@scriptc/compiler 0.4.7 → 0.4.8

package/dist/frontend/lowering/expressions/property-access.js

@@ -1,14 +1,20 @@
+import { lowerIteratorMemberValue } from "../iterator-prototype.js";
 import { widensReducedRecords } from "../function-returns.js";
+import { nullishReadTypeError, throwAfterEach } from "../primitive-throws.js";
 import { lowerStaticPrivateRead } from "../private-statics.js";
 import { widthNarrowHelper } from "../coercions/unions.js";
 /* Property reads (`a.b`): lowerExprInner's property-access branch, intrinsic and union properties, field reads and targets, and match-group reads. */
 import { jsSpecialGlobalValue } from "../global-values.js";
+import { HOST_GLOBAL_PROTOTYPE_MEMBERS, HOST_GLOBAL_VALUE_MEMBERS, hostGlobalCallTarget, hostGlobalNameOfMember, hostGlobalNameOfRead, hostGlobalPrototypeOf, } from "../host-globals.js";
+import { hostGlobalValue } from "../host-global-values.js";
+import { globalFunctionValue } from "../global-function-values.js";
 import { arrayClassMemberOwner, arrayClassReceiver, lowerArrayClassConstructorRead, } from "../builtins/array-classes.js";
 import { indexedUnionArms, lowerIndexedUnionMember } from "../indexed-unions.js";
 import { keyedHelperName } from "../stable-names.js";
 import { builtinNamespaceValue } from "../builtin-namespaces.js";
 import { staticallySelected } from "../static-typeof.js";
 import { lowerWebStreamClassRead } from "../builtins/web-streams-dyn.js";
+import { wrapperConstructors } from "../primitive-wrappers.js";
 import * as ts from "../../ts7/adapter.js";
 import { lowerHistogramProperty } from "../builtins/performance.js";
 import { staticFunctionNameRead } from "../static-function-names.js";
@@ -18,7 +24,7 @@ import { isThisParameter } from "../call-signatures.js";
 import { argumentCountSlot, contextualCallCount, usedAsValue } from "../argument-counts.js";
 import { checkedPrivateValue, localPrivateBrandClass, privateNameClass, } from "../private-brands.js";
 import { PoisonError, builtinValueNameOf, jsFuncNameOf, neverTaintedJsType, own, } from "../lowerer.js";
-import { ARRAY_METHODS, MAP_METHODS, NARROW_FIRST, OBJECT_CALLABLE_VALUES, SET_METHODS, STDLIB_SURFACE, STRING_INDEX_METHODS, STR_METHODS, isChildSurfaceMember, stdlibGlobalNameOf, } from "../surfaces.js";
+import { ARRAY_METHODS, MAP_METHODS, NARROW_FIRST, SET_METHODS, STDLIB_SURFACE, STRING_INDEX_METHODS, STR_METHODS, isChildSurfaceMember, stdlibGlobalNameOf, } from "../surfaces.js";
 import { isGenericCallableMemberType, isLegacyUrlSymbol, isOsConstantsType, isParseArgsDynTypeName, } from "../../type-mapper.js";
 import { BIGINT_T, BOOL, BYTES_U8, DYN, F64, NULL_T, SEARCH_PARAMS_T, STRING, SYMBOL_T, UNDEFINED_T, arrayOf, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isUnitType, typeEquals, typeKey, unionContainerArmsOk, BYTES_ELEMENT_SIZE, } from "../../../ir/ir.js";
 import { lowerNavigatorMember, navigatorValue } from "../builtins/navigator.js";
@@ -41,10 +47,11 @@ import { hasOptionalChainGuard, isOptionalChainTail, isRequireMainFilename, } fr
 import { isCjsModuleGlobal, lowerNodeModuleProperty, lowerRequireMainProperty, } from "../lower-node-module.js";
 import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../../ir/build.js";
 import { typedArrayLacksMember } from "../builtins/typed-array-members.js";
-import { TEMPORAL_GLOBAL } from "../../builtin-modules.js";
+import { COMMONJS_MODULE_BINDINGS, TEMPORAL_GLOBAL } from "../../builtin-modules.js";
 import { tryLowerExpression } from "./try-lower-expression.js";
 import { applyDeferredAssertion, assertedReceiverNode, deferredMemberReadTarget, deferredProbeReadAccess, } from "./asserted-receiver.js";
 import { lowerRecordInheritedMember } from "../record-inherited.js";
+import { MUTABLE_BUFFER_MEMBERS } from "../buffers.js";
 import { DATE_METHOD_HINT } from "../builtins/dates.js";
 import { cjsClassExprWholeExportOf, cjsExportAssignmentOf, cjsExportDiscardReason, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isModuleExportsAccess, isNodeEsmFile, locOf, } from "../../program.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, contextualUndefReadType, fenceEarlyNsMemberRef, nsMemberIdentOf, nsUndefRead, } from "../lower-namespaces.js";
