count (BuiltinModuleFn.valueLength), by adapter name. */
+    builtinCallableValueLengths = new Map();
     /** Optional-chain lowering state. While a chain body lowers, the guarded
      * receiver NODE reads as a chainRecv (typed by the narrowed arm) instead
      * of re-lowering, its checker type reads non-nullish (typeOf), and the
@@ -2316,6 +2330,11 @@ export class Lowerer {
      * (builtins/fs-paths.ts): each lowers to the hidden local that holds its
      * value, which is null until the path's lowering has saved it. */
     stagedArguments = new Map();
+    /** Closure arguments an implicit-any call already lowered to learn their
+     * type (storedImplicitArgumentType), by node: the argument's own lowering
+     * in the same function and with the same type bindings takes that value
+     * once instead of lowering the closure again. */
+    speculatedClosures = new Map();
     /** What each fs path argument of a URL-path call lowers to (the plans
      * of builtins/fs-paths.ts). */
     fsPathPlans = new Map();
@@ -2442,6 +2461,9 @@ export class Lowerer {
     recordFieldDeletes = new Set();
     /** typeKeys of the array types the program may freeze (IrModule.freezableArrays). */
     freezableArrays = new Set();
+    /** Whether the program freezes, seals or prevents extensions of untyped
+     * values other than fresh literals (noteUntypedIntegrity). */
+    untypedIntegrity = false;
     liftedFns = [];
     /** The first lifted function of each name (liftedFnNamed), for the
      * liftedFns indexed so far. liftedFns only grows. */
@@ -2844,9 +2866,7 @@ export class Lowerer {
      * that comes back through a boundary cast keeps its identity. */
     declBoundaryMemo = null;
     get declBoundary() {
-        this.declBoundaryMemo ??= this.program
-            .getSourceFiles()
-            .some((sf) => isDeclBoundaryFile(sf.fileName));
+        this.declBoundaryMemo ??= this.program.getSourceFileNames().some(isDeclBoundaryFile);
         return this.declBoundaryMemo;
     }
     /** Tracked classes' bag initializers over a typed `this`
@@ -2889,7 +2909,7 @@ export class Lowerer {
             positionOf: (node) => this.positions.of(node),
             shapes: this.shapes,
             unions: this.unions,
-            classNamer: this.classNamer,
+            classNamer: (decl) => this.classNamer(decl),
             resolveTypeParam: this.typeParamResolver,
             resolveTypeParamTs: this.typeParamTsResolver,
             isErasing: () => this.erasingDepth > 0,
@@ -2953,8 +2973,8 @@ export class Lowerer {
             },
             mixinIntersectionInstance: (widened) => mixinIntersectionInstanceType(this, widened),
             classImplementedProtocol: (type) => this.classImplementedProtocol(type),
-            isStdlibFile: this.isStdlibFile,
-            isNpmFile: this.isNpmFile,
+            isStdlibFile: (sf) => this.isStdlibFile(sf),
+            isNpmFile: (sf) => this.isNpmFile(sf),
             // The declaration-typed boundary's generated types (decl-projection.ts)
             // describe data, like an explicitly mapped external type surface.
             isExternalTypeFile: (sf) => this.externalTypeSpecifiersByFile.has(tsgoPath(resolve(sf.fileName))) ||
@@ -3018,7 +3038,8 @@ export class Lowerer {
     /** Declared class fields may store a DYN value only when its static type
      * is `unknown` or `object` (also with `null` or `undefined`, or an array
      * of those), names checked protocol identity, is an owned runtime
-     * handle (a Worker or MessagePort, a fetch Headers/Request/Response, or
+     * handle (a Worker or MessagePort, a fetch Headers/Request/Response or
+     * AbortController/AbortSignal, or
      * a node:crypto ECDH, DiffieHellman or DiffieHellmanGroup), or is a
      * WeakMap/WeakSet (native weak collections live in checked-dynamic
      * storage, as locals of those types do); `any` fields stay refused. */
@@ -3086,6 +3107,35 @@ export class Lowerer {
         }
         return null;
     }
+    /** For each CommonJS module read through a JavaScript namespace import:
+     * the property names of Node's namespace object
+     * (cjsNamespaceExportNames), and the exports the module assigns inside
+     * functions, which the namespace does not see
+     * (cjsExportsAssignedInFunctions). */
+    cjsNamespaces = new Map();
+    cjsNamespaceOf(dep) {
+        let namespace = this.cjsNamespaces.get(dep);
+        if (namespace === undefined) {
+            // A re-exported name reads the module that assigns it, so the writes
+            // after evaluation of every re-exported module count too.
