@scriptc/compiler 0.4.8 → 0.4.9

package/dist/ir/runtime-features.d.ts

@@ -79,6 +79,9 @@ export declare function moduleUsesWebCryptoAsymmetric(mod: IrModule): boolean;
  * (A1 adds dyn.intrinsic); the slices share one SCR_JS_OBJECT_MODEL build
  * of every unit they touch instead of one build column per feature. */
 export declare const JS_OBJECT_MODEL_LIB_FNS: ReadonlySet<IrLibFn>;
+/** The member name Object.prototype answers as an accessor (protoAccessor):
+ * a dynamic read (`dynKeyGet`) or a dynamic key write names it. */
+export declare function isProtoKeyLiteral(node: IrExpr): boolean;
 /** The JavaScript object model build's program facts (t262-da §J): every
  * runtime feature that shares the one SCR_JS_OBJECT_MODEL build ORs in here
  * (BigInt views today, array attributes and handle property tables next), so
@@ -87,7 +90,10 @@ export declare const JS_OBJECT_MODEL_LIB_FNS: ReadonlySet<IrLibFn>;
 export declare function jsObjectModelFact(features: {
     jsObjectModel?: boolean;
     bigintBytes?: boolean;
+    handleProps?: boolean;
     mutableBuffers?: boolean;
+    protoAccessor?: boolean;
+    sparseArrays?: boolean;
 }): boolean;
 /** One rule per runtime feature, sorted by name. A new feature is an
  * entry here and its line in noRuntimeFeatures; RuntimeFeatures, the scan
@@ -120,6 +126,12 @@ declare const RUNTIME_FEATURE_RULES: {
      * own, so a program that never passes those options keeps the default
      * object, byte for byte. */
     childOptionExt: RuntimeFeatureRule;
+    /** The spawnSync result's `.error` property answers Node's
+     * errnoException fields (errno, syscall, path, spawnargs). The fields
+     * ride a build of scr_child.c of their own (SCR_CHILD_ERR_FIELDS), so a
+     * program that never reads `.error` keeps the default object and the
+     * result container exactly as they were. */
+    childErrorFields: RuntimeFeatureRule;
     /** scr_cipher.c over the mbedTLS archive; DEP0182 reports through the
      * process-warning unit, and unknown output encodings render through the
      * inspect unit. WebCrypto's encrypt, decrypt, wrapKey and unwrapKey
@@ -156,6 +168,10 @@ declare const RUNTIME_FEATURE_RULES: {
     /** A standard library prototype object read as a value in a JavaScript
      * source (scr_dyn_stdlib_prototype.c): `Date.prototype`. */
     stdlibPrototypeValue: RuntimeFeatureRule;
+    /** DataView.prototype read as a value in a JavaScript source, and its
+     * members through it (scr_data_view_proto.c): the getter/setter family's
+     * prototype object. */
+    dataViewPrototypeValue: RuntimeFeatureRule;
     /** The dynamic global object's answer for the Node globals the native
      * runtime does not implement (scr_global_host_absent.c, plus the
      * SCR_GLOBAL_HOST_ABSENT build of scr_node_builtin.c): a computed read of
@@ -165,9 +181,9 @@ declare const RUNTIME_FEATURE_RULES: {
      * (scr_dyn_array_like.c), which delegates every other name to the
      * dyn-invoke unit's array dispatch. */
     arrayLikeDispatch: RuntimeFeatureRule;
-    /** Number.prototype and Boolean.prototype as values
-     * (scr_dyn_builtin_prototype.c). */
-    builtinPrototypeValue: RuntimeFeatureRule;
+    /** A builtin prototype method as a function value (String's trim family,
+     * RegExp's exec/test/toString; scr_dyn_builtin_methods.c). */
+    builtinMethodValue: RuntimeFeatureRule;
     dynInvoke: RuntimeFeatureRule;
     /** The program has dynamic-tier jsval operations (js.* builtins, the
      * jsval pass): links the scr_js_* units (two-tier design I3). */
@@ -175,7 +191,8 @@ declare const RUNTIME_FEATURE_RULES: {
     /** Checked-dynamic stream slots test values and pipe into JavaScript
      * stream objects (scr_stream_dyn.c). */
     streamDyn: RuntimeFeatureRule;
-    /** Own properties JavaScript adds to children (scr_dyn_handle_props.c). */
+    /** Own properties JavaScript adds to runtime handles (scr_dyn_handle_props.c):
+     * a Date, RegExp, Map, Set, weak collection, buffer or child. */
     handleProps: RuntimeFeatureRule;
     /** The declaration-typed boundary's adoption (scr_decl_adopt.c): its
      * casts, and closures boxed in a boundary program, which adopt their
@@ -226,6 +243,11 @@ declare const RUNTIME_FEATURE_RULES: {
     mime: RuntimeFeatureRule;
     /** Web streams in checked-dynamic code (scr_webstreams.c). */
     webStreams: RuntimeFeatureRule;
+    /** A program that builds a Blob or File can hand one to fetch: selects
+     * scr_fetch.c's SCR_WEB_BODIES build, which sends the blob's bytes and
+     * type as Node does. Every other program keeps the default fetch unit,
+     * byte for byte. */
+    webBodies: RuntimeFeatureRule;
     /** AbortController and AbortSignal (scr_abort.c, or the fetch unit).
