@scriptc/compiler 0.4.7 → 0.4.8

package/dist/ir/runtime-features.js

@@ -1,3 +1,4 @@
+import { BIGINT_BYTES_NAMES, } from "./ir.js";
 import { isDirentShape, recordHandleCodecClass, recordTextCodecClass, RUNTIME_EMITTER_CLASS, RUNTIME_EVENT_CLASS, RUNTIME_EVENT_TARGET_CLASS, RUNTIME_STREAM_CLASSES, } from "./ir.js";
 import { everyModuleNode, everyStmtList } from "./traverse.js";
 import { eachNodeOfKinds } from "./node-index.js";
@@ -16,12 +17,16 @@ const DYN_BUFFER_NUM_METHODS = new Set(["read", "write"].flatMap((rw) => [
         "DoubleBE",
     ].map((n) => `${rw}${n}`),
 ]));
-/** Buffer.prototype members scr_bytes_dyn.c refuses on Buffer receivers. */
-const DYN_BUFFER_REFUSED_METHODS = [
-    ...["read", "write"].flatMap((rw) => [
-        ...["UIntLE", "UIntBE", "UintLE", "UintBE", "IntLE", "IntBE"].map((n) => `${rw}${n}`),
-        ...["BigUInt64", "BigUint64", "BigInt64"].flatMap((n) => [`${rw}${n}LE`, `${rw}${n}BE`]),
-    ]),
+/** The variable-width and BigInt reads and writes, which
+ * scr_dyn_invoke_buffer_wide runs. */
+const DYN_BUFFER_WIDE_METHODS = ["read", "write"].flatMap((rw) => [
+    ...["UIntLE", "UIntBE", "UintLE", "UintBE", "IntLE", "IntBE"].map((n) => `${rw}${n}`),
+    ...["BigUInt64", "BigUint64", "BigInt64"].flatMap((n) => [`${rw}${n}LE`, `${rw}${n}BE`]),
+]);
+/** The Buffer.prototype members scr_dyn_invoke_buffer refuses on Buffer
+ * receivers besides running the named ones: the per-encoding slices and
+ * writes, and inspect. */
+const DYN_BUFFER_FAMILY_METHODS = [
     ...["ascii", "base64", "base64url", "latin1", "hex", "ucs2", "utf8"].flatMap((enc) => [
         `${enc}Slice`,
         `${enc}Write`,
@@ -30,11 +35,13 @@ const DYN_BUFFER_REFUSED_METHODS = [
 ];
 /** The scr_bytes_dyn.c entry, one per method family, that a checked-dynamic
  * call of a Buffer.prototype method name routes to: the fixed-width reads and
- * writes (both "UInt" and "Uint" spellings), write, fill, toString, the
- * searches, and the other Buffer-only members. Each runs the method on a
- * Buffer receiver and gives any other receiver the ordinary dispatch. */
+ * writes (both "UInt" and "Uint" spellings), the variable-width and BigInt
+ * ones, write, fill, toString, the searches, and the other Buffer-only
+ * members. Each runs the method on a Buffer receiver and gives any other
+ * receiver the ordinary dispatch. */
 export const DYN_BUFFER_METHODS = new Map([
     ...[...DYN_BUFFER_NUM_METHODS].map((m) => [m, "scr_dyn_invoke_buffer_num"]),
+    ...DYN_BUFFER_WIDE_METHODS.map((m) => [m, "scr_dyn_invoke_buffer_wide"]),
     ["write", "scr_dyn_invoke_buffer_write"],
     ["fill", "scr_dyn_invoke_buffer_fill"],
     ["toString", "scr_dyn_invoke_buffer_to_string"],
@@ -50,12 +57,14 @@ export const DYN_BUFFER_METHODS = new Map([
         "swap16",
         "swap32",
         "swap64",
-        ...DYN_BUFFER_REFUSED_METHODS,
+        ...DYN_BUFFER_FAMILY_METHODS,
     ].map((m) => [m, "scr_dyn_invoke_buffer"]),
 ]);
 const DYN_ASYNC_LIB_FNS = new Set([
     // DEP0040 rides the dyn-async unit's warning machinery.
     "async.awaitDyn",
+    // So does SlowBuffer's DEP0030.
+    "buffer.slowBuffer",
     // The child property table adopts thenables through the dyn-async unit.