@@ -64,9 +71,9 @@ import { npmStaticPackageOfPath } from "../../npm-static.js";
 import { importMetaField, isImportMeta } from "../import-meta.js";
 import { createRequireCalleeFileOf } from "../builtins/module-bindings.js";
 import { createRequireResolveFenceValue, createRequireResolveValue, } from "../builtins/module-resolution.js";
-import { builtinPrototypeMethod, lowerArrayIsArrayValue, lowerCheckedPredicateValue, lowerNumberParserValue, lowerObjectAssignValue, lowerStringCodesValue, } from "../lower-builtin-values.js";
-import { lowerArrayFromValue } from "../containers/array-construction.js";
-import { lowerBufferPrototypeMember } from "../containers/bytes.js";
+import { builtinPrototypeMethod, lowerCheckedPredicateValue } from "../lower-builtin-values.js";
+import { constructorStaticValue, objectFreezeValue } from "../builtin-statics.js";
+import { lowerBufferPrototypeMember, lowerBufferPrototypeObject } from "../containers/bytes.js";
 import { lowerNetAddressStaticRead } from "../builtins/net-address.js";
 import { STATS_TYPE_TESTS } from "../builtins/filesystem.js";
 import { arrayValueRead, arrayValueType } from "../array-values.js";
@@ -75,7 +82,7 @@ import { reflectMemberValue } from "../builtins/reflection.js";
 import { objLitGenericFnInfoOf, objLitGenericFnNodeOf, requireObjLitGenericReceiver, } from "../generic-functions.js";
 import { narrowStoredClassValue, structuralReadType } from "../class-unions.js";
 import { InternalCompilerError } from "../../../errors.js";
-import { lowerUnionFieldRead } from "./union-fields.js";
+import { lowerUnionFieldRead, narrowedArmRead, narrowedUnionView } from "./union-fields.js";
 import { errorPropertyRead } from "../error-methods.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./evaluation-safety.js";
 import { partialAssertionFields, partialFieldRead } from "../partial-assertions.js";
@@ -159,6 +166,26 @@ function isStatFsDynProperty(lowerer, expr) {
             return false;
         }));
 }
+/** The Iterator.prototype helpers and the iterator members with no typed
+ * value lowering, read as values on a typed iterator in JavaScript.
+ * `next` and `return` answer the function Node's prototype chain holds
+ * (a generator's, or an iterator helper object's); `throw` is not here
+ * because an iterator helper object has none. */
+const TYPED_ITERATOR_MEMBER_VALUES = new Set([
+    "next",
+    "map",
+    "filter",
+    "take",
+    "drop",
+    "flatMap",
+    "reduce",
+    "toArray",
+    "forEach",
+    "some",
+    "every",
+    "find",
+    "return",
+]);
 /** The dgram.Socket methods its checked-dynamic handle answers as
  * function values (scr_dgram.c's scr_dgram_dyn_method_names). */
 const DGRAM_METHOD_VALUES = new Set([
@@ -177,6 +204,22 @@ const DGRAM_METHOD_VALUES = new Set([
     "ref",
     "unref",
 ]);
+/** A lib builtin iterator whose prototype chain holds no `return` in Node
+ * 24: the Array, String, Map and Set iterators. Generators and iterator
+ * helper objects do have one. */
+function builtinIteratorWithoutReturn(lowerer, node) {
+    const symbol = lowerer.typeOf(node).getSymbol();
+    if (symbol === undefined)
+        return false;
+    const name = ts.symbolName(symbol);
+    if (name !== "ArrayIterator" &&
+        name !== "StringIterator" &&
+        name !== "MapIterator" &&
+        name !== "SetIterator")
+        return false;
+    return (symbol.declarations.length > 0 &&
+        symbol.declarations.every((d) => lowerer.isStdlibFile(ts.getSourceFileOfNode(d))));
+}
 function isCreateRequireResolveValue(lowerer, expr) {
     let resolve = expr;
     if (expr.name.text === "paths" &&
@@ -189,6 +232,11 @@ function isCreateRequireResolveValue(lowerer, expr) {
         createRequireCalleeFileOf(lowerer, resolve.expression) !== null);
 }
 export function lowerPropertyAccessExpr(lowerer, expr, loc) {
+    // A JavaScript source reading a member that resizes, grows or detaches a
+    // buffer is the mutableBuffers fact (buffers.ts, t262-dc §2.4). The name
+    // decides: the receiver may be a checked-dynamic value.