      * A WritableStream controller's signal is one (scr_webstreams.c). */
     abortSignal: RuntimeFeatureRule;
@@ -309,11 +331,12 @@ declare const RUNTIME_FEATURE_RULES: {
     streamWriteErrors: RuntimeFeatureRule;
     /** The program reaches the process output streams' write slot — the
      * write method as a value (process.stdioSlot), its replacement, a patched
-     * program's typed writes, or a run-time-typed chunk
-     * (process.stdioWriteDyn): the SCR_STDIO_WRITE_SLOT build of the events
-     * unit carries the shared write body, the dynamic-chunk entry point and
-     * Node's anonymous write function. Every other program links the default
-     * object, byte for byte. */
+     * program's typed writes, a run-time-typed chunk
+     * (process.stdioWriteDyn), or the untyped one-string write
+     * (process.stdioWriteStr): the SCR_STDIO_WRITE_SLOT build of the events
+     * unit carries the shared write body, the dynamic-chunk entry point,
+     * the string entry point and Node's anonymous write function. Every
+     * other program links the default object unchanged. */
     stdioWriteSlot: RuntimeFeatureRule;
     stream: RuntimeFeatureRule;
     /** A Dirent row converted to dyn carries Node's Symbol(type) key
@@ -339,6 +362,29 @@ declare const RUNTIME_FEATURE_RULES: {
      * build column of its own. Every other program keeps the byte-for-byte
      * default objects. */
     bigintBytes: RuntimeFeatureRule;
+    /** `new Promise` whose executor takes a checked-dynamic reject parameter,
+     * and `Promise.withResolvers` on a checked-dynamic promise whose resolver
+     * record does: that reason is the program's own value, not an Error, so
+     * the emitter builds the reject closure with scr_make_reject_dyn — which
+     * lives in the SCR_PROMISE_REJECT_DYN build of scr_async.c. A promise
+     * lowered with an Error-taking reject (the typed `util.promisify` family,
+     * even for an unknown settled value; any typed `withResolvers`) keeps the
+     * default object. Every other program links the default object, byte for
+     * byte. */
+    promiseRejectDyn: RuntimeFeatureRule;
+    /** Sparse arrays (t262 W7): an array whose length exceeds its dense
+     * prefix. Only a checked-dynamic member write can produce one, and only a
+     * write the source spells an index proves it: a key computed at run time
+     * (`a[k] = v`) may name any index, so proving sparseness from it would
+     * select this build for every program with a computed write. The elements
+     * past the prefix live in the JavaScript object model build (t262-da §J)
+     * of scr_json.c and scr_dyn_invoke.c, and that build's keyed read answers
+     * `length` from the array's own length instead of the prefix field. The
+     * fact ORs into jsObjectModel (jsObjectModelFact), so it selects no build
+     * column of its own. Every program that exists today keeps its build:
+     * a spelled index or `length` the runtime can place densely stays in the
+     * default objects, and a computed one keeps its SC2020 refusal. */
+    sparseArrays: RuntimeFeatureRule;
     /** Module namespace objects as checked-dynamic values
      * (scr_module_namespace.c). */
     moduleNamespace: RuntimeFeatureRule;
@@ -351,10 +397,22 @@ declare const RUNTIME_FEATURE_RULES: {
