@scriptc/compiler 0.4.6 → 0.4.7

package/dist/frontend/lowering/lower-calls.js

@@ -1,6 +1,9 @@
+import { programCreatesWrappers } from "./primitive-wrappers.js";
 import { arrayClassMemberOwner, arrayClassReceiver, lowerArrayClassStaticCall, } from "./builtins/array-classes.js";
 import { structuralCallInstance } from "./structural-instances.js";
+import { classViewOf } from "./class-views.js";
 import { checkedPrivateMethodReceiver, privateNameClass } from "./private-brands.js";
+import { lowerStaticPrivateCall } from "./private-statics.js";
 import { assertFunctionAliasOf } from "./lower-assert.js";
 import { keyedHelperName } from "./stable-names.js";
 import { perKeyOrder } from "./key-order-witness.js";
@@ -38,7 +41,7 @@ import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
 import { lowerReadlineDisposeCall } from "./builtins/readline.js";
 import { errorToStringCall } from "./error-methods.js";
 import { lowerClassPrototypeAssign, lowerClassPrototypeDescriptors } from "./class-prototypes.js";
-import { BYTES_ELEMENT_NAME, BYTES_U8, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, shapeKeyOrders, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
+import { BYTES_ELEMENT_NAME, BYTES_U8, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, recordTextCodecClass, shapeHasAccessorSlots, shapeKeyOrders, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
 import { lowerProtocolMethodCall } from "./class-protocol-dispatch.js";
 import { isJsSourceFile, locOf, requireSpecOf } from "../program.js";
 import { isPackageShimFile, isShimIntrinsicName } from "../package-shims.js";
@@ -56,6 +59,7 @@ import { lowerGeneratorHelperCall, lowerHelperReturnCall, lowerIteratorFromCall,
 import { lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, } from "./containers/indexed-objects.js";
 import { lowerTupleReadMethodCall } from "./containers/array-methods.js";
 import { tryFuseIndexRead } from "./array-values.js";
+import { isPrimitivePrototypeRead } from "./expressions/property-access.js";
 import { lowerBufferConstruct, lowerBytesPrototypeSetCall, lowerBytesStaticCall, } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall, isDynPrimitiveKindMethod, lowerDynPrimitiveMethodCall, lowerExtraNumberMethodCall, } from "./containers/string-and-regexp.js";
 import { createRequireSpecOf } from "./builtins/module-bindings.js";
@@ -69,7 +73,7 @@ import { lowerDirentMethodCall, lowerFileHandleMethodCall, lowerDirMethodCall, l
 import { fencePerfEntryKeyWalk, isPerfEntryType, lowerHistogramMethodCall, lowerPerfHooksCall, perfEntryTag, } from "./builtins/performance.js";
 import { fenceX509KeyWalk } from "./builtins/x509.js";
 import { lowerProcStreamMethodCall, lowerProcessBuiltinModuleNamespace, } from "./builtins/process.js";
-import { recordMayKeepSource, throughRecordSource } from "./record-sources.js";
+import { recordMayKeepSource, recordSourceTest, throughRecordSource } from "./record-sources.js";
 import { lowerReflectCall } from "./builtins/reflection.js";
 import { lowerAbsenceProbe, v8CalleeText, lowerPromiseAllTupleCall, lowerPromiseRejectCall, lowerToNumberArgument, stringWrapperToString, symbolFieldInfo, templateRawTextOf, primitiveCtorClosure, } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
@@ -88,7 +92,8 @@ import { lowerConsoleInstanceCall, lowerConsoleMethodCall, lowerConsoleOutput, }
 import { STREAM_API_MEMBERS, STREAM_OPERATORS, lowerStreamMethodCall, lowerStreamStaticCall, streamSidesOf, } from "./lower-stream.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, ambientUndefinedFnSymbolOf, contextualUndefReadType, fenceEarlyAliasUse, fenceEarlyNsMemberRef, nsMemberIdentOf, nsUndefRead, } from "./lower-namespaces.js";
 import { expandoMemberRead } from "./lower-expando.js";
-import { fenceNodeModuleMutationCall, lowerRequireCacheKeys } from "./lower-node-module.js";
+import { fenceNodeModuleMutationCall, isCjsRequireGlobal, lowerRequireCacheKeys, } from "./lower-node-module.js";
+import { pathModuleValue } from "./lower-builtin-values.js";
 import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedArgument, positionNumber, } from "./optional-arguments.js";
 import { fenceSymbolFieldCopy } from "./symbol-fields.js";
 import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
@@ -106,6 +111,7 @@ import { maybePromiseReturnStmt, promiseArmedUnionOf, promiseOrUnitUnionOf, } fr
 import { requireObjLitGenericReceiver, objLitGenericFnNodeOf, objLitGenericFnInfoOf, genericCallInstance, } from "./generic-functions.js";
 import { codeGenerationCalleeOf, lowerCodeGenerationCall } from "./code-generation.js";
 import { lowerRecordInheritedCall } from "./record-inherited.js";
+import { fenceDatePrototypeWriteCall } from "./expressions/property-access.js";
 const ZLIB_STREAM_METHODS = new Set(["flush", "params", "close", "reset"]);
 /** The node:util member a `(0, member)` callee names, or null. */
 function indirectUtilCalleeOf(lowerer, callee) {
@@ -269,6 +275,20 @@ export function lowerCall(lowerer, expr) {
         if (inlineValue)
             return inlineValue;
     }
+    // `require("path/posix")` of a builtin as a value: the module's
+    // namespace, as a `const posix = require("path/posix")` binding is.