     "child.propsInstall",
     "child.propsResolve",
@@ -70,6 +79,9 @@ const DYN_ASYNC_LIB_FNS = new Set([
     "dyn.promiseAllSettled",
     "dyn.promiseAny",
     "dyn.promiseResolve",
+    // The generic Promise statics build and settle their capability's promise
+    // with dyn values (scr_dyn_new_promise, scr_dyn_promise_resolve).
+    "promise.genericStatic",
     "fs.callbackCall",
     "fs.callbackGlob",
     "fs.callbackValue",
@@ -96,6 +108,8 @@ const DYN_ASYNC_LIB_FNS = new Set([
     "util.debounce",
     "util.throttle",
     "timers.immediatePromise",
+    // A timer callback bound to its handle as `this`.
+    "timers.thisCallback",
     // The performance timeline (scr_perf.c, linked with this unit for its
     // MaxPerformanceEntryBufferExceededWarning).
     "perf.clearMarks",
@@ -204,6 +218,10 @@ const ABORT_SIGNAL_LIB_FNS = new Set([
     "http.requestDynCb",
     "https.requestDyn",
     "https.requestDynCb",
+    "http.requestUrlDyn",
+    "http.requestUrlDynCb",
+    "https.requestUrlDyn",
+    "https.requestUrlDynCb",
     "rl.createSignal",
     "rl.questionAsyncSignal",
     "sp.finishedOptsSignal",
@@ -334,6 +352,47 @@ const INHERITED_MEMBER_NAMES = new Set([
     "toString",
     "valueOf",
 ]);
+/** Array.prototype's method names. A constant-key dynamic read of one on an array answers the method the array's implicit prototype installs, so the read links the dyn-invoke unit. Mirrors the method table in scr_dyn_invoke.c (runtime-registries.test.ts checks the two agree). */
+export const ARRAY_PROTOTYPE_MEMBER_NAMES = new Set([
+    "at",
+    "concat",
+    "copyWithin",
+    "fill",
+    "find",
+    "findIndex",
+    "findLast",
+    "findLastIndex",
+    "lastIndexOf",
+    "pop",
+    "push",
+    "reverse",
+    "shift",
+    "unshift",
+    "slice",
+    "sort",
+    "splice",
+    "includes",
+    "indexOf",
+    "join",
+    "keys",
+    "entries",
+    "values",
+    "forEach",
+    "filter",
+    "flat",
+    "flatMap",
+    "map",
+    "every",
+    "some",
+    "reduce",
+    "reduceRight",
+    "toReversed",
+    "toSorted",
+    "toSpliced",
+    "with",
+    "toLocaleString",
+    "toString",
+]);
 /** Entry points that link the child-process unit (with CHILD_PROCESS_LIB_PREFIXES): the fork IPC channel on the process object. */
 const CHILD_PROCESS_LIB_FNS = new Set([
     "process.connected",
@@ -374,6 +433,7 @@ const SYMBOL_LIB_FNS = new Set([
     "buffer.constructor",
     "buffer.staticValue",
     "buffer.prototypeMember",
+    "buffer.prototypeObject",
 ]);
 /** Entry points that link the querystring unit. */
 const QS_LIB_FNS = new Set([
@@ -585,6 +645,12 @@ const PROCESS_EVENT_LIB_FNS = new Set([
     "stdin.onData",
     "stdin.onEnd",
     "stdin.onError",
+    "stdin.onReadable",
+    "stdin.pause",
+    "stdin.resume",
+    "stdin.isPaused",
+    "stdin.readableLength",
+    "stdin.read",
     // node:readline rides the stdin unit (scr_readline.c links beside
     // scr_events.c under the same gate).