     mutableBuffers: RuntimeFeatureRule;
     /** A module namespace boxed for typed code (scr_module_namespace_dyn.c). */
     moduleNamespaceDyn: RuntimeFeatureRule;
-    /** Primitive wrapper objects (scr_js_wrapper.c). */
+    /** Primitive wrapper objects (scr_js_wrapper.c), which also own
+     * Number.prototype and Boolean.prototype: the value a JavaScript source
+     * reads through dyn.builtinPrototype, and the compiled constructor's
+     * `prototype` member of the same object. */
     primitiveWrapper: RuntimeFeatureRule;
     /** %Iterator% and %Iterator.prototype% as values (scr_js_iterator.c). */
     iteratorProto: RuntimeFeatureRule;
+    /** A JavaScript source reads or writes the member named `__proto__` by
+     * that literal name on a dynamic value, or builds a literal member with
+     * that name: Object.prototype's accessor answers the read with the
+     * receiver's [[Prototype]] and the write by replacing it, while a literal
+     * member is a property definition, both of which the object model build
+     * models (scr_json.c, expr-dynamic.ts). The fact ORs into jsObjectModel
+     * (jsObjectModelFact), so a program that names the member links that one
+     * build; every other program keeps the default object, byte for byte. */
+    protoAccessor: RuntimeFeatureRule;
     /** The WebAssembly API (scr_wasm.c). */
     wasm: RuntimeFeatureRule;
     /** crypto.subtle importKey/sign/verify/digest and CryptoKey:

package/dist/ir/runtime-features.js

@@ -65,8 +65,9 @@ const DYN_ASYNC_LIB_FNS = new Set([
     "async.awaitDyn",
     // So does SlowBuffer's DEP0030.
     "buffer.slowBuffer",
-    // The child property table adopts thenables through the dyn-async unit.
-    "child.propsInstall",
+    // The handle property table adopts child thenables through the dyn-async
+    // unit.
+    "handle.propsInstall",
     "child.propsResolve",
     "crypto.native",
     // The crypto global's object extends crypto.native's.
@@ -172,6 +173,7 @@ const ASYNC_CONTEXT_LIB_FNS = new Set([
 const LEGACY_URL_LIB_FNS = new Set([
     "url.domainToASCII",
     "url.domainToUnicode",
+    "url.legacyClass",
     "url.legacyFormat",
     "url.legacyParse",
     "url.legacyResolve",
@@ -218,6 +220,8 @@ const ABORT_SIGNAL_LIB_FNS = new Set([
     "http.requestDynCb",
     "https.requestDyn",
     "https.requestDynCb",
+    "https.requestFnDyn",
+    "https.requestFnDynCb",
     "http.requestUrlDyn",
     "http.requestUrlDynCb",
     "https.requestUrlDyn",
@@ -325,9 +329,15 @@ const DYN_INVOKE_LIB_FNS = new Set([
     "dyn.arrayPrototype",
     "dyn.builtinFunction",
     "dyn.builtinMethod",
+    "dyn.builtinMethodValue",
     "dyn.stdlibPrototype",
+    "dyn.dataViewPrototype",
     "dyn.defineProperty",
     "dyn.definePropertyShapes",
+    "handle.propsDefineProps",
+    // The table's member test reads inherited prototype members through
+    // scr_dyn_invoke.c's scr_dyn_inherited_read.
+    "handle.propsInstall",
     "child.propsDefine",
     "dyn.defineProps",
     "dyn.definePropsShapes",
@@ -434,6 +444,9 @@ const SYMBOL_LIB_FNS = new Set([
     "buffer.staticValue",
     "buffer.prototypeMember",
     "buffer.prototypeObject",
+    // The array-like unit reads a receiver's @@isConcatSpreadable through
+    // scr_sym_well_known before it spreads that receiver's elements.