+    if (ts.isIdentifier(expr.expression) &&
+        expr.expression.text === "require" &&
+        isCjsRequireGlobal(lowerer, expr.expression)) {
+        const module = lowerer.builtinNamespaceModuleOf(expr);
+        // The platform namespaces are the path module objects.
+        if (module === "path/posix" || module === "path/win32")
+            return pathModuleValue(lowerer, module, loc);
+        if (module !== null && module !== "constants") {
+            const moduleId = `builtin:${module}`;
+            return { kind: "moduleNsRef", moduleId, type: { kind: "moduleNs", moduleId }, loc };
+        }
+    }
     // A call whose chain ROOTS at an ambient-undefined name (`declare
     // const value: Y | undefined; value?.foo("a")`, `declare function
     // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -441,6 +461,9 @@ export function lowerCall(lowerer, expr) {
     if (ts.isPropertyAccessExpression(expr.expression) &&
         ts.isPrivateIdentifier(expr.expression.name) &&
         !expr.expression.questionDotToken) {
+        const staticPrivate = lowerStaticPrivateCall(lowerer, expr, expr.expression);
+        if (staticPrivate)
+            return staticPrivate;
         const privateCall = lowerCheckedPrivateMethodCall(lowerer, expr, expr.expression);
         if (privateCall)
             return privateCall;
@@ -1561,6 +1584,11 @@ export function lowerCall(lowerer, expr) {
                 lowerer.unsupported("SC1090", expr, `calls of the generic method '${expr.expression.name.text}' through this receiver (no compiled declaration with a body resolves statically here — ambient 'declare class' and interface-only methods are signature-only, and only class, static, and object-literal generic methods with bodies monomorphize)`);
             }
         }
+        {
+            const unionCall = lowerUnionReceiverMethodCall(lowerer, expr, expr.expression);
+            if (unionCall)
+                return unionCall;
+        }
         lowerer.unsupported("SC1090", expr, `method calls like '${ts.getTextOfNode(expr.expression)}'`);
     }
     // `s[Symbol.iterator]()` on a string: the string iterator as a value.
@@ -1753,7 +1781,7 @@ function callableInstanceStringCall(lowerer, expr, callee, loc) {
 }
 /** A call through an evaluated callee value: checked-dynamic callees,
  * function unions, typed-rest and runtime-arity closures. */
-function lowerCallThroughValue(lowerer, expr, callee, loc) {
+export function lowerCallThroughValue(lowerer, expr, callee, loc) {
     // A CHECKED-DYNAMIC callee — `fn(a, b)` where fn is an implicit-any
     // JS binding (the mustCall body's `fn(...args)`), a dyn capture, or a
     // keyed read off a dyn value: the dynCall boundary. Arguments convert
@@ -2283,8 +2311,12 @@ function objectToStringTag(lowerer, type) {
             return "Symbol";
         case "array":
             return "Array";
-        case "record":
-            return "Object";
+        case "record": {
+            // TextEncoder and TextDecoder define Symbol.toStringTag on their
+            // prototypes.
+            const shape = lowerer.shapes.get(type.shapeId);
+            return (shape && recordTextCodecClass(shape)) ?? "Object";
+        }
         case "func":
         case "classval":
             return "Function";
@@ -2393,6 +2425,29 @@ function immediateObjectTagReceiver(lowerer, node) {
     }
     return null;
 }
+/** Array.prototype methods whose `.<name>.call(receiver, ...)` form the
+ * array-like unit runs generically when `receiver` is not a native array:
+ * the rest of the prototype's methods besides the invoke unit's own set
+ * (at, slice, indexOf, lastIndexOf, includes and the higher-order
+ * callbacks). */
+const ARRAY_LIKE_BORROW_METHODS = new Set([
+    "concat",
+    "copyWithin",
+    "fill",
+    "flat",
+    "flatMap",
+    "join",
+    "pop",
+    "push",
+    "reverse",
+    "shift",
+    "splice",
+    "toReversed",
+    "toSorted",
+    "toSpliced",
+    "unshift",
+    "with",
+]);
 const ARRAY_BORROW_METHODS = new Set([
     "at",
     "every",
@@ -2421,7 +2476,7 @@ function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
         return null;
     const method = access.expression;
     if (method.questionDotToken ||
-        !ARRAY_BORROW_METHODS.has(method.name.text) ||
+        !(ARRAY_BORROW_METHODS.has(method.name.text) || ARRAY_LIKE_BORROW_METHODS.has(method.name.text)) ||
         !ts.isPropertyAccessExpression(method.expression) ||
         method.expression.questionDotToken ||
         method.expression.name.text !== "prototype" ||
@@ -2435,7 +2490,12 @@ function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
     const args = call.arguments.nodes.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN));
     return {
         kind: "libCall",
-        fn: "dyn.arrayProtoCall",
+        // The array-like unit runs an extended method's algorithm over a
+        // receiver that is not a native array and delegates the rest to the
+        // invoke unit's dispatch.
