@scriptc/compiler 0.4.6 → 0.4.7

package/dist/frontend/lowering/expressions/property-access.js

@@ -1,4 +1,5 @@
 import { widensReducedRecords } from "../function-returns.js";
+import { lowerStaticPrivateRead } from "../private-statics.js";
 import { widthNarrowHelper } from "../coercions/unions.js";
 /* Property reads (`a.b`): lowerExprInner's property-access branch, intrinsic and union properties, field reads and targets, and match-group reads. */
 import { jsSpecialGlobalValue } from "../global-values.js";
@@ -77,10 +78,12 @@ import { InternalCompilerError } from "../../../errors.js";
 import { lowerUnionFieldRead } from "./union-fields.js";
 import { errorPropertyRead } from "../error-methods.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./evaluation-safety.js";
+import { partialAssertionFields, partialFieldRead } from "../partial-assertions.js";
 import { isZlibStreamMember, lowerZlibStreamBytesWritten } from "../builtins/compression.js";
 import { isWebCryptoReceiver } from "../builtins/crypto.js";
 import { isFsStreamMember, lowerFsStreamProperty } from "../builtins/fs-streams.js";
 import { keyedFieldRead } from "./keyed-field-targets.js";
+import { heldEnvValueType } from "../builtins/environment.js";
 import { promisePrototypeValue } from "../thenables.js";
 import { lowerChildPropertyRead } from "../handle-properties.js";
 /** True when a property access names an ABSTRACT property declaration
@@ -189,6 +192,13 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     const arrayClassConstructor = lowerArrayClassConstructorRead(lowerer, expr, loc);
     if (arrayClassConstructor !== null)
         return arrayClassConstructor;
+    // `R.#x` for a static private on a checked-dynamic receiver: the brand
+    // check, then the native storage (private-statics.ts).
+    {
+        const staticPrivate = lowerStaticPrivateRead(lowerer, expr, loc);
+        if (staticPrivate)
+            return staticPrivate;
+    }
     // `value.#x` on a checked-dynamic value, or on a checked extraction of
     // one: the field of the brand-checked receiver (checkedPrivateValue).
     if (ts.isPrivateIdentifier(expr.name)) {
@@ -552,7 +562,9 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             };
         }
     }
-    if ((expr.name.text === "index" || expr.name.text === "input") && !expr.questionDotToken) {
+    // `re.exec(s)?.index` takes the same read: the chain lowering binds the
+    // guarded receiver (non-nullish inside the guard) before re-dispatching.
+    if (expr.name.text === "index" || expr.name.text === "input") {
         const represented = tryLowerExpression(lowerer, expr.expression);
         if (represented &&
             isMatchSliceType(lowerer, represented.type) &&
@@ -760,6 +772,26 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         if (promiseMember)
             return promiseMember;
     }
+    // A weak collection's method read as a VALUE in a JavaScript source
+    // (`wm.has.call(x, k)` — the WeakMap/WeakSet brand-check tests): the
+    // runtime's interned prototype function, which applies the method to its
+    // own receiver and throws Node's TypeError for a foreign one. A direct
+    // call keeps the instance fast path (`dynKeyGet` dispatches to the
+    // handle), and an optional read keeps the fence.
+    if (!expr.questionDotToken &&
+        isJsSourceFile(ts.getSourceFileOfNode(expr)) &&
+        !isCalleeOf(expr) &&
+        // `WeakMap.prototype.has` is the prototype table's own read: it never
+        // lowers the prototype object (a value read of `WeakMap.prototype`
+        // is a fence), so leave that spelling there.
+        !(ts.isPropertyAccessExpression(expr.expression) &&
+            expr.expression.name.text === "prototype" &&
+            stdlibGlobalNameOf(lowerer, expr.expression.expression) !== null)) {
+        const weak = lowerer.weakCollectionNamesOf(lowerer.typeOf(expr.expression));
+        if (weak !== null &&
+            weak.names.some((prototype) => WEAK_COLLECTION_METHOD_NAMES[prototype].has(expr.name.text)))
+            return weakCollectionMethodValue(lowerer, expr, weak.names, weak.nullable, expr.name.text);
+    }
     const handled = lowerer.lowerProcessEnvGet(expr) ??
         lowerer.lowerServerProperty(expr) ??
         // diagnostics_channel Channel receivers — name/hasSubscribers
@@ -1363,6 +1395,20 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     const asserted = assertedMemberRead(lowerer, expr.expression, expr.name.text, recvLowered, loc);
     if (asserted)
         return asserted;
+    // Lowering erases flow narrowing, so a checker-NARROWED receiver keeps
+    // the wider union it stores (`stored?.type` after the earlier arm
+    // returned, `(entry as { role: string }).role`): the checker's type
+    // names one record while the value still carries its siblings. Read the
+    // member off whichever arm the value holds — an arm that does not
+    // declare it answers undefined, exactly Node's get — and narrow the
+    // answer to the checker's type, which traps on an arm the checker's
+    // narrowing ruled out (types do not lie). Reaching this point means no
+    // lowering above claimed the read, so only refusals gain a lowering.