+    if (MUTABLE_BUFFER_MEMBERS.has(expr.name.text) && isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        lowerer.buffersMutable = true;
     const arrayClassConstructor = lowerArrayClassConstructorRead(lowerer, expr, loc);
     if (arrayClassConstructor !== null)
         return arrayClassConstructor;
@@ -233,7 +281,7 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         };
     }
     {
-        const member = lowerBufferPrototypeMember(lowerer, expr);
+        const member = lowerBufferPrototypeMember(lowerer, expr) ?? lowerBufferPrototypeObject(lowerer, expr);
         if (member)
             return member;
     }
@@ -430,33 +478,8 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         };
     }
-    if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze") {
-        // Object.freeze as a value can freeze any untyped value it is passed.
-        lowerer.untypedIntegrity = true;
-        const name = "%builtin.Object.freeze";
-        if (!lowerer.liftedFns.some((fn) => fn.name === name))
-            lowerer.liftedFns.push({
-                name,
-                params: [{ localId: "value", name: "value", type: DYN }],
-                locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
-                returnType: DYN,
-                body: [
-                    {
-                        kind: "return",
-                        value: {
-                            kind: "libCall",
-                            fn: "dyn.freeze",
-                            args: [varRef("value", DYN, loc)],
-                            type: DYN,
-                            loc,
-                        },
-                        loc,
-                    },
-                ],
-                loc,
-            });
-        return { kind: "closure", fnName: name, captures: [], type: funcOf([DYN], DYN), loc };
-    }
+    if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze")
+        return objectFreezeValue(lowerer, loc);
     // An Hmac has no copy() (Hash does): Node answers undefined, which
     // `typeof mac.copy` feature checks read. TypeScript rejects the read.
     if (expr.name.text === "copy" &&
@@ -487,6 +510,38 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         };
     }
+    // A read of a Node 24 global the native runtime does not implement
+    // (globalThis.WebSocket, (globalThis as T).FormData, alias.X) is not a
+    // capability probe: the branch below would answer undefined, where Node
+    // has the constructor. Answer the constructor (host-global-values.ts);
+    // constructing or calling it is the use that refuses (SC2020,
+    // host-global).
+    {
+        const hostGlobal = hostGlobalNameOfMember(lowerer, expr);
+        if (hostGlobal !== null) {
+            if (hostGlobalCallTarget(expr))
+                lowerer.hostGlobalFence(hostGlobal, expr);
+            return hostGlobalValue(lowerer, hostGlobal, expr);
+        }
+    }
+    // A member read off that value (`WebSocket.OPEN`, `FormData.prototype`):
+    // the value carries the function intrinsics only, and its prototype
+    // carries the constructor link (`FormData.prototype.constructor`). Node's
+    // class also has static members and instance methods, which native code
+    // does not provide, so reading one is a use of that surface and refuses
+    // (SC2020, host-global) instead of answering undefined.
+    {
+        const hostGlobal = hostGlobalNameOfRead(lowerer, expr.expression);
+        if (hostGlobal !== null) {
+            if (!HOST_GLOBAL_VALUE_MEMBERS.has(expr.name.text))
+                lowerer.hostGlobalFence(hostGlobal, expr);
+        }
+        else {
+            const prototypeOf = hostGlobalPrototypeOf(lowerer, expr.expression);
+            if (prototypeOf !== null && !HOST_GLOBAL_PROTOTYPE_MEMBERS.has(expr.name.text))
+                lowerer.hostGlobalFence(prototypeOf, expr);
+        }
+    }
     // Missing host globals (Bun/Deno capability probes) have no binding
     // in a native program. Declared globals retain their own lowering;
     // arbitrary global-object mutation remains fenced. Preserve a dyn
@@ -874,8 +929,9 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         if (canonical !== null) {
             if (canonical === "globalThis")
                 return lowerGlobalValue(lowerer, expr);
-            // Typed for the programs that name it, absent in Node 24.
-            if (canonical === TEMPORAL_GLOBAL)
+            // Typed for the programs that name it, absent in Node 24, and the
+            // CommonJS module bindings, which the global object does not hold.
+            if (canonical === TEMPORAL_GLOBAL || COMMONJS_MODULE_BINDINGS.has(canonical))
                 return dynUndefinedExpr(loc);
             const value = jsSpecialGlobalValue(lowerer, canonical, loc);
             if (value)
@@ -1037,14 +1093,19 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             // by the property or function it reads. A builtin function value
             // keeps its length when that is not its adapter's parameter count
             // (`Math.max.length` is 2).