+        fn: ARRAY_LIKE_BORROW_METHODS.has(method.name.text)
+            ? "dyn.arrayLikeProtoCall"
+            : "dyn.arrayProtoCall",
         args: [
             receiver,
             { kind: "strLit", value: method.name.text, type: STRING, loc },
@@ -3062,6 +3122,57 @@ function isFreshCallResult(node) {
         e = e.expression;
     return ts.isCallExpression(e);
 }
+/** A METHOD call on a union receiver whose arms declare the member with
+ * DIFFERENT signatures (`OAuthAuth | ApiKeyAuth` both declare `login`, one
+ * with an options parameter): no single static signature picks an arm, and
+ * JavaScript does not pick one either — it reads the property off the value
+ * and calls it. Box the receiver into the checked-dynamic value and lower
+ * the read and the call dynamically, so the member lookup and the call stay
+ * checked (a missing member throws V8's own TypeError) and the result
+ * crosses back through the expected type's checked conversion. Null when
+ * the receiver is not a union of object/record arms with a dyn-safe layout,
+ * leaving the method-call fence in place. */
+function lowerUnionReceiverMethodCall(lowerer, call, access) {
+    if (access.questionDotToken || call.questionDotToken)
+        return null;
+    if (call.arguments.nodes.some(ts.isSpreadElement))
+        return null;
+    const value = tryLowerExpression(lowerer, access.expression);
+    if (value?.type.kind !== "union")
+        return null;
+    const union = lowerer.unions.get(value.type.unionId);
+    if (!union || !union.arms.every((arm) => arm.kind === "object" || arm.kind === "record")) {
+        return null;
+    }
+    if (!lowerer.dynConvertible(value.type))
+        return null;
+    const loc = locOf(call);
+    const boxed = lowerer.coerceToExpected(value, DYN);
+    const local = lowerer.declareHiddenLocal("%unionReceiver", DYN);
+    const receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
+    const member = {
+        kind: "dynKeyGet",
+        value: receiver,
+        key: { kind: "strLit", value: access.name.text, type: STRING, loc },
+        type: DYN,
+        loc,
+    };
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: local.id, init: boxed, loc }],
+        result: {
+            kind: "dynCall",
+            callee: member,
+            receiver,
+            calleeName: ts.getTextOfNode(access),
+            args: call.arguments.nodes.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+            type: DYN,
+            loc,
+        },
+        type: DYN,
+        loc,
+    };
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's dyn kind, extract, and ride the STATIC method machinery — the
@@ -3277,6 +3388,12 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         recv = lowerer.coerceToExpected(recv, DYN);
     if (recv.type.kind !== "dyn")
         return null;
+    // `Number.prototype.m(...)` reads the prototype OBJECT, whose `m` is its
+    // own member, so every primitive specialization below — which assumes a
+    // primitive receiver and coerces the value it is given — would be wrong.
+    // The shared dispatch reads the member and calls it with the prototype as
+    // `this`, which is Node's answer for the wrapper around +0 / false.
+    const prototypeReceiver = isPrimitivePrototypeRead(lowerer, access.expression);
     if (access.name.text === "normalize" &&
         call.arguments.nodes.length <= 1 &&
         !call.arguments.nodes.some(ts.isSpreadElement)) {
@@ -3383,7 +3500,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // prototype declares (Array carries includes/indexOf/slice too), so no
     // other kind inherits them. Shared names would need a receiver-kind
     // dispatch — they keep the fence.
-    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable) {
+    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable && !prototypeReceiver) {
         // A checked-dynamic object can still carry its OWN member of that
         // name: zod's schemas assign `trim`, `toLowerCase` and `startsWith`
         // in their constructors (`z.string().trim().min(1)`), an object's
@@ -3394,9 +3511,10 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         // receiver's runtime kind: a string runs the string lowering, anything
         // else calls its member as Node does.
         if ((checkerUntyped ||
-            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) &&
-            !call.questionDotToken &&
-            !access.questionDotToken &&
+            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0 ||
+            // A receiver of the boxed String type may be a wrapper object.
