@scriptc/compiler 0.4.8 → 0.4.9

package/dist/frontend/lowering/expressions/property-access.js

@@ -1,3 +1,4 @@
+import { callableMemberFieldTarget } from "../callable-properties.js";
 import { lowerIteratorMemberValue } from "../iterator-prototype.js";
 import { widensReducedRecords } from "../function-returns.js";
 import { nullishReadTypeError, throwAfterEach } from "../primitive-throws.js";
@@ -11,10 +12,9 @@ import { globalFunctionValue } from "../global-function-values.js";
 import { arrayClassMemberOwner, arrayClassReceiver, lowerArrayClassConstructorRead, } from "../builtins/array-classes.js";
 import { indexedUnionArms, lowerIndexedUnionMember } from "../indexed-unions.js";
 import { keyedHelperName } from "../stable-names.js";
-import { builtinNamespaceValue } from "../builtin-namespaces.js";
+import { builtinNamespaceValue, wellKnownSymbolValue } from "../builtin-namespaces.js";
 import { staticallySelected } from "../static-typeof.js";
 import { lowerWebStreamClassRead } from "../builtins/web-streams-dyn.js";
-import { wrapperConstructors } from "../primitive-wrappers.js";
 import * as ts from "../../ts7/adapter.js";
 import { lowerHistogramProperty } from "../builtins/performance.js";
 import { staticFunctionNameRead } from "../static-function-names.js";
@@ -24,9 +24,10 @@ import { isThisParameter } from "../call-signatures.js";
 import { argumentCountSlot, contextualCallCount, usedAsValue } from "../argument-counts.js";
 import { checkedPrivateValue, localPrivateBrandClass, privateNameClass, } from "../private-brands.js";
 import { PoisonError, builtinValueNameOf, jsFuncNameOf, neverTaintedJsType, own, } from "../lowerer.js";
+import { httpClientFnBindingOf, httpClientSecureRef } from "../lower-server.js";
 import { ARRAY_METHODS, MAP_METHODS, NARROW_FIRST, SET_METHODS, STDLIB_SURFACE, STRING_INDEX_METHODS, STR_METHODS, isChildSurfaceMember, stdlibGlobalNameOf, } from "../surfaces.js";
 import { isGenericCallableMemberType, isLegacyUrlSymbol, isOsConstantsType, isParseArgsDynTypeName, } from "../../type-mapper.js";
-import { BIGINT_T, BOOL, BYTES_U8, DYN, F64, NULL_T, SEARCH_PARAMS_T, STRING, SYMBOL_T, UNDEFINED_T, arrayOf, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isUnitType, typeEquals, typeKey, unionContainerArmsOk, BYTES_ELEMENT_SIZE, } from "../../../ir/ir.js";
+import { BIGINT_T, BOOL, BYTES_U8, DYN, F64, NULL_T, SEARCH_PARAMS_T, STRING, SYMBOL_T, UNDEFINED_T, arrayOf, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isUnitType, typeEquals, sortArms, sortArmsTotal, typeKey, unionContainerArmsOk, BYTES_ELEMENT_SIZE, } from "../../../ir/ir.js";
 import { lowerNavigatorMember, navigatorValue } from "../builtins/navigator.js";
 import { lowerX509PublicKey } from "../builtins/x509.js";
 import { fenceMimeStaticRead } from "../builtins/mime.js";
@@ -49,13 +50,13 @@ import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../.
