@scriptc/compiler 0.4.6 → 0.4.8

package/dist/frontend/lowering/expressions/property-access.js

@@ -1,13 +1,20 @@
+import { lowerIteratorMemberValue } from "../iterator-prototype.js";
 import { widensReducedRecords } from "../function-returns.js";
+import { nullishReadTypeError, throwAfterEach } from "../primitive-throws.js";
+import { lowerStaticPrivateRead } from "../private-statics.js";
 import { widthNarrowHelper } from "../coercions/unions.js";
 /* Property reads (`a.b`): lowerExprInner's property-access branch, intrinsic and union properties, field reads and targets, and match-group reads. */
 import { jsSpecialGlobalValue } from "../global-values.js";
+import { HOST_GLOBAL_PROTOTYPE_MEMBERS, HOST_GLOBAL_VALUE_MEMBERS, hostGlobalCallTarget, hostGlobalNameOfMember, hostGlobalNameOfRead, hostGlobalPrototypeOf, } from "../host-globals.js";
+import { hostGlobalValue } from "../host-global-values.js";
+import { globalFunctionValue } from "../global-function-values.js";
 import { arrayClassMemberOwner, arrayClassReceiver, lowerArrayClassConstructorRead, } from "../builtins/array-classes.js";
 import { indexedUnionArms, lowerIndexedUnionMember } from "../indexed-unions.js";
 import { keyedHelperName } from "../stable-names.js";
 import { builtinNamespaceValue } from "../builtin-namespaces.js";
 import { staticallySelected } from "../static-typeof.js";
 import { lowerWebStreamClassRead } from "../builtins/web-streams-dyn.js";
+import { wrapperConstructors } from "../primitive-wrappers.js";
 import * as ts from "../../ts7/adapter.js";
 import { lowerHistogramProperty } from "../builtins/performance.js";
 import { staticFunctionNameRead } from "../static-function-names.js";
@@ -17,7 +24,7 @@ import { isThisParameter } from "../call-signatures.js";
 import { argumentCountSlot, contextualCallCount, usedAsValue } from "../argument-counts.js";
 import { checkedPrivateValue, localPrivateBrandClass, privateNameClass, } from "../private-brands.js";
 import { PoisonError, builtinValueNameOf, jsFuncNameOf, neverTaintedJsType, own, } from "../lowerer.js";
-import { ARRAY_METHODS, MAP_METHODS, NARROW_FIRST, OBJECT_CALLABLE_VALUES, SET_METHODS, STDLIB_SURFACE, STRING_INDEX_METHODS, STR_METHODS, isChildSurfaceMember, stdlibGlobalNameOf, } from "../surfaces.js";
+import { ARRAY_METHODS, MAP_METHODS, NARROW_FIRST, SET_METHODS, STDLIB_SURFACE, STRING_INDEX_METHODS, STR_METHODS, isChildSurfaceMember, stdlibGlobalNameOf, } from "../surfaces.js";
 import { isGenericCallableMemberType, isLegacyUrlSymbol, isOsConstantsType, isParseArgsDynTypeName, } from "../../type-mapper.js";
 import { BIGINT_T, BOOL, BYTES_U8, DYN, F64, NULL_T, SEARCH_PARAMS_T, STRING, SYMBOL_T, UNDEFINED_T, arrayOf, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isUnitType, typeEquals, typeKey, unionContainerArmsOk, BYTES_ELEMENT_SIZE, } from "../../../ir/ir.js";
 import { lowerNavigatorMember, navigatorValue } from "../builtins/navigator.js";
@@ -40,10 +47,11 @@ import { hasOptionalChainGuard, isOptionalChainTail, isRequireMainFilename, } fr
 import { isCjsModuleGlobal, lowerNodeModuleProperty, lowerRequireMainProperty, } from "../lower-node-module.js";
 import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../../ir/build.js";
 import { typedArrayLacksMember } from "../builtins/typed-array-members.js";
-import { TEMPORAL_GLOBAL } from "../../builtin-modules.js";
+import { COMMONJS_MODULE_BINDINGS, TEMPORAL_GLOBAL } from "../../builtin-modules.js";
 import { tryLowerExpression } from "./try-lower-expression.js";
 import { applyDeferredAssertion, assertedReceiverNode, deferredMemberReadTarget, deferredProbeReadAccess, } from "./asserted-receiver.js";
 import { lowerRecordInheritedMember } from "../record-inherited.js";
+import { MUTABLE_BUFFER_MEMBERS } from "../buffers.js";
 import { DATE_METHOD_HINT } from "../builtins/dates.js";
 import { cjsClassExprWholeExportOf, cjsExportAssignmentOf, cjsExportDiscardReason, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isModuleExportsAccess, isNodeEsmFile, locOf, } from "../../program.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, contextualUndefReadType, fenceEarlyNsMemberRef, nsMemberIdentOf, nsUndefRead, } from "../lower-namespaces.js";
@@ -63,9 +71,9 @@ import { npmStaticPackageOfPath } from "../../npm-static.js";
 import { importMetaField, isImportMeta } from "../import-meta.js";
 import { createRequireCalleeFileOf } from "../builtins/module-bindings.js";
 import { createRequireResolveFenceValue, createRequireResolveValue, } from "../builtins/module-resolution.js";
-import { builtinPrototypeMethod, lowerArrayIsArrayValue, lowerCheckedPredicateValue, lowerNumberParserValue, lowerObjectAssignValue, lowerStringCodesValue, } from "../lower-builtin-values.js";
-import { lowerArrayFromValue } from "../containers/array-construction.js";
-import { lowerBufferPrototypeMember } from "../containers/bytes.js";
+import { builtinPrototypeMethod, lowerCheckedPredicateValue } from "../lower-builtin-values.js";
+import { constructorStaticValue, objectFreezeValue } from "../builtin-statics.js";
+import { lowerBufferPrototypeMember, lowerBufferPrototypeObject } from "../containers/bytes.js";
 import { lowerNetAddressStaticRead } from "../builtins/net-address.js";
 import { STATS_TYPE_TESTS } from "../builtins/filesystem.js";
 import { arrayValueRead, arrayValueType } from "../array-values.js";
@@ -74,13 +82,15 @@ import { reflectMemberValue } from "../builtins/reflection.js";
 import { objLitGenericFnInfoOf, objLitGenericFnNodeOf, requireObjLitGenericReceiver, } from "../generic-functions.js";
 import { narrowStoredClassValue, structuralReadType } from "../class-unions.js";
 import { InternalCompilerError } from "../../../errors.js";
-import { lowerUnionFieldRead } from "./union-fields.js";
+import { lowerUnionFieldRead, narrowedArmRead, narrowedUnionView } from "./union-fields.js";
 import { errorPropertyRead } from "../error-methods.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./evaluation-safety.js";
+import { partialAssertionFields, partialFieldRead } from "../partial-assertions.js";
 import { isZlibStreamMember, lowerZlibStreamBytesWritten } from "../builtins/compression.js";
 import { isWebCryptoReceiver } from "../builtins/crypto.js";
 import { isFsStreamMember, lowerFsStreamProperty } from "../builtins/fs-streams.js";
 import { keyedFieldRead } from "./keyed-field-targets.js";
+import { heldEnvValueType } from "../builtins/environment.js";
 import { promisePrototypeValue } from "../thenables.js";
 import { lowerChildPropertyRead } from "../handle-properties.js";
 /** True when a property access names an ABSTRACT property declaration
@@ -156,6 +166,26 @@ function isStatFsDynProperty(lowerer, expr) {
             return false;
         }));
 }
+/** The Iterator.prototype helpers and the iterator members with no typed
+ * value lowering, read as values on a typed iterator in JavaScript.
+ * `next` and `return` answer the function Node's prototype chain holds
+ * (a generator's, or an iterator helper object's); `throw` is not here
+ * because an iterator helper object has none. */
+const TYPED_ITERATOR_MEMBER_VALUES = new Set([
+    "next",
+    "map",
+    "filter",
+    "take",
+    "drop",
+    "flatMap",
+    "reduce",
+    "toArray",
+    "forEach",
+    "some",
+    "every",
+    "find",
+    "return",
+]);
 /** The dgram.Socket methods its checked-dynamic handle answers as
  * function values (scr_dgram.c's scr_dgram_dyn_method_names). */
 const DGRAM_METHOD_VALUES = new Set([
@@ -174,6 +204,22 @@ const DGRAM_METHOD_VALUES = new Set([
     "ref",
     "unref",
 ]);
+/** A lib builtin iterator whose prototype chain holds no `return` in Node
+ * 24: the Array, String, Map and Set iterators. Generators and iterator
+ * helper objects do have one. */
+function builtinIteratorWithoutReturn(lowerer, node) {
+    const symbol = lowerer.typeOf(node).getSymbol();
+    if (symbol === undefined)
+        return false;
+    const name = ts.symbolName(symbol);
+    if (name !== "ArrayIterator" &&
+        name !== "StringIterator" &&
+        name !== "MapIterator" &&
+        name !== "SetIterator")
+        return false;
+    return (symbol.declarations.length > 0 &&
+        symbol.declarations.every((d) => lowerer.isStdlibFile(ts.getSourceFileOfNode(d))));
+}
 function isCreateRequireResolveValue(lowerer, expr) {
     let resolve = expr;
     if (expr.name.text === "paths" &&
@@ -186,9 +232,21 @@ function isCreateRequireResolveValue(lowerer, expr) {
         createRequireCalleeFileOf(lowerer, resolve.expression) !== null);
 }
 export function lowerPropertyAccessExpr(lowerer, expr, loc) {
+    // A JavaScript source reading a member that resizes, grows or detaches a
+    // buffer is the mutableBuffers fact (buffers.ts, t262-dc §2.4). The name
+    // decides: the receiver may be a checked-dynamic value.