+            (lowerer.createsWrappers ??= programCreatesWrappers(lowerer))) &&
+            !lowerer.chainBlocked(call, access) &&
             !call.arguments.nodes.some(ts.isSpreadElement))
             return lowerStringOrMemberCall(lowerer, call, access, recv);
         const checked = () => dynStringReceiver(lowerer, recv, access);
@@ -3408,8 +3526,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // or number receiver runs the typed lowering, every other kind keeps the
     // runtime dispatch.
     if (!ownCallable &&
-        !call.questionDotToken &&
-        !access.questionDotToken &&
+        !prototypeReceiver &&
         isDynPrimitiveKindMethod(access.name.text) &&
         !lowerer.chainBlocked(access, call)) {
         const primitive = lowerDynPrimitiveMethodCall(lowerer, call, access.name.text, ts.getTextOfNode(access), recv);
@@ -3423,6 +3540,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     if (access.name.text === "toString" &&
         call.arguments.nodes.length <= 1 &&
         !ownCallable &&
+        !prototypeReceiver &&
         !(checkerUntyped && jsAssignsOwnToString(lowerer, access.expression))) {
         const argument = call.arguments.nodes[0];
         return {
@@ -3440,7 +3558,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // Every dyn kind's prototype chain declares valueOf, and the runtime
     // answers each kind's own: primitives and plain objects themselves, a
     // Date its time value, an own or inherited valueOf member its result.
-    if (access.name.text === "valueOf" && call.arguments.nodes.length === 0) {
+    if (access.name.text === "valueOf" && call.arguments.nodes.length === 0 && !prototypeReceiver) {
         const webAssembly = lowerWebAssemblyValueOf(lowerer, access.expression, recv, locOf(call));
         if (webAssembly !== null)
             return webAssembly;
@@ -3537,9 +3655,13 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         !ownToString &&
         !stringOnlyName)
         return null;
-    // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
-    // machinery's short-circuit semantics — not modeled here yet.
-    if (call.questionDotToken || access.questionDotToken)
+    // An UNHANDLED `?.` step (`obj.cb?.()`, `obj?.cb()`) belongs to the chain
+    // machinery's short-circuit semantics. Inside the guarded body of a chain
+    // the active lowering has ALREADY proven the receiver present, so the
+    // step is a plain read-and-call there — the same "read the member, call
+    // it" shape below, with `dynCall` throwing Node's catchable
+    // "obj.cb is not a function" for a present but non-callable member.
+    if (lowerer.chainBlocked(call, access))
         return null;
     const loc = locOf(call);
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
@@ -3604,7 +3726,24 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
     const loc = locOf(call);
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
     const receiver = varRef(receiverLocal.id, DYN, loc);
-    const isString = { kind: "dynTest", test: "string", value: receiver, type: BOOL, loc };
+    const nameLit = { kind: "strLit", value: access.name.text, type: STRING, loc };
+    const receiverIsString = {
+        kind: "dynTest",
+        test: "string",
+        value: receiver,
+        type: BOOL,
+        loc,
+    };
+    // In a program that creates wrapper objects, a receiver whose member is
+    // the builtin String.prototype method runs the string lowering on
+    // ToString of the receiver, after the arguments, as the builtin does.
+    // The member is read once: the check inspects the value the call read.
+    const wrappers = (lowerer.createsWrappers ??= programCreatesWrappers(lowerer));
+    const builtinLocal = wrappers ? lowerer.declareHiddenLocal("%dynCallStringMethod", BOOL) : null;
+    const isString = builtinLocal
+        ? { kind: "varRef", localId: builtinLocal.id, type: BOOL, loc }
+        : receiverIsString;
+    const stringLocal = wrappers ? lowerer.declareHiddenLocal("%dynCallString", DYN) : null;
     const calleeLocal = lowerer.declareHiddenLocal("%dynCallCallee", DYN);
     const callee = varRef(calleeLocal.id, DYN, loc);
     const stmts = [
@@ -3614,7 +3753,7 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             localId: calleeLocal.id,
             init: {
                 kind: "ternary",
-                cond: isString,
+                cond: receiverIsString,
                 then: dynUndefinedExpr(loc),
                 else_: {
                     kind: "dynKeyGet",
@@ -3628,16 +3767,52 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             },
             loc,
         },
+        ...(builtinLocal
+            ? [
+                {
+                    kind: "varDecl",
+                    localId: builtinLocal.id,
+                    init: {
+                        kind: "logical",
+                        op: "||",
+                        left: receiverIsString,
+                        right: {
+                            kind: "libCall",
+                            fn: "wrapper.isStringMethod",
+                            args: [callee, nameLit],
+                            type: BOOL,
+                            loc,
+                        },
+                        type: BOOL,
+                        loc,
+                    },
+                    loc,
+                },
+            ]
+            : []),
     ];
     const args = call.arguments.nodes.map((node) => {
-        const value = lowerer.lowerExpr(node);
+        const lowered = lowerer.lowerExpr(node);
+        // A unit-typed argument (`f()` of a void function, a literal undefined
+        // or null) has no local storage of its own: hold it as the dynamic
+        // value both branches receive.