     "rl.checkCompleter",
@@ -713,6 +779,54 @@ function webCryptoAsymmetricScan() {
         result: () => webcrypto && named,
     };
 }
+/** The Buffer.prototype method names a checked-dynamic read can answer from
+ * scr_bytes_dyn.c: the ones calls route there, and the members Buffer
+ * defines over %TypedArray%.prototype's. */
+const BUFFER_PROTOTYPE_METHOD_NAMES = new Set([
+    ...DYN_BUFFER_METHODS.keys(),
+    "subarray",
+    "slice",
+    "toLocaleString",
+]);
+const u8BytesLeaf = (t) => t.kind === "bytes" && t.elem === "u8";
+/** Whether converting a value of type `t` to dyn can box a Buffer: a
+ * Uint8Array or Buffer, or a function, collection, record, union, promise
+ * or class instance that carries one. */
+function mentionsU8Bytes(t, tables) {
+    tables.u8BytesCarriers ??= leafCarriers(tables, u8BytesLeaf);
+    return carriesLeaf(t, tables.u8BytesCarriers, u8BytesLeaf, tables);
+}
+/** A checked-dynamic read with a key computed at run time, or one naming a
+ * Buffer.prototype method, in a module that makes Buffer values and boxes a
+ * value that can hold one: `buf[name]` and `buf.indexOf` read as values
+ * name Buffer.prototype methods, which scr_bytes_dyn.c answers. A Buffer
+ * value also comes from a typed file read, which answers a branded Buffer
+ * with no `buffer.*` call, so those reads count as making one. */
+function computedBufferMemberScan(mod) {
+    let tables;
+    const typeTables = () => (tables ??= {
+        records: new Map((mod.records ?? []).map((r) => [r.id, r])),
+        unions: new Map((mod.unions ?? []).map((u) => [u.id, u])),
+        classes: new Map((mod.classes ?? []).map((c) => [c.name, c])),
+    });
+    let computed = false;
+    let buffer = false;
+    let boxed = false;
+    return {
+        expr: (node) => {
+            if (node.kind === "dynKeyGet" &&
+                (node.key.kind !== "strLit" || BUFFER_PROTOTYPE_METHOD_NAMES.has(node.key.value)))
+                computed = true;
+            else if (node.kind === "libCall" && node.fn.startsWith("buffer."))
+                buffer = true;
+            else if (node.kind === "libCall" && FS_READ_BYTES_FNS.has(node.fn))
+                buffer = true;
+            else if (!boxed && node.kind === "dynFrom" && mentionsU8Bytes(node.value.type, typeTables()))
+                boxed = true;
+        },
+        result: () => computed && buffer && boxed,
+    };
+}
 /** Whether the module calls WebCrypto and a string literal in it names one
  * of the asymmetric algorithms (matched without regard to case, as
  * normalizeAlgorithm matches names): scr_webcrypto_pki.c and the pki unit
@@ -733,9 +847,8 @@ export function moduleUsesWebCryptoAsymmetric(mod) {
     });
     return webcrypto && named;
 }
-/** The typed file reads that answer a ScrBytes: Node answers a Buffer, but
- * scr_lib.c brands it only in the SCR_FS_BUFFER_BRAND build, so a program
- * that can observe the difference links that build. */
+/** The typed file reads that answer a ScrBytes: Node answers a Buffer, and
+ * scr_lib.c's read entries brand it, so a typed read makes a Buffer value. */
 const FS_READ_BYTES_FNS = new Set([
     "fs.readFileSyncBuf",
     "fs.readFileSyncBytes",
@@ -743,136 +856,28 @@ const FS_READ_BYTES_FNS = new Set([
     "fsp.readFileBytes",
     "fileHandle.readFileBytes",
 ]);
-/** The bytesIntrinsic searches whose runtime branch reads the brand: a
- * Buffer viewed as a Uint8Array searches bytes, a plain Uint8Array compares
- * element values (NaN and out-of-range needles differ). */
-const FS_BUFFER_SEARCH_METHODS = new Set([
-    "indexOfElem",
-    "lastIndexOfElem",
-    "includesElem",
+/** The entries that need the JavaScript object model build (t262-da §J):
+ * the runtime code a JavaScript source reaches for builtin intrinsics,
+ * array attributes, BigInt views, handle property tables and buffer views
+ * that no typed program can observe. Empty until the first slice lands
+ * (A1 adds dyn.intrinsic); the slices share one SCR_JS_OBJECT_MODEL build
+ * of every unit they touch instead of one build column per feature. */
+export const JS_OBJECT_MODEL_LIB_FNS = new Set([
+    // Resizable ArrayBuffers and growable SharedArrayBuffers (t262-dc C2), and
+    // the arming call that turns on the buffer views registry.