+    if (recvLowered.type.kind === "union") {
+        const read = lowerUnionValueRead(lowerer, expr, recvLowered, true);
+        if (read)
+            return lowerer.maybeNarrow(read, expr);
+    }
     // A checker-`any` receiver whose value is a FRESH typed result of an
     // earlier step in the chain (`out.split(" ").length`, where split
     // extracted the string and answered a native string[]): the member read
@@ -1602,9 +1648,165 @@ function mergeReadTypes(lowerer, types) {
 function importMetaProperty(lowerer, expr) {
     return isImportMeta(expr.expression) ? importMetaField(lowerer, expr, expr.name.text) : null;
 }
+const DATE_PROTOTYPE_WRITE_MESSAGE = "writing through a standard library prototype (`Date.prototype` is a value for reads; a Date never observes a write to it)";
+/** How many member steps separate `node` from `Date.prototype` in the read
+ * chain `node` is part of: 0 for `Date.prototype` itself, 1 for a member, 2
+ * for a property read on a member (the interned function object). Null when
+ * the chain is not rooted at `Date.prototype`. */
+function datePrototypeDepth(lowerer, node) {
+    let depth = 0;
+    let cur = node;
+    for (;;) {
+        if (ts.isPropertyAccessExpression(cur) &&
+            lowerer.stdlibGlobalMember(cur, "Date") === "prototype")
+            return depth;
+        if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur)) {
+            cur = cur.expression;
+            depth++;
+            continue;
+        }
+        return null;
+    }
+}
+/** The prototype object and its members are a read surface: a write that
+ * replaces a member, or a key of the prototype itself, keeps the SC1090
+ * refusal it reached before the prototype had a value, because a typed Date
+ * never observes it and the write would silently differ from Node. A property
+ * OF a member (the interned function object, `Date.prototype.getTime.length
+ * = 1`) writes the function the dynamic tier shares with Node, which matches,
+ * so it stays open. True when `node` is the target of such a write
+ * (assignment, compound assignment, `delete`, `++`/`--`), directly or as the
+ * base of the target's member chain. */
+export function isDatePrototypeWrite(lowerer, node) {
+    const depth = datePrototypeDepth(lowerer, node);
+    if (depth === null)
+        return false;
+    let steps = 0;
+    let cur = node;
+    for (;;) {
+        while (ts.isParenthesizedExpression(cur.parent))
+            cur = cur.parent;
+        const parent = cur.parent;
+        if (!parent)
+            return false;
+        if ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) &&
+            parent.expression === cur) {
+            cur = parent;
+            steps++;
+            continue;
+        }
+        const written = (ts.isBinaryExpression(parent) &&
+            parent.left === cur &&
+            (parent.operatorToken.kind === ts.SyntaxKind.EqualsToken ||
+                (parent.operatorToken.kind >= ts.SyntaxKind.FirstCompoundAssignment &&
+                    parent.operatorToken.kind <= ts.SyntaxKind.LastCompoundAssignment))) ||
+            ts.isDeleteExpression(parent) ||
+            // `++`/`--` write their operand; the other prefix unary forms (`!`,
+            // `typeof`, `void`, `+`, `-`, `~`) only read it.
+            ((ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) &&
+                (parent.operator === ts.SyntaxKind.PlusPlusToken ||
+                    parent.operator === ts.SyntaxKind.MinusMinusToken));
+        return written && depth + steps <= 1;
+    }
+}
+/** The fence for a write found while lowering a property access (see
+ * isDatePrototypeWrite). The cheap syntactic pre-test keeps every other
+ * property access down to one identifier comparison: only a chain rooted at
+ * the `Date` global can name the prototype, and the write path reaches this
+ * before chainBlocked's early return. */
+export function fenceDatePrototypeWrite(lowerer, expr) {
+    let root = expr;
+    while (ts.isPropertyAccessExpression(root) || ts.isElementAccessExpression(root))
+        root = root.expression;
+    while (ts.isParenthesizedExpression(root))
+        root = root.expression;
+    if (!ts.isIdentifier(root) || root.text !== "Date")
+        return;
+    if (isDatePrototypeWrite(lowerer, expr))
+        lowerer.unsupported("SC1090", expr, DATE_PROTOTYPE_WRITE_MESSAGE);
+}
+/** The same fence for a call-shaped write (`Object.defineProperty`,
+ * `Object.assign`) whose target argument is `Date.prototype` or one of its
+ * members. */
+export function fenceDatePrototypeWriteCall(lowerer, node) {
+    const depth = datePrototypeDepth(lowerer, node);
+    if (depth !== null && depth <= 1)
+        lowerer.unsupported("SC1090", node, DATE_PROTOTYPE_WRITE_MESSAGE);
+}
 /** The TypeError of a deferred-init field read that finds the field
  * unassigned where its declared type cannot hold undefined. */
 export const DEFERRED_READ_MESSAGE = "undefined is not representable in the target union (a value narrowed or asserted past it still held it)";
+/** A collection method read as a VALUE (`s.add`, `m.has` — the `f.call(x)`
+ * tests and callback plumbing): the runtime's interned prototype function
+ * for that name, which applies the method to its own receiver and throws
+ * Node's brand-check TypeError when that receiver is not a collection of
+ * the right kind. Only JavaScript sources take this path: a typed source
+ * keeps its refusal (the checker's Set/Map signature has no value form).