+        const value = lowered.type.kind === "void" ||
+            lowered.type.kind === "undefinedT" ||
+            lowered.type.kind === "nullT"
+            ? lowerer.coerceToExpected(lowered, DYN)
+            : lowered;
         const local = lowerer.declareHiddenLocal("%dynCallArg", value.type);
         stmts.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
         return { node, value: varRef(local.id, value.type, value.loc) };
     });
     // String.prototype methods ignore arguments past the ones they read.
     const arity = DYN_STRING_ONLY_ARITY[access.name.text] ?? call.arguments.nodes.length;
-    const stringReceiver = () => ({ kind: "dynCheck", value: receiver, type: STRING, loc });
+    const stringReceiver = () => ({
+        kind: "dynCheck",
+        value: stringLocal ? varRef(stringLocal.id, DYN, loc) : receiver,
+        type: STRING,
+        loc,
+    });
     const lowerString = () => (call.arguments.nodes.length <= arity
         ? lowerRegexMethodCall(lowerer, call, access, stringReceiver)
         : null) ??
@@ -3659,7 +3834,35 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             kind: "ternary",
             cond: isString,
             then: stringCall
-                ? lowerer.coerceToExpected(stringCall, DYN)
+                ? stringLocal
+                    ? {
+                        kind: "seqExpr",
+                        stmts: [
+                            {
+                                kind: "varDecl",
+                                localId: stringLocal.id,
+                                init: {
+                                    kind: "ternary",
+                                    cond: receiverIsString,
+                                    then: receiver,
+                                    else_: {
+                                        kind: "libCall",
+                                        fn: "wrapper.thisString",
+                                        args: [receiver, nameLit],
+                                        type: DYN,
+                                        loc,
+                                    },
+                                    type: DYN,
+                                    loc,
+                                },
+                                loc,
+                            },
+                        ],
+                        result: lowerer.coerceToExpected(stringCall, DYN),
+                        type: DYN,
+                        loc,
+                    }
+                    : lowerer.coerceToExpected(stringCall, DYN)
                 : nodeThrowExpr(0, "SC1090", `method calls like '${ts.getTextOfNode(access)}' on a string are not supported yet [SC1090 at ${ts.getSourceFileOfNode(call).fileName}:${ts.getLineAndCharacterOfPosition(ts.getSourceFileOfNode(call), ts.tokenStartOfNode(call)).line + 1}]`, DYN, loc),
             else_: memberCall,
             type: DYN,
@@ -4713,17 +4916,57 @@ function lowerPrimitiveProtoCall(lowerer, call, recv, name, memberSym) {
     }
     // Number.prototype.toLocaleString("en-US") — the spec makes it
     // NumberFormat(locale).format(this), so the en-US embedded formatter
-    // answers exactly. The unlowered forms fence by NAME: no locale (the
-    // host environment's default, which a compiled binary cannot carry),
-    // other locales (ICU data the binary does not embed), options bags.
+    // answers exactly. Without a locale (or with `undefined`) the DEFAULT
+    // locale answers, over the ICU data scr_intl.c loads; other locales and
+    // options bags stay fenced.
     if (name === "toLocaleString" && recvKind === "f64") {
-        if (call.arguments.nodes.length === 0) {
-            lowerer.noLowering("Number.prototype.toLocaleString without a locale", call, "the default locale is the host environment's, which a compiled binary cannot carry — " +
-                'pass it explicitly: x.toLocaleString("en-US")');
+        // Exactly undefined (or void): what the absent form means. A union that
+        // merely includes undefined may hold a locale at run time and falls
+        // through to the refusal below.
+        const isUndefined = (node) => {
+            const flags = lowerer.typeOf(node).flags;
+            return flags === ts.TypeFlags.Undefined || flags === ts.TypeFlags.Void;
+        };
+        const defaultLocale = call.arguments.nodes.length === 0 ||
+            (call.arguments.nodes.length === 1 &&
+                !ts.isSpreadElement(call.arguments.nodes[0]) &&
+                isUndefined(call.arguments.nodes[0]));
+        if (defaultLocale) {
+            const operand = lowerer.lowerExpr(recv);
+            if (operand.type.kind !== "f64")
+                return null;
+            const stmts = [];
+            let formatted = operand;
+            if (call.arguments.nodes.length === 1) {
+                // An explicit undefined may be any expression that evaluates to it
+                // (a call, a variable), so it still runs, after the receiver and
+                // before the formatting: the receiver's value is read first, so an
+                // argument that writes it does not change the number formatted. Its
+                // unit value has no standalone representation, so it is coerced
+                // into the dynamic slot every argument occupies.