+            let assignedLater = new Set();
+            for (const mod of cjsReexportedModules(this.program, dep)) {
+                const later = cjsExportsAssignedInFunctions(mod);
+                if (later === "all") {
+                    assignedLater = "all";
+                    break;
+                }
+                for (const name of later)
+                    assignedLater.add(name);
+            }
+            namespace = {
+                names: cjsNamespaceExportNames(this.program, dep),
+                assignedLater,
+            };
+            this.cjsNamespaces.set(dep, namespace);
+        }
+        return namespace;
+    }
     sourceFileOfModuleNamespace(type) {
         if (type.kind !== "moduleNs" || !type.moduleId.startsWith("file:"))
             return null;
@@ -5591,6 +5641,23 @@ export class Lowerer {
                 });
             return keys;
         };
+        // `t[i]!` on a typed array, stored into an array, keeps an invalid
+        // index's undefined (assertedReadObservesUndefined): `!` performs no
+        // runtime check. A read whose consumers treat undefined like NaN stores
+        // NaN instead.
+        const assertedReadMayBeUndefined = (node) => {
+            let e = node;
+            while (ts.isParenthesizedExpression(e))
+                e = e.expression;
+            if (!ts.isNonNullExpression(e))
+                return false;
+            let read = e.expression;
+            while (ts.isParenthesizedExpression(read))
+                read = read.expression;
+            return (ts.isElementAccessExpression(read) &&
+                this.mapTypeOf(this.typeOf(read.expression))?.kind === "bytes" &&
+                !nanCoded.isNumericRead(read));
+        };
         const elementStates = new ArrayElementStates({
             elementAdmitsUndefined: (key) => {
                 siteDependencies?.read(key);
@@ -5601,9 +5668,16 @@ export class Lowerer {
             arrayKeys: arrayKeysOf,
             mayBeUndefined: (node) => {
                 if (explicitlyNonNull(node))
-                    return false;
+                    return assertedReadMayBeUndefined(node);
                 if (mayBeOptional(node))
                     return true;
+                // A value the checker types as possibly undefined: `(T | undefined)[]`
+                // stores T elements (the type mapper), so its undefined values are
+                // facts of T's arrays.
+                const checked = typeOrNull(node);
+                if (checked !== null &&
+                    (checked.isUnionType() ? ts.constituentTypes(checked) : [checked]).some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0))
+                    return true;
                 // `undefined as unknown as T` keeps the undefined value.
                 for (let inner = node; ts.isParenthesizedExpression(inner) ||
                     ts.isAsExpression(inner) ||
@@ -5620,7 +5694,37 @@ export class Lowerer {
                 const symbol = symbolOf(e);
                 return symbol !== null && iterationSymbols.has(symbol) && !provenPresent(e, symbol);
             },
-            callbackReturnsUndefined: (node) => callbackReturnsOptional(node),
+            iterationMayYieldUndefined: (node) => {
+                const type = typeOrNull(node);
+                if (type === null || this.checker.isArrayType(type))
+                    return false;
+                // A tuple yields its elements, in order.
+                if (this.checker.isTupleType(type))
+                    return panicSafe(() => this.checker
+                        .getTypeArguments(type)
+                        .some((element) => (element.isUnionType() ? ts.constituentTypes(element) : [element]).some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0)), true);
+                // The first type argument of Set<T>, Map and Set iterators,
+                // generators and iterables is the value they yield.
+                const element = (type.flags & ts.TypeFlags.Object) !== 0
+                    ? panicSafe(() => this.checker.getTypeArguments(type)[0], undefined)
+                    : undefined;
+                if (element === undefined)
+                    return false;
+                return (element.isUnionType() ? ts.constituentTypes(element) : [element]).some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0);
+            },
+            callbackReturnsUndefined: (node) => {
+                if (callbackReturnsOptional(node))
+                    return true;
+                // A callback the checker types as possibly returning undefined
+                // (`(m) => map.get(m)`): its results are present undefined
+                // elements of a `(T | undefined)[]`, which stores T elements.