+    if (MUTABLE_BUFFER_MEMBERS.has(expr.name.text) && isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        lowerer.buffersMutable = true;
     const arrayClassConstructor = lowerArrayClassConstructorRead(lowerer, expr, loc);
     if (arrayClassConstructor !== null)
         return arrayClassConstructor;
+    // `R.#x` for a static private on a checked-dynamic receiver: the brand
+    // check, then the native storage (private-statics.ts).
+    {
+        const staticPrivate = lowerStaticPrivateRead(lowerer, expr, loc);
+        if (staticPrivate)
+            return staticPrivate;
+    }
     // `value.#x` on a checked-dynamic value, or on a checked extraction of
     // one: the field of the brand-checked receiver (checkedPrivateValue).
     if (ts.isPrivateIdentifier(expr.name)) {
@@ -223,7 +281,7 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         };
     }
     {
-        const member = lowerBufferPrototypeMember(lowerer, expr);
+        const member = lowerBufferPrototypeMember(lowerer, expr) ?? lowerBufferPrototypeObject(lowerer, expr);
         if (member)
             return member;
     }
@@ -420,33 +478,8 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         };
     }
-    if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze") {
-        // Object.freeze as a value can freeze any untyped value it is passed.
-        lowerer.untypedIntegrity = true;
-        const name = "%builtin.Object.freeze";
-        if (!lowerer.liftedFns.some((fn) => fn.name === name))
-            lowerer.liftedFns.push({
-                name,
-                params: [{ localId: "value", name: "value", type: DYN }],
-                locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
-                returnType: DYN,
-                body: [
-                    {
-                        kind: "return",
-                        value: {
-                            kind: "libCall",
-                            fn: "dyn.freeze",
-                            args: [varRef("value", DYN, loc)],
-                            type: DYN,
-                            loc,
-                        },
-                        loc,
-                    },
-                ],
-                loc,
-            });
-        return { kind: "closure", fnName: name, captures: [], type: funcOf([DYN], DYN), loc };
-    }
+    if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze")
+        return objectFreezeValue(lowerer, loc);
     // An Hmac has no copy() (Hash does): Node answers undefined, which
     // `typeof mac.copy` feature checks read. TypeScript rejects the read.
     if (expr.name.text === "copy" &&
@@ -477,6 +510,38 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         };
     }
+    // A read of a Node 24 global the native runtime does not implement
+    // (globalThis.WebSocket, (globalThis as T).FormData, alias.X) is not a
+    // capability probe: the branch below would answer undefined, where Node
+    // has the constructor. Answer the constructor (host-global-values.ts);
+    // constructing or calling it is the use that refuses (SC2020,
+    // host-global).
+    {
+        const hostGlobal = hostGlobalNameOfMember(lowerer, expr);
+        if (hostGlobal !== null) {
+            if (hostGlobalCallTarget(expr))
+                lowerer.hostGlobalFence(hostGlobal, expr);
+            return hostGlobalValue(lowerer, hostGlobal, expr);
+        }
+    }
+    // A member read off that value (`WebSocket.OPEN`, `FormData.prototype`):
+    // the value carries the function intrinsics only, and its prototype
+    // carries the constructor link (`FormData.prototype.constructor`). Node's
+    // class also has static members and instance methods, which native code
+    // does not provide, so reading one is a use of that surface and refuses
+    // (SC2020, host-global) instead of answering undefined.
+    {
+        const hostGlobal = hostGlobalNameOfRead(lowerer, expr.expression);
+        if (hostGlobal !== null) {
+            if (!HOST_GLOBAL_VALUE_MEMBERS.has(expr.name.text))
+                lowerer.hostGlobalFence(hostGlobal, expr);
+        }
+        else {
+            const prototypeOf = hostGlobalPrototypeOf(lowerer, expr.expression);
+            if (prototypeOf !== null && !HOST_GLOBAL_PROTOTYPE_MEMBERS.has(expr.name.text))
+                lowerer.hostGlobalFence(prototypeOf, expr);
+        }
+    }
     // Missing host globals (Bun/Deno capability probes) have no binding
     // in a native program. Declared globals retain their own lowering;
     // arbitrary global-object mutation remains fenced. Preserve a dyn
@@ -552,7 +617,9 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             };
         }
     }
-    if ((expr.name.text === "index" || expr.name.text === "input") && !expr.questionDotToken) {
+    // `re.exec(s)?.index` takes the same read: the chain lowering binds the
+    // guarded receiver (non-nullish inside the guard) before re-dispatching.
+    if (expr.name.text === "index" || expr.name.text === "input") {
         const represented = tryLowerExpression(lowerer, expr.expression);
         if (represented &&
             isMatchSliceType(lowerer, represented.type) &&
@@ -760,6 +827,26 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         if (promiseMember)
             return promiseMember;
     }
+    // A weak collection's method read as a VALUE in a JavaScript source
+    // (`wm.has.call(x, k)` — the WeakMap/WeakSet brand-check tests): the
+    // runtime's interned prototype function, which applies the method to its
+    // own receiver and throws Node's TypeError for a foreign one. A direct
+    // call keeps the instance fast path (`dynKeyGet` dispatches to the
+    // handle), and an optional read keeps the fence.
+    if (!expr.questionDotToken &&
+        isJsSourceFile(ts.getSourceFileOfNode(expr)) &&
+        !isCalleeOf(expr) &&
+        // `WeakMap.prototype.has` is the prototype table's own read: it never
+        // lowers the prototype object (a value read of `WeakMap.prototype`
+        // is a fence), so leave that spelling there.
+        !(ts.isPropertyAccessExpression(expr.expression) &&
+            expr.expression.name.text === "prototype" &&
+            stdlibGlobalNameOf(lowerer, expr.expression.expression) !== null)) {
+        const weak = lowerer.weakCollectionNamesOf(lowerer.typeOf(expr.expression));
+        if (weak !== null &&
+            weak.names.some((prototype) => WEAK_COLLECTION_METHOD_NAMES[prototype].has(expr.name.text)))
+            return weakCollectionMethodValue(lowerer, expr, weak.names, weak.nullable, expr.name.text);
+    }
     const handled = lowerer.lowerProcessEnvGet(expr) ??
         lowerer.lowerServerProperty(expr) ??
         // diagnostics_channel Channel receivers — name/hasSubscribers
@@ -842,8 +929,9 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         if (canonical !== null) {
             if (canonical === "globalThis")
                 return lowerGlobalValue(lowerer, expr);
-            // Typed for the programs that name it, absent in Node 24.
-            if (canonical === TEMPORAL_GLOBAL)
+            // Typed for the programs that name it, absent in Node 24, and the
+            // CommonJS module bindings, which the global object does not hold.
+            if (canonical === TEMPORAL_GLOBAL || COMMONJS_MODULE_BINDINGS.has(canonical))
                 return dynUndefinedExpr(loc);
             const value = jsSpecialGlobalValue(lowerer, canonical, loc);
             if (value)
@@ -1005,14 +1093,19 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             // by the property or function it reads. A builtin function value
             // keeps its length when that is not its adapter's parameter count
             // (`Math.max.length` is 2).
-            const fnName = builtinValueNameOf(expr.expression, lowerer) ?? jsFuncNameOf(expr.expression, lowerer);
-            const fnLength = lowerer.builtinFunctionIdentity(probed).fnLength;
+            const builtinName = builtinValueNameOf(expr.expression, lowerer);
+            const fnName = builtinName ?? jsFuncNameOf(expr.expression, lowerer);
+            const identity = lowerer.builtinFunctionIdentity(probed);
+            const fnLength = identity.fnLength;
             const boxed = {
                 kind: "dynFrom",
                 value: probed,
                 type: DYN,
                 ...(fnName !== null ? { fnName } : {}),
                 ...(fnLength !== undefined ? { fnLength } : {}),
+                ...(builtinName !== null && identity.fnNameMainThreadOnly
+                    ? { fnNameMainThreadOnly: true }
+                    : {}),
                 loc,
             };
             const key = {
@@ -1097,7 +1190,13 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         isStatFsDynProperty(lowerer, expr) ||
         segmentDataProperty ||
         osConstants ||
-        isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), lowerer)) {
+        // A record, not the Lowerer itself: the compiler lowers its own source,
+        // and a class instance does not width-coerce to this shape.
+        isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), {
+            isStdlibFile: (sf) => lowerer.isStdlibFile(sf),
+            symbolProvenance: lowerer.symbolProvenance,
+            verifySymbolProvenance: lowerer.verifySymbolProvenance,
+        })) {
         const recv = lowerer.lowerExpr(expr.expression);
         if (recv.type.kind === "dyn") {
             const key = {
@@ -1363,6 +1462,20 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     const asserted = assertedMemberRead(lowerer, expr.expression, expr.name.text, recvLowered, loc);
     if (asserted)
         return asserted;
+    // Lowering erases flow narrowing, so a checker-NARROWED receiver keeps
+    // the wider union it stores (`stored?.type` after the earlier arm
+    // returned, `(entry as { role: string }).role`): the checker's type
+    // names one record while the value still carries its siblings. Read the
+    // member off whichever arm the value holds — an arm that does not
+    // declare it answers undefined, exactly Node's get — and narrow the
+    // answer to the checker's type, which traps on an arm the checker's
+    // narrowing ruled out (types do not lie). Reaching this point means no
+    // lowering above claimed the read, so only refusals gain a lowering.