+                const receiver = lowerer.declareHiddenLocal("%localeReceiver", F64);
+                stmts.push({ kind: "varDecl", localId: receiver.id, init: operand, loc });
+                formatted = varRef(receiver.id, F64, loc);
+                const arg = call.arguments.nodes[0];
+                const value = lowerer.lowerExpr(arg);
+                stmts.push({
+                    kind: "exprStmt",
+                    expr: value.type.kind === "void" ? value : lowerer.coerceInto(arg, value, DYN),
+                    loc,
+                });
+            }
+            const call_ = {
+                kind: "libCall",
+                fn: "icu.numFormatDefault",
+                args: [formatted],
+                type: STRING,
+                loc,
+            };
+            return stmts.length ? { kind: "seqExpr", stmts, result: call_, type: STRING, loc } : call_;
         }
         if (call.arguments.nodes.length > 1) {
-            lowerer.noLowering("Number.prototype.toLocaleString with an options bag", call, "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction " +
-                'digits, grouping) — x.toLocaleString("en-US")');
+            lowerer.noLowering("Number.prototype.toLocaleString with an options bag", call, "what lowers is the DEFAULT options shape (decimal notation, up to 3 fraction digits, " +
+                "grouping) at the default locale or at en-US — omit the options bag");
         }
         const locNode = call.arguments.nodes[0];
         if (ts.isSpreadElement(locNode) ||
@@ -4731,8 +4974,8 @@ function lowerPrimitiveProtoCall(lowerer, call, recv, name, memberSym) {
             locNode.text !== "en-US") {
             lowerer.noLowering(!ts.isSpreadElement(locNode) && ts.isStringLiteralLike(locNode)
                 ? `Number.prototype.toLocaleString at locale "${locNode.text}"`
-                : "Number.prototype.toLocaleString with a non-literal locale", locNode, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
-                "everything else is ICU data the binary does not carry");
+                : "Number.prototype.toLocaleString with a non-literal locale", locNode, "what lowers is the default locale (no argument) and the composed en-US form — " +
+                "other locales are ICU data the binary does not negotiate yet");
         }
         const operand = lowerer.lowerExpr(recv);
         if (operand.type.kind !== "f64")
@@ -6506,6 +6749,33 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
             }
             body.push(...perKeyOrder(current, ref, walks, loc));
             body.push({ kind: "return", value: outRef, loc });
+            // A record that kept undeclared keys answers for-in through its live
+            // kept view, exactly as Object.keys does at its call site. Gated on
+            // the shape being one a kept width spread builds (a shape that keeps
+            // no source stays byte-identical to main) and on the shape holding a
+            // source at all.
+            if (lowerer.keyOrder.keptSourceShapes.has(argIr.shapeId) &&
+                recordMayKeepSource(lowerer, argIr)) {
+                body.unshift({
+                    kind: "if",
+                    cond: recordSourceTest(ref, loc),
+                    then: [
+                        {
+                            kind: "return",
+                            value: {
+                                kind: "libCall",
+                                fn: "dyn.objKeyStrings",
+                                args: [{ kind: "dynFrom", value: ref, liveRef: true, type: DYN, loc }],
+                                type: resultT,
+                                loc,
+                            },
+                            loc,
+                        },
+                    ],
+                    else_: null,
+                    loc,
+                });
+            }
             fn.body = body;
         };
         finalize();
@@ -6567,6 +6837,35 @@ export function recordHasOwnHelper(lowerer, shapeId, loc) {
         body,
         loc,
     });
+    // A record that kept undeclared keys answers an undeclared key through
+    // its kept view: the declared branches above stay exact (the table's
+    // placeholders only fill declared names the record owns), and the
+    // closed-shape `false` fallback becomes the view's own-key test when a
+    // kept width spread builds this shape.
+    if (!shape.indexValue && recordMayKeepSource(lowerer, recT)) {
+        const fn = lowerer.liftedFns[lowerer.liftedFns.length - 1];
+        lowerer.shapeOrderHelperFinalizers.push(() => {
+            if (!lowerer.keyOrder.keptSourceShapes.has(shapeId))
+                return;
+            const last = fn.body[fn.body.length - 1];
+            if (last.kind !== "return")
+                return;
+            last.value = {
+                kind: "logical",
+                op: "&&",
+                left: recordSourceTest(rRef, loc),
+                right: {
+                    kind: "libCall",
+                    fn: "dyn.hasOwn",
+                    args: [{ kind: "dynFrom", value: rRef, liveRef: true, type: DYN, loc }, kRef],
+                    type: BOOL,
+                    loc,
+                },
+                type: BOOL,
+                loc,
+            };
+        });
+    }
     return helper;
 }
 /** Whether `Object.assign(instance, record)` can copy every field of the
@@ -6839,6 +7138,44 @@ function isDynEntryPairsType(lowerer, t) {
     const field = (name) => shape.fields.find((f) => f.name === name)?.type;
     return field("0")?.kind === "string" && field("1")?.kind === "dyn";
 }
+/** True when the expression is statically a PLAIN OBJECT at runtime: a dyn
+ *  object literal, or a record (a literal, a clone, or any expression of a
+ *  record type, which dynFrom boxes field by field). Both build an ordinary
+ *  object whose fields are own data properties, which the plain-object
+ *  descriptor reader answers exactly. Every other expression (a variable of
+ *  any other type, a call, an array, a function) may be an object of any
+ *  kind with inherited fields, so it takes the entry points whose
+ *  ToPropertyDescriptor reads every object kind (dyn.definePropertyShapes
+ *  and its siblings). */
+export function isPlainObjectLiteral(expr) {
+    if (expr.kind === "dynObjLit")
+        return true;
+    if (expr.kind !== "dynFrom")
+        return false;
+    const value = expr.value;