-            const fnName = builtinValueNameOf(expr.expression, lowerer) ?? jsFuncNameOf(expr.expression, lowerer);
-            const fnLength = lowerer.builtinFunctionIdentity(probed).fnLength;
+            const builtinName = builtinValueNameOf(expr.expression, lowerer);
+            const fnName = builtinName ?? jsFuncNameOf(expr.expression, lowerer);
+            const identity = lowerer.builtinFunctionIdentity(probed);
+            const fnLength = identity.fnLength;
             const boxed = {
                 kind: "dynFrom",
                 value: probed,
                 type: DYN,
                 ...(fnName !== null ? { fnName } : {}),
                 ...(fnLength !== undefined ? { fnLength } : {}),
+                ...(builtinName !== null && identity.fnNameMainThreadOnly
+                    ? { fnNameMainThreadOnly: true }
+                    : {}),
                 loc,
             };
             const key = {
@@ -1129,7 +1190,13 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         isStatFsDynProperty(lowerer, expr) ||
         segmentDataProperty ||
         osConstants ||
-        isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), lowerer)) {
+        // A record, not the Lowerer itself: the compiler lowers its own source,
+        // and a class instance does not width-coerce to this shape.
+        isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), {
+            isStdlibFile: (sf) => lowerer.isStdlibFile(sf),
+            symbolProvenance: lowerer.symbolProvenance,
+            verifySymbolProvenance: lowerer.verifySymbolProvenance,
+        })) {
         const recv = lowerer.lowerExpr(expr.expression);
         if (recv.type.kind === "dyn") {
             const key = {
@@ -1443,6 +1510,22 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
         typedArrayLacksMember(expr.name.text, recvLowered.type.elem === "u8")) {
         return afterReceiver(recvLowered, dynUndefinedExpr(loc), loc);
     }
+    // Buffer.prototype's parent and offset getters, which @types/node does not
+    // declare (so only JavaScript reads them): the box answers a Buffer's
+    // ArrayBuffer and byteOffset, and undefined for a Uint8Array, by the
+    // runtime flag that tells the two apart.
+    if (recvLowered.type.kind === "bytes" &&
+        recvLowered.type.elem === "u8" &&
+        (expr.name.text === "parent" || expr.name.text === "offset") &&
+        !declaredMemberOf(lowerer, expr.expression, expr.name.text)) {
+        return {
+            kind: "dynKeyGet",
+            value: lowerer.coerceToExpected(recvLowered, DYN),
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+            type: DYN,
+            loc,
+        };
+    }
     // A typed array under a checker `any` (a JS binding its own initializer's
     // inference refers to: hono's etag digest `nextChunk`) reads through its
     // box, as the method-call twin dispatches. The box shares the native
@@ -1457,6 +1540,25 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             loc,
         }, expr);
     }
+    // A NULLISH receiver: JavaScript's RequireObjectCoercible throws Node's
+    // TypeError at the read (only an optional chain, lowered elsewhere,
+    // answers undefined). A primitive receiver that is not nullish never
+    // reaches this fence — its members lower above.
+    if (isUnitType(recvLowered.type)) {
+        const unit = recvLowered.type.kind === "nullT" ? "null" : "undefined";
+        const t = ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
+        return throwAfterEach([recvLowered], nullishReadTypeError(unit, expr.name.text, t, loc), loc);
+    }
+    // The site is about to be refused: a checker-narrowed receiver still
+    // stores the wider union, whose other arms may be what refuse the member
+    // (the OAuth arm's index signature beside `ApiKeyCredential.key`). Read
+    // it off the arms the checker still allows, exactly where the refusal
+    // would be.
+    if (recvLowered.type.kind === "union") {
+        const read = narrowedUnionValueRead(lowerer, expr, recvLowered);
+        if (read)
+            return read;
+    }
     lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' from a value of type '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'`);
 }
 /** `result` after evaluating `receiver` for its effects (none to keep when
@@ -1828,6 +1930,45 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     fenceDatePrototypeWrite(lowerer, expr);
     if (lowerer.chainBlocked(expr))
         return null;
+    // Iterator.prototype, its members and Iterator's own members in
+    // JavaScript: the live objects (scr_js_iterator.c).
+    const iteratorMember = lowerIteratorMemberValue(lowerer, expr);
+    if (iteratorMember)
+        return iteratorMember;
+    // A helper method read as a value on a typed iterator in JavaScript
+    // (`g().map === Iterator.prototype.map`), or a member the typed iterator
+    // has no lowering for (`[].values().return` is undefined): the value the
+    // runtime answers through the boxed iterator, exactly Node's.
+    if (!expr.questionDotToken &&
+        TYPED_ITERATOR_MEMBER_VALUES.has(expr.name.text) &&
+        isJsSourceFile(ts.getSourceFileOfNode(expr))) {
+        const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+        if (recvT?.kind === "generator" && recvT.async !== true) {
+            // Node's builtin iterators (%ArrayIteratorPrototype%'s family) hold
+            // no `return`; a generator's and an iterator helper object's do.