+ * The receiver expression still runs for its effects, and a receiver the
+ * checker typed with an undefined arm (an out-of-bounds element of a
+ * `Set[]`, `xs[1].has`) throws Node's TypeError at the read itself: the
+ * member access on a nullish receiver fails before any method exists. */
+function dynCollectionMethodValue(lowerer, expr, prototype, name) {
+    const loc = locOf(expr);
+    const method = {
+        kind: "libCall",
+        fn: "dyn.builtinMethod",
+        args: [
+            { kind: "strLit", value: prototype, type: STRING, loc },
+            { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
+        ],
+        type: DYN,
+        loc,
+    };
+    const receiver = lowerer.lowerExpr(expr.expression);
+    const unionType = receiver.type.kind === "union" ? receiver.type : null;
+    const units = [];
+    if (unionType) {
+        const def = lowerer.unions.get(unionType.unionId);
+        def?.arms.forEach((arm, tag) => {
+            if (isUnitType(arm))
+                units.push({ tag, unit: arm.kind === "nullT" ? "null" : "undefined" });
+        });
+    }
+    if (units.length === 0 || unionType === null) {
+        return isSafeToDiscard(receiver)
+            ? method
+            : {
+                kind: "seqExpr",
+                stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr.expression) }],
+                result: method,
+                type: DYN,
+                loc,
+            };
+    }
+    const held = lowerer.declareHiddenLocal("%collectionMethodReceiver", unionType);
+    let result = method;
+    for (const { tag, unit } of units) {
+        result = {
+            kind: "ternary",
+            cond: {
+                kind: "unionIsTag",
+                unionId: unionType.unionId,
+                tag,
+                negated: false,
+                value: varRef(held.id, unionType, loc),
+                type: BOOL,
+                loc,
+            },
+            then: nodeThrowExpr(1, "", `Cannot read properties of ${unit} (reading '${name}')`, DYN, loc),
+            else_: result,
+            type: DYN,
+            loc,
+        };
+    }
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: held.id, init: receiver, loc }],
+        result,
+        type: DYN,
+        loc,
+    };
+}
 /** Property access on a string or array receiver: `.length` lowers to the
  * matching intrinsic; a bare method reference (`const f = s.slice` — a
  * function value) is rejected with a specific message. Returns null for
@@ -1619,6 +1821,11 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     }
     if (lowerer.stdlibGlobalMember(expr, "Reflect") === "ownKeys")
         return reflectMemberValue(lowerer, "ownKeys", locOf(expr));
+    // A write, `delete` or defineProperty through `Date.prototype` keeps its
+    // fence: the value below is a read surface, and a typed Date never observes
+    // a dynamic write to it. This runs before the chainBlocked early return
+    // because a write lowers the prototype read with the chain blocked.
+    fenceDatePrototypeWrite(lowerer, expr);
     if (lowerer.chainBlocked(expr))
         return null;
     // Object.prototype.constructor: the Object constructor value.
@@ -1626,6 +1833,9 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         ts.isPropertyAccessExpression(expr.expression) &&
         lowerer.stdlibGlobalMember(expr.expression, "Object") === "prototype")
         return builtinGlobalValue("Object", locOf(expr));
+    const primitivePrototype = jsPrimitivePrototypeValue(lowerer, expr);
+    if (primitivePrototype)
+        return primitivePrototype;
     const builtinPrototype = builtinPrototypeMethod(lowerer, expr);
     if (builtinPrototype)
         return {
@@ -1660,6 +1870,37 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         return { kind: "libCall", fn: "dyn.functionApply", args: [], type: DYN, loc: locOf(expr) };
     if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
         return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
+    // Date.prototype as a value, and its members read through it: the
+    // prototype object the language defines (an ordinary object carrying the
+    // interface's methods), not a Date. `Date.prototype.hasOwnProperty("x")`
+    // and `Date.prototype.getTime` are reads of that object; a Date method
+    // CALLED on it is a TypeError, which the checked-dynamic method dispatch
+    // answers because the receiver is not a Date handle.
+    if (lowerer.stdlibGlobalMember(expr, "Date") === "prototype") {
+        return {
+            kind: "libCall",
+            fn: "dyn.stdlibPrototype",
+            args: [{ kind: "strLit", value: "Date", type: STRING, loc: locOf(expr) }],
+            type: DYN,
+            loc: locOf(expr),
+        };
+    }
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        lowerer.stdlibGlobalMember(expr.expression, "Date") === "prototype") {
+        return {
+            kind: "dynKeyGet",
+            value: {
+                kind: "libCall",
+                fn: "dyn.stdlibPrototype",
+                args: [{ kind: "strLit", value: "Date", type: STRING, loc: locOf(expr.expression) }],
+                type: DYN,
+                loc: locOf(expr.expression),
+            },
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+            type: DYN,
+            loc: locOf(expr),
+        };
+    }
     if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
         return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
     // Error.prototype as a value (`F.prototype = Object.create(Error.prototype)`)
@@ -2235,6 +2476,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             };
         }
         if (MAP_METHODS.has(name) || name === "forEach") {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr)) && !expr.questionDotToken)
+                return dynCollectionMethodValue(lowerer, expr, "Map", name);
             lowerer.unsupported("SC1090", expr, `Map methods as values (call '${name}' directly)`);
         }
         return null;
@@ -2253,6 +2496,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             };
         }
         if (SET_METHODS.has(name)) {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr)) && !expr.questionDotToken)
+                return dynCollectionMethodValue(lowerer, expr, "Set", name);
             lowerer.unsupported("SC1090", expr, `Set methods as values (call '${name}' directly)`);
         }
         return null;
@@ -3100,8 +3345,19 @@ function unreachableReceiver(lowerer, expr) {
 export function lowerUnionProperty(lowerer, expr) {
     if (lowerer.chainBlocked(expr))
         return null;
-    const receiverIr = structuralReadType(lowerer, expr.expression) ??
+    const spelled = structuralReadType(lowerer, expr.expression) ??
         lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+    // Inside an optional-chain body the guarded receiver is checker-typed by
+    // its non-nullish narrowing — often one record of a discriminated union
+    // — while the bound chain value still carries the whole present union
+    // (`stored?.type` after an earlier `stored?.type === "oauth"` return
+    // narrowed `stored` to `ApiKeyCredential`, though the runtime-optional
+    // storage still holds `ApiKeyCredential | OAuthCredential`). The union
+    // reader dispatches on the runtime tag, so take the union the chain
+    // binding hands to `lowerExpr` below instead of the spelled narrowing.