 import { typedArrayLacksMember } from "../builtins/typed-array-members.js";
 import { COMMONJS_MODULE_BINDINGS, TEMPORAL_GLOBAL } from "../../builtin-modules.js";
 import { tryLowerExpression } from "./try-lower-expression.js";
-import { applyDeferredAssertion, assertedReceiverNode, deferredMemberReadTarget, deferredProbeReadAccess, } from "./asserted-receiver.js";
+import { applyDeferredAssertion, assertedOptionalMemberRead, assertedReceiverNode, deferredMemberReadTarget, deferredProbeReadAccess, } from "./asserted-receiver.js";
 import { lowerRecordInheritedMember } from "../record-inherited.js";
 import { MUTABLE_BUFFER_MEMBERS } from "../buffers.js";
 import { DATE_METHOD_HINT } from "../builtins/dates.js";
 import { cjsClassExprWholeExportOf, cjsExportAssignmentOf, cjsExportDiscardReason, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isModuleExportsAccess, isNodeEsmFile, locOf, } from "../../program.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, contextualUndefReadType, fenceEarlyNsMemberRef, nsMemberIdentOf, nsUndefRead, } from "../lower-namespaces.js";
-import { expandoMemberRead } from "../lower-expando.js";
+import { fenceExpandoRead } from "../lower-expando.js";
 import { lowerProtocolPropertyRead } from "../class-protocol-dispatch.js";
 import { lowerReadlineProperty } from "../builtins/readline.js";
 import { lowerAsyncLocalStorageProperty } from "../builtins/async-context.js";
@@ -69,9 +70,9 @@ import { nullishGenericBindingUnitOf } from "../binding-analysis.js";
 import { blockedBindingUseDiag } from "../../../diagnostics/diagnostic.js";
 import { npmStaticPackageOfPath } from "../../npm-static.js";
 import { importMetaField, isImportMeta } from "../import-meta.js";
-import { createRequireCalleeFileOf } from "../builtins/module-bindings.js";
+import { createRequireCalleeFileOf, createRequireRuntimeBaseOf, } from "../builtins/module-bindings.js";
 import { createRequireResolveFenceValue, createRequireResolveValue, } from "../builtins/module-resolution.js";
-import { builtinPrototypeMethod, lowerCheckedPredicateValue } from "../lower-builtin-values.js";
+import { builtinMethodValue, builtinPrototypeMethod, lowerCheckedPredicateValue, stringTrimMethodName, } from "../lower-builtin-values.js";
 import { constructorStaticValue, objectFreezeValue } from "../builtin-statics.js";
 import { lowerBufferPrototypeMember, lowerBufferPrototypeObject } from "../containers/bytes.js";
 import { lowerNetAddressStaticRead } from "../builtins/net-address.js";
@@ -92,7 +93,7 @@ import { isFsStreamMember, lowerFsStreamProperty } from "../builtins/fs-streams.
 import { keyedFieldRead } from "./keyed-field-targets.js";
 import { heldEnvValueType } from "../builtins/environment.js";
 import { promisePrototypeValue } from "../thenables.js";
-import { lowerChildPropertyRead } from "../handle-properties.js";
+import { lowerChildPropertyRead, lowerHandlePropertyRead } from "../handle-properties.js";
 /** True when a property access names an ABSTRACT property declaration
  * (`abstract p: number` — a PropertyDeclaration, not an accessor).
  * These uses need concrete property dispatch because the base has no slot. */
@@ -229,7 +230,8 @@ function isCreateRequireResolveValue(lowerer, expr) {
     return (!expr.questionDotToken &&
         ts.isPropertyAccessExpression(resolve) &&
         resolve.name.text === "resolve" &&
-        createRequireCalleeFileOf(lowerer, resolve.expression) !== null);
+        (createRequireCalleeFileOf(lowerer, resolve.expression) !== null ||
+            createRequireRuntimeBaseOf(lowerer, resolve.expression)));
 }
 export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     // A JavaScript source reading a member that resizes, grows or detaches a
@@ -240,6 +242,16 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     const arrayClassConstructor = lowerArrayClassConstructorRead(lowerer, expr, loc);
     if (arrayClassConstructor !== null)
         return arrayClassConstructor;
+    // A createRequire loader's resolve read as a value (passed on, or
+    // picked by `??`): a function that resolves its request at run time.
+    // resolve.paths read as a value has no run-time lowering: a function
+    // that throws the fence when called. Claimed before the generic
+    // function-member reads below, which would otherwise read `.resolve`
+    // off the loader's run-time value form.
+    if (isCreateRequireResolveValue(lowerer, expr))
+        return expr.name.text === "paths"
+            ? createRequireResolveFenceValue(lowerer, expr, loc)
+            : createRequireResolveValue(lowerer, expr, loc);
     // `R.#x` for a static private on a checked-dynamic receiver: the brand
     // check, then the native storage (private-statics.ts).