+    "arrayBuffer.newResizable",
+    "sharedArrayBuffer.newGrowable",
+    "arrayBuffer.armMutable",
 ]);
-/** Whether a type holds bytes without passing another declaration, collecting
- * the record and union declarations it references. A boxed function's call
- * thunk boxes its result, and a checked function's thunk boxes its
- * arguments, with no dynFrom in the IR. */
-function reachesBytesDirect(t, deps) {
-    switch (t.kind) {
-        case "bytes":
-            return true;
-        case "array":
-        case "set":
-            return reachesBytesDirect(t.elem, deps);
-        case "map":
-            return reachesBytesDirect(t.key, deps) || reachesBytesDirect(t.value, deps);
-        case "promise":
-            return reachesBytesDirect(t.inner, deps);
-        case "func":
-            return reachesBytesDirect(t.ret, deps) || t.params.some((p) => reachesBytesDirect(p, deps));
-        case "record":
-            deps.push(`r:${t.shapeId}`);
-            return false;
-        case "union":
-            deps.push(`u:${t.unionId}`);
-            return false;
-        default:
-            return false;
-    }
-}
-/** The module's declarations that can hold bytes, resolved to a fixpoint: a
- * record or union that references another declaration holding bytes holds
- * bytes, and a recursive declaration resolves like a non-recursive one. The
- * closure answers each reference from one pass over the declarations instead
- * of walking the shape tree at every reference. */
-function bytesCarryingDecls(mod) {
-    const referrers = new Map();
-    const carrying = new Set();
-    const queue = [];
-    const direct = (id, t) => {
-        const deps = [];
-        if (reachesBytesDirect(t, deps)) {
-            if (!carrying.has(id)) {
-                carrying.add(id);
-                queue.push(id);
-            }
-        }
-        for (const dep of deps) {
-            const list = referrers.get(dep);
-            if (list === undefined)
-                referrers.set(dep, [id]);
-            else
-                list.push(id);
-        }
-    };
-    for (const record of mod.records ?? []) {
-        for (const field of record.fields)
-            direct(`r:${record.id}`, field.type);
-        if (record.indexValue !== undefined)
-            direct(`r:${record.id}`, record.indexValue);
-    }
-    for (const union of mod.unions ?? []) {
-        for (const arm of union.arms)
-            direct(`u:${union.id}`, arm);
-    }
-    for (let i = 0; i < queue.length; i++) {
-        for (const from of referrers.get(queue[i]) ?? []) {
-            if (carrying.has(from))
-                continue;
-            carrying.add(from);
-            queue.push(from);
-        }
-    }
-    const deps = [];
-    const holdsBytes = (t) => {
-        deps.length = 0;
-        if (reachesBytesDirect(t, deps))
-            return true;
-        for (const dep of deps)
-            if (carrying.has(dep))
-                return true;
-        return false;
-    };
-    return holdsBytes;
-}
-/** fsBufferBrand's condition as a scan over the module: it reads file bytes
- * through a typed read and can observe their Buffer-ness. scr_lib.c's read
- * entries set is_buffer only under SCR_FS_BUFFER_BRAND, so this conjunction
- * selects that variant; a program that reads bytes without observing them
- * keeps the default object. */
-function fsBufferBrandScan(mod) {
-    let reads = false;
-    let observes = false;
-    let holdsBytes;
-    return {
-        expr: (node) => {
-            if (reads && observes)
-                return;
-            if (node.kind === "libCall" && FS_READ_BYTES_FNS.has(node.fn)) {
-                reads = true;
-                return;
-            }
-            if (observes)
-                return;
-            switch (node.kind) {
-                case "dynFrom":
-                    observes = (holdsBytes ??= bytesCarryingDecls(mod))(node.value.type);
-                    return;
-                case "dynCheck":
-                    if (node.type.kind === "func") {
-                        observes = (holdsBytes ??= bytesCarryingDecls(mod))(node.type);
-                    }
-                    return;
-                case "bytesIntrinsic":
-                    observes = FS_BUFFER_SEARCH_METHODS.has(node.method);
-                    return;
-                case "libCall":
-                    observes = node.fn === "buffer.isBranded" || node.fn === "insp.bytes";