+    if (recvLowered.type.kind === "union") {
+        const read = lowerUnionValueRead(lowerer, expr, recvLowered, true);
+        if (read)
+            return lowerer.maybeNarrow(read, expr);
+    }
     // A checker-`any` receiver whose value is a FRESH typed result of an
     // earlier step in the chain (`out.split(" ").length`, where split
     // extracted the string and answered a native string[]): the member read
@@ -1397,6 +1510,22 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         typedArrayLacksMember(expr.name.text, recvLowered.type.elem === "u8")) {
         return afterReceiver(recvLowered, dynUndefinedExpr(loc), loc);
     }
+    // Buffer.prototype's parent and offset getters, which @types/node does not
+    // declare (so only JavaScript reads them): the box answers a Buffer's
+    // ArrayBuffer and byteOffset, and undefined for a Uint8Array, by the
+    // runtime flag that tells the two apart.
+    if (recvLowered.type.kind === "bytes" &&
+        recvLowered.type.elem === "u8" &&
+        (expr.name.text === "parent" || expr.name.text === "offset") &&
+        !declaredMemberOf(lowerer, expr.expression, expr.name.text)) {
+        return {
+            kind: "dynKeyGet",
+            value: lowerer.coerceToExpected(recvLowered, DYN),
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+            type: DYN,
+            loc,
+        };
+    }
     // A typed array under a checker `any` (a JS binding its own initializer's
     // inference refers to: hono's etag digest `nextChunk`) reads through its
     // box, as the method-call twin dispatches. The box shares the native
@@ -1411,6 +1540,25 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         }, expr);
     }
+    // A NULLISH receiver: JavaScript's RequireObjectCoercible throws Node's
+    // TypeError at the read (only an optional chain, lowered elsewhere,
+    // answers undefined). A primitive receiver that is not nullish never
+    // reaches this fence — its members lower above.
+    if (isUnitType(recvLowered.type)) {
+        const unit = recvLowered.type.kind === "nullT" ? "null" : "undefined";
+        const t = ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
+        return throwAfterEach([recvLowered], nullishReadTypeError(unit, expr.name.text, t, loc), loc);
+    }
+    // The site is about to be refused: a checker-narrowed receiver still
+    // stores the wider union, whose other arms may be what refuse the member
+    // (the OAuth arm's index signature beside `ApiKeyCredential.key`). Read
+    // it off the arms the checker still allows, exactly where the refusal
+    // would be.
+    if (recvLowered.type.kind === "union") {
+        const read = narrowedUnionValueRead(lowerer, expr, recvLowered);
+        if (read)
+            return read;
+    }
     lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' from a value of type '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'`);
 }
 /** `result` after evaluating `receiver` for its effects (none to keep when
@@ -1602,9 +1750,165 @@ function mergeReadTypes(lowerer, types) {
 function importMetaProperty(lowerer, expr) {
     return isImportMeta(expr.expression) ? importMetaField(lowerer, expr, expr.name.text) : null;
 }
+const DATE_PROTOTYPE_WRITE_MESSAGE = "writing through a standard library prototype (`Date.prototype` is a value for reads; a Date never observes a write to it)";
+/** How many member steps separate `node` from `Date.prototype` in the read
+ * chain `node` is part of: 0 for `Date.prototype` itself, 1 for a member, 2
+ * for a property read on a member (the interned function object). Null when
+ * the chain is not rooted at `Date.prototype`. */
+function datePrototypeDepth(lowerer, node) {
+    let depth = 0;
+    let cur = node;
+    for (;;) {
+        if (ts.isPropertyAccessExpression(cur) &&
+            lowerer.stdlibGlobalMember(cur, "Date") === "prototype")
+            return depth;
+        if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur)) {
+            cur = cur.expression;
+            depth++;
+            continue;
+        }
+        return null;
+    }
+}
+/** The prototype object and its members are a read surface: a write that
+ * replaces a member, or a key of the prototype itself, keeps the SC1090
+ * refusal it reached before the prototype had a value, because a typed Date
+ * never observes it and the write would silently differ from Node. A property
+ * OF a member (the interned function object, `Date.prototype.getTime.length
+ * = 1`) writes the function the dynamic tier shares with Node, which matches,
+ * so it stays open. True when `node` is the target of such a write
+ * (assignment, compound assignment, `delete`, `++`/`--`), directly or as the
+ * base of the target's member chain. */
+export function isDatePrototypeWrite(lowerer, node) {
+    const depth = datePrototypeDepth(lowerer, node);
+    if (depth === null)
+        return false;
+    let steps = 0;
+    let cur = node;
+    for (;;) {
+        while (ts.isParenthesizedExpression(cur.parent))
+            cur = cur.parent;
+        const parent = cur.parent;
+        if (!parent)
+            return false;
+        if ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) &&
+            parent.expression === cur) {
+            cur = parent;
+            steps++;
+            continue;
+        }
+        const written = (ts.isBinaryExpression(parent) &&
+            parent.left === cur &&
+            (parent.operatorToken.kind === ts.SyntaxKind.EqualsToken ||
+                (parent.operatorToken.kind >= ts.SyntaxKind.FirstCompoundAssignment &&
+                    parent.operatorToken.kind <= ts.SyntaxKind.LastCompoundAssignment))) ||
+            ts.isDeleteExpression(parent) ||
+            // `++`/`--` write their operand; the other prefix unary forms (`!`,
+            // `typeof`, `void`, `+`, `-`, `~`) only read it.
+            ((ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) &&
+                (parent.operator === ts.SyntaxKind.PlusPlusToken ||
+                    parent.operator === ts.SyntaxKind.MinusMinusToken));
+        return written && depth + steps <= 1;
+    }
+}
+/** The fence for a write found while lowering a property access (see
+ * isDatePrototypeWrite). The cheap syntactic pre-test keeps every other
+ * property access down to one identifier comparison: only a chain rooted at
+ * the `Date` global can name the prototype, and the write path reaches this
+ * before chainBlocked's early return. */
+export function fenceDatePrototypeWrite(lowerer, expr) {
+    let root = expr;
+    while (ts.isPropertyAccessExpression(root) || ts.isElementAccessExpression(root))
+        root = root.expression;
+    while (ts.isParenthesizedExpression(root))
+        root = root.expression;
+    if (!ts.isIdentifier(root) || root.text !== "Date")
+        return;
+    if (isDatePrototypeWrite(lowerer, expr))
+        lowerer.unsupported("SC1090", expr, DATE_PROTOTYPE_WRITE_MESSAGE);
+}
+/** The same fence for a call-shaped write (`Object.defineProperty`,
+ * `Object.assign`) whose target argument is `Date.prototype` or one of its
+ * members. */
+export function fenceDatePrototypeWriteCall(lowerer, node) {
+    const depth = datePrototypeDepth(lowerer, node);
+    if (depth !== null && depth <= 1)
+        lowerer.unsupported("SC1090", node, DATE_PROTOTYPE_WRITE_MESSAGE);
+}
 /** The TypeError of a deferred-init field read that finds the field
  * unassigned where its declared type cannot hold undefined. */
 export const DEFERRED_READ_MESSAGE = "undefined is not representable in the target union (a value narrowed or asserted past it still held it)";
+/** A collection method read as a VALUE (`s.add`, `m.has` — the `f.call(x)`
+ * tests and callback plumbing): the runtime's interned prototype function
+ * for that name, which applies the method to its own receiver and throws
+ * Node's brand-check TypeError when that receiver is not a collection of
+ * the right kind. Only JavaScript sources take this path: a typed source
+ * keeps its refusal (the checker's Set/Map signature has no value form).
+ * The receiver expression still runs for its effects, and a receiver the
+ * checker typed with an undefined arm (an out-of-bounds element of a
+ * `Set[]`, `xs[1].has`) throws Node's TypeError at the read itself: the
+ * member access on a nullish receiver fails before any method exists. */
+function dynCollectionMethodValue(lowerer, expr, prototype, name) {
+    const loc = locOf(expr);
+    const method = {
+        kind: "libCall",
+        fn: "dyn.builtinMethod",
+        args: [
+            { kind: "strLit", value: prototype, type: STRING, loc },
+            { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
+        ],
+        type: DYN,
+        loc,
+    };
+    const receiver = lowerer.lowerExpr(expr.expression);
+    const unionType = receiver.type.kind === "union" ? receiver.type : null;
+    const units = [];
+    if (unionType) {
+        const def = lowerer.unions.get(unionType.unionId);
+        def?.arms.forEach((arm, tag) => {
+            if (isUnitType(arm))
+                units.push({ tag, unit: arm.kind === "nullT" ? "null" : "undefined" });
+        });
+    }
+    if (units.length === 0 || unionType === null) {
+        return isSafeToDiscard(receiver)
+            ? method
+            : {
+                kind: "seqExpr",
+                stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr.expression) }],
+                result: method,
+                type: DYN,
+                loc,
+            };
+    }
+    const held = lowerer.declareHiddenLocal("%collectionMethodReceiver", unionType);
+    let result = method;
+    for (const { tag, unit } of units) {
+        result = {
+            kind: "ternary",
+            cond: {
+                kind: "unionIsTag",
+                unionId: unionType.unionId,
+                tag,
+                negated: false,
+                value: varRef(held.id, unionType, loc),
+                type: BOOL,
+                loc,
+            },
+            then: nodeThrowExpr(1, "", `Cannot read properties of ${unit} (reading '${name}')`, DYN, loc),
+            else_: result,
+            type: DYN,
+            loc,
+        };
+    }
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: held.id, init: receiver, loc }],
+        result,
+        type: DYN,
+        loc,
+    };
+}
 /** Property access on a string or array receiver: `.length` lowers to the
  * matching intrinsic; a bare method reference (`const f = s.slice` — a
  * function value) is rejected with a specific message. Returns null for
@@ -1619,13 +1923,60 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     }
     if (lowerer.stdlibGlobalMember(expr, "Reflect") === "ownKeys")
         return reflectMemberValue(lowerer, "ownKeys", locOf(expr));
+    // A write, `delete` or defineProperty through `Date.prototype` keeps its
+    // fence: the value below is a read surface, and a typed Date never observes
+    // a dynamic write to it. This runs before the chainBlocked early return
+    // because a write lowers the prototype read with the chain blocked.