+    const chainRecv = lowerer.chainRecvByNode.get(expr.expression);
+    const chainUnion = spelled?.kind !== "union" && chainRecv?.type.kind === "union" ? chainRecv.type : null;
+    const receiverIr = chainUnion ?? spelled;
     // The checker can rule the receiver UNREACHABLE and the assertion that
     // escapes it (`const x: never = event; (event as any).type` — the
     // `default:` branch of a switch that exhausts every arm) erases to
@@ -3130,6 +3386,16 @@ export function lowerUnionProperty(lowerer, expr) {
         else
             value = narrowStoredClassValue(lowerer, value, receiverIr) ?? value;
     }
+    // The spelled type is a narrowing, so every path below (dyn, record,
+    // object, array) was unreachable for this read before it took the stored
+    // union: answer it only when the union reader can, and otherwise hand the
+    // read back to the lowering the spelled type used to reach. A stored arm
+    // the checker ruled out that has no such member (`m1?.name` where the
+    // stored union still carries a `string` arm) must not turn an accepted
+    // program into a refusal.
+    if (chainUnion !== null) {
+        return value.type.kind === "union" ? lowerUnionValueRead(lowerer, expr, value) : null;
+    }
     // A checker-union receiver whose VALUE lowered to a plain RECORD (the
     // merged-signature fiction — `runner(cmd, args)` where runner joined
     // a structural runner type with spawnSync's, and the local adopted
@@ -3192,9 +3458,26 @@ export function lowerUnionProperty(lowerer, expr) {
     if (value.type.kind !== "union") {
         lowerer.unsupported("SC1090", expr, "shared property access without a represented union receiver");
     }
-    const def = lowerer.unions.get(value.type.unionId);
+    const read = lowerUnionValueRead(lowerer, expr, value);
+    if (read)
+        return read;
+    lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' on a union-typed value (every arm must be an object/record ` +
+        `with a same-typed field '${expr.name.text}'; ` +
+        `${NARROW_FIRST})`);
+}
+/** The member read itself on a lowered UNION value: `lowerUnionProperty`
+ * after it has produced the value (retagged to the checker's union when
+ * the checker removed arms) and the dispatcher's narrowed-receiver
+ * fallback, which reaches the same read with the value a checker-narrowed
+ * receiver still stores. Returns null when no arm can answer — the caller
+ * owns the diagnostic. */
+export function lowerUnionValueRead(lowerer, expr, value, missingFieldAsUndefined = false) {
+    if (value.type.kind !== "union")
+        return null;
+    const unionId = value.type.unionId;
+    const def = lowerer.unions.get(unionId);
     if (!def)
-        throw new InternalCompilerError(`lowerer bug: unknown union ${value.type.unionId}`);
+        throw new InternalCompilerError(`lowerer bug: unknown union ${unionId}`);
     const field = expr.name.text;
     if (field === "length") {
         const presentArms = def.arms.filter((arm) => !isUnitType(arm));
@@ -3221,6 +3504,31 @@ export function lowerUnionProperty(lowerer, expr) {
                     };
             }
         }
+        // A union of arrays and strings (`Model[] | ModelRef[]`,
+        // `string[] | Buffer[]`): every arm answers its own length, so the
+        // read dispatches on the tag. Node's `.length` is a number for both,
+        // and no arm can be absent here (a unit arm would have to throw on
+        // this read, which the checker's narrowing already excludes).
+        if (def.arms.length > 1 &&
+            def.arms.every((arm) => arm.kind === "array" || arm.kind === "string")) {
+            return perArmUnionRead(lowerer, expr, unionId, value, F64, "%unionLength", (arm, _tag, receiver) => arm.kind === "string"
+                ? {
+                    kind: "strIntrinsic",
+                    method: "length",
+                    receiver,
+                    args: [],
+                    type: F64,
+                    loc: locOf(expr),
+                }
+                : {
+                    kind: "arrIntrinsic",
+                    method: "length",
+                    receiver,
+                    args: [],
+                    type: F64,
+                    loc: locOf(expr),
+                });
+        }
     }
     const nonUnitArms = def.arms.filter((arm) => !isUnitType(arm));
     if (nonUnitArms.length === 1 && nonUnitArms[0]?.kind === "object") {
@@ -3229,7 +3537,7 @@ export function lowerUnionProperty(lowerer, expr) {
         if (fieldType !== undefined) {
             let receiver = lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, objectType, field);
             if (receiver === null) {
-                const helper = lowerer.narrowedArmHelper(value.type.unionId, objectType, locOf(expr.expression));
+                const helper = lowerer.narrowedArmHelper(unionId, objectType, locOf(expr.expression));
                 if (helper !== null)
                     receiver = lowerer.checkedNarrowCall(helper, value, objectType, locOf(expr.expression));
             }
@@ -3245,6 +3553,15 @@ export function lowerUnionProperty(lowerer, expr) {
             }
         }
     }
+    // A member the arms answer through an ACCESSOR (a getter inherited
+    // from a shared base class — `renderer.hasOverlayEntries` on
+    // `FullscreenRenderer | RegularRenderer`): there is no field slot
+    // `unionDisc` could read, so dispatch on the tag and call each arm's
+    // own getter. Fires only when some arm's answer is an accessor, so
+    // data-field unions keep their `unionDisc` lowering.