-                    return;
-                default:
-                    return;
-            }
-        },
-        result: () => reads && observes,
-    };
+/** The JavaScript object model build's program facts (t262-da §J): every
+ * runtime feature that shares the one SCR_JS_OBJECT_MODEL build ORs in here
+ * (BigInt views today, array attributes and handle property tables next), so
+ * pack selection and the source build (RUNTIME_DEFINES, the library's
+ * cflags) agree on when the build is on. */
+export function jsObjectModelFact(features) {
+    return (features.jsObjectModel === true ||
+        features.bigintBytes === true ||
+        features.mutableBuffers === true);
 }
 /** One rule per runtime feature, sorted by name. A new feature is an
  * entry here and its line in noRuntimeFeatures; RuntimeFeatures, the scan
@@ -916,6 +921,13 @@ const RUNTIME_FEATURE_RULES = {
             "child.signalCode",
         ],
     }),
+    /** spawnSync's and the exec/execFile callback form's `cwd`/`input`/
+     * `shell` entries (SCR_CHILD_CP_OPTIONS): a build of scr_child.c of its
+     * own, so a program that never passes those options keeps the default
+     * object, byte for byte. */
+    childOptionExt: rule({
+        fns: ["cp.spawnSyncExt", "cp.spawnSyncExtEnv", "cp.execFileCwd"],
+    }),
     /** scr_cipher.c over the mbedTLS archive; DEP0182 reports through the
      * process-warning unit, and unknown output encodings render through the
      * inspect unit. WebCrypto's encrypt, decrypt, wrapKey and unwrapKey
@@ -982,6 +994,10 @@ const RUNTIME_FEATURE_RULES = {
                 (node.name === "promise.allSettled" || node.name === "promise.any")) ||
             (node.kind === "dynFrom" && boxesPromise(node.value.type, tables(), new Set())),
     }),
+    /** The Promise statics through Function.prototype.call with a foreign
+     * constructor (scr_js_promise_generic.c): NewPromiseCapability(C), the
+     * C.resolve lookup and the iterator protocol. */
+    promiseGeneric: rule({ fns: ["promise.genericStatic"] }),
     /** EventEmitter and the stream classes as untyped constructor values
      * (scr_dyn_builtin_class.c), which call listeners through the dyn-invoke
      * unit, render unhandled 'error' payloads through the inspect unit and
@@ -996,6 +1012,11 @@ const RUNTIME_FEATURE_RULES = {
     /** A standard library prototype object read as a value in a JavaScript
      * source (scr_dyn_stdlib_prototype.c): `Date.prototype`. */
     stdlibPrototypeValue: rule({ fns: ["dyn.stdlibPrototype"] }),
+    /** The dynamic global object's answer for the Node globals the native
+     * runtime does not implement (scr_global_host_absent.c, plus the
+     * SCR_GLOBAL_HOST_ABSENT build of scr_node_builtin.c): a computed read of
+     * the global object, or `… in globalThis` (host-globals.ts). */
+    hostAbsentGlobals: rule({ fns: ["global.hostAbsent", "dyn.globalHas"] }),
     /** Array.prototype's generic algorithms over array-like receivers
      * (scr_dyn_array_like.c), which delegates every other name to the
      * dyn-invoke unit's array dispatch. */
@@ -1005,12 +1026,14 @@ const RUNTIME_FEATURE_RULES = {
     builtinPrototypeValue: rule({ fns: ["dyn.builtinPrototype"] }),
     dynInvoke: rule({
         initial: (mod) => mod.workers === true,
+        scan: computedBufferMemberScan,
         fns: [
             ...DYN_INVOKE_LIB_FNS,
             ...UTIL_CALLABLE_LIB_FNS,
             ...BUILTIN_CLASS_LIB_FNS,
             "util.promisifyDyn",
             "buffer.prototypeMember",
+            "buffer.prototypeObject",
             // scr_webstreams.c calls the iterators ReadableStream.from reads.
             "webstream.class",
             "webstream.instanceOf",
@@ -1020,13 +1043,21 @@ const RUNTIME_FEATURE_RULES = {
             "wrapper.objectTag",
             "wrapper.new",
             "wrapper.toObject",
+            // The Boolean prototype's methods run scr_js_wrapper_apply in the
+            // same unit, which calls scr_dyn_invoke.
+            "wrapper.booleanPrototype",
+            // The generic Promise statics call C's resolve and the iterable's
+            // next/return through scr_dyn_invoke.
+            "promise.genericStatic",
         ],
-        // Constant-key reads of Object.prototype member names answer the
-        // inherited member through scr_dyn_invoke.c.