+    return value.kind === "dynObjLit" || value.type.kind === "record";
+}
+/** True when the expression is a plain property-descriptor map for
+ *  Object.defineProperties or Object.create: a plain object
+ *  (isPlainObjectLiteral) whose every field is a plain object too. A dyn
+ *  literal's field values are checked with isPlainObjectLiteral and a
+ *  record's fields by their types, since dynFrom boxes a record-typed field
+ *  into an ordinary object. A map with any other field (`{ a: view }`, where
+ *  `view` is a DataView or an array) takes the any-object entry points. */
+export function isPlainDescriptorMap(expr, getRecord) {
+    if (!isPlainObjectLiteral(expr))
+        return false;
+    const literal = expr.kind === "dynFrom" ? expr.value : expr;
+    if (literal.kind === "dynObjLit")
+        return (literal.fields ?? []).every((field) => isPlainObjectLiteral(field.value));
+    if (literal.type.kind !== "record")
+        return false;
+    const shape = getRecord(literal.type.shapeId);
+    return (shape !== undefined &&
+        !shape.tuple &&
+        shape.indexValue === undefined &&
+        shape.fields.every((field) => field.type.kind === "record"));
+}
 function lowerObjectStaticCall(lowerer, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
@@ -6883,6 +7220,16 @@ function lowerObjectStaticCall(lowerer, call, access) {
             object.type.kind === "bool" ||
             isUnitType(object.type))
             object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call) };
+        // An array or class instance reflects through its own checked-dynamic
+        // view (own fields and elements, in property order). A record keeps its
+        // static key walk below when it has one — `getOwnPropertyNames` over a
+        // fixed record is exactly Object.keys' construction, and boxing a typed
+        // record would link the dynamic tier into a program that needs none of
+        // it. The descriptor and symbol forms have no static walk, so a record
+        // takes the view there.
+        const staticWalk = member === "getOwnPropertyNames" && object.type.kind === "record";
+        if (!staticWalk && object.type.kind !== "dyn" && lowerer.dynConvertible(object.type))
+            object = lowerer.coerceToExpected(object, DYN);
         if (object.type.kind === "dyn")
             return {
                 kind: "libCall",
@@ -7133,7 +7480,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (descriptors.type.kind === "dyn")
                 return {
                     kind: "libCall",
-                    fn: "dyn.objCreateWithProperties",
+                    // A descriptor map built by an expression, or a literal map with a
+                    // descriptor built by one, may hold an array, a function or an
+                    // object with inherited fields.
+                    fn: isPlainDescriptorMap(descriptors, (id) => lowerer.shapes.get(id))
+                        ? "dyn.objCreateWithProperties"
+                        : "dyn.objCreateWithPropertiesShapes",
                     args: [proto, descriptors],
                     type: DYN,
                     loc,
@@ -7147,6 +7499,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const prototype = lowerClassPrototypeAssign(lowerer, call);
         if (prototype)
             return prototype;
+        // A standard-library prototype value as the target is a write through it.
+        if (call.arguments.nodes.length > 0)
+            fenceDatePrototypeWriteCall(lowerer, call.arguments.nodes[0]);
         if (isJsSourceFile(ts.getSourceFileOfNode(call)) &&
             call.arguments.nodes.length > 0 &&
             !call.arguments.nodes.some(ts.isSpreadElement)) {
@@ -7220,8 +7575,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
             const sProbe = tryLowerExpression(lowerer, call.arguments.nodes[1]);
             // CHECKED-DYNAMIC target and source (the JS file-scope
             // object-literal identity story): the runtime dyn copy — own
-            // members of the source land on the target, which returns.
-            if (tProbe?.type.kind === "dyn") {
+            // members of the source land on the target, which returns. A
+            // CLASS-INSTANCE target joins them when the call's own RESULT type
+            // is checked-dynamic: that is the `C & { extra }` intersection
+            // (mapClassExpandoIntersection), whose value IS the instance, so
+            // the same dyn copy writes the expando members onto its view and
+            // answers the instance — identity and prototype intact.
+            if (tProbe?.type.kind === "dyn" ||
+                (tProbe?.type.kind === "object" && lowerer.mapTypeOf(lowerer.typeOf(call))?.kind === "dyn")) {
                 const loc = locOf(call);
                 const target = lowerer.lowerExpr(call.arguments.nodes[0]);
                 const rawSource = lowerer.lowerExpr(call.arguments.nodes[1]);
@@ -7232,8 +7593,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 if (ts.isObjectLiteralExpression(targetNode))
                     fenceClassCopyIntoFreshObject(lowerer, call, call.arguments.nodes[1], rawSource);
                 const source = lowerer.coerceToExpected(rawSource, DYN);
-                if (target.type.kind === "dyn" && source.type.kind === "dyn") {
-                    return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
+                const dynTarget = target.type.kind === "dyn" ? target : lowerer.coerceToExpected(target, DYN);
+                if (dynTarget.type.kind === "dyn" && source.type.kind === "dyn") {
+                    return { kind: "libCall", fn: "dyn.assign", args: [dynTarget, source], type: DYN, loc };
                 }
             }
             // A CLASS-INSTANCE target and a plain record source whose fields are
@@ -7439,8 +7801,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         (member === "getOwnPropertyDescriptor" && call.arguments.nodes.length === 2)) {
         if (call.arguments.nodes.some((a) => ts.isSpreadElement(a)))
             return null;
-        let target = tryLowerExpression(lowerer, call.arguments.nodes[0]);
         const targetNode = call.arguments.nodes[0];
+        // Object.defineProperty/defineProperties over a standard-library prototype
+        // value: a typed Date never observes a dynamic definition there, so the
+        // write keeps the fence it reached before the value existed. The
+        // descriptor READ below is not a write and stays open.