+    fenceDatePrototypeWrite(lowerer, expr);
     if (lowerer.chainBlocked(expr))
         return null;
+    // Iterator.prototype, its members and Iterator's own members in
+    // JavaScript: the live objects (scr_js_iterator.c).
+    const iteratorMember = lowerIteratorMemberValue(lowerer, expr);
+    if (iteratorMember)
+        return iteratorMember;
+    // A helper method read as a value on a typed iterator in JavaScript
+    // (`g().map === Iterator.prototype.map`), or a member the typed iterator
+    // has no lowering for (`[].values().return` is undefined): the value the
+    // runtime answers through the boxed iterator, exactly Node's.
+    if (!expr.questionDotToken &&
+        TYPED_ITERATOR_MEMBER_VALUES.has(expr.name.text) &&
+        isJsSourceFile(ts.getSourceFileOfNode(expr))) {
+        const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+        if (recvT?.kind === "generator" && recvT.async !== true) {
+            // Node's builtin iterators (%ArrayIteratorPrototype%'s family) hold
+            // no `return`; a generator's and an iterator helper object's do.
+            if (expr.name.text === "return" && builtinIteratorWithoutReturn(lowerer, expr.expression))
+                return {
+                    kind: "seqExpr",
+                    stmts: [
+                        {
+                            kind: "exprStmt",
+                            expr: lowerer.lowerExpr(expr.expression),
+                            loc: locOf(expr.expression),
+                        },
+                    ],
+                    result: dynUndefinedExpr(locOf(expr)),
+                    type: DYN,
+                    loc: locOf(expr),
+                };
+            return {
+                kind: "dynKeyGet",
+                value: lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), DYN),
+                key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+                type: DYN,
+                loc: locOf(expr),
+            };
+        }
+    }
     // Object.prototype.constructor: the Object constructor value.
     if (expr.name.text === "constructor" &&
         ts.isPropertyAccessExpression(expr.expression) &&
         lowerer.stdlibGlobalMember(expr.expression, "Object") === "prototype")
         return builtinGlobalValue("Object", locOf(expr));
+    const primitivePrototype = jsPrimitivePrototypeValue(lowerer, expr);
+    if (primitivePrototype)
+        return primitivePrototype;
     const builtinPrototype = builtinPrototypeMethod(lowerer, expr);
     if (builtinPrototype)
         return {
@@ -1660,21 +2011,42 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         return { kind: "libCall", fn: "dyn.functionApply", args: [], type: DYN, loc: locOf(expr) };
     if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
         return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
-    if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
-        return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
-    // Error.prototype as a value (`F.prototype = Object.create(Error.prototype)`)
-    // and Error.captureStackTrace read as a function (`if
-    // (Error.captureStackTrace) ...`).
-    if (isErrorPrototypeValue(lowerer, expr))
-        return { kind: "libCall", fn: "dyn.errorPrototype", args: [], type: DYN, loc: locOf(expr) };
-    if (lowerer.stdlibGlobalMember(expr, "Error") === "captureStackTrace")
+    // Date.prototype as a value, and its members read through it: the
+    // prototype object the language defines (an ordinary object carrying the
+    // interface's methods), not a Date. `Date.prototype.hasOwnProperty("x")`
+    // and `Date.prototype.getTime` are reads of that object; a Date method
+    // CALLED on it is a TypeError, which the checked-dynamic method dispatch
+    // answers because the receiver is not a Date handle.
+    if (lowerer.stdlibGlobalMember(expr, "Date") === "prototype") {
         return {
             kind: "libCall",
-            fn: "dyn.errorCaptureStackTraceFunction",
-            args: [],
+            fn: "dyn.stdlibPrototype",
+            args: [{ kind: "strLit", value: "Date", type: STRING, loc: locOf(expr) }],
             type: DYN,
             loc: locOf(expr),
         };
+    }
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        lowerer.stdlibGlobalMember(expr.expression, "Date") === "prototype") {
+        return {
+            kind: "dynKeyGet",
+            value: {
+                kind: "libCall",
+                fn: "dyn.stdlibPrototype",
+                args: [{ kind: "strLit", value: "Date", type: STRING, loc: locOf(expr.expression) }],
+                type: DYN,
+                loc: locOf(expr.expression),
+            },
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+            type: DYN,
+            loc: locOf(expr),
+        };
+    }
+    if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
+        return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
+    // Error.prototype as a value (`F.prototype = Object.create(Error.prototype)`).
+    if (isErrorPrototypeValue(lowerer, expr))
+        return { kind: "libCall", fn: "dyn.errorPrototype", args: [], type: DYN, loc: locOf(expr) };
     // Function.prototype as a VALUE (a prototype-chain link:
     // `Object.setPrototypeOf(F.prototype, Function.prototype)`): one
     // anonymous function answering undefined, length 0 — a zero-capture
@@ -1703,16 +2075,19 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             loc,
         };
     }
-    if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
-        return lowerArrayIsArrayValue(lowerer, locOf(expr));
-    if (lowerer.stdlibGlobalMember(expr, "Array") === "from")
-        return lowerArrayFromValue(lowerer, locOf(expr));
-    const stringMember = lowerer.stdlibGlobalMember(expr, "String");
-    if (stringMember === "fromCharCode" || stringMember === "fromCodePoint")
-        return lowerStringCodesValue(lowerer, stringMember, locOf(expr));
-    const numberMember = lowerer.stdlibGlobalMember(expr, "Number");
-    if (numberMember === "parseInt" || numberMember === "parseFloat")
-        return lowerNumberParserValue(lowerer, numberMember, locOf(expr));
+    // Array.isArray, Object.keys, Date.now, Error.captureStackTrace (`if
+    // (Error.captureStackTrace) ...`) and the other statics with function
+    // values: the same values a read through the constructor's untyped value
+    // answers (builtin-statics.ts).
+    {
+        const owner = stdlibGlobalNameOf(lowerer, expr.expression);
+        const member = owner === null ? null : lowerer.stdlibGlobalMember(expr, owner);
+        const value = owner === null || member === null
+            ? null
+            : constructorStaticValue(lowerer, owner, member, locOf(expr));
+        if (value !== null)
+            return value;
+    }
     if (lowerer.stdlibGlobalMember(expr, "Buffer") === "poolSize")
         return { kind: "libCall", fn: "buffer.poolSize", args: [], type: F64, loc: locOf(expr) };
     {
@@ -1765,20 +2140,6 @@ export function lowerIntrinsicProperty(lowerer, expr) {
                 { mode: "required", type: DYN },
             ],
         }, "Buffer.compare", locOf(expr));
-    if (lowerer.stdlibGlobalMember(expr, "Date") === "now")
-        return lowerer.lowerNativeCallableValue({
-            fn: "date.now",
-            params: [],
-            result: F64,
-            valueParams: [],
-        }, "Date.now", locOf(expr));
-    if (stdlibGlobalNameOf(lowerer, expr.expression) === "Object") {
-        if (expr.name.text === "assign")
-            return lowerObjectAssignValue(lowerer, locOf(expr));
-        const fn = own(OBJECT_CALLABLE_VALUES, expr.name.text);
-        if (fn)
-            return lowerer.lowerNativeCallableValue(fn, `Object.${expr.name.text}`, locOf(expr));
-    }
     // A never-tainted JS receiver type lowered checked-dynamic
     // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
     // stand down so the dyn keyed read below the chain answers, instead
@@ -2216,6 +2577,21 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
             return { kind: "bytesIntrinsic", method: "buffer", receiver, args: [], type: DYN, loc };
         }
+        // A method read as a value in JavaScript (`buf.indexOf ===
+        // Buffer.prototype.indexOf`, `const write = buf.writeUInt8`): the box
+        // answers the function Node's prototype holds, which runs on the
+        // receiver it is called with.