+    "dyn.arrayLikeProtoCall",
 ]);
 /** Entry points that link the querystring unit. */
 const QS_LIB_FNS = new Set([
@@ -641,6 +654,7 @@ const PROCESS_EVENT_LIB_FNS = new Set([
     "process.stdinIsRaw",
     "process.stdioSlot",
     "process.stdioWriteDyn",
+    "process.stdioWriteStr",
     "stdin.nextChunk",
     "stdin.onData",
     "stdin.onEnd",
@@ -847,6 +861,158 @@ export function moduleUsesWebCryptoAsymmetric(mod) {
     });
     return webcrypto && named;
 }
+/** Whether a property name spells a canonical array index `String(i)` for
+ * an integer i below 2^32 - 1: digits only, and no leading zero unless the
+ * whole name is "0". */
+function isIndexString(name) {
+    if (name.length === 0 || name.length > 10)
+        return false;
+    if (name.length > 1 && name[0] === "0")
+        return false;
+    let index = 0;
+    for (let i = 0; i < name.length; i++) {
+        const c = name.charCodeAt(i);
+        if (c < 48 || c > 57)
+            return false;
+        index = index * 10 + (c - 48);
+    }
+    return index < 4294967295;
+}
+/** The index past which an array write cannot materialize its holes: the
+ * dense prefix scr_json.c is willing to fill (`+ 1000000`). */
+const SPARSE_INDEX_LIMIT = 1_000_000;
+function literalOf(expr) {
+    const raw = expr.kind === "dynFrom" ? expr.value : expr;
+    return raw.kind === "numLit" || raw.kind === "strLit" ? raw : undefined;
+}
+/** The canonical index a value spells: a number that is one, or a string
+ * that names one. */
+function literalIndex(expr) {
+    const lit = literalOf(expr);
+    if (lit === undefined)
+        return undefined;
+    if (lit.kind === "numLit")
+        return Number.isInteger(lit.value) && lit.value >= 0 && lit.value < 4294967295
+            ? lit.value
+            : undefined;
+    return isIndexString(lit.value) ? Number(lit.value) : undefined;
+}
+/** The receiver, key and value one dynamic member write takes, or three
+ * undefined for any other node. A write is a `dyn.keySet`/`dyn.keySetComputed`
+ * call or a call into a class-dispatch stub that carries the stored value
+ * (class-dynamic-dispatch.ts `%dyn.class.computed.<n>`). */
+function writeArgs(node) {
+    const none = [undefined, undefined, undefined];
+    if (node.kind === "libCall") {
+        if (node.fn !== "dyn.keySet" && node.fn !== "dyn.keySetComputed")
+            return none;
+        return [node.args[0], node.args[1], node.args[2]];
+    }
+    if (node.kind === "call" &&
+        node.callee.startsWith("%dyn.class.computed.") &&
+        node.args.length >= 3)
+        return [node.args[0], node.args[1], node.args[2]];
+    return none;
+}
+/** Whether the module writes an array element at an index the source
+ * spells past SPARSE_INDEX_LIMIT, or sets `length` to a spelled value past
+ * it: the sparse writes a static fact can prove (see the sparseArrays
+ * rule). A keyed write evaluates its key into a hidden local first
+ * (lower-exprs.ts lowerDynMemberAssignment), so the write reads the literal
+ * the source spells back through that local's one definition. */
+function moduleWritesSparseIndex(mod) {
+    const literals = new Map();
+    const definitions = new Map();
+    /** The assigns a global takes. A module-level `const view = typed`
+     * initializes its global with an assign rather than a varDecl; a local
+     * assigned more than once could hold anything by the time of the write. */
+    const assigns = new Map();
+    everyModuleNode(mod, {
+        expr: () => true,
+        stmt: (node) => {
+            if (node.kind === "assign") {
+                const taken = assigns.get(node.localId);
+                if (taken === undefined)
+                    assigns.set(node.localId, [node.value]);
+                else
+                    taken.push(node.value);
+                return true;
+            }
+            if (node.kind !== "varDecl" || node.init === null)
+                return true;
+            definitions.set(node.localId, node.init);
+            const literal = literalOf(node.init);
+            if (literal !== undefined)