+                const type = typeOrNull(node);
+                return (type !== null &&
+                    this.checker.getCallSignatures(type).some((signature) => {
+                        const result = this.checker.getReturnTypeOfSignature(signature);
+                        return (result.isUnionType() ? ts.constituentTypes(result) : [result]).some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0);
+                    }));
+            },
             isGlobal: (node, name) => this.isStdlibGlobal(node, name),
             isString: (node) => {
                 const type = typeOrNull(node);
@@ -5648,6 +5752,15 @@ export class Lowerer {
                 const rest = sig.params.find((shape) => shape.mode === "rest");
                 return rest?.type.kind === "array" ? [typeKey(rest.type.elem)] : [];
             },
+            restStart: (call) => {
+                const callee = peel(call.expression);
+                if (!ts.isIdentifier(callee) && !ts.isPropertyAccessExpression(callee))
+                    return null;
+                const symbol = callableSymbolOf(callee);
+                const sig = symbol ? signatureBySymbol.get(symbol) : undefined;
+                const at = sig ? sig.params.findIndex((shape) => shape.mode === "rest") : -1;
+                return at >= 0 ? at : null;
+            },
             markIterationBinding: (node, known) => {
                 const symbol = symbolOf(node);
                 if (!symbol)
@@ -5684,6 +5797,7 @@ export class Lowerer {
             if (cached !== undefined)
                 return cached;
             const nodes = [];
+            const values = [];
             ts.walkPreorder(sf, (node) => {
                 if (ts.isVariableDeclaration(node) ||
                     (ts.isParameter(node) && ts.isObjectBindingPattern(node.name)) ||
@@ -5697,7 +5811,19 @@ export class Lowerer {
                     ts.isPrefixUnaryExpression(node) ||
                     ts.isPostfixUnaryExpression(node))
                     nodes.push(node);
+                // The values these sites store, whose checker types mayBeUndefined
+                // reads: batched here, since dead bodies are scanned too.
+                if (ts.isArrayLiteralExpression(node))
+                    for (const element of node.elements.nodes)
+                        values.push(ts.isSpreadElement(element) ? element.expression : element);
+                else if (ts.isCallExpression(node) || ts.isNewExpression(node))
+                    for (const arg of node.arguments?.nodes ?? [])
+                        values.push(ts.isSpreadElement(arg) ? arg.expression : arg);
+                else if (ts.isBinaryExpression(node) &&
+                    node.operatorToken.kind === ts.SyntaxKind.EqualsToken)
+                    values.push(node.right);
             });
+            this.checker.prefetchCollectionTypes(values);
             scanSites.set(sf, nodes);
             return nodes;
         };
@@ -6875,6 +7001,7 @@ export class Lowerer {
         finalizePrivateBrands(this, functions);
         trackClassFieldCreation(this, functions);
         boxClassInstancesExactly(this, functions);
+        addUntypedIntegrityWords(this);
         guardClassAttributeWrites(this, functions);
         guardFrozenWrites(this, functions);
         applyHandleProperties(this, functions);
@@ -6967,6 +7094,7 @@ export class Lowerer {
         // every producer and consumer agrees. Programs with no unregistered
         // reference are untouched — byte-stability holds.
         checkRequireBindingAccesses(this, functions);
+        refuseX509DynValues(this, functions);
         const module = this.diags.length > 0
             ? null
             : {
@@ -6987,6 +7115,7 @@ export class Lowerer {
                 ...(this.freezableArrays.size > 0
                     ? { freezableArrays: [...this.freezableArrays].sort() }
                     : {}),
+                ...(this.untypedIntegrity ? { untypedIntegrity: true } : {}),
                 ...(isNodeEsmFile(this.entry, this.program) ? {} : { commonJsEntry: true }),
                 ...(this.ffiImports.length > 0 ? { ffiImports: [...this.ffiImports] } : {}),
             };
@@ -7171,9 +7300,28 @@ export class Lowerer {
         // retained-function keys and are deterministic by construction
         // (qualified declaration names).
         const units = new Map();
-        const bodyRoots = (...roots) => roots.filter((root) => root !== undefined && root !== null);
-        const functionRoots = (decl) => bodyRoots(...decl.parameters.nodes.map((param) => param.initializer), decl.body);
-        const classCtorRoots = (info) => bodyRoots(...(info.ctor?.parameters?.nodes ?? []).map((param) => param.initializer), info.ctor?.body, ...info.fieldOrder.map((field) => field.initializer));
+        // Roots are collected with plain pushes: spread arguments into a rest
+        // parameter pass the nodes as dynamic values.