+        if (isJsSourceFile(ts.getSourceFileOfNode(expr))) {
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+            return {
+                kind: "dynKeyGet",
+                value: lowerer.coerceToExpected(receiver, DYN),
+                key: { kind: "strLit", value: name, type: STRING, loc },
+                type: DYN,
+                loc,
+            };
+        }
         if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
             lowerer.unsupported("SC1090", expr, `typed-array methods as values (call '${name}' directly)`);
         }
@@ -2235,6 +2611,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             };
         }
         if (MAP_METHODS.has(name) || name === "forEach") {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr)) && !expr.questionDotToken)
+                return dynCollectionMethodValue(lowerer, expr, "Map", name);
             lowerer.unsupported("SC1090", expr, `Map methods as values (call '${name}' directly)`);
         }
         return null;
@@ -2253,6 +2631,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             };
         }
         if (SET_METHODS.has(name)) {
+            if (isJsSourceFile(ts.getSourceFileOfNode(expr)) && !expr.questionDotToken)
+                return dynCollectionMethodValue(lowerer, expr, "Set", name);
             lowerer.unsupported("SC1090", expr, `Set methods as values (call '${name}' directly)`);
         }
         return null;
@@ -3100,8 +3480,19 @@ function unreachableReceiver(lowerer, expr) {
 export function lowerUnionProperty(lowerer, expr) {
     if (lowerer.chainBlocked(expr))
         return null;
-    const receiverIr = structuralReadType(lowerer, expr.expression) ??
+    const spelled = structuralReadType(lowerer, expr.expression) ??
         lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+    // Inside an optional-chain body the guarded receiver is checker-typed by
+    // its non-nullish narrowing — often one record of a discriminated union
+    // — while the bound chain value still carries the whole present union
+    // (`stored?.type` after an earlier `stored?.type === "oauth"` return
+    // narrowed `stored` to `ApiKeyCredential`, though the runtime-optional
+    // storage still holds `ApiKeyCredential | OAuthCredential`). The union
+    // reader dispatches on the runtime tag, so take the union the chain
+    // binding hands to `lowerExpr` below instead of the spelled narrowing.
+    const chainRecv = lowerer.chainRecvByNode.get(expr.expression);
+    const chainUnion = spelled?.kind !== "union" && chainRecv?.type.kind === "union" ? chainRecv.type : null;
+    const receiverIr = chainUnion ?? spelled;
     // The checker can rule the receiver UNREACHABLE and the assertion that
     // escapes it (`const x: never = event; (event as any).type` — the
     // `default:` branch of a switch that exhausts every arm) erases to
@@ -3130,6 +3521,16 @@ export function lowerUnionProperty(lowerer, expr) {
         else
             value = narrowStoredClassValue(lowerer, value, receiverIr) ?? value;
     }
+    // The spelled type is a narrowing, so every path below (dyn, record,
+    // object, array) was unreachable for this read before it took the stored
+    // union: answer it only when the union reader can, and otherwise hand the
+    // read back to the lowering the spelled type used to reach. A stored arm
+    // the checker ruled out that has no such member (`m1?.name` where the
+    // stored union still carries a `string` arm) must not turn an accepted
+    // program into a refusal.
+    if (chainUnion !== null) {
+        return value.type.kind === "union" ? lowerUnionValueRead(lowerer, expr, value) : null;
+    }
     // A checker-union receiver whose VALUE lowered to a plain RECORD (the
     // merged-signature fiction — `runner(cmd, args)` where runner joined
     // a structural runner type with spawnSync's, and the local adopted
@@ -3189,12 +3590,53 @@ export function lowerUnionProperty(lowerer, expr) {
             loc: locOf(expr),
         };
     }
+    if (isUnitType(value.type)) {
+        // A nullish receiver: Node's RequireObjectCoercible TypeError, after
+        // the receiver's own evaluation.
+        const unit = value.type.kind === "nullT" ? "null" : "undefined";
+        return throwAfterEach([value], nullishReadTypeError(unit, expr.name.text, lowerer.mapTypeOf(lowerer.typeOf(expr)) ?? DYN, locOf(expr)), locOf(expr));
+    }
     if (value.type.kind !== "union") {
         lowerer.unsupported("SC1090", expr, "shared property access without a represented union receiver");
     }
-    const def = lowerer.unions.get(value.type.unionId);
+    const read = lowerUnionValueRead(lowerer, expr, value) ?? narrowedUnionValueRead(lowerer, expr, value);
+    if (read)
+        return read;
+    lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' on a union-typed value (every arm must be an object/record ` +
+        `with a same-typed field '${expr.name.text}'; ` +
+        `${NARROW_FIRST})`);
+}
+/** The member read itself on a lowered UNION value: `lowerUnionProperty`
+ * after it has produced the value (retagged to the checker's union when
+ * the checker removed arms) and the dispatcher's narrowed-receiver
+ * fallback, which reaches the same read with the value a checker-narrowed
+ * receiver still stores. Returns null when no arm can answer — the caller
+ * owns the diagnostic. */
+export function lowerUnionValueRead(lowerer, expr, value, missingFieldAsUndefined = false) {
+    return unionValueRead(lowerer, expr, value, missingFieldAsUndefined);
+}
+/** The stored-union read again over the arms the checker's narrowing still
+ * allows: an arm it ruled out at this site refused the read (the OAuth
+ * arm's index signature beside `ApiKeyCredential.key`, behind an
+ * optional-chain discriminant guard). Only the REFUSAL points call this —
+ * a site another lowering answers keeps it — so no compiling program
+ * gains a second, narrowed lowering. Returns null when the site's type is
+ * not a narrowing of the value's union. */
+export function narrowedUnionValueRead(lowerer, expr, value) {
+    const narrowed = narrowedUnionView(lowerer, expr.expression, value, locOf(expr));
+    if (!narrowed)
+        return null;
+    if (narrowed.arm)
+        return narrowedArmRead(lowerer, expr, narrowed.value, narrowed.arm);
+    return unionValueRead(lowerer, expr, narrowed.value, false);
+}
+function unionValueRead(lowerer, expr, value, missingFieldAsUndefined) {
+    if (value.type.kind !== "union")
+        return null;
+    const unionId = value.type.unionId;
+    const def = lowerer.unions.get(unionId);
     if (!def)
-        throw new InternalCompilerError(`lowerer bug: unknown union ${value.type.unionId}`);
+        throw new InternalCompilerError(`lowerer bug: unknown union ${unionId}`);
     const field = expr.name.text;
     if (field === "length") {
         const presentArms = def.arms.filter((arm) => !isUnitType(arm));
@@ -3221,6 +3663,31 @@ export function lowerUnionProperty(lowerer, expr) {
                     };
             }
         }
+        // A union of arrays and strings (`Model[] | ModelRef[]`,
+        // `string[] | Buffer[]`): every arm answers its own length, so the
+        // read dispatches on the tag. Node's `.length` is a number for both,
+        // and no arm can be absent here (a unit arm would have to throw on
+        // this read, which the checker's narrowing already excludes).
+        if (def.arms.length > 1 &&
+            def.arms.every((arm) => arm.kind === "array" || arm.kind === "string")) {
+            return perArmUnionRead(lowerer, expr, unionId, value, F64, "%unionLength", (arm, _tag, receiver) => arm.kind === "string"
+                ? {
+                    kind: "strIntrinsic",
+                    method: "length",
+                    receiver,
+                    args: [],
+                    type: F64,
+                    loc: locOf(expr),
+                }
+                : {
+                    kind: "arrIntrinsic",
+                    method: "length",
+                    receiver,
+                    args: [],
+                    type: F64,
+                    loc: locOf(expr),
+                });
+        }
     }
     const nonUnitArms = def.arms.filter((arm) => !isUnitType(arm));
     if (nonUnitArms.length === 1 && nonUnitArms[0]?.kind === "object") {
@@ -3229,7 +3696,7 @@ export function lowerUnionProperty(lowerer, expr) {
         if (fieldType !== undefined) {
             let receiver = lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, objectType, field);
             if (receiver === null) {
-                const helper = lowerer.narrowedArmHelper(value.type.unionId, objectType, locOf(expr.expression));
+                const helper = lowerer.narrowedArmHelper(unionId, objectType, locOf(expr.expression));
                 if (helper !== null)
                     receiver = lowerer.checkedNarrowCall(helper, value, objectType, locOf(expr.expression));
             }
@@ -3245,6 +3712,15 @@ export function lowerUnionProperty(lowerer, expr) {
             }
         }
     }
+    // A member the arms answer through an ACCESSOR (a getter inherited
+    // from a shared base class — `renderer.hasOverlayEntries` on
+    // `FullscreenRenderer | RegularRenderer`): there is no field slot
+    // `unionDisc` could read, so dispatch on the tag and call each arm's
+    // own getter. Fires only when some arm's answer is an accessor, so
+    // data-field unions keep their `unionDisc` lowering.