+    const accessorRead = lowerUnionAccessorRead(lowerer, expr, unionId, value);
+    if (accessorRead)
+        return accessorRead;
     let common = null;
     for (const arm of def.arms) {
         let ft;
@@ -3274,7 +3591,7 @@ export function lowerUnionProperty(lowerer, expr) {
     // arms): the JOIN path — `env.PORTLESS_PORT` on `ProcessEnv |
     // Record<string, string>`, the tail read of `loaded?.config.script`.
     const key = { kind: "strLit", value: field, type: STRING, loc: locOf(expr.name) };
-    const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, field);
+    const keyed = lowerUnionKeyedRead(lowerer, expr, unionId, value, key, field, missingFieldAsUndefined);
     if (keyed)
         return keyed;
     // Class arms declaring the field with compatible but different types
@@ -3304,9 +3621,197 @@ export function lowerUnionProperty(lowerer, expr) {
         if (member)
             return member;
     }
-    lowerer.unsupported("SC1090", expr, `reading '${field}' on a union-typed value (every arm must be an object/record ` +
-        `with a same-typed field '${field}'; ` +
-        `${NARROW_FIRST})`);
+    return null;
+}
+/** Evaluate `value` once into a hidden local and answer the read by
+ * dispatching on the union's tag: arm `tag` (narrowed from the local)
+ * answers `answer(arm, tag, narrowed)`. The first non-unit arm's answer
+ * is the fallback branch, which a representable union never reaches. */
+function perArmUnionRead(lowerer, expr, unionId, value, type, name, answer) {
+    const loc = locOf(expr);
+    const def = lowerer.unions.get(unionId);
+    if (!def)
+        throw new InternalCompilerError(`lowerer bug: unknown union ${unionId}`);
+    const stable = lowerer.declareHiddenLocal(name, value.type);
+    const ref = () => ({ kind: "varRef", localId: stable.id, type: value.type, loc });
+    let result = null;
+    def.arms.forEach((arm, tag) => {
+        if (isUnitType(arm))
+            return;
+        const receiver = { kind: "unionNarrow", unionId, tag, value: ref(), type: arm, loc };
+        const read = answer(arm, tag, receiver);
+        result =
+            result === null
+                ? read
+                : {
+                    kind: "ternary",
+                    cond: {
+                        kind: "unionIsTag",
+                        unionId,
+                        tag,
+                        value: ref(),
+                        negated: false,
+                        type: BOOL,
+                        loc,
+                    },
+                    then: read,
+                    else_: result,
+                    type,
+                    loc,
+                };
+    });
+    if (result === null)
+        throw new InternalCompilerError(`lowerer bug: no arm answers ${name}`);
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: stable.id, init: value, loc }],
+        result,
+        type,
+        loc,
+    };
+}
+/** A member read the arms answer through an ACCESSOR — an inherited
+ * getter (`this.renderer.hasOverlayEntries`). `unionDisc` reads record
+ * and class FIELD slots, so a getter arm needs the tag dispatch: each
+ * arm calls its own getter (once per read, as Node's read does). Data
+ * arms in the same union read their slot. Every arm must answer one
+ * type; a unit arm or an arm without the member declines (the caller's
+ * keyed read and fences own those). Null when no arm answers through an
+ * accessor — plain field unions keep `unionDisc`. */
+function lowerUnionAccessorRead(lowerer, expr, unionId, value) {
+    const def = lowerer.unions.get(unionId);
+    if (!def)
+        return null;
+    const field = expr.name.text;
+    const getterName = `get:${field}`;
+    let type = null;
+    let anyAccessor = false;
+    const arms = [];
+    for (let tag = 0; tag < def.arms.length; tag++) {
+        const arm = def.arms[tag];
+        if (isUnitType(arm))
+            return null;
+        let answer;
+        let read;
+        if (arm.kind === "record") {
+            const shape = lowerer.shapes.get(arm.shapeId);
+            if (!shape || shape.tuple)
+                return null;
+            const data = shape.fields.find((f) => f.name === field);
+            if (data) {
+                answer = data.type;
+                read = (receiver) => ({
+                    kind: "recordGet",
+                    obj: receiver,
+                    shapeId: arm.shapeId,
+                    field,
+                    type: data.type,
+                    loc: locOf(expr),
+                });
+            }
+            else {
+                const getter = shape.fields.find((f) => f.name === getterName);
+                if (!getter || getter.type.kind !== "func")
+                    return null;
+                anyAccessor = true;
+                answer = getter.type.ret;
+                read = (receiver) => lowerer.coerceToExpected({
+                    kind: "callValue",
+                    callee: {
+                        kind: "recordGet",
+                        obj: receiver,
+                        shapeId: arm.shapeId,
+                        field: getterName,
+                        type: getter.type,
+                        loc: locOf(expr),
+                    },
+                    args: [],
+                    type: getter.type.kind === "func" ? getter.type.ret : DYN,
+                    loc: locOf(expr),
+                }, answer);
+            }
+        }
+        else if (arm.kind === "object") {
+            const info = lowerer.classes.get(arm.className) ?? null;
+            const slot = info?.fields.get(field);
+            if (slot !== undefined) {
+                answer = slot;
+                read = (receiver) => ({
+                    kind: "fieldGet",
+                    obj: receiver,
+                    className: arm.className,
+                    field,
+                    type: slot,
+                    loc: locOf(expr),
+                });
+            }
+            else {
+                const getter = lowerer.findMethodOn(info, getterName);
+                if (!getter || getter.sig.ret.kind === "void")
+                    return null;
+                anyAccessor = true;
+                answer = getter.sig.ret;
+                read = (receiver) => lowerer.fieldGetExpr({
+                    container: "accessor",
+                    obj: receiver,
+                    className: arm.className,
+                    field,
+                    fieldType: getter.sig.ret,
+                }, locOf(expr), expr);
+            }
+        }
+        else {
+            return null;
+        }
+        if (answer.kind === "void" || isUnitType(answer))
+            return null;
+        if (type !== null && !typeEquals(type, answer))
+            return null;
+        type = answer;
+        arms.push({ tag, read });
+    }
+    if (!anyAccessor || type === null || arms.length < 2)
+        return null;
+    return perArmUnionRead(lowerer, expr, unionId, value, type, "%unionMember", (_arm, tag, receiver) => {
+        const entry = arms.find((a) => a.tag === tag);
+        if (!entry)
+            throw new InternalCompilerError("lowerer bug: accessor arm missing");
+        return entry.read(receiver);
+    });
+}
+/** A LITERAL-key read on a union receiver whose stored arm is a scalar
+ * primitive the property does not exist on. Lowering erases flow
+ * narrowing, so the value keeps arms the checker ruled out
+ * (`{ url?: string } | "pending"` read as `x?.url` after the guard); JS
+ * boxes a primitive and answers undefined for a name its prototype chain
+ * does not carry, which is exactly what the unit and missing-field arms
+ * answer. A name the primitive DOES declare (`length`, `toUpperCase`)
+ * leaves the read to its own lowering/refusal — `{ n: number } | string`
+ * must keep answering the string's own member, not undefined. */
+function primitiveArmLacksMember(lowerer, arm, field) {
+    // `"abc"[0]` is an element read (JS indexes a string by position), not a
+    // missing property: canonical numeric keys keep their own lowering.