     {
@@ -773,16 +785,10 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
                 fenceEarlyNsMemberRef(lowerer, expr, memberSym);
             return lowerExpr(lowerer, nsMember);
         }
-        // Expando function members (`foo.bar` after `foo.bar = 12`): the
-        // member's module global (lower-expando.ts), before the ambient-
-        // namespace fence — a declare-namespace merge over a real function
-        // (`declare namespace Foo { var baz: number }` + `function Foo`)
-        // reads its assigned members, not the ambient ReferenceError.
-        {
-            const ex = expandoMemberRead(lowerer, expr);
-            if (ex)
-                return lowerer.maybeNarrow(ex, expr);
-        }
+        // Expando function members (`foo.bar` after `foo.bar = 12`) read
+        // through the closure's own-property table (the callable-member path
+        // below); this only keeps the source-order fence (lower-expando.ts).
+        fenceExpandoRead(lowerer, expr);
         // An AMBIENT namespace receiver (`M.x` where only `declare
         // namespace M` exists): the namespace object never exists at
         // runtime — Node's exact catchable ReferenceError at the access,
@@ -1043,6 +1049,36 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             };
         }
     }
+    // A client function chosen at run time (`const requestFn = c ?
+    // https.request : http.request`): both arms are Node's `request` (the
+    // .get pair both are `get`), and the length follows the arm the program
+    // picked — https.request.length is 0, http.request.length 3.
+    if (expr.name.text === "name" || expr.name.text === "length") {
+        const ident = ts.isIdentifier(expr.expression) ? expr.expression : null;
+        const sym = ident ? lowerer.resolveValueSymbol(ident) : undefined;
+        const binding = sym ? httpClientFnBindingOf(lowerer, sym) : undefined;
+        if (binding) {
+            if (expr.name.text === "name")
+                return { kind: "strLit", value: binding.member, type: STRING, loc };
+            const httpLength = 3;
+            const httpsLength = binding.member === "get" ? 3 : 0;
+            if (httpsLength === httpLength)
+                return { kind: "numLit", value: httpLength, type: F64, loc };
+            const secure = binding.secureStorage !== undefined
+                ? httpClientSecureRef(lowerer, binding, expr, loc)
+                : lowerer.lowerCondition(binding.cond);
+            return {
+                kind: "ternary",
+                cond: binding.trueSecure
+                    ? secure
+                    : { kind: "unary", op: "!", operand: secure, type: BOOL, loc },
+                then: { kind: "numLit", value: httpsLength, type: F64, loc },
+                else_: { kind: "numLit", value: httpLength, type: F64, loc },
+                type: F64,
+                loc,
+            };
+        }
+    }
     // `f.name` / `f.length` / own properties on a FUNCTION-typed JS
     // value (the mustCall wrapper's function-instance members): read
     // through the dyn box — the closure's own-property table answers
@@ -1058,6 +1094,21 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             expr.name.text === "length" ||
             expr.name.text === "constructor")) {
         const probed = tryLowerExpression(lowerer, expr.expression);
+        // A builtin function value's own name and length are fixed when the
+        // adapter is built: answer them without boxing the closure. Node's
+        // wrapper names (`process.cwd` is `wrappedCwd`) and lengths that
+        // differ from the adapter's parameters (`fs.readFile.length` is 3)
+        // come from the same table the boxed value reports.
+        if (probed?.type.kind === "func" &&
+            (expr.name.text === "name" || expr.name.text === "length")) {
+            const identity = lowerer.builtinFunctionIdentity(probed);
+            if (expr.name.text === "name" &&
+                identity.fnName !== undefined &&
+                !identity.fnNameMainThreadOnly)
+                return { kind: "strLit", value: identity.fnName, type: STRING, loc };
+            if (expr.name.text === "length" && identity.fnLength !== undefined)
+                return { kind: "numLit", value: identity.fnLength, type: F64, loc };
+        }
         // Inferred callable returns can use checked storage even when the
         // checker still describes a function. Read its actual dyn value;
         // the ambient Function member must not hide its own properties.