+        // Constant-key reads of Object.prototype member names, and of
+        // Array.prototype method names on arrays, answer the inherited member
+        // through scr_dyn_invoke.c.
         expr: (node, _tables) => node.kind === "dynInvoke" ||
             (node.kind === "dynKeyGet" &&
                 node.key.kind === "strLit" &&
-                INHERITED_MEMBER_NAMES.has(node.key.value)),
+                (INHERITED_MEMBER_NAMES.has(node.key.value) ||
+                    ARRAY_PROTOTYPE_MEMBER_NAMES.has(node.key.value))),
     }),
     /** The program has dynamic-tier jsval operations (js.* builtins, the
      * jsval pass): links the scr_js_* units (two-tier design I3). */
@@ -1050,13 +1081,36 @@ const RUNTIME_FEATURE_RULES = {
     typeOrigins: rule({ initial: (mod) => (mod.declOrigins?.length ?? 0) > 0 }),
     /** for await over checked-dynamic values (scr_dyn_for_await.c). */
     dynForAwait: rule({ fns: ["dyn.asyncIteratorOpen", "dyn.asyncIteratorWasSync"] }),
+    /** Object.isExtensible and Object.isSealed of a value typed dynamically
+     * (scr_dyn_integrity.c, a unit of its own so scr_json.c keeps its layout). */
+    dynIntegrityQueries: rule({ fns: ["dyn.isExtensibleQuery", "dyn.isSealedQuery"] }),
+    /** A generator that binds its parameters at the call (scr_gen_bind.c):
+     * the spawn wrapper's eager step imports the bind helper, and every other
+     * program links the default runtime objects. */
+    genBind: rule({
+        initial: (mod) => mod.functions.some((fn) => fn.generator?.bindAtCall === true),
+    }),
     /** Buffer.prototype methods called on checked-dynamic values
      * (scr_bytes_dyn.c). */
     dynBuffer: rule({
-        // Buffer.prototype members read as values dispatch to the same entries.
-        fns: ["buffer.prototypeMember"],
+        // Buffer.prototype members read as values, and Buffer members read with
+        // a computed key, dispatch to the same entries.
+        fns: ["buffer.prototypeMember", "buffer.prototypeObject"],
+        scan: computedBufferMemberScan,
         expr: (node, _tables) => node.kind === "dynInvoke" && DYN_BUFFER_METHODS.has(node.method),
     }),
+    /** Checked-dynamic reads that answer Buffer.prototype methods by name
+     * (`buf[name]`, `buf.indexOf` as a value, Buffer.prototype): the program
+     * installs scr_bytes_dyn.c's member hook, which references every
+     * scr_dyn_invoke_buffer entry. */
+    dynBufferMembers: rule({
+        fns: ["buffer.prototypeMember", "buffer.prototypeObject"],
+        scan: computedBufferMemberScan,
+    }),
+    /** Buffer.prototype as a value: the program installs the symbol unit's
+     * Symbol.for for scr_bytes_dyn.c, which registers
+     * Symbol(nodejs.util.inspect.custom) as one of its keys. */
+    bufferPrototypeObject: rule({ fns: ["buffer.prototypeObject"] }),
     /** createRequire's require and require.resolve with specifiers computed
      * at run time (scr_require.c). */
     computedRequire: rule({ fns: ["module.requireComputed", "module.resolveComputed"] }),
@@ -1070,12 +1124,14 @@ const RUNTIME_FEATURE_RULES = {
             "buffer.installValue",
             "buffer.staticValue",
             "buffer.prototypeMember",
+            "buffer.prototypeObject",
             "dyn.validateString",
             "dyn.validateStrings",
             "path.resolveValue",
             "path.parseValue",
             "path.formatValue",
             "path.toNamespacedValue",
+            "dyn.installBuiltinStatics",
         ],
     }),
     /** The stream unit emits through the emitter unit, also when the
@@ -1120,10 +1176,6 @@ const RUNTIME_FEATURE_RULES = {
     eventsOnceSignal: rule({ fns: ["events.onceSignal"] }),
     fetch: rule({ prefixes: ["fetch."] }),
     fileHandle: rule({ types: ["fileHandle"] }),
-    /** A typed fs read whose bytes value the program can observe as a Buffer:
-     * scr_lib.c's SCR_FS_BUFFER_BRAND build, so programs that never see the
-     * brand keep the default object. */
-    fsBufferBrand: rule({ scan: fsBufferBrandScan }),
     fsWatch: rule({ prefixes: ["fs.watch", "watcher."], types: ["fsWatcher"] }),
     /** fs.watchFile / fs.unwatchFile (scr_watch_file.c): the stat-polling
      * half of the watching surface, gated on its own unit. */
@@ -1154,6 +1206,9 @@ const RUNTIME_FEATURE_RULES = {
     inspect: rule({
         fns: [
             "global.native",
+            // formatBigInt renders a bigint's digits in Node's form, and the
+            // numericSeparator groups they take are inspect state.