+        const addRoot = (roots, root) => {
+            if (root !== undefined && root !== null)
+                roots.push(root);
+        };
+        const functionRoots = (decl) => {
+            const roots = [];
+            for (const param of decl.parameters.nodes)
+                addRoot(roots, param.initializer);
+            addRoot(roots, decl.body);
+            return roots;
+        };
+        const classCtorRoots = (info) => {
+            const roots = [];
+            for (const param of info.ctor?.parameters?.nodes ?? [])
+                addRoot(roots, param.initializer);
+            addRoot(roots, info.ctor?.body);
+            for (const field of info.fieldOrder)
+                addRoot(roots, field.initializer);
+            return roots;
+        };
         const classMemberRoots = (info) => {
             const roots = classCtorRoots(info);
             for (const { member } of this.classMethodMembers(info))
@@ -7357,8 +7505,9 @@ export class Lowerer {
                 register(`%${cName}.set:${prop}`, [], () => this.throwingSetterFn(info, prop));
             }
         };
+        const onEdge = this.onEdge;
         for (const name of collectionEdges)
-            this.onEdge(name);
+            onEdge(name);
         // Generic instances queued by the bodies above lower here (an instance
         // body fires edges of its own and can queue further instances of
         // either kind — function instances and class instantiations drain to
@@ -7462,8 +7611,9 @@ export class Lowerer {
         // profile-mapped exports are called from outside the graph, so they
         // seed the worklist beside the init bodies. Unknown names are inert
         // (the export-map resolution reports them as SC4002 later).
+        const rootEdge = this.onEdge;
         for (const root of extraRoots ?? [])
-            this.onEdge?.(root);
+            rootEdge?.(root);
         const shuffle = lowerShuffle();
         const drainUnits = () => {
             while (queue.length > 0) {
@@ -7579,8 +7729,10 @@ export class Lowerer {
     /** Reachability hook (see emitReachable): fires when lowering resolves a
      * reference to a lowerable body. */
     noteEdge(name) {
-        if (this.onEdge)
-            this.onEdge(name);
+        // Called as a plain function: the instance is not its receiver.
+        const onEdge = this.onEdge;
+        if (onEdge)
+            onEdge(name);
     }
     /** A subclass constructor's super() edge: the base constructor runs, but
      * no instance of exactly the base class is created. */
@@ -7733,8 +7885,11 @@ export class Lowerer {
         }
         this.diags.push(d);
     }
-    unsupported(code, node, featureOverride, hintOverride) {
-        this.pushDiag(unsupportedDiag(code, locOf(node), featureOverride, hintOverride));
+    unsupported(code, node, featureOverride, hintOverride, reason) {
+        const diag = unsupportedDiag(code, locOf(node), featureOverride, hintOverride);
+        if (reason !== undefined)
+            diag.reason = reason;
+        this.pushDiag(diag);
         throw new PoisonError();
     }
     externalHostFence(specifier, node, valueUse = true) {
@@ -7913,8 +8068,11 @@ export class Lowerer {
      * nothing lowers. Poisons the statement like every other rejection.
      * `sym`, when given, picks the wording: surface declared only by the
      * adopted @types/node is blamed at @types/node. */
-    noLowering(surface, node, hint, sym) {
-        this.pushDiag(noLoweringDiag(surface, locOf(node), hint, this.nodeTypesOnlySymbol(sym)));
+    noLowering(surface, node, hint, sym, reason) {
+        const diag = noLoweringDiag(surface, locOf(node), hint, this.nodeTypesOnlySymbol(sym));
+        if (reason !== undefined)
+            diag.reason = reason;
+        this.pushDiag(diag);
         throw new PoisonError();
     }
     stdlibMemberFence(access) {
@@ -7971,6 +8129,11 @@ export class Lowerer {
         return symbol !== undefined && this.anySymbols.has(symbol);
     }
     typeOf(node) {
+        if (ts.isIdentifier(node)) {
+            const inferred = inferredCollectionType(this, node);
+            if (inferred)
+                return inferred;
+        }
         if (this.anySymbols.size > 0 && this.readsAnySymbol(node))
             return this.checker.getAnyType();
         // A checked-dynamic argument that another overload could take at run
@@ -8620,7 +8783,8 @@ export class Lowerer {
             // so its module binding is too (`ReleaseEmitter = EventEmitter` over
             // `const EventEmitter = require("events")`).