@@ -1084,7 +1135,10 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
                 loc,
             }, expr);
         }
-        if ((isJsSourceFile(ts.getSourceFileOfNode(expr)) || expr.name.text === "constructor") &&
+        if ((isJsSourceFile(ts.getSourceFileOfNode(expr)) ||
+            expr.name.text === "name" ||
+            expr.name.text === "length" ||
+            expr.name.text === "constructor") &&
             probed?.type.kind === "func" &&
             canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
             // A function is named by its definition, through const aliases: a
@@ -1250,14 +1304,6 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
             return declared && declared.kind !== "void" ? lowerer.coerceToExpected(read, declared) : read;
         }
     }
-    // A createRequire loader's resolve read as a value (passed on, or
-    // picked by `??`): a function that resolves its request at run time.
-    // resolve.paths read as a value has no run-time lowering: a function
-    // that throws the fence when called.
-    if (isCreateRequireResolveValue(lowerer, expr))
-        return expr.name.text === "paths"
-            ? createRequireResolveFenceValue(lowerer, expr, loc)
-            : createRequireResolveValue(lowerer, expr, loc);
     // The lib fence's PROPERTY chokepoint: a stdlib-declared member that
     // no lowering above claimed ([1,2].entries, Math.SQRT2, Promise.all,
     // re.exec as a value, ...) reports SC2020 here.
@@ -1495,6 +1541,14 @@ export function lowerPropertyAccessExpr(lowerer, expr, loc) {
     const childProperty = lowerChildPropertyRead(lowerer, expr);
     if (childProperty)
         return childProperty;
+    // A member a typed handle's class does not declare (a JavaScript read
+    // such as `m.label`): a property table entry of the handle
+    // (scr_dyn_handle_props.c).
+    {
+        const handleProperty = lowerHandlePropertyRead(lowerer, expr, recvLowered);
+        if (handleProperty)
+            return handleProperty;
+    }
     // A member a typed array's type does not declare (a JavaScript read, or
     // one under @ts-ignore), such as the feature probe `typeof bytes.toHex`:
     // when Node's prototype chain for the value lacks the name too, the read
@@ -1744,7 +1798,7 @@ function mergeReadTypes(lowerer, types) {
         return null;
     if (arms.length === 1)
         return arms[0];
-    const canonical = arms.sort((a, b) => typeKey(a) < typeKey(b) ? -1 : typeKey(a) > typeKey(b) ? 1 : 0);
+    const canonical = sortArmsTotal(arms);
     return { kind: "union", unionId: lowerer.unions.intern(canonical) };
 }
 function importMetaProperty(lowerer, expr) {
@@ -1978,7 +2032,18 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     if (primitivePrototype)
         return primitivePrototype;
     const builtinPrototype = builtinPrototypeMethod(lowerer, expr);
-    if (builtinPrototype)
+    if (builtinPrototype) {
+        // The trim family and RegExp's methods have a value of their own
+        // (scr_dyn_builtin_methods.c). The invoke unit's table answers a member
+        // read on a receiver it already knows; these values have no receiver at
+        // read time and brand-check whatever `this` they are later called with,
+        // which a receiver-keyed lookup cannot express. The interned value is
+        // shared with the `''.trim` and `/a/.exec` spellings below.
+        const trim = builtinPrototype === "String" ? stringTrimMethodName(expr.name.text) : null;
+        if (trim)
+            return builtinMethodValue("String", trim, locOf(expr));
+        if (builtinPrototype === "RegExp")
+            return builtinMethodValue("RegExp", expr.name.text, locOf(expr));
         return {
             kind: "libCall",
             fn: "dyn.builtinMethod",
@@ -1989,6 +2054,7 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             type: DYN,
             loc: locOf(expr),
         };
+    }
     if (ts.isPropertyAccessExpression(expr.expression) &&
         lowerer.stdlibGlobalMember(expr.expression, "Array") === "prototype") {
         return {
@@ -2011,6 +2077,41 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         return { kind: "libCall", fn: "dyn.functionApply", args: [], type: DYN, loc: locOf(expr) };
     if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
         return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
+    // DataView.prototype as a value, and its members read through it: the
+    // prototype object the language defines — its see-through properties
+    // (buffer, byteLength, byteOffset), its getter/setter family and its
+    // constructor — not a view. A DataView method CALLED on the prototype
+    // object itself throws the TypeError its brand check answers. Typed
+    // sources keep the standard-library member fence: their views lower
+    // through the intrinsic path, and only a JavaScript source can pass a
+    // view around as a value.