+        if (member === "defineProperty")
+            fenceDatePrototypeWriteCall(lowerer, targetNode);
+        let target = tryLowerExpression(lowerer, targetNode);
         // The checker gives C.prototype the instance type, but its lowered
         // value is the shared prototype table, not an instance to unbox.
         const prototypeTarget = ts.isPropertyAccessExpression(targetNode) &&
@@ -7517,7 +7885,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
             return null;
         return {
             kind: "libCall",
-            fn: "dyn.defineProperty",
+            // A descriptor built by an expression may be an array, a function or an
+            // object with inherited fields, which only the any-object entry point
+            // reads; a plain object literal keeps the plain-object reader.
+            fn: isPlainObjectLiteral(descriptor) ? "dyn.defineProperty" : "dyn.definePropertyShapes",
             args: [target, key, descriptor],
             type: DYN,
             loc: locOf(call),
@@ -7533,6 +7904,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (member === "defineProperties" &&
         call.arguments.nodes.length === 2 &&
         !call.arguments.nodes.some((a) => ts.isSpreadElement(a))) {
+        // A standard-library prototype value as the target is a write through it,
+        // exactly like the defineProperty form above: a typed Date never observes
+        // a definition made on the dynamic prototype object.
+        fenceDatePrototypeWriteCall(lowerer, call.arguments.nodes[0]);
         const prototype = lowerClassPrototypeDescriptors(lowerer, call, member);
         if (prototype)
             return prototype;
@@ -7573,7 +7948,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (descs.type.kind === "dyn") {
                 return {
                     kind: "libCall",
-                    fn: "dyn.defineProps",
+                    // As for Object.create above: a descriptor map built by an
+                    // expression, or a literal map with a descriptor built by one, takes
+                    // the any-object entry point.
+                    fn: isPlainDescriptorMap(descs, (id) => lowerer.shapes.get(id))
+                        ? "dyn.defineProps"
+                        : "dyn.definePropsShapes",
                     args: [target, descs],
                     type: DYN,
                     loc: locOf(call),
@@ -9959,7 +10339,8 @@ function maybePromiseHandlerResult(lowerer, call, value, R) {
     }
     return stmt;
 }
-/** `view.m(args)` where `view` is a `Pick<C, K>` / `Omit<C, K>` view of a
+/** `view.m(args)` where `view` is a `Pick<C, K>` / `Omit<C, K>` view (inline
+ * or through type aliases, classViewOf) of a
  * program class C and `m` is one of C's GENERIC methods (its overloads
  * included): generic methods have no dispatchable method value, so the
  * view's live receiver is extracted as the C instance it holds (a checked
@@ -9967,12 +10348,10 @@ function maybePromiseHandlerResult(lowerer, call, value, R) {
  * text naming C) and the call monomorphizes statically against C, the
  * same lowering a C-typed receiver gets. Null for other receivers. */
 function pickViewGenericMethodCall(lowerer, call, access, recvTs) {
-    const alias = recvTs.getAliasSymbol();
-    if (alias === undefined || (ts.symbolName(alias) !== "Pick" && ts.symbolName(alias) !== "Omit"))
-        return null;
-    if (!alias.declarations.every((d) => ts.getSourceFileOfNode(d).isDeclarationFile))
+    const view = classViewOf(lowerer.checker, recvTs);
+    if (view === null)
         return null;
-    const source = recvTs.getAliasTypeArguments()[0];
+    const source = view.source;
     const symbol = source?.getSymbol();
     const info = symbol ? lowerer.classBySymbol.get(symbol) : undefined;
     if (!info || call.questionDotToken || access.questionDotToken)
@@ -9989,7 +10368,7 @@ function pickViewGenericMethodCall(lowerer, call, access, recvTs) {
     if (lowered.type.kind === "object" &&
         lowered.type.className !== info.def.name &&
         !lowerer.isSubclassOf(lowered.type.className, info.def.name)) {
-        lowerer.unsupported("SC1090", access, `calling the generic method '${access.name.text}' through a '${ts.symbolName(alias)}' view of '${info.def.name}' that holds a '${lowerer.fmt(lowered.type)}'`);
+        lowerer.unsupported("SC1090", access, `calling the generic method '${access.name.text}' through a '${view.name}' view of '${info.def.name}' that holds a '${lowerer.fmt(lowered.type)}'`);
     }
     const receiver = lowered.type.kind === "object"
         ? lowered