+                literals.set(node.localId, literal);
+            return true;
+        },
+        type: () => true,
+    });
+    const reassigned = new Set();
+    for (const [localId, values] of assigns) {
+        if (values.length === 1)
+            definitions.set(localId, values[0]);
+        else
+            reassigned.add(localId);
+    }
+    /** The literal behind a hidden local, or the node itself when the
+     * lowering spelled it directly. */
+    const resolve = (expr) => expr.kind === "varRef" ? literals.get(expr.localId) : literalOf(expr);
+    /** Whether the value a local holds, followed through the locals and
+     * globals it is copied from, is a live view of a native array (`const
+     * view: any = typed`). Such an array already keeps the elements past its
+     * dense prefix in its own out-of-line storage (the ScrArr ext), so a far
+     * write through the view needs no part of the checked-dynamic array's
+     * sparse support: the typed path answers it, in the default build too. */
+    const holdsNativeView = (start) => {
+        let expr = start;
+        for (let hop = 0; hop < 4; hop++) {
+            if (expr.kind === "dynFrom") {
+                if (expr.value.type.kind === "array")
+                    return true;
+                expr = expr.value;
+                continue;
+            }
+            if (expr.kind !== "varRef" || reassigned.has(expr.localId))
+                return false;
+            const next = definitions.get(expr.localId);
+            if (next === undefined)
+                return false;
+            expr = next;
+        }
+        return false;
+    };
+    const writesNativeView = (receiver) => {
+        const init = receiver.kind === "varRef" ? definitions.get(receiver.localId) : undefined;
+        return holdsNativeView(init ?? receiver);
+    };
+    let sparse = false;
+    everyModuleNode(mod, {
+        expr: (node) => {
+            if (sparse)
+                return false;
+            const [receiver, rawKey, rawValue] = writeArgs(node);
+            if (receiver === undefined || rawKey === undefined || rawValue === undefined)
+                return true;
+            if (writesNativeView(receiver))
+                return true;
+            const key = resolve(rawKey);
+            const index = key === undefined ? undefined : literalIndex(key);
+            if (index !== undefined && index > SPARSE_INDEX_LIMIT)
+                sparse = true;
+            else if (key?.kind === "strLit" && key.value === "length") {
+                const value = resolve(rawValue);
+                const length = value === undefined ? undefined : literalIndex(value);
+                if (length !== undefined && length > SPARSE_INDEX_LIMIT)
+                    sparse = true;
+            }
+            return !sparse;
+        },
+        stmt: () => !sparse,
+        type: () => true,
+    });
+    return sparse;
+}
 /** The typed file reads that answer a ScrBytes: Node answers a Buffer, and
  * scr_lib.c's read entries brand it, so a typed read makes a Buffer value. */
 const FS_READ_BYTES_FNS = new Set([
@@ -869,6 +1035,19 @@ export const JS_OBJECT_MODEL_LIB_FNS = new Set([
     "sharedArrayBuffer.newGrowable",
     "arrayBuffer.armMutable",
 ]);
+/** The member name Object.prototype answers as an accessor (protoAccessor):
+ * a dynamic read (`dynKeyGet`) or a dynamic key write names it. */
+export function isProtoKeyLiteral(node) {
+    return node.kind === "strLit" && node.value === "__proto__";
+}
+/** The dynamic key operations whose member-name argument reaches the write
+ * path (dyn.keySet, and the bag entries a JavaScript source's object
+ * literals use). */
+const PROTO_KEY_LIB_FNS = new Set([
+    "dyn.bagGet",
+    "dyn.bagSet",
+    "dyn.keySet",
+]);
 /** The JavaScript object model build's program facts (t262-da §J): every
  * runtime feature that shares the one SCR_JS_OBJECT_MODEL build ORs in here
  * (BigInt views today, array attributes and handle property tables next), so
@@ -877,7 +1056,10 @@ export const JS_OBJECT_MODEL_LIB_FNS = new Set([