+    if (isJsSourceFile(ts.getSourceFileOfNode(expr)) &&
+        lowerer.stdlibGlobalMember(expr, "DataView") === "prototype") {
+        return {
+            kind: "libCall",
+            fn: "dyn.dataViewPrototype",
+            args: [wellKnownSymbolValue("toStringTag", locOf(expr))],
+            type: DYN,
+            loc: locOf(expr),
+        };
+    }
+    if (isJsSourceFile(ts.getSourceFileOfNode(expr)) &&
+        ts.isPropertyAccessExpression(expr.expression) &&
+        lowerer.stdlibGlobalMember(expr.expression, "DataView") === "prototype") {
+        return {
+            kind: "dynKeyGet",
+            value: {
+                kind: "libCall",
+                fn: "dyn.dataViewPrototype",
+                args: [wellKnownSymbolValue("toStringTag", locOf(expr.expression))],
+                type: DYN,
+                loc: locOf(expr.expression),
+            },
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+            type: DYN,
+            loc: locOf(expr),
+        };
+    }
     // Date.prototype as a value, and its members read through it: the
     // prototype object the language defines (an ordinary object carrying the
     // interface's methods), not a Date. `Date.prototype.hasOwnProperty("x")`
@@ -2246,6 +2347,23 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             const receiver = lowerer.lowerExpr(expr.expression);
             return { kind: "libCall", fn: "child.killed", args: [receiver], type: BOOL, loc };
         }
+        // spawnfile / spawnargs: the file the child was started from, and that
+        // file followed by its arguments. A shell spawn reports the shell and
+        // its invocation (Node's own record of what it ran).
+        if (name === "spawnfile") {
+            const receiver = lowerer.lowerExpr(expr.expression);
+            return { kind: "libCall", fn: "child.spawnfile", args: [receiver], type: STRING, loc };
+        }
+        if (name === "spawnargs") {
+            const receiver = lowerer.lowerExpr(expr.expression);
+            return {
+                kind: "libCall",
+                fn: "child.spawnargs",
+                args: [receiver],
+                type: arrayOf(STRING),
+                loc,
+            };
+        }
         // signalCode: `NodeJS.Signals | null`, the signal that terminated the
         // child (null while running, after a normal exit, and after a spawn
         // failure) — the exit listener's second parameter, read as a property.
@@ -2262,7 +2380,7 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         if (name === "on" || name === "once" || name === "kill" || name === "unref") {
             lowerer.unsupported("SC1090", expr, `child methods as values (call '${name}' directly)`);
         }
-        lowerer.noLowering(`ChildProcess.${name}`, expr, 'on/once("exit" | "close" | "error", cb), pid, exitCode, killed, kill(signal?), and unref() are the supported ChildProcess members', lowerer.checker.getSymbolAtLocation(expr.name));
+        lowerer.noLowering(`ChildProcess.${name}`, expr, 'on/once("exit" | "close" | "error", cb), pid, exitCode, killed, spawnfile, spawnargs, kill(signal?), ref(), and unref() are the supported ChildProcess members', lowerer.checker.getSymbolAtLocation(expr.name));
     }
     if (kind === "spawnRes") {
         // The spawnSync-result reads. status is the interned `number | null`
@@ -2503,8 +2621,16 @@ export function lowerIntrinsicProperty(lowerer, expr) {
                 loc,
             };
         }
-        if (name === "test") {
-            lowerer.unsupported("SC1090", expr, "regex methods as values (call 'test' directly)");
+        // A regex method read as a value: the same interned function
+        // `RegExp.prototype.exec` is (scr_dyn_builtin_methods.c), which
+        // brand-checks its receiver. A compiled regex carries no own member of
+        // any of these names, so the read answers the prototype's method exactly
+        // as Node does. A direct call keeps its intrinsic lowering: it is
+        // statically typed, and the value form would make it a dynamic call.
+        if ((name === "exec" || name === "test" || name === "toString") && !isCalleeOf(expr)) {
+            // The read still evaluates the receiver first: a call that answers the
+            // regex may have side effects or throw before the member is read.