+    const accessorRead = lowerUnionAccessorRead(lowerer, expr, unionId, value);
+    if (accessorRead)
+        return accessorRead;
     let common = null;
     for (const arm of def.arms) {
         let ft;
@@ -3274,7 +3750,7 @@ export function lowerUnionProperty(lowerer, expr) {
     // arms): the JOIN path — `env.PORTLESS_PORT` on `ProcessEnv |
     // Record<string, string>`, the tail read of `loaded?.config.script`.
     const key = { kind: "strLit", value: field, type: STRING, loc: locOf(expr.name) };
-    const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, field);
+    const keyed = lowerUnionKeyedRead(lowerer, expr, unionId, value, key, field, missingFieldAsUndefined);
     if (keyed)
         return keyed;
     // Class arms declaring the field with compatible but different types
@@ -3304,9 +3780,197 @@ export function lowerUnionProperty(lowerer, expr) {
         if (member)
             return member;
     }
-    lowerer.unsupported("SC1090", expr, `reading '${field}' on a union-typed value (every arm must be an object/record ` +
-        `with a same-typed field '${field}'; ` +
-        `${NARROW_FIRST})`);
+    return null;
+}
+/** Evaluate `value` once into a hidden local and answer the read by
+ * dispatching on the union's tag: arm `tag` (narrowed from the local)
+ * answers `answer(arm, tag, narrowed)`. The first non-unit arm's answer
+ * is the fallback branch, which a representable union never reaches. */
+function perArmUnionRead(lowerer, expr, unionId, value, type, name, answer) {
+    const loc = locOf(expr);
+    const def = lowerer.unions.get(unionId);
+    if (!def)
+        throw new InternalCompilerError(`lowerer bug: unknown union ${unionId}`);
+    const stable = lowerer.declareHiddenLocal(name, value.type);
+    const ref = () => ({ kind: "varRef", localId: stable.id, type: value.type, loc });
+    let result = null;
+    def.arms.forEach((arm, tag) => {
+        if (isUnitType(arm))
+            return;
+        const receiver = { kind: "unionNarrow", unionId, tag, value: ref(), type: arm, loc };
+        const read = answer(arm, tag, receiver);
+        result =
+            result === null
+                ? read
+                : {
+                    kind: "ternary",
+                    cond: {
+                        kind: "unionIsTag",
+                        unionId,
+                        tag,
+                        value: ref(),
+                        negated: false,
+                        type: BOOL,
+                        loc,
+                    },
+                    then: read,
+                    else_: result,
+                    type,
+                    loc,
+                };
+    });
+    if (result === null)
+        throw new InternalCompilerError(`lowerer bug: no arm answers ${name}`);
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: stable.id, init: value, loc }],
+        result,
+        type,
+        loc,
+    };
+}
+/** A member read the arms answer through an ACCESSOR — an inherited
+ * getter (`this.renderer.hasOverlayEntries`). `unionDisc` reads record
+ * and class FIELD slots, so a getter arm needs the tag dispatch: each
+ * arm calls its own getter (once per read, as Node's read does). Data
+ * arms in the same union read their slot. Every arm must answer one
+ * type; a unit arm or an arm without the member declines (the caller's
+ * keyed read and fences own those). Null when no arm answers through an
+ * accessor — plain field unions keep `unionDisc`. */
+function lowerUnionAccessorRead(lowerer, expr, unionId, value) {
+    const def = lowerer.unions.get(unionId);
+    if (!def)
+        return null;
+    const field = expr.name.text;
+    const getterName = `get:${field}`;
+    let type = null;
+    let anyAccessor = false;
+    const arms = [];
+    for (let tag = 0; tag < def.arms.length; tag++) {
+        const arm = def.arms[tag];
+        if (isUnitType(arm))
+            return null;
+        let answer;
+        let read;
+        if (arm.kind === "record") {
+            const shape = lowerer.shapes.get(arm.shapeId);
+            if (!shape || shape.tuple)
+                return null;
+            const data = shape.fields.find((f) => f.name === field);
+            if (data) {
+                answer = data.type;
+                read = (receiver) => ({
+                    kind: "recordGet",
+                    obj: receiver,
+                    shapeId: arm.shapeId,
+                    field,
+                    type: data.type,
+                    loc: locOf(expr),
+                });
+            }
+            else {
+                const getter = shape.fields.find((f) => f.name === getterName);
+                if (!getter || getter.type.kind !== "func")
+                    return null;
+                anyAccessor = true;
+                answer = getter.type.ret;
+                read = (receiver) => lowerer.coerceToExpected({
+                    kind: "callValue",
+                    callee: {
+                        kind: "recordGet",
+                        obj: receiver,
+                        shapeId: arm.shapeId,
+                        field: getterName,
+                        type: getter.type,
+                        loc: locOf(expr),
+                    },
+                    args: [],
+                    type: getter.type.kind === "func" ? getter.type.ret : DYN,
+                    loc: locOf(expr),
+                }, answer);
+            }
+        }
+        else if (arm.kind === "object") {
+            const info = lowerer.classes.get(arm.className) ?? null;
+            const slot = info?.fields.get(field);
+            if (slot !== undefined) {
+                answer = slot;
+                read = (receiver) => ({
+                    kind: "fieldGet",
+                    obj: receiver,
+                    className: arm.className,
+                    field,
+                    type: slot,
+                    loc: locOf(expr),
+                });
+            }
+            else {
+                const getter = lowerer.findMethodOn(info, getterName);
+                if (!getter || getter.sig.ret.kind === "void")
+                    return null;
+                anyAccessor = true;
+                answer = getter.sig.ret;
+                read = (receiver) => lowerer.fieldGetExpr({
+                    container: "accessor",
+                    obj: receiver,
+                    className: arm.className,
+                    field,
+                    fieldType: getter.sig.ret,
+                }, locOf(expr), expr);
+            }
+        }
+        else {
+            return null;
+        }
+        if (answer.kind === "void" || isUnitType(answer))
+            return null;
+        if (type !== null && !typeEquals(type, answer))
+            return null;
+        type = answer;
+        arms.push({ tag, read });
+    }
+    if (!anyAccessor || type === null || arms.length < 2)
+        return null;
+    return perArmUnionRead(lowerer, expr, unionId, value, type, "%unionMember", (_arm, tag, receiver) => {
+        const entry = arms.find((a) => a.tag === tag);
+        if (!entry)
+            throw new InternalCompilerError("lowerer bug: accessor arm missing");
+        return entry.read(receiver);
+    });
+}
+/** A LITERAL-key read on a union receiver whose stored arm is a scalar
+ * primitive the property does not exist on. Lowering erases flow
+ * narrowing, so the value keeps arms the checker ruled out
+ * (`{ url?: string } | "pending"` read as `x?.url` after the guard); JS
+ * boxes a primitive and answers undefined for a name its prototype chain
+ * does not carry, which is exactly what the unit and missing-field arms
+ * answer. A name the primitive DOES declare (`length`, `toUpperCase`)
+ * leaves the read to its own lowering/refusal — `{ n: number } | string`
+ * must keep answering the string's own member, not undefined. */
+function primitiveArmLacksMember(lowerer, arm, field) {
+    // `"abc"[0]` is an element read (JS indexes a string by position), not a
+    // missing property: canonical numeric keys keep their own lowering.
+    if (/^(?:0|[1-9]\d*)$/.test(field))
+        return false;
+    const checker = lowerer.checker;
+    let primitive;
+    switch (arm.kind) {
+        case "string":
+            primitive = checker.getStringType();
+            break;
+        case "f64":
+            primitive = checker.getNumberType();
+            break;
+        case "bool":
+            primitive = checker.getBooleanType();
+            break;
+        case "bigint":
+            primitive = checker.getBigIntType();
+            break;
+        default:
+            return false;
+    }
+    return checker.getPropertyOfType(primitive, field) === undefined;
 }
 /** The unionDisc generalization: a keyed read on a union receiver whose
  * arms answer DIFFERENT (but joinable) types. Each arm contributes its
@@ -3325,6 +3989,15 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
     const def = lowerer.unions.get(unionId);
     if (!def)
         return null;
+    // A JavaScript-source read on a dyn-convertible receiver already has a
+    // dynamic fallback at every call site (`dynKeyGet`), so the primitive
+    // arm's undefined answer would REPLACE a read that compiles today and
+    // change a working program's IR. Keep that fallback: the static answer
+    // exists to replace a refusal, which is the TypeScript-source case.
+    const keepsDynamicFallback = isJsSourceFile(ts.getSourceFileOfNode(expr)) && lowerer.dynConvertible(value.type);
+    const primitiveArmAnswers = (arm) => literalField !== null &&
+        !keepsDynamicFallback &&
+        primitiveArmLacksMember(lowerer, arm, literalField);
     // Pass 1: per-arm declared answers, joined into the result type.
     const joinArms = [];
     const seen = new Set();
@@ -3359,8 +4032,13 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
                 return null;
             continue;
         }
-        if (arm.kind !== "record")
+        if (arm.kind !== "record") {
+            if (primitiveArmAnswers(arm)) {
+                push(UNDEFINED_T);
+                continue;
+            }
             return null;
+        }
         const shape = lowerer.shapes.get(arm.shapeId);
         if (!shape || shape.tuple)
             return null;
@@ -3423,8 +4101,16 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
                 return null;
             continue;
         }
-        if (arm.kind !== "record")
+        if (arm.kind !== "record") {
+            if (primitiveArmAnswers(arm)) {
+                // The primitive's answer above must surface as the join's
+                // undefined arm (the backend's missing-key path stores it).