+            if (expr.name.text === "return" && builtinIteratorWithoutReturn(lowerer, expr.expression))
+                return {
+                    kind: "seqExpr",
+                    stmts: [
+                        {
+                            kind: "exprStmt",
+                            expr: lowerer.lowerExpr(expr.expression),
+                            loc: locOf(expr.expression),
+                        },
+                    ],
+                    result: dynUndefinedExpr(locOf(expr)),
+                    type: DYN,
+                    loc: locOf(expr),
+                };
+            return {
+                kind: "dynKeyGet",
+                value: lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), DYN),
+                key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+                type: DYN,
+                loc: locOf(expr),
+            };
+        }
+    }
     // Object.prototype.constructor: the Object constructor value.
     if (expr.name.text === "constructor" &&
         ts.isPropertyAccessExpression(expr.expression) &&
@@ -1903,19 +2044,9 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     }
     if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
         return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
-    // Error.prototype as a value (`F.prototype = Object.create(Error.prototype)`)
-    // and Error.captureStackTrace read as a function (`if
-    // (Error.captureStackTrace) ...`).
+    // Error.prototype as a value (`F.prototype = Object.create(Error.prototype)`).
     if (isErrorPrototypeValue(lowerer, expr))
         return { kind: "libCall", fn: "dyn.errorPrototype", args: [], type: DYN, loc: locOf(expr) };
-    if (lowerer.stdlibGlobalMember(expr, "Error") === "captureStackTrace")
-        return {
-            kind: "libCall",
-            fn: "dyn.errorCaptureStackTraceFunction",
-            args: [],
-            type: DYN,
-            loc: locOf(expr),
-        };
     // Function.prototype as a VALUE (a prototype-chain link:
     // `Object.setPrototypeOf(F.prototype, Function.prototype)`): one
     // anonymous function answering undefined, length 0 — a zero-capture
@@ -1944,16 +2075,19 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             loc,
         };
     }
-    if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
-        return lowerArrayIsArrayValue(lowerer, locOf(expr));
-    if (lowerer.stdlibGlobalMember(expr, "Array") === "from")
-        return lowerArrayFromValue(lowerer, locOf(expr));
-    const stringMember = lowerer.stdlibGlobalMember(expr, "String");
-    if (stringMember === "fromCharCode" || stringMember === "fromCodePoint")
-        return lowerStringCodesValue(lowerer, stringMember, locOf(expr));
-    const numberMember = lowerer.stdlibGlobalMember(expr, "Number");
-    if (numberMember === "parseInt" || numberMember === "parseFloat")
-        return lowerNumberParserValue(lowerer, numberMember, locOf(expr));
+    // Array.isArray, Object.keys, Date.now, Error.captureStackTrace (`if
+    // (Error.captureStackTrace) ...`) and the other statics with function
+    // values: the same values a read through the constructor's untyped value
+    // answers (builtin-statics.ts).
+    {
+        const owner = stdlibGlobalNameOf(lowerer, expr.expression);
+        const member = owner === null ? null : lowerer.stdlibGlobalMember(expr, owner);
+        const value = owner === null || member === null
+            ? null
+            : constructorStaticValue(lowerer, owner, member, locOf(expr));
+        if (value !== null)
+            return value;
+    }
     if (lowerer.stdlibGlobalMember(expr, "Buffer") === "poolSize")
         return { kind: "libCall", fn: "buffer.poolSize", args: [], type: F64, loc: locOf(expr) };
     {
@@ -2006,20 +2140,6 @@ export function lowerIntrinsicProperty(lowerer, expr) {
                 { mode: "required", type: DYN },
             ],
         }, "Buffer.compare", locOf(expr));
-    if (lowerer.stdlibGlobalMember(expr, "Date") === "now")
-        return lowerer.lowerNativeCallableValue({
-            fn: "date.now",
-            params: [],
-            result: F64,
-            valueParams: [],
-        }, "Date.now", locOf(expr));
-    if (stdlibGlobalNameOf(lowerer, expr.expression) === "Object") {
-        if (expr.name.text === "assign")
-            return lowerObjectAssignValue(lowerer, locOf(expr));
-        const fn = own(OBJECT_CALLABLE_VALUES, expr.name.text);
-        if (fn)
-            return lowerer.lowerNativeCallableValue(fn, `Object.${expr.name.text}`, locOf(expr));
-    }
     // A never-tainted JS receiver type lowered checked-dynamic
     // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
     // stand down so the dyn keyed read below the chain answers, instead
@@ -2457,6 +2577,21 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
             return { kind: "bytesIntrinsic", method: "buffer", receiver, args: [], type: DYN, loc };
         }
+        // A method read as a value in JavaScript (`buf.indexOf ===
+        // Buffer.prototype.indexOf`, `const write = buf.writeUInt8`): the box
+        // answers the function Node's prototype holds, which runs on the
+        // receiver it is called with.