+            return afterReceiver(lowerer.lowerExpr(expr.expression), builtinMethodValue("RegExp", name, locOf(expr)), locOf(expr));
         }
         return null;
     }
@@ -2690,16 +2816,22 @@ export function lowerIntrinsicProperty(lowerer, expr) {
         // runtime's interned function that runs it on its receiver.
         if (kind === "string" && isJsSourceFile(expr.getSourceFile()) && !expr.questionDotToken) {
             const receiver = lowerer.lowerExpr(expr.expression);
-            const method = {
-                kind: "libCall",
-                fn: "dyn.builtinMethod",
-                args: [
-                    { kind: "strLit", value: "String", type: STRING, loc: locOf(expr) },
-                    { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
-                ],
-                type: DYN,
-                loc: locOf(expr),
-            };
+            // `''.trim` is the same interned function as String.prototype.trim, so
+            // its call/apply run the method generically (scr_dyn_builtin_methods.c
+            // rather than the invoke unit's table, which has no trim entry).
+            const trim = stringTrimMethodName(name);
+            const method = trim
+                ? builtinMethodValue("String", trim, locOf(expr))
+                : {
+                    kind: "libCall",
+                    fn: "dyn.builtinMethod",
+                    args: [
+                        { kind: "strLit", value: "String", type: STRING, loc: locOf(expr) },
+                        { kind: "strLit", value: name, type: STRING, loc: locOf(expr.name) },
+                    ],
+                    type: DYN,
+                    loc: locOf(expr),
+                };
             return isSafeToDiscard(receiver)
                 ? method
                 : {
@@ -3283,6 +3415,16 @@ export function lowerFieldRead(lowerer, expr) {
     // answer in lowerPropertyAccessExpr (asserted-receiver.ts).
     if (deferredProbeReadAccess(lowerer, expr))
         return null;
+    // A member only an asserted intersection declares
+    // (`(item as Base & { icons?: unknown }).icons`): the assertion's width
+    // copy has the name but no value in it, while the record the value
+    // actually holds still carries the property in its kept source. Answer
+    // from there (assertedOnlyFieldRead), as the destructuring twin does.
+    {
+        const assertedOnly = assertedOptionalMemberRead(lowerer, expr);
+        if (assertedOnly)
+            return assertedOnly;
+    }
     const target = lowerer.fieldTarget(expr);
     if (target)
         return lowerer.fieldGetExpr(target, locOf(expr), expr);
@@ -4080,7 +4222,7 @@ export function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalF
             joinArms.some((a) => a.kind === "dyn" || a.kind === "generator" || a.kind === "caught"))) {
         return null;
     }
-    joinArms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+    sortArms(joinArms);
     const type = joinArms.length === 1
         ? joinArms[0]
         : { kind: "union", unionId: lowerer.unions.intern(joinArms) };
@@ -4644,6 +4786,15 @@ export function fieldTarget(lowerer, access) {
         }
         return null;
     }
+    // A member of a typed CALLABLE: the closure's own-property table
+    // (callable-properties.ts). The receiver lowered as a closure, so its
+    // members are the function object's own data properties, read through the
+    // identity-preserving box with the declared member type checked back.