+                if (!(type.kind === "union" && lowerer.armTag(type.unionId, UNDEFINED_T) >= 0))
+                    return null;
+                continue;
+            }
             return null;
+        }
         const shape = lowerer.shapes.get(arm.shapeId);
         if (!shape)
             return null;
@@ -3556,6 +4242,92 @@ function checkedDynamicValue(expr) {
         return expr;
     return expr.kind === "dynCheck" && expr.value.type.kind === "dyn" ? expr.value : null;
 }
+/** A GENERIC receiver type: a type parameter, or a narrowing of one that
+ * intersects it (`"k" in options` refines a type variable to
+ * `T & Record<"k", unknown>`). Its stored layout is whatever the call site
+ * instantiated it with, and the CONSTRAINT's members are not necessarily
+ * stored there. */
+function typeParameterReceiver(t) {
+    try {
+        if ((t.flags & ts.TypeFlags.TypeParameter) !== 0)
+            return true;
+        return ((t.flags & ts.TypeFlags.Intersection) !== 0 &&
+            ts.constituentTypes(t).some((part) => (part.flags & ts.TypeFlags.TypeParameter) !== 0));
+    }
+    catch (e) {
+        if (ts.isUnreadableConstituentsPanic(e))
+            return false;
+        throw e;
+    }
+}
+/** Whether `access` is only READ (not the target of an assignment, a
+ * delete, or an increment). The left operand of `??`, `===` or `&&`, and
+ * the operand of `!`, `-` or `typeof`, are reads. */
+function readOnlyAccess(access) {
+    const parent = access.parent;
+    if (parent === undefined)
+        return true;
+    if (ts.isBinaryExpression(parent) &&
+        parent.left === access &&
+        parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+        parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+        return false;
+    if (ts.isDeleteExpression(parent))
+        return false;
+    if (ts.isPostfixUnaryExpression(parent))
+        return false;
+    return (!ts.isPrefixUnaryExpression(parent) ||
+        (parent.operator !== ts.SyntaxKind.PlusPlusToken &&
+            parent.operator !== ts.SyntaxKind.MinusMinusToken));
+}
+/** The operand a member WRITE addresses through a chain of type assertions:
+ * `(p as View).x = v` names `p`. Node erases a type assertion, so a write
+ * mutates the very object the operand names; the assertion only decides what
+ * the checker accepts. Null when no `as`/`<T>` wraps the receiver (a write
+ * there keeps the ordinary lowering). */
+function assertionOperand(access) {
+    let node = access.expression;
+    let asserted = false;
+    for (;;) {
+        if (ts.isParenthesizedExpression(node)) {
+            node = node.expression;
+            continue;
+        }
+        if (ts.isAsExpression(node) || ts.isTypeAssertion(node)) {
+            node = node.expression;
+            asserted = true;
+            continue;
+        }
+        break;
+    }
+    return asserted ? node : null;
+}
+/** The unasserted value a member write addresses, when its OWN stored
+ * layout holds the member at the asserted type — the erased write of Node.
+ * The asserted view's conversion may instead build a fresh width record
+ * (`%rec.width`), and a write into that temporary is dropped, so a view
+ * that adds a member to a record has nothing to write and the caller
+ * refuses. Only a RECORD operand converts like that: a dyn value's cast is
+ * a checked, identity-preserving view (`dyn-literal-identity.ts`), and the
+ * ordinary lowering already writes through it. The static type decides, so
+ * the operand is lowered exactly once even when it has side effects. */
+function assertedWrite(lowerer, access, operand, fieldType, assertedType) {
+    if (lowerer.mapTypeOf(lowerer.typeOf(operand))?.kind !== "record") {
+        return { receiver: null, refuse: false };
+    }
+    const value = lowerer.lowerExpr(operand);
+    if (value.type.kind === "record") {
+        const field = lowerer.shapes
+            .get(value.type.shapeId)
+            ?.fields.find((f) => f.name === access.name.text);
+        return field && typeEquals(field.type, fieldType)
+            ? { receiver: value, refuse: false }
+            : { receiver: null, refuse: true };
+    }
+    // The value stayed non-record (a generic body, an aliased layout): keep
+    // the assertion's conversion over the value already lowered.
+    return { receiver: lowerer.coerceInto(access.expression, value, assertedType), refuse: false };
+}
 export function fieldTarget(lowerer, access) {
     if (lowerer.cjsLocalModuleBindingOf(access.expression))
         return null;
@@ -3647,11 +4419,94 @@ export function fieldTarget(lowerer, access) {
     if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
         return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
     }
+    // A member the checker ADMITS on a receiver that has no static layout: a
+    // write through an assertion on a checked-dynamic value (a caught binding
+    // — `(error as { headers?: Headers }).headers = undefined`). Node erases
+    // the assertion, so the write lands on the runtime object as an own
+    // property; the checked-dynamic keyed write sets exactly that, and the
+    // class-typed value converts at the write like every other dyn→static edge.
+    if (receiverIr?.kind === "dyn" && !readOnlyAccess(access)) {
+        // The assertion itself may be unrepresentable (a class member on a
+        // structural view); it is erased at runtime, so address the operand.
+        const writeOperand = assertionOperand(access);
+        const admitted = lowerer.mapTypeOf(lowerer.typeOf(access));
+        if (writeOperand && admitted && admitted.kind !== "void")
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceToExpected(lowerer.lowerExpr(writeOperand), DYN),
+                field: access.name.text,
+                fieldType: admitted,
+            };
+    }
+    // A member the checker ADMITS but the stored layout cannot hold. The
+    // constraint of a type parameter declares it (a generic options bag read
+    // through an `"sessionId" in options` guard, or `options?.apiKey` with the
+    // guarded spelling), and so does a cast that intersects the member onto a
+    // record (`options as Omit<T, "k"> & ProviderRequestOptions<M>`), while the
+    // record the value was STORED as has no such slot: the call site omitted the
+    // optional member, the instantiation is a union of option shapes, or the cast
+    // added a member its source layout never declared. Node reads the property
+    // off the object it actually has — undefined when the object lacks it, the
+    // value when the value kept one — so the read is the checked-dynamic keyed
+    // read of the stored value, entering the static code at the type the checker
+    // gave the read (a failed conversion throws; it never diverges).
+    //
+    // Inside a `?.` chain this lowering runs on the re-dispatch, with the
+    // receiver node bound to the chain's present (non-nullish) arm, so the
+    // stored value is already the record and the chain supplies the guard.
+    if ((!access.questionDotToken || lowerer.chainHandled.has(access)) && readOnlyAccess(access)) {
+        const storedIr = stored ?? narrowed;
+        const present = storedIr?.kind === "union" ? lowerer.stripUndefinedArm(storedIr) : storedIr;
+        const arms = present?.kind === "union"
+            ? (lowerer.unions.get(present.unionId)?.arms ?? [present])
+            : present
+                ? [present]
+                : [];
+        // Every arm is a plain record layout with no slot for the member.
+        const layoutMissing = arms.length > 0 &&
+            arms.every((arm) => {
+                if (arm.kind !== "record")
+                    return false;
+                const shape = lowerer.shapes.get(arm.shapeId);
+                return (shape !== undefined &&
+                    !shape.tuple &&
+                    !shape.indexValue &&
+                    !shape.fields.some((f) => f.name === access.name.text));
+            });
+        const admitted = lowerer.mapTypeOf(lowerer.typeOf(access));
+        const checkerHolds = typeParameterReceiver(lowerer.typeOf(access.expression)) ||
+            narrowed === null ||
+            (narrowed.kind === "record" &&
+                (lowerer.shapes.get(narrowed.shapeId)?.fields.some((f) => f.name === access.name.text) ??
+                    false));
+        if (layoutMissing && checkerHolds && admitted && admitted.kind !== "void") {
+            let obj = lowerer.lowerExpr(access.expression);
+            if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
+                const presentType = lowerer.stripUndefinedArm(obj.type);
+                obj =
+                    presentType.kind === "record"
+                        ? (lowerer.runtimeOptionalPropertyReceiver(access.expression, obj, presentType, access.name.text) ?? obj)
+                        : lowerer.maybeNarrow(obj, access.expression);
+            }
+            if (!lowerer.dynConvertible(obj.type))
+                return null;
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceToExpected(obj, DYN),
+                field: access.name.text,
+                fieldType: admitted,
+            };
+        }
+    }
     if (receiverIr?.kind === "record") {
         const shape = lowerer.shapes.get(receiverIr.shapeId);
         const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
         if (fieldType) {
-            let obj = lowerer.lowerExpr(access.expression);
+            const writeOperand = readOnlyAccess(access) ? null : assertionOperand(access);
+            const write = writeOperand === null
+                ? null
+                : assertedWrite(lowerer, access, writeOperand, fieldType, receiverIr);
+            let obj = write?.receiver ?? lowerer.lowerExpr(access.expression);
             const nominal = representedClassFieldTarget(lowerer, access.expression, access.name.text, obj);
             if (nominal)
                 return nominal;
@@ -3683,6 +4538,13 @@ export function fieldTarget(lowerer, access) {
             }
             if (obj.type.kind !== "record")
                 return null;
+            // A write through a type assertion that the value's own layout cannot
+            // host would land on the assertion's converted copy (`%rec.width.<id>`)
+            // and be dropped. Node erases the assertion and mutates the object the
+            // operand names, so refuse rather than diverge silently.
+            if (write?.refuse === true) {
+                lowerer.unsupported("SC1090", access, `writing '${access.name.text}' through a type assertion to a member the value's own layout does not hold (the write would land on a converted copy; declare the member on the value's type)`);
+            }
             const actualShape = lowerer.shapes.get(obj.type.shapeId);
             const actualField = actualShape?.fields.find((f) => f.name === access.name.text);
             return {
@@ -3875,6 +4737,21 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
     // construction), typed as the index value armed with undefined
     // (mirroring lowerRecordKeyRead).
     if (target.container === "recordOvf") {
+        // A dot read through a value HELD from process.env (`const env =
+        // process.env; env.X`): the hold aliases the live table, so the read is
+        // the same getenv the direct spelling lowers to.