+        if (isJsSourceFile(ts.getSourceFileOfNode(expr))) {
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+            return {
+                kind: "dynKeyGet",
+                value: lowerer.coerceToExpected(receiver, DYN),
+                key: { kind: "strLit", value: name, type: STRING, loc },
+                type: DYN,
+                loc,
+            };
+        }
         if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
             lowerer.unsupported("SC1090", expr, `typed-array methods as values (call '${name}' directly)`);
         }
@@ -3455,10 +3590,16 @@ export function lowerUnionProperty(lowerer, expr) {
             loc: locOf(expr),
         };
     }
+    if (isUnitType(value.type)) {
+        // A nullish receiver: Node's RequireObjectCoercible TypeError, after
+        // the receiver's own evaluation.
+        const unit = value.type.kind === "nullT" ? "null" : "undefined";
+        return throwAfterEach([value], nullishReadTypeError(unit, expr.name.text, lowerer.mapTypeOf(lowerer.typeOf(expr)) ?? DYN, locOf(expr)), locOf(expr));
+    }
     if (value.type.kind !== "union") {
         lowerer.unsupported("SC1090", expr, "shared property access without a represented union receiver");
     }
-    const read = lowerUnionValueRead(lowerer, expr, value);
+    const read = lowerUnionValueRead(lowerer, expr, value) ?? narrowedUnionValueRead(lowerer, expr, value);
     if (read)
         return read;
     lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' on a union-typed value (every arm must be an object/record ` +
@@ -3472,6 +3613,24 @@ export function lowerUnionProperty(lowerer, expr) {
  * receiver still stores. Returns null when no arm can answer — the caller
  * owns the diagnostic. */
 export function lowerUnionValueRead(lowerer, expr, value, missingFieldAsUndefined = false) {
+    return unionValueRead(lowerer, expr, value, missingFieldAsUndefined);
+}
+/** The stored-union read again over the arms the checker's narrowing still
+ * allows: an arm it ruled out at this site refused the read (the OAuth
+ * arm's index signature beside `ApiKeyCredential.key`, behind an
+ * optional-chain discriminant guard). Only the REFUSAL points call this —
+ * a site another lowering answers keeps it — so no compiling program
+ * gains a second, narrowed lowering. Returns null when the site's type is
+ * not a narrowing of the value's union. */
+export function narrowedUnionValueRead(lowerer, expr, value) {
+    const narrowed = narrowedUnionView(lowerer, expr.expression, value, locOf(expr));
+    if (!narrowed)
+        return null;
+    if (narrowed.arm)
+        return narrowedArmRead(lowerer, expr, narrowed.value, narrowed.arm);
+    return unionValueRead(lowerer, expr, narrowed.value, false);
+}
+function unionValueRead(lowerer, expr, value, missingFieldAsUndefined) {
     if (value.type.kind !== "union")
         return null;
     const unionId = value.type.unionId;
@@ -4121,6 +4280,54 @@ function readOnlyAccess(access) {
         (parent.operator !== ts.SyntaxKind.PlusPlusToken &&
             parent.operator !== ts.SyntaxKind.MinusMinusToken));
 }
+/** The operand a member WRITE addresses through a chain of type assertions:
+ * `(p as View).x = v` names `p`. Node erases a type assertion, so a write
+ * mutates the very object the operand names; the assertion only decides what
+ * the checker accepts. Null when no `as`/`<T>` wraps the receiver (a write
+ * there keeps the ordinary lowering). */
+function assertionOperand(access) {
+    let node = access.expression;
+    let asserted = false;
+    for (;;) {
+        if (ts.isParenthesizedExpression(node)) {
+            node = node.expression;
+            continue;
+        }
+        if (ts.isAsExpression(node) || ts.isTypeAssertion(node)) {
+            node = node.expression;
+            asserted = true;
+            continue;
+        }
+        break;
+    }
+    return asserted ? node : null;
+}
+/** The unasserted value a member write addresses, when its OWN stored
+ * layout holds the member at the asserted type — the erased write of Node.