+    if (receiverIr?.kind === "func") {
+        const callable = callableMemberFieldTarget(lowerer, access, receiverIr);
+        if (callable)
+            return callable;
+    }
     return null;
 }
 /** The read expression for a field target (fieldGet / recordGet /
@@ -4995,7 +5146,28 @@ const BUILTIN_VALUE_REFLECTION = new Set([
  * redefinition (`Object.hasOwn(Object, "hasOwn")`,
  * `Object.defineProperty(Promise, ...)`, `hasOwnProperty.call(Map, ...)`),
  * which would observe or change members the interned value does not
- * model. */
+ * model — except an own-key query whose answer the value does model
+ * (faithfulOwnKeyQuery). */
+/** The interned values whose own properties the runtime models exactly as
+ * Node's constructor has them: Proxy is the one builtin constructor with no
+ * `prototype` own property, and the runtime's Proxy value carries Node's
+ * other own keys (length, name, revocable). The other interns would answer
+ * `hasOwnProperty(..., "prototype")` false where Node answers true. */
+const BUILTIN_VALUE_OWN_KEYS_FAITHFUL = new Set(["Proxy"]);
+/** `Object.prototype.hasOwnProperty.call(<interned value>, key)` asks which
+ * own keys the value has; it neither reads nor redefines a member. The
+ * answer is Node's when the interned value's own keys are
+ * (BUILTIN_VALUE_OWN_KEYS_FAITHFUL). */
+function faithfulOwnKeyQuery(lowerer, callee, canonical) {
+    if (!BUILTIN_VALUE_OWN_KEYS_FAITHFUL.has(canonical) || callee.name.text !== "call")
+        return false;
+    const method = callee.expression;
+    return (ts.isPropertyAccessExpression(method) &&
+        method.name.text === "hasOwnProperty" &&
+        ts.isPropertyAccessExpression(method.expression) &&
+        method.expression.name.text === "prototype" &&
+        stdlibGlobalNameOf(lowerer, method.expression.expression) === "Object");
+}
 export function builtinGlobalValueAt(lowerer, expr, canonical, loc, js) {
     // A namespace object models its own properties, so member reads and
     // reflection read it like any object.
@@ -5024,7 +5196,8 @@ export function builtinGlobalValueAt(lowerer, expr, canonical, loc, js) {
                 call.arguments.nodes[0] === node &&
                 lowerer.isStdlibSymbol(lowerer.checker.getSymbolAtLocation(ts.isPropertyAccessExpression(callee.expression)
                     ? callee.expression.name
-                    : callee.expression)));
+                    : callee.expression)) &&
+                !faithfulOwnKeyQuery(lowerer, callee, canonical));
         if (reflects) {
             const name = owner !== null
                 ? `${owner}.${callee.name.text}`
@@ -5271,6 +5444,26 @@ export function isPromisePrototypeRead(lowerer, expr) {
         inner.name.text === "constructor" &&
         lowerer.mapTypeOf(lowerer.typeOf(inner.expression))?.kind === "promise");
 }
+/** Whether `expr` reads DataView.prototype, or a member read through it, in
+ * a JavaScript source. The checker types the read DataView — whose lowering
+ * is a bytes view — but the value is the prototype OBJECT
+ * (dyn.dataViewPrototype), so a binding inferred from it stays
+ * checked-dynamic: the bytes extraction would throw where Node answers the
+ * object. */
+export function isDataViewPrototypeRead(lowerer, expr) {
+    if (!expr)
+        return false;
+    while (ts.isParenthesizedExpression(expr))
+        expr = expr.expression;
+    if (!ts.isPropertyAccessExpression(expr) || expr.questionDotToken)
+        return false;
+    if (!isJsSourceFile(ts.getSourceFileOfNode(expr)))
+        return false;
+    if (lowerer.stdlibGlobalMember(expr, "DataView") === "prototype")
+        return true;
+    return (ts.isPropertyAccessExpression(expr.expression) &&
+        lowerer.stdlibGlobalMember(expr.expression, "DataView") === "prototype");
+}
 /** A promise's `constructor` (the Promise constructor value), and
  * Promise.prototype read as `promise.constructor.prototype` or
  * `Promise.prototype` (execa's `(async () => {})().constructor.prototype`):
@@ -5396,14 +5589,20 @@ function jsPrimitivePrototypeValue(lowerer, expr) {
             {
                 kind: "libCall",
                 fn: "wrapper.booleanPrototype",
-                args: [wrapperConstructors(lowerer, loc)[2]],
+                args: [lowerer.coerceToExpected(primitiveCtorClosure(lowerer, kind, loc, true), DYN)],
                 type: DYN,
                 loc,
             }
         : {
             kind: "libCall",
             fn: "dyn.builtinPrototype",
-            args: [{ kind: "strLit", value: kind, type: STRING, loc }],
+            args: [
+                { kind: "strLit", value: kind, type: STRING, loc },
+                // The compiled constructor value the prototype belongs to: the
+                // unit answers it as the constructor's `prototype` member, so
+                // `Object(1).constructor.prototype === Number.prototype`.
+                lowerer.coerceToExpected(primitiveCtorClosure(lowerer, kind, loc, true), DYN),
+            ],
             type: DYN,
             loc,
         };