+            "bigint.inspect",
             // ERR_ARG_NOT_ITERABLE renders the value as util.format's %s does.
             "webstream.class",
             // ERR_UNKNOWN_ENCODING formats an encoding that is not a string with %s.
@@ -1176,6 +1231,13 @@ const RUNTIME_FEATURE_RULES = {
         prefixes: ["insp.", "console.", "test."],
         libCall: (node) => node.fn === "rl.terminal" && !isDynUndefined(node.args[3]),
     }),
+    /** The JavaScript object model build (t262-da §J): every runtime feature
+     * only a JavaScript source reaches shares one SCR_JS_OBJECT_MODEL build
+     * of the units it touches, so a program with one of them selects that
+     * build rather than a variant column of its own. The program has no
+     * typed-to-dynamic bridge of its own to lose: jsObjectModel implies
+     * dynTier. */
+    jsObjectModel: rule({ fns: [...JS_OBJECT_MODEL_LIB_FNS] }),
     legacyTextDecoder: rule({
         fns: [...LEGACY_TEXT_DECODER_LIB_FNS],
         expr: (node, tables) => (node.kind === "dynFrom" && mentionsTextDecoder(node.value.type, tables())) ||
@@ -1275,9 +1337,19 @@ const RUNTIME_FEATURE_RULES = {
     symbol: rule({
         initial: (mod) => (mod.records ?? []).some(isDirentShape),
         fns: [...SYMBOL_LIB_FNS],
-        prefixes: ["sym.", "disposable."],
+        // %Iterator.prototype% (scr_js_iterator.c) defines its Symbol.iterator,
+        // Symbol.toStringTag and Symbol.dispose members with the well-known
+        // symbols scr_sym_well_known makes.
+        prefixes: ["sym.", "disposable.", "iterator."],
         types: ["symbol"],
     }),
+    /** Symbol.toPrimitive is read (sym.wellKnown with that name, or a name
+     * computed at run time): the program installs ToNumber's
+     * Symbol.toPrimitive step (scr_dyn_to_primitive_number_install). */
+    toPrimitiveNumber: rule({
+        libCall: (node) => node.fn === "sym.wellKnown" &&
+            (node.args[0]?.kind !== "strLit" || node.args[0].value === "toPrimitive"),
+    }),
     tls: rule({ prefixes: ["tls.", "https.", "http2."], types: ["secureCtx"] }),
     tlsCa: rule({ prefixes: ["tlsca."] }),
     /** util.promisify over an untyped function (scr_util_promisify.c): its
@@ -1286,19 +1358,36 @@ const RUNTIME_FEATURE_RULES = {
     utilPromisify: rule({ fns: ["util.promisifyDyn"] }),
     /** process.emitWarning is assigned (process.setEmitWarning). */
     warningReplace: rule({ fns: ["process.setEmitWarning"] }),
-    /** A record literal asserted to a wider record type answers a partial
-     * record view (record-views.ts): the SIZE_MAX sentinel and its trap live in
-     * the SCR_RECORD_VIEW_PARTIAL build of scr_json.c. */
-    recordViewPartial: rule({
-        expr: (node) => node.kind === "dynCheck" && node.partialView === true,
+    /** A BigInt typed-array constructor read as a value (BigInt64Array,
+     * BigUint64Array): their element kinds, which no double represents, live
+     * in the JavaScript object model build (t262-da §J) of scr_bytes.c,
+     * scr_json.c, scr_dyn_invoke.c and the assert, inspect and console units.