 export function jsObjectModelFact(features) {
     return (features.jsObjectModel === true ||
         features.bigintBytes === true ||
-        features.mutableBuffers === true);
+        features.handleProps === true ||
+        features.mutableBuffers === true ||
+        features.protoAccessor === true ||
+        features.sparseArrays === true);
 }
 /** One rule per runtime feature, sorted by name. A new feature is an
  * entry here and its line in noRuntimeFeatures; RuntimeFeatures, the scan
@@ -928,6 +1110,12 @@ const RUNTIME_FEATURE_RULES = {
     childOptionExt: rule({
         fns: ["cp.spawnSyncExt", "cp.spawnSyncExtEnv", "cp.execFileCwd"],
     }),
+    /** The spawnSync result's `.error` property answers Node's
+     * errnoException fields (errno, syscall, path, spawnargs). The fields
+     * ride a build of scr_child.c of their own (SCR_CHILD_ERR_FIELDS), so a
+     * program that never reads `.error` keeps the default object and the
+     * result container exactly as they were. */
+    childErrorFields: rule({ fns: ["spawnRes.error"] }),
     /** scr_cipher.c over the mbedTLS archive; DEP0182 reports through the
      * process-warning unit, and unknown output encodings render through the
      * inspect unit. WebCrypto's encrypt, decrypt, wrapKey and unwrapKey
@@ -1012,6 +1200,10 @@ const RUNTIME_FEATURE_RULES = {
     /** A standard library prototype object read as a value in a JavaScript
      * source (scr_dyn_stdlib_prototype.c): `Date.prototype`. */
     stdlibPrototypeValue: rule({ fns: ["dyn.stdlibPrototype"] }),
+    /** DataView.prototype read as a value in a JavaScript source, and its
+     * members through it (scr_data_view_proto.c): the getter/setter family's
+     * prototype object. */
+    dataViewPrototypeValue: rule({ fns: ["dyn.dataViewPrototype"] }),
     /** The dynamic global object's answer for the Node globals the native
      * runtime does not implement (scr_global_host_absent.c, plus the
      * SCR_GLOBAL_HOST_ABSENT build of scr_node_builtin.c): a computed read of
@@ -1021,9 +1213,9 @@ const RUNTIME_FEATURE_RULES = {
      * (scr_dyn_array_like.c), which delegates every other name to the
      * dyn-invoke unit's array dispatch. */
     arrayLikeDispatch: rule({ fns: ["dyn.arrayLikeProtoCall"] }),
-    /** Number.prototype and Boolean.prototype as values
-     * (scr_dyn_builtin_prototype.c). */
-    builtinPrototypeValue: rule({ fns: ["dyn.builtinPrototype"] }),
+    /** A builtin prototype method as a function value (String's trim family,
+     * RegExp's exec/test/toString; scr_dyn_builtin_methods.c). */
+    builtinMethodValue: rule({ fns: ["dyn.builtinMethodValue"] }),
     dynInvoke: rule({
         initial: (mod) => mod.workers === true,
         scan: computedBufferMemberScan,
@@ -1067,8 +1259,9 @@ const RUNTIME_FEATURE_RULES = {
     streamDyn: rule({
         fns: ["stream.dynNative", "stream.dynNativePipe", "stream.pipeDyn", "stream.unpipeDyn"],
     }),
-    /** Own properties JavaScript adds to children (scr_dyn_handle_props.c). */
-    handleProps: rule({ fns: ["child.propsInstall"] }),
+    /** Own properties JavaScript adds to runtime handles (scr_dyn_handle_props.c):
+     * a Date, RegExp, Map, Set, weak collection, buffer or child. */
+    handleProps: rule({ fns: ["handle.propsInstall", "handle.propsGrant"] }),
     /** The declaration-typed boundary's adoption (scr_decl_adopt.c): its
      * casts, and closures boxed in a boundary program, which adopt their
      * arguments. */
@@ -1167,6 +1360,11 @@ const RUNTIME_FEATURE_RULES = {
     mime: rule({ prefixes: ["mime."] }),
     /** Web streams in checked-dynamic code (scr_webstreams.c). */
     webStreams: rule({ prefixes: ["webstream."] }),
+    /** A program that builds a Blob or File can hand one to fetch: selects
+     * scr_fetch.c's SCR_WEB_BODIES build, which sends the blob's bytes and
+     * type as Node does. Every other program keeps the default fetch unit,
+     * byte for byte. */
+    webBodies: rule({ prefixes: ["blob."] }),
     /** AbortController and AbortSignal (scr_abort.c, or the fetch unit).