             if (expr.type.kind === "moduleNs" && isJsSourceFileName(expr.loc.file)) {
-                const object = moduleNamespaceObject(this, expr);
+                const ns = expr;
+                const object = moduleNamespaceObject(this, ns) ?? moduleNamespaceValue(this, ns);
                 if (object)
                     return object;
             }
@@ -8663,6 +8827,7 @@ export class Lowerer {
                 // A builtin function's adapter boxes under the builtin's name, the
                 // name Node's function carries (`[Function: randomUUID]`).
                 const builtinName = expr.kind === "closure" ? this.builtinCallableValueNames.get(expr.fnName) : undefined;
+                const builtinLength = expr.kind === "closure" ? this.builtinCallableValueLengths.get(expr.fnName) : undefined;
                 return {
                     kind: "dynFrom",
                     value: expr,
@@ -8670,6 +8835,7 @@ export class Lowerer {
                     loc: expr.loc,
                     ...(liveRef ? { liveRef: true } : {}),
                     ...(builtinName !== undefined ? { fnName: builtinName } : {}),
+                    ...(builtinLength !== undefined ? { fnLength: builtinLength } : {}),
                 };
             }
             return expr;
@@ -9147,8 +9313,8 @@ export class Lowerer {
     unionRetagHelper(fromId, toId, loc, trappable) {
         return unionRetagHelper(this, fromId, toId, loc, trappable);
     }
-    narrowedArmHelper(fromId, target, loc) {
-        return narrowedArmHelper(this, fromId, target, loc);
+    narrowedArmHelper(fromId, target, loc, message) {
+        return narrowedArmHelper(this, fromId, target, loc, message);
     }
     checkedNarrowCall(helper, value, type, loc) {
         return checkedNarrowCall(this, helper, value, type, loc);
@@ -10423,10 +10589,13 @@ export class Lowerer {
     }
     /** Method-like members with their collected method-map names. Body
      * lowering omits abstract declarations; ABI analysis must include them
-     * because an abstract-typed call selects the same virtual slot. */
-    *classMethodMembers(info, includeAbstract = false) {
+     * because an abstract-typed call selects the same virtual slot. An array,
+     * not a generator: a generator's yielded values are dynamic values, which
+     * would make every syntax node one. */
+    classMethodMembers(info, includeAbstract = false) {
+        const members = [];
         if (!info.decl)
-            return; // builtin error classes: runtime-provided bodies
+            return members; // builtin error classes: runtime-provided bodies
         for (const member of info.decl.members.nodes) {
             const fnLike = ts.isMethodDeclaration(member) || ts.isGetAccessor(member) || ts.isSetAccessor(member)
                 ? member
@@ -10453,8 +10622,9 @@ export class Lowerer {
             const signature = info.methods.get(mName);
             if (!signature || (!fnLike.body && !(includeAbstract && signature.abstract)))
                 continue;
-            yield { mName, member: fnLike };
+            members.push({ mName, member: fnLike });
         }
+        return members;
     }
     lowerClassCtor(info) {
         return lowerClassCtor(this, info);
@@ -11250,11 +11420,28 @@ export class Lowerer {
     }
     /* ── expressions ──────────────────────────────────────────────────── */
     lowerExpr(expr) {
+        if (this.speculatedClosures.size > 0) {
+            const speculated = this.speculatedClosure(expr);
+            if (speculated !== null) {
+                this.speculatedClosures.delete(expr);
+                return speculated;
+            }
+        }
         const streamValue = this.valueStreamReceivers.get(expr);
         if (streamValue)
             return valueStreamOf(varRef(streamValue.localId, streamValue.type, locOf(expr)));
         return this.stagedArgument(expr) ?? lowerExpr(this, expr);
     }
+    /** The value storedImplicitArgumentType lowered for `expr` in the active
+     * function and type bindings (speculatedClosures), or null. */
+    speculatedClosure(expr) {
+        const entry = this.speculatedClosures.get(expr);
+        return entry !== undefined &&
+            entry.ctx === this.ctx &&
+            entry.bindings === this.typeParamBindings
+            ? entry.value
+            : null;
+    }
     /** The saved value of a staged fs argument (stagedArguments, keyed
      * without type-only wrappers), or null for every other expression. */
     stagedArgument(node) {
@@ -11344,6 +11531,10 @@ export class Lowerer {
             expr.expression.name.text === "cache") {
             return lowerElementAccess(this, expr);
         }
+        // `a?.[i]`: the optional chain tests the receiver's undefined arm and
+        // lowers this access again inside its guard.