+     * The fact ORs into jsObjectModel (jsObjectModelFact), so it selects no
+     * build column of its own. Every other program keeps the byte-for-byte
+     * default objects. */
+    bigintBytes: rule({
+        libCall: (node) => node.fn === "bytes.constructor" &&
+            node.args[0]?.kind === "strLit" &&
+            BIGINT_BYTES_NAMES.has(node.args[0].value),
     }),
     /** Module namespace objects as checked-dynamic values
      * (scr_module_namespace.c). */
     moduleNamespace: rule({ fns: ["module.namespaceValue"] }),
+    /** A JavaScript source resizes, grows or detaches an ArrayBuffer
+     * (frontend/lowering/buffers.ts): the program arms the buffer views
+     * registry, which lives in the gated unit scr_js_buffers.c, and its bytes
+     * headers stop being invariant (IrModule.bytesHeadersMutable). The fact
+     * ORs into jsObjectModel (jsObjectModelFact), so it selects no build
+     * column of its own. Every other program links no part of the unit. */
+    mutableBuffers: rule({
+        fns: ["arrayBuffer.armMutable", "arrayBuffer.newResizable", "sharedArrayBuffer.newGrowable"],
+    }),
     /** A module namespace boxed for typed code (scr_module_namespace_dyn.c). */
     moduleNamespaceDyn: rule({ fns: ["module.namespaceDyn"] }),
     /** Primitive wrapper objects (scr_js_wrapper.c). */
     primitiveWrapper: rule({ prefixes: ["wrapper."] }),
+    /** %Iterator% and %Iterator.prototype% as values (scr_js_iterator.c). */
+    iteratorProto: rule({ prefixes: ["iterator."] }),
     /** The WebAssembly API (scr_wasm.c). */
     wasm: rule({ prefixes: ["wasm."] }),
     /** crypto.subtle importKey/sign/verify/digest and CryptoKey:
@@ -1363,6 +1452,9 @@ const RUNTIME_FEATURE_RULES = {
     /** node:zlib's Brotli forms: zlib.brotliInstall, which %main calls when
      * the program uses Brotli (scr_brotli.c). */
     brotli: rule({ fns: ["zlib.brotliInstall"] }),
+    /** node:zlib's zstd forms: zlib.zstdInstall, which %main calls when the
+     * program uses zstd (scr_zstd.c). */
+    zstd: rule({ fns: ["zlib.zstdInstall"] }),
 };
 const RUNTIME_FEATURE_NAMES = [];
 for (const name in RUNTIME_FEATURE_RULES)
@@ -1384,9 +1476,11 @@ function noRuntimeFeatures() {
         textCodecDyn: false,
         dnsPromises: false,
         dynAsync: false,
+        promiseGeneric: false,
         dynBuiltinClass: false,
         dynBuiltinStream: false,
         stdlibPrototypeValue: false,
+        hostAbsentGlobals: false,
         dynInvoke: false,
         arrayLikeDispatch: false,
         builtinPrototypeValue: false,
@@ -1399,14 +1493,16 @@ function noRuntimeFeatures() {
         eventsOnceSignal: false,
         fetch: false,
         fileHandle: false,
-        fsBufferBrand: false,
         fsFlags: false,
         fsWatch: false,
         fsWatchFile: false,
+        genBind: false,
         http2: false,
         http: false,
         icu: false,
         inspect: false,
+        jsObjectModel: false,
+        mutableBuffers: false,
         legacyTextDecoder: false,
         mime: false,
         webStreams: false,
@@ -1433,27 +1529,34 @@ function noRuntimeFeatures() {
         moduleNamespace: false,
         moduleNamespaceDyn: false,
         primitiveWrapper: false,
+        iteratorProto: false,
         stream: false,
         strdecDyn: false,
         streamDyn: false,
         handleProps: false,
         childLifecycle: false,
+        childOptionExt: false,
         declAdopt: false,
         typeOrigins: false,
         dynForAwait: false,
+        dynIntegrityQueries: false,
         dynBuffer: false,
+        dynBufferMembers: false,
+        bufferPrototypeObject: false,
         builtinValues: false,
         computedRequire: false,
         symbol: false,
+        toPrimitiveNumber: false,
         tls: false,
         tlsCa: false,
         utilPromisify: false,
         warningReplace: false,
-        recordViewPartial: false,
+        bigintBytes: false,
         wasm: false,
         webcrypto: false,
         zlib: false,
         brotli: false,
+        zstd: false,
     };
 }
 const ruleOf = (name) => RUNTIME_FEATURE_RULES[name];
@@ -1549,7 +1652,7 @@ function scanRuntimeFeatures(mod, stopAt, nodes) {
         if (scan.result())
             features[name] = true;
     // Inline-cache sites of dynamic-tier functions use the tier's caches
-    // (scr_js_object.c, with the SCR_JS_TIER build of scr_json.c).
+    // (scr_js_object.c).
     if (!features.dynTier && mod.functions.some((fn) => fn.tier === "dynamic")) {
         const sites = new JsIcSites(mod);
         features.dynTier = mod.functions.some((fn) => fn.tier === "dynamic" && hasJsIcSite(fn, sites));