      * A WritableStream controller's signal is one (scr_webstreams.c). */
     abortSignal: rule({ prefixes: ["abort.", "webstream."] }),
@@ -1321,12 +1519,15 @@ const RUNTIME_FEATURE_RULES = {
     streamWriteErrors: rule({ fns: ["writable.writeEcb"] }),
     /** The program reaches the process output streams' write slot — the
      * write method as a value (process.stdioSlot), its replacement, a patched
-     * program's typed writes, or a run-time-typed chunk
-     * (process.stdioWriteDyn): the SCR_STDIO_WRITE_SLOT build of the events
-     * unit carries the shared write body, the dynamic-chunk entry point and
-     * Node's anonymous write function. Every other program links the default
-     * object, byte for byte. */
-    stdioWriteSlot: rule({ fns: ["process.stdioSlot", "process.stdioWriteDyn"] }),
+     * program's typed writes, a run-time-typed chunk
+     * (process.stdioWriteDyn), or the untyped one-string write
+     * (process.stdioWriteStr): the SCR_STDIO_WRITE_SLOT build of the events
+     * unit carries the shared write body, the dynamic-chunk entry point,
+     * the string entry point and Node's anonymous write function. Every
+     * other program links the default object unchanged. */
+    stdioWriteSlot: rule({
+        fns: ["process.stdioSlot", "process.stdioWriteDyn", "process.stdioWriteStr"],
+    }),
     stream: rule({
         initial: (mod) => (mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)),
         fns: [...STREAM_LIB_FNS, "dyn.builtinStreamClass"],
@@ -1370,6 +1571,50 @@ const RUNTIME_FEATURE_RULES = {
             node.args[0]?.kind === "strLit" &&
             BIGINT_BYTES_NAMES.has(node.args[0].value),
     }),
+    /** `new Promise` whose executor takes a checked-dynamic reject parameter,
+     * and `Promise.withResolvers` on a checked-dynamic promise whose resolver
+     * record does: that reason is the program's own value, not an Error, so
+     * the emitter builds the reject closure with scr_make_reject_dyn — which
+     * lives in the SCR_PROMISE_REJECT_DYN build of scr_async.c. A promise
+     * lowered with an Error-taking reject (the typed `util.promisify` family,
+     * even for an unknown settled value; any typed `withResolvers`) keeps the
+     * default object. Every other program links the default object, byte for
+     * byte. */
+    promiseRejectDyn: rule({
+        expr: (node, tables) => {
+            if (node.kind === "newPromise")
+                return (node.type.kind === "promise" &&
+                    node.type.inner.kind === "dyn" &&
+                    node.executor.type.kind === "func" &&
+                    node.executor.type.params.length === 2 &&
+                    node.executor.type.params[1] !== undefined &&
+                    node.executor.type.params[1].kind === "func" &&
+                    node.executor.type.params[1].params[0] !== undefined &&
+                    node.executor.type.params[1].params[0].kind === "dyn");
+            if (node.kind !== "promiseWithResolvers" || node.type.kind !== "record")
+                return false;
+            const shape = tables().records.get(node.type.shapeId);
+            const promT = shape?.fields.find((f) => f.name === "promise")?.type;
+            const rejectT = shape?.fields.find((f) => f.name === "reject")?.type;
+            return (promT?.kind === "promise" &&
+                promT.inner.kind === "dyn" &&
+                rejectT?.kind === "func" &&
+                rejectT.params[0]?.kind === "dyn");
+        },
+    }),
+    /** Sparse arrays (t262 W7): an array whose length exceeds its dense
+     * prefix. Only a checked-dynamic member write can produce one, and only a
+     * write the source spells an index proves it: a key computed at run time
+     * (`a[k] = v`) may name any index, so proving sparseness from it would
+     * select this build for every program with a computed write. The elements
+     * past the prefix live in the JavaScript object model build (t262-da §J)
+     * of scr_json.c and scr_dyn_invoke.c, and that build's keyed read answers