+ * The asserted view's conversion may instead build a fresh width record
+ * (`%rec.width`), and a write into that temporary is dropped, so a view
+ * that adds a member to a record has nothing to write and the caller
+ * refuses. Only a RECORD operand converts like that: a dyn value's cast is
+ * a checked, identity-preserving view (`dyn-literal-identity.ts`), and the
+ * ordinary lowering already writes through it. The static type decides, so
+ * the operand is lowered exactly once even when it has side effects. */
+function assertedWrite(lowerer, access, operand, fieldType, assertedType) {
+    if (lowerer.mapTypeOf(lowerer.typeOf(operand))?.kind !== "record") {
+        return { receiver: null, refuse: false };
+    }
+    const value = lowerer.lowerExpr(operand);
+    if (value.type.kind === "record") {
+        const field = lowerer.shapes
+            .get(value.type.shapeId)
+            ?.fields.find((f) => f.name === access.name.text);
+        return field && typeEquals(field.type, fieldType)
+            ? { receiver: value, refuse: false }
+            : { receiver: null, refuse: true };
+    }
+    // The value stayed non-record (a generic body, an aliased layout): keep
+    // the assertion's conversion over the value already lowered.
+    return { receiver: lowerer.coerceInto(access.expression, value, assertedType), refuse: false };
+}
 export function fieldTarget(lowerer, access) {
     if (lowerer.cjsLocalModuleBindingOf(access.expression))
         return null;
@@ -4212,38 +4419,76 @@ export function fieldTarget(lowerer, access) {
     if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
         return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
     }
-    // A generic receiver's member the INSTANTIATION cannot store: the type
-    // parameter's constraint declares the member (so tsc admits the read),
-    // while the record the parameter was instantiated with has no such slot —
-    // a generic options bag read through its constraint (`options.sessionId`
-    // under an `"sessionId" in options` guard) at a call site whose options
-    // literal omits the optional member. Node reads the property off the
-    // object it actually has: undefined when the caller omitted it, the extra
-    // property when a JavaScript caller supplied one. So the read is the
-    // checked-dynamic keyed read of the stored record, entering the static
-    // code at the type the checker gave the read.
-    if (!access.questionDotToken &&
-        readOnlyAccess(access) &&
-        typeParameterReceiver(lowerer.typeOf(access.expression))) {
+    // A member the checker ADMITS on a receiver that has no static layout: a
+    // write through an assertion on a checked-dynamic value (a caught binding
+    // — `(error as { headers?: Headers }).headers = undefined`). Node erases
+    // the assertion, so the write lands on the runtime object as an own
+    // property; the checked-dynamic keyed write sets exactly that, and the
+    // class-typed value converts at the write like every other dyn→static edge.
+    if (receiverIr?.kind === "dyn" && !readOnlyAccess(access)) {
+        // The assertion itself may be unrepresentable (a class member on a
+        // structural view); it is erased at runtime, so address the operand.
+        const writeOperand = assertionOperand(access);
+        const admitted = lowerer.mapTypeOf(lowerer.typeOf(access));
+        if (writeOperand && admitted && admitted.kind !== "void")
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceToExpected(lowerer.lowerExpr(writeOperand), DYN),
+                field: access.name.text,
+                fieldType: admitted,
+            };
+    }
+    // A member the checker ADMITS but the stored layout cannot hold. The
+    // constraint of a type parameter declares it (a generic options bag read
+    // through an `"sessionId" in options` guard, or `options?.apiKey` with the
+    // guarded spelling), and so does a cast that intersects the member onto a
+    // record (`options as Omit<T, "k"> & ProviderRequestOptions<M>`), while the
+    // record the value was STORED as has no such slot: the call site omitted the
+    // optional member, the instantiation is a union of option shapes, or the cast
+    // added a member its source layout never declared. Node reads the property
+    // off the object it actually has — undefined when the object lacks it, the
+    // value when the value kept one — so the read is the checked-dynamic keyed
+    // read of the stored value, entering the static code at the type the checker
+    // gave the read (a failed conversion throws; it never diverges).
+    //
+    // Inside a `?.` chain this lowering runs on the re-dispatch, with the
+    // receiver node bound to the chain's present (non-nullish) arm, so the
+    // stored value is already the record and the chain supplies the guard.
+    if ((!access.questionDotToken || lowerer.chainHandled.has(access)) && readOnlyAccess(access)) {
         const storedIr = stored ?? narrowed;
-        const arm = storedIr?.kind === "union" ? lowerer.stripUndefinedArm(storedIr) : storedIr;
-        const shape = arm?.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
+        const present = storedIr?.kind === "union" ? lowerer.stripUndefinedArm(storedIr) : storedIr;
+        const arms = present?.kind === "union"
+            ? (lowerer.unions.get(present.unionId)?.arms ?? [present])
+            : present
+                ? [present]
+                : [];
+        // Every arm is a plain record layout with no slot for the member.