+        if (ts.isPropertyAccessExpression(blame)) {
+            const live = heldEnvValueType(lowerer, blame.expression);
+            if (live !== null) {
+                return {
+                    kind: "libCall",
+                    fn: "process.envGet",
+                    args: [{ kind: "strLit", value: target.field, type: STRING, loc }],
+                    type: live,
+                    loc,
+                };
+            }
+        }
         let obj = target.obj;
         if (obj.type.kind === "union" && ts.isPropertyAccessExpression(blame)) {
             const present = lowerer.stripUndefinedArm(obj.type);
@@ -3958,6 +4835,23 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
         }
         return read;
     }
+    // A field some partial record assertion leaves unwritten (a partial
+    // record view, partial-assertions.ts): a read of an absent field throws
+    // the catchable TypeError instead of reading a slot the view lacks.
+    if (partialAssertionFields(lowerer, target.shapeId).has(target.field)) {
+        const obj = target.obj;
+        if (isSafeToRepeat(obj))
+            return partialFieldRead(lowerer, obj, target.shapeId, target.field, target.fieldType, loc);
+        const stable = lowerer.declareHiddenLocal("%partialRecv", obj.type);
+        const ref = varRef(stable.id, obj.type, loc);
+        return {
+            kind: "seqExpr",
+            stmts: [{ kind: "varDecl", localId: stable.id, init: obj, loc }],
+            result: partialFieldRead(lowerer, ref, target.shapeId, target.field, target.fieldType, loc),
+            type: target.fieldType,
+            loc,
+        };
+    }
     return {
         kind: "recordGet",
         obj: target.obj,
@@ -4010,7 +4904,10 @@ const ERROR_CONSTRUCTOR_VALUES = new Set([
  * constructor, and dynamic values answer `.constructor` with the same one,
  * so `o.constructor === Object` and `err.constructor === TypeError` are
  * exact identity tests, and `err.constructor.name` is the constructor's
- * name. */
+ * name. SharedArrayBuffer, DataView, BigInt64Array, BigUint64Array and
+ * Proxy have values with Node's name, length and instanceof answers;
+ * calling one throws Node's TypeError, and constructing through the value
+ * is fenced. */
 const GLOBAL_CONSTRUCTOR_VALUES = new Set([
     "Object",
     "Function",
@@ -4022,6 +4919,11 @@ const GLOBAL_CONSTRUCTOR_VALUES = new Set([
     "WeakMap",
     "WeakSet",
     "FinalizationRegistry",
+    "SharedArrayBuffer",
+    "DataView",
+    "BigInt64Array",
+    "BigUint64Array",
+    "Proxy",
     ...ERROR_CONSTRUCTOR_VALUES,
 ]);
 /** The builtin global functions JavaScript sources read as interned
@@ -4102,7 +5004,8 @@ export function builtinGlobalValueAt(lowerer, expr, canonical, loc, js) {
         return namespace;
     if (readsBuiltinGlobalMembers(expr))
         return null;
-    const value = builtinGlobalValue(canonical, loc, js);
+    const value = builtinGlobalValue(canonical, loc, js) ??
+        (js ? globalFunctionValue(lowerer, canonical, loc) : null);
     if (value === null)
         return null;
     let node = expr;
@@ -4190,6 +5093,94 @@ const OBJECT_PROTOTYPE_VALUE_READS = new Set([
     "hasOwnProperty",
     "propertyIsEnumerable",
 ]);
+/** The method names each weak collection's prototype declares. */
+const WEAK_COLLECTION_METHOD_NAMES = {
+    WeakMap: new Set(["get", "set", "has", "delete"]),
+    WeakSet: new Set(["add", "has", "delete"]),
+};
+/** A weak-collection method read as a VALUE (`wm.has`, the
+ * `map.has.call(x, k)` brand-check tests): the runtime's interned prototype
+ * function for that name, which applies the method to its own receiver and
+ * throws Node's brand-check TypeError when that receiver is not a
+ * WeakMap/WeakSet. A receiver typed `WeakMap | WeakSet` picks the function by
+ * the collection the value holds, and one that admits `null`/`undefined`
+ * throws the property-read TypeError the read itself throws in Node. Only
+ * JavaScript sources take this path: a typed source keeps its refusal (the
+ * checker's signature has no value form). The receiver expression still runs
+ * for its effects. */
+function weakCollectionMethodValue(lowerer, expr, prototypes, nullable, name) {
+    const loc = locOf(expr);
+    const method = (prototype) => WEAK_COLLECTION_METHOD_NAMES[prototype].has(name)
+        ? {
+            kind: "libCall",
+            fn: "dyn.builtinMethod",
+            args: [
+                { kind: "strLit", value: prototype, type: STRING, loc },
+                { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
+            ],
+            type: DYN,
+            loc,
+        }
+        : // The collection without the method reads it as undefined.
+            dynUndefinedExpr(loc);
+    const receiver = lowerer.lowerExpr(expr.expression);
+    if (!nullable && prototypes.length === 1) {
+        const value = method(prototypes[0]);
+        return isSafeToDiscard(receiver)
+            ? value
+            : {
+                kind: "seqExpr",
+                stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr.expression) }],
+                result: value,
+                type: DYN,
+                loc,
+            };
+    }
+    // The receiver answers the kind and unit tests below, so it waits in a
+    // hidden local.
+    const held = lowerer.declareHiddenLocal("%weakRecv", DYN);
+    const ref = () => varRef(held.id, DYN, loc);
+    let value = method(prototypes[0]);
+    if (prototypes.length > 1)
+        value = {
+            kind: "ternary",
+            cond: { kind: "libCall", fn: "weakMap.is", args: [ref()], type: BOOL, loc },
+            then: method("WeakMap"),
+            else_: method("WeakSet"),
+            type: DYN,
+            loc,
+        };
+    if (nullable)
+        value = {
+            kind: "ternary",
+            cond: { kind: "dynTest", test: "nullish", value: ref(), type: BOOL, loc },
+            // Node throws from the read itself, naming the unit and the member.
+            then: {
+                kind: "dynKeyGet",
+                value: ref(),
+                key: { kind: "strLit", value: name, type: STRING, loc },
+                type: DYN,
+                loc,
+            },
+            else_: value,
+            type: DYN,
+            loc,
+        };
+    return {
+        kind: "seqExpr",
+        stmts: [
+            {
+                kind: "varDecl",
+                localId: held.id,
+                init: lowerer.coerceInto(expr.expression, receiver, DYN),
+                loc,
+            },
+        ],
+        result: value,
+        type: DYN,
+        loc,
+    };
+}
 /** Whether `expr` is the callee of a call (`o.toString()`), which keeps its
  * call lowering rather than reading the member as a value. */
 function isCalleeOf(expr) {
@@ -4388,4 +5379,67 @@ function globalThisWrittenNames(lowerer, globalType) {
     }
     return names;
 }
+/** `Number.prototype` / `Boolean.prototype` in a JavaScript source: the
+ * prototype object the checked-dynamic world builds (with its methods), or
+ * one of its members read as a value. Typed sources keep their own
+ * lowering, so no typed program links the unit that builds it. */
+function jsPrimitivePrototypeValue(lowerer, expr) {
+    if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        return null;
+    const loc = locOf(expr);
+    const value = (kind) => kind === "Boolean"
+        ? // The wrapper unit's Boolean.prototype is the object Boolean
+            // instances inherit from, so its valueOf/toString are the interned
+            // members and accept a primitive boolean or a Boolean wrapper
+            // receiver (the dyn.builtinPrototype builder takes only the kind's
+            // primitives).
+            {
+                kind: "libCall",
+                fn: "wrapper.booleanPrototype",
+                args: [wrapperConstructors(lowerer, loc)[2]],
+                type: DYN,
+                loc,
+            }
+        : {
+            kind: "libCall",
+            fn: "dyn.builtinPrototype",
+            args: [{ kind: "strLit", value: kind, type: STRING, loc }],
+            type: DYN,
+            loc,
+        };
+    const receiver = expr.expression;
+    if (ts.isPropertyAccessExpression(receiver) && receiver.name.text === "prototype") {
+        const kind = primitivePrototypeKind(lowerer, receiver);
+        if (!kind)
+            return null;
+        return {
+            kind: "dynKeyGet",
+            value: value(kind),
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+            type: DYN,
+            loc,
+        };
+    }
+    const kind = primitivePrototypeKind(lowerer, expr);
+    return kind ? value(kind) : null;
+}
+/** Whether `expr` names `Number.prototype` or `Boolean.prototype` in a
+ * JavaScript source, which lowers to the prototype object above rather than
+ * to the wrapper interface's numeric/boolean value. */
+export function isPrimitivePrototypeRead(lowerer, expr) {
+    return primitivePrototypeKind(lowerer, expr) !== null;
+}
+/** The kind whose prototype `expr` names (`Number.prototype`) in a
+ * JavaScript source, if any. */
+function primitivePrototypeKind(lowerer, expr) {
+    if (!ts.isPropertyAccessExpression(expr) || expr.name.text !== "prototype")
+        return null;
+    if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        return null;
+    if (lowerer.stdlibGlobalMember(expr, "Number") === "prototype")
+        return "Number";
+    if (lowerer.stdlibGlobalMember(expr, "Boolean") === "prototype")
+        return "Boolean";
+    return null;
+}
 //# sourceMappingURL=property-access.js.map