+    if (/^(?:0|[1-9]\d*)$/.test(field))
+        return false;
+    const checker = lowerer.checker;
+    let primitive;
+    switch (arm.kind) {
+        case "string":
+            primitive = checker.getStringType();
+            break;
+        case "f64":
+            primitive = checker.getNumberType();
+            break;
+        case "bool":
+            primitive = checker.getBooleanType();
+            break;
+        case "bigint":
+            primitive = checker.getBigIntType();
+            break;
+        default:
+            return false;
+    }
+    return checker.getPropertyOfType(primitive, field) === undefined;
 }
 /** The unionDisc generalization: a keyed read on a union receiver whose
  * arms answer DIFFERENT (but joinable) types. Each arm contributes its
@@ -3325,6 +3830,15 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
     const def = lowerer.unions.get(unionId);
     if (!def)
         return null;
+    // A JavaScript-source read on a dyn-convertible receiver already has a
+    // dynamic fallback at every call site (`dynKeyGet`), so the primitive
+    // arm's undefined answer would REPLACE a read that compiles today and
+    // change a working program's IR. Keep that fallback: the static answer
+    // exists to replace a refusal, which is the TypeScript-source case.
+    const keepsDynamicFallback = isJsSourceFile(ts.getSourceFileOfNode(expr)) && lowerer.dynConvertible(value.type);
+    const primitiveArmAnswers = (arm) => literalField !== null &&
+        !keepsDynamicFallback &&
+        primitiveArmLacksMember(lowerer, arm, literalField);
     // Pass 1: per-arm declared answers, joined into the result type.
     const joinArms = [];
     const seen = new Set();
@@ -3359,8 +3873,13 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
                 return null;
             continue;
         }
-        if (arm.kind !== "record")
+        if (arm.kind !== "record") {
+            if (primitiveArmAnswers(arm)) {
+                push(UNDEFINED_T);
+                continue;
+            }
             return null;
+        }
         const shape = lowerer.shapes.get(arm.shapeId);
         if (!shape || shape.tuple)
             return null;
@@ -3423,8 +3942,16 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
                 return null;
             continue;
         }
-        if (arm.kind !== "record")
+        if (arm.kind !== "record") {
+            if (primitiveArmAnswers(arm)) {
+                // The primitive's answer above must surface as the join's
+                // undefined arm (the backend's missing-key path stores it).
+                if (!(type.kind === "union" && lowerer.armTag(type.unionId, UNDEFINED_T) >= 0))
+                    return null;
+                continue;
+            }
             return null;
+        }
         const shape = lowerer.shapes.get(arm.shapeId);
         if (!shape)
             return null;
@@ -3556,6 +4083,44 @@ function checkedDynamicValue(expr) {
         return expr;
     return expr.kind === "dynCheck" && expr.value.type.kind === "dyn" ? expr.value : null;
 }
+/** A GENERIC receiver type: a type parameter, or a narrowing of one that
+ * intersects it (`"k" in options` refines a type variable to
+ * `T & Record<"k", unknown>`). Its stored layout is whatever the call site
+ * instantiated it with, and the CONSTRAINT's members are not necessarily
+ * stored there. */
+function typeParameterReceiver(t) {
+    try {
+        if ((t.flags & ts.TypeFlags.TypeParameter) !== 0)
+            return true;
+        return ((t.flags & ts.TypeFlags.Intersection) !== 0 &&
+            ts.constituentTypes(t).some((part) => (part.flags & ts.TypeFlags.TypeParameter) !== 0));
+    }
+    catch (e) {
+        if (ts.isUnreadableConstituentsPanic(e))
+            return false;
+        throw e;
+    }
+}
+/** Whether `access` is only READ (not the target of an assignment, a
+ * delete, or an increment). The left operand of `??`, `===` or `&&`, and
+ * the operand of `!`, `-` or `typeof`, are reads. */
+function readOnlyAccess(access) {
+    const parent = access.parent;
+    if (parent === undefined)
+        return true;
+    if (ts.isBinaryExpression(parent) &&
+        parent.left === access &&
+        parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+        parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+        return false;
+    if (ts.isDeleteExpression(parent))
+        return false;
+    if (ts.isPostfixUnaryExpression(parent))
+        return false;
+    return (!ts.isPrefixUnaryExpression(parent) ||
+        (parent.operator !== ts.SyntaxKind.PlusPlusToken &&
+            parent.operator !== ts.SyntaxKind.MinusMinusToken));
+}
 export function fieldTarget(lowerer, access) {
     if (lowerer.cjsLocalModuleBindingOf(access.expression))
         return null;
@@ -3647,6 +4212,47 @@ export function fieldTarget(lowerer, access) {
     if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
         return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
     }
+    // A generic receiver's member the INSTANTIATION cannot store: the type
+    // parameter's constraint declares the member (so tsc admits the read),
+    // while the record the parameter was instantiated with has no such slot —
+    // a generic options bag read through its constraint (`options.sessionId`
+    // under an `"sessionId" in options` guard) at a call site whose options
+    // literal omits the optional member. Node reads the property off the
+    // object it actually has: undefined when the caller omitted it, the extra
+    // property when a JavaScript caller supplied one. So the read is the
+    // checked-dynamic keyed read of the stored record, entering the static
+    // code at the type the checker gave the read.