+     * `length` from the array's own length instead of the prefix field. The
+     * fact ORs into jsObjectModel (jsObjectModelFact), so it selects no build
+     * column of its own. Every program that exists today keeps its build:
+     * a spelled index or `length` the runtime can place densely stays in the
+     * default objects, and a computed one keeps its SC2020 refusal. */
+    sparseArrays: rule({ initial: (mod) => moduleWritesSparseIndex(mod) }),
     /** Module namespace objects as checked-dynamic values
      * (scr_module_namespace.c). */
     moduleNamespace: rule({ fns: ["module.namespaceValue"] }),
@@ -1384,10 +1629,27 @@ const RUNTIME_FEATURE_RULES = {
     }),
     /** A module namespace boxed for typed code (scr_module_namespace_dyn.c). */
     moduleNamespaceDyn: rule({ fns: ["module.namespaceDyn"] }),
-    /** Primitive wrapper objects (scr_js_wrapper.c). */
-    primitiveWrapper: rule({ prefixes: ["wrapper."] }),
+    /** Primitive wrapper objects (scr_js_wrapper.c), which also own
+     * Number.prototype and Boolean.prototype: the value a JavaScript source
+     * reads through dyn.builtinPrototype, and the compiled constructor's
+     * `prototype` member of the same object. */
+    primitiveWrapper: rule({ prefixes: ["wrapper."], fns: ["dyn.builtinPrototype"] }),
     /** %Iterator% and %Iterator.prototype% as values (scr_js_iterator.c). */
     iteratorProto: rule({ prefixes: ["iterator."] }),
+    /** A JavaScript source reads or writes the member named `__proto__` by
+     * that literal name on a dynamic value, or builds a literal member with
+     * that name: Object.prototype's accessor answers the read with the
+     * receiver's [[Prototype]] and the write by replacing it, while a literal
+     * member is a property definition, both of which the object model build
+     * models (scr_json.c, expr-dynamic.ts). The fact ORs into jsObjectModel
+     * (jsObjectModelFact), so a program that names the member links that one
+     * build; every other program keeps the default object, byte for byte. */
+    protoAccessor: rule({
+        expr: (node) => (node.kind === "dynKeyGet" && isProtoKeyLiteral(node.key)) ||
+            (node.kind === "dynObjLit" &&
+                (node.fields ?? []).some((field) => isProtoKeyLiteral(field.key))),
+        libCall: (node) => PROTO_KEY_LIB_FNS.has(node.fn) && node.args.some((arg) => isProtoKeyLiteral(arg)),
+    }),
     /** The WebAssembly API (scr_wasm.c). */
     wasm: rule({ prefixes: ["wasm."] }),
     /** crypto.subtle importKey/sign/verify/digest and CryptoKey:
@@ -1480,10 +1742,11 @@ function noRuntimeFeatures() {
         dynBuiltinClass: false,
         dynBuiltinStream: false,
         stdlibPrototypeValue: false,
+        dataViewPrototypeValue: false,
         hostAbsentGlobals: false,
         dynInvoke: false,
         arrayLikeDispatch: false,
-        builtinPrototypeValue: false,
+        builtinMethodValue: false,
         dynTier: false,
         ecdh: false,
         x509: false,
@@ -1505,6 +1768,7 @@ function noRuntimeFeatures() {
         mutableBuffers: false,
         legacyTextDecoder: false,
         mime: false,
+        webBodies: false,
         webStreams: false,
         abortSignal: false,
         utilTiming: false,
@@ -1530,12 +1794,14 @@ function noRuntimeFeatures() {
         moduleNamespaceDyn: false,
         primitiveWrapper: false,
         iteratorProto: false,
+        protoAccessor: false,
         stream: false,
         strdecDyn: false,
         streamDyn: false,
         handleProps: false,
         childLifecycle: false,
         childOptionExt: false,
+        childErrorFields: false,
         declAdopt: false,
         typeOrigins: false,
         dynForAwait: false,
@@ -1551,7 +1817,9 @@ function noRuntimeFeatures() {
         tlsCa: false,
         utilPromisify: false,
         warningReplace: false,
+        promiseRejectDyn: false,
         bigintBytes: false,
+        sparseArrays: false,
         wasm: false,
         webcrypto: false,
         zlib: false,