+        const layoutMissing = arms.length > 0 &&
+            arms.every((arm) => {
+                if (arm.kind !== "record")
+                    return false;
+                const shape = lowerer.shapes.get(arm.shapeId);
+                return (shape !== undefined &&
+                    !shape.tuple &&
+                    !shape.indexValue &&
+                    !shape.fields.some((f) => f.name === access.name.text));
+            });
         const admitted = lowerer.mapTypeOf(lowerer.typeOf(access));
-        if (shape &&
-            !shape.tuple &&
-            !shape.indexValue &&
-            !shape.fields.some((f) => f.name === access.name.text) &&
-            admitted &&
-            admitted.kind !== "void") {
+        const checkerHolds = typeParameterReceiver(lowerer.typeOf(access.expression)) ||
+            narrowed === null ||
+            (narrowed.kind === "record" &&
+                (lowerer.shapes.get(narrowed.shapeId)?.fields.some((f) => f.name === access.name.text) ??
+                    false));
+        if (layoutMissing && checkerHolds && admitted && admitted.kind !== "void") {
             let obj = lowerer.lowerExpr(access.expression);
             if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-                const present = lowerer.stripUndefinedArm(obj.type);
+                const presentType = lowerer.stripUndefinedArm(obj.type);
                 obj =
-                    present.kind === "record"
-                        ? (lowerer.runtimeOptionalPropertyReceiver(access.expression, obj, present, access.name.text) ?? obj)
+                    presentType.kind === "record"
+                        ? (lowerer.runtimeOptionalPropertyReceiver(access.expression, obj, presentType, access.name.text) ?? obj)
                         : lowerer.maybeNarrow(obj, access.expression);
             }
-            if (obj.type.kind !== "record")
+            if (!lowerer.dynConvertible(obj.type))
                 return null;
             return {
                 container: "dynamic",
@@ -4257,7 +4502,11 @@ export function fieldTarget(lowerer, access) {
         const shape = lowerer.shapes.get(receiverIr.shapeId);
         const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
         if (fieldType) {
-            let obj = lowerer.lowerExpr(access.expression);
+            const writeOperand = readOnlyAccess(access) ? null : assertionOperand(access);
+            const write = writeOperand === null
+                ? null
+                : assertedWrite(lowerer, access, writeOperand, fieldType, receiverIr);
+            let obj = write?.receiver ?? lowerer.lowerExpr(access.expression);
             const nominal = representedClassFieldTarget(lowerer, access.expression, access.name.text, obj);
             if (nominal)
                 return nominal;
@@ -4289,6 +4538,13 @@ export function fieldTarget(lowerer, access) {
             }
             if (obj.type.kind !== "record")
                 return null;
+            // A write through a type assertion that the value's own layout cannot
+            // host would land on the assertion's converted copy (`%rec.width.<id>`)
+            // and be dropped. Node erases the assertion and mutates the object the
+            // operand names, so refuse rather than diverge silently.
+            if (write?.refuse === true) {
+                lowerer.unsupported("SC1090", access, `writing '${access.name.text}' through a type assertion to a member the value's own layout does not hold (the write would land on a converted copy; declare the member on the value's type)`);
+            }
             const actualShape = lowerer.shapes.get(obj.type.shapeId);
             const actualField = actualShape?.fields.find((f) => f.name === access.name.text);
             return {
@@ -4748,7 +5004,8 @@ export function builtinGlobalValueAt(lowerer, expr, canonical, loc, js) {
         return namespace;
     if (readsBuiltinGlobalMembers(expr))
         return null;
-    const value = builtinGlobalValue(canonical, loc, js);
+    const value = builtinGlobalValue(canonical, loc, js) ??
+        (js ? globalFunctionValue(lowerer, canonical, loc) : null);
     if (value === null)
         return null;
     let node = expr;
@@ -5130,13 +5387,26 @@ function jsPrimitivePrototypeValue(lowerer, expr) {
     if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
         return null;
     const loc = locOf(expr);
-    const value = (kind) => ({
-        kind: "libCall",
-        fn: "dyn.builtinPrototype",
-        args: [{ kind: "strLit", value: kind, type: STRING, loc }],
-        type: DYN,
-        loc,
-    });
+    const value = (kind) => kind === "Boolean"
+        ? // The wrapper unit's Boolean.prototype is the object Boolean
+            // instances inherit from, so its valueOf/toString are the interned
+            // members and accept a primitive boolean or a Boolean wrapper
+            // receiver (the dyn.builtinPrototype builder takes only the kind's
+            // primitives).
+            {
+                kind: "libCall",
+                fn: "wrapper.booleanPrototype",
+                args: [wrapperConstructors(lowerer, loc)[2]],
+                type: DYN,
+                loc,
+            }
+        : {
+            kind: "libCall",
+            fn: "dyn.builtinPrototype",
+            args: [{ kind: "strLit", value: kind, type: STRING, loc }],
+            type: DYN,
+            loc,
+        };
     const receiver = expr.expression;
     if (ts.isPropertyAccessExpression(receiver) && receiver.name.text === "prototype") {
         const kind = primitivePrototypeKind(lowerer, receiver);