+    if (!access.questionDotToken &&
+        readOnlyAccess(access) &&
+        typeParameterReceiver(lowerer.typeOf(access.expression))) {
+        const storedIr = stored ?? narrowed;
+        const arm = storedIr?.kind === "union" ? lowerer.stripUndefinedArm(storedIr) : storedIr;
+        const shape = arm?.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
+        const admitted = lowerer.mapTypeOf(lowerer.typeOf(access));
+        if (shape &&
+            !shape.tuple &&
+            !shape.indexValue &&
+            !shape.fields.some((f) => f.name === access.name.text) &&
+            admitted &&
+            admitted.kind !== "void") {
+            let obj = lowerer.lowerExpr(access.expression);
+            if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
+                const present = lowerer.stripUndefinedArm(obj.type);
+                obj =
+                    present.kind === "record"
+                        ? (lowerer.runtimeOptionalPropertyReceiver(access.expression, obj, present, access.name.text) ?? obj)
+                        : lowerer.maybeNarrow(obj, access.expression);
+            }
+            if (obj.type.kind !== "record")
+                return null;
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceToExpected(obj, DYN),
+                field: access.name.text,
+                fieldType: admitted,
+            };
+        }
+    }
     if (receiverIr?.kind === "record") {
         const shape = lowerer.shapes.get(receiverIr.shapeId);
         const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
@@ -3875,6 +4481,21 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
     // construction), typed as the index value armed with undefined
     // (mirroring lowerRecordKeyRead).
     if (target.container === "recordOvf") {
+        // A dot read through a value HELD from process.env (`const env =
+        // process.env; env.X`): the hold aliases the live table, so the read is
+        // the same getenv the direct spelling lowers to.
+        if (ts.isPropertyAccessExpression(blame)) {
+            const live = heldEnvValueType(lowerer, blame.expression);
+            if (live !== null) {
+                return {
+                    kind: "libCall",
+                    fn: "process.envGet",
+                    args: [{ kind: "strLit", value: target.field, type: STRING, loc }],
+                    type: live,
+                    loc,
+                };
+            }
+        }
         let obj = target.obj;
         if (obj.type.kind === "union" && ts.isPropertyAccessExpression(blame)) {
             const present = lowerer.stripUndefinedArm(obj.type);
@@ -3958,6 +4579,23 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
         }
         return read;
     }
+    // A field some partial record assertion leaves unwritten (a partial
+    // record view, partial-assertions.ts): a read of an absent field throws
+    // the catchable TypeError instead of reading a slot the view lacks.
+    if (partialAssertionFields(lowerer, target.shapeId).has(target.field)) {
+        const obj = target.obj;
+        if (isSafeToRepeat(obj))
+            return partialFieldRead(lowerer, obj, target.shapeId, target.field, target.fieldType, loc);
+        const stable = lowerer.declareHiddenLocal("%partialRecv", obj.type);
+        const ref = varRef(stable.id, obj.type, loc);
+        return {
+            kind: "seqExpr",
+            stmts: [{ kind: "varDecl", localId: stable.id, init: obj, loc }],
+            result: partialFieldRead(lowerer, ref, target.shapeId, target.field, target.fieldType, loc),
+            type: target.fieldType,
+            loc,
+        };
+    }
     return {
         kind: "recordGet",
         obj: target.obj,
@@ -4010,7 +4648,10 @@ const ERROR_CONSTRUCTOR_VALUES = new Set([
  * constructor, and dynamic values answer `.constructor` with the same one,
  * so `o.constructor === Object` and `err.constructor === TypeError` are
  * exact identity tests, and `err.constructor.name` is the constructor's
- * name. */
+ * name. SharedArrayBuffer, DataView, BigInt64Array, BigUint64Array and
+ * Proxy have values with Node's name, length and instanceof answers;
+ * calling one throws Node's TypeError, and constructing through the value
+ * is fenced. */
 const GLOBAL_CONSTRUCTOR_VALUES = new Set([
     "Object",
     "Function",
@@ -4022,6 +4663,11 @@ const GLOBAL_CONSTRUCTOR_VALUES = new Set([
     "WeakMap",
     "WeakSet",
     "FinalizationRegistry",
+    "SharedArrayBuffer",
+    "DataView",
+    "BigInt64Array",
+    "BigUint64Array",
+    "Proxy",
     ...ERROR_CONSTRUCTOR_VALUES,
 ]);
 /** The builtin global functions JavaScript sources read as interned
@@ -4190,6 +4836,94 @@ const OBJECT_PROTOTYPE_VALUE_READS = new Set([
     "hasOwnProperty",
     "propertyIsEnumerable",
 ]);
+/** The method names each weak collection's prototype declares. */
+const WEAK_COLLECTION_METHOD_NAMES = {
+    WeakMap: new Set(["get", "set", "has", "delete"]),
+    WeakSet: new Set(["add", "has", "delete"]),
+};
+/** A weak-collection method read as a VALUE (`wm.has`, the
+ * `map.has.call(x, k)` brand-check tests): the runtime's interned prototype
+ * function for that name, which applies the method to its own receiver and
+ * throws Node's brand-check TypeError when that receiver is not a
+ * WeakMap/WeakSet. A receiver typed `WeakMap | WeakSet` picks the function by
+ * the collection the value holds, and one that admits `null`/`undefined`
+ * throws the property-read TypeError the read itself throws in Node. Only
+ * JavaScript sources take this path: a typed source keeps its refusal (the
+ * checker's signature has no value form). The receiver expression still runs
+ * for its effects. */
+function weakCollectionMethodValue(lowerer, expr, prototypes, nullable, name) {
+    const loc = locOf(expr);
+    const method = (prototype) => WEAK_COLLECTION_METHOD_NAMES[prototype].has(name)
+        ? {
+            kind: "libCall",
+            fn: "dyn.builtinMethod",
+            args: [
+                { kind: "strLit", value: prototype, type: STRING, loc },
+                { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
+            ],
+            type: DYN,
+            loc,
+        }
+        : // The collection without the method reads it as undefined.