+        if (expr.questionDotToken && !this.chainHandled.has(expr))
+            return lowerElementAccess(this, expr);
         const receiver = this.runtimeOptionalIdentifierValue(expr.expression);
         const receiverValue = receiver && (receiver.present.kind === "array" || receiver.present.kind === "record")
             ? (() => {
@@ -11581,6 +11772,7 @@ export class Lowerer {
             lowerStaticBlobCall(this, expr) ??
             lowerWebCryptoCall(this, expr) ??
             lowerKeyObjectCall(this, expr) ??
+            lowerX509Call(this, expr) ??
             lowerEcdhCall(this, expr) ??
             lowerDiffieHellmanCall(this, expr) ??
             lowerNetAddressCall(this, expr) ??
@@ -11645,14 +11837,20 @@ export class Lowerer {
     accessorCall(className, member, obj, extraArgs, ret, loc) {
         return accessorCall(this, className, member, obj, extraArgs, ret, loc);
     }
-    classIteratorOf(t) {
-        return classIteratorOf(this, t);
+    classIteratorOf(t, options) {
+        return classIteratorOf(this, t, options);
+    }
+    classIteratorReturnCall(cit, it, loc) {
+        return classIteratorMethodCall(this, cit, "return", it, loc);
     }
     classIteratorOpenCall(cit, recv, loc) {
         return classIteratorOpenCall(this, cit, recv, loc);
     }
-    classIteratorNextCall(cit, itRef, loc) {
-        return classIteratorNextCall(this, cit, itRef, loc);
+    classIteratorNextRead(cit, itRef, loc) {
+        return classIteratorNextRead(this, cit, itRef, loc);
+    }
+    classIteratorNextCall(cit, itRef, next, loc) {
+        return classIteratorNextCall(this, cit, itRef, next, loc);
     }
     classIteratorDrainCall(src, loc, elemT) {
         return classIteratorDrainCall(this, src, loc, elemT);
@@ -11911,7 +12109,7 @@ export class Lowerer {
         }
         if (ts.isPropertyAccessExpression(expr) &&
             !expr.questionDotToken &&
-            ts.isIdentifier(expr.expression)) {
+            (ts.isIdentifier(expr.expression) || requireSpecOf(expr.expression) !== null)) {
             const outer = this.builtinNamespaceModuleOf(expr.expression);
             if (outer === null)
                 return null;
@@ -12114,6 +12312,15 @@ export class Lowerer {
         if (builtinModuleFnOf(this, bi.module, bi.member)) {
             this.unsupported("SC1090", expr, `library functions as values (call '${ts.getTextOfNode(expr)}' directly)`);
         }
+        // A member that is a supported module in its own right (`fs.promises`
+        // is node:fs/promises, as in Node) reads as that module's namespace.
+        {
+            const sub = this.builtinNamespaceModuleOf(expr);
+            if (sub !== null) {
+                const type = { kind: "moduleNs", moduleId: `builtin:${sub}` };
+                return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
+            }
+        }
         this.noLowering(`${bi.module}.${bi.member}`, expr, builtinFenceHintOf(bi.module, bi.member), this.checker.getSymbolAtLocation(expr.name));
     }
     /** Materialize one explicitly value-callable table entry as an interned
@@ -12122,6 +12329,9 @@ export class Lowerer {
      * deliberately narrower than table membership because many table rows
      * are only dispatch sentinels for call-site-specific lowering. */
     lowerBuiltinCallableValue(bi, loc) {
+        const assertion = assertFunctionValue(bi, loc);
+        if (assertion)
+            return assertion;
         if (bi.module === "util" && bi.member === "types")
             return utilTypesModuleValue(this, loc);
         if (bi.module === "util/types" && builtinModuleFnOf(this, bi.module, bi.member))
@@ -12170,6 +12380,8 @@ export class Lowerer {
             fnName = keyedHelperName(this, `%builtin.value.${fn.valueFn ?? fn.fn}`, key);
             this.builtinCallableValueFns.set(key, fnName);
             this.builtinCallableValueNames.set(fnName, display.slice(display.lastIndexOf(".") + 1));
+            if (fn.valueLength !== undefined)
+                this.builtinCallableValueLengths.set(fnName, fn.valueLength);
             const params = funcType.params.map((type, index) => ({
                 localId: `arg.${index}`,
                 name: `arg${index}`,