+            dynUndefinedExpr(loc);
+    const receiver = lowerer.lowerExpr(expr.expression);
+    if (!nullable && prototypes.length === 1) {
+        const value = method(prototypes[0]);
+        return isSafeToDiscard(receiver)
+            ? value
+            : {
+                kind: "seqExpr",
+                stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr.expression) }],
+                result: value,
+                type: DYN,
+                loc,
+            };
+    }
+    // The receiver answers the kind and unit tests below, so it waits in a
+    // hidden local.
+    const held = lowerer.declareHiddenLocal("%weakRecv", DYN);
+    const ref = () => varRef(held.id, DYN, loc);
+    let value = method(prototypes[0]);
+    if (prototypes.length > 1)
+        value = {
+            kind: "ternary",
+            cond: { kind: "libCall", fn: "weakMap.is", args: [ref()], type: BOOL, loc },
+            then: method("WeakMap"),
+            else_: method("WeakSet"),
+            type: DYN,
+            loc,
+        };
+    if (nullable)
+        value = {
+            kind: "ternary",
+            cond: { kind: "dynTest", test: "nullish", value: ref(), type: BOOL, loc },
+            // Node throws from the read itself, naming the unit and the member.
+            then: {
+                kind: "dynKeyGet",
+                value: ref(),
+                key: { kind: "strLit", value: name, type: STRING, loc },
+                type: DYN,
+                loc,
+            },
+            else_: value,
+            type: DYN,
+            loc,
+        };
+    return {
+        kind: "seqExpr",
+        stmts: [
+            {
+                kind: "varDecl",
+                localId: held.id,
+                init: lowerer.coerceInto(expr.expression, receiver, DYN),
+                loc,
+            },
+        ],
+        result: value,
+        type: DYN,
+        loc,
+    };
+}
 /** Whether `expr` is the callee of a call (`o.toString()`), which keeps its
  * call lowering rather than reading the member as a value. */
 function isCalleeOf(expr) {
@@ -4388,4 +5122,54 @@ function globalThisWrittenNames(lowerer, globalType) {
     }
     return names;
 }
+/** `Number.prototype` / `Boolean.prototype` in a JavaScript source: the
+ * prototype object the checked-dynamic world builds (with its methods), or
+ * one of its members read as a value. Typed sources keep their own
+ * lowering, so no typed program links the unit that builds it. */
+function jsPrimitivePrototypeValue(lowerer, expr) {
+    if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        return null;
+    const loc = locOf(expr);
+    const value = (kind) => ({
+        kind: "libCall",
+        fn: "dyn.builtinPrototype",
+        args: [{ kind: "strLit", value: kind, type: STRING, loc }],
+        type: DYN,
+        loc,
+    });
+    const receiver = expr.expression;
+    if (ts.isPropertyAccessExpression(receiver) && receiver.name.text === "prototype") {
+        const kind = primitivePrototypeKind(lowerer, receiver);
+        if (!kind)
+            return null;
+        return {
+            kind: "dynKeyGet",
+            value: value(kind),
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+            type: DYN,
+            loc,
+        };
+    }
+    const kind = primitivePrototypeKind(lowerer, expr);
+    return kind ? value(kind) : null;
+}
+/** Whether `expr` names `Number.prototype` or `Boolean.prototype` in a
+ * JavaScript source, which lowers to the prototype object above rather than
+ * to the wrapper interface's numeric/boolean value. */
+export function isPrimitivePrototypeRead(lowerer, expr) {
+    return primitivePrototypeKind(lowerer, expr) !== null;
+}
+/** The kind whose prototype `expr` names (`Number.prototype`) in a
+ * JavaScript source, if any. */
+function primitivePrototypeKind(lowerer, expr) {
+    if (!ts.isPropertyAccessExpression(expr) || expr.name.text !== "prototype")
+        return null;
+    if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        return null;
+    if (lowerer.stdlibGlobalMember(expr, "Number") === "prototype")
+        return "Number";
+    if (lowerer.stdlibGlobalMember(expr, "Boolean") === "prototype")
+        return "Boolean";
+    return null;
+}
 //# sourceMappingURL=property-access.js.map