@yabgu_gm/tensionscript 0.11.4 → 0.13.0

package/dist/assemblyscript.generated.d.ts

@@ -338,6 +338,8 @@ declare module "types:tensionscript/src/common" {
         const Object = "Object";
         const Array = "Array";
         const StaticArray = "StaticArray";
+        /** The descriptor behind `@managed @dynamic [T * n]` (Landing 4d.1). */
+        const DynamicArray = "DynamicArray";
         const Set = "Set";
         const Map = "Map";
         const Function = "Function";
@@ -2332,7 +2334,37 @@ declare module "types:tensionscript/src/types" {
         /** String iterator. */
         StringviewIter = 25,
         /** No return type. */
-        Void = 26
+        Void = 26,
+        /**
+         * A pointer to `T` with unknown length, `[T *]`.
+         *
+         * **Appended at the end**, not beside {@link FixedArray}, on purpose. This is
+         * a `const enum` with implicit numbering, so an insert would renumber the
+         * twelve kinds between `FixedArray` and `Void`; the compiler is self-hosted, so
+         * a partial rebuild could then disagree with `dist/` about what
+         * `TypeKind.Extern` means -- silently. The order here carries no meaning.
+         *
+         * One slot holding an address: not a value (no extent to inline), not a
+         * reference (the collector owns nothing). `toRef` answers the pointer type,
+         * which is what lets a `[T *]` parameter, local, global and return bind as one
+         * slot where `T[N]` reaches `Type#toRef`'s `assert(false)`.
+         */
+        UnmanagedArray = 27,
+        /**
+         * `@unmanaged @dynamic [T * n]` — a header-prefixed array whose length is a
+         * runtime value.
+         *
+         * Appended for the same reason {@link UnmanagedArray} was: an insert would
+         * renumber every kind after it, and the compiler is self-hosted.
+         *
+         * A separate kind rather than a flag on `UnmanagedArray` because the two have
+         * different layouts — one addresses bare elements, the other a
+         * `[u32 length][pad][data]` header — and every element access has to know
+         * which it is looking at. The storage *model* is a field
+         * ({@link dynamicMemoryModel}), not a kind, so `@managed @dynamic` (Landing 4d)
+         * is the same kind under a different owner.
+         */
+        DynamicArray = 28
     }
     /** Indicates capabilities of a type. */
     export const enum TypeFlags {
@@ -2383,12 +2415,55 @@ declare module "types:tensionscript/src/types" {
         /** Element count of a {@link TypeKind.FixedArray}, else `0`. */
         fixedLength: number;
         /**
-         * Alignment (log2) of a {@link TypeKind.FixedArray}: its element's.
+         * Who owns a {@link TypeKind.FixedArray}'s storage — the second axis of the
+         * kind, alongside the element and the length.
+         *
+         * The memory model was already on the AST (`TypeNode.memoryModel`) and was
+         * simply dropped before Landing 5a.5: `Type.fixedArray` interned one object
+         * per `(element, length)`, so `[u32 * 4]`, `@unmanaged [u32 * 4]`,
+         * `@managed [u32 * 4]` and `@inline [u32 * 4]` were **the same Type**, and
+         * the prefix was decorative — measured, all four emitted identical code.
+         *
+         * The two forms are not the same thing. `[u32 * 4]` is 16 bytes of inline
+         * elements with no address of its own; `@unmanaged [u32 * 4]` is a pointer to
+         * four elements, i.e. 4 bytes. Part of {@link equals} for the same reason
+         * {@link dynamicMemoryModel} is: interning them together would make the two
+         * spellings the same object, and no downstream test could tell them apart.
+         */
+        fixedMemoryModel: MemoryModelCode;
+        /**
+         * Element type of a {@link TypeKind.UnmanagedArray}, else `null`.
+         *
+         * Kept apart from {@link fixedElementType} rather than shared. The two kinds
+         * say different things -- an extent versus an address -- and a shared field
+         * would force every `kind == FixedArray` test in the compiler to become a
+         * three-way test, with the risk that one of them silently starts treating an
+         * address as an extent. `size` differs for the same reason: this kind's size is
+         * the pointer's, not the element's replicated.
+         */
+        unmanagedElementType: Type | null;
+        /** Element type of a {@link TypeKind.DynamicArray}, else `null`. */
+        dynamicArrayElementType: Type | null;
+        /**
+         * Who owns a {@link TypeKind.DynamicArray}'s buffer.
          *
-         * `alignLog2` cannot derive this from `byteSize` -- a 24-byte `f32[6]` would
-         * report 16-byte alignment (`31 - clz(24)` = 4), and a 96-byte `f32[24]` would
-         * report 64. An array is aligned as its element is, no matter how long it is,
-         * so the value is carried rather than computed.
+         * {@link MemoryModelCode.Unmanaged} for a C-compatible header-prefixed buffer;
+         * {@link MemoryModelCode.Managed} is Landing 4d. Part of {@link equals}, so the
+         * two cannot be confused for one another even though they share a kind and a
+         * layout.
+         */
+        dynamicMemoryModel: MemoryModelCode;
+        /**
+         * Alignment (log2) of a {@link TypeKind.FixedArray}.
+         *
+         * For the **value** form this is the element's. `alignLog2` cannot derive
+         * that from `byteSize` -- a 24-byte `f32[6]` would report 16-byte alignment
+         * (`31 - clz(24)` = 4), and a 96-byte `f32[24]` would report 64. An array is
+         * aligned as its element is, no matter how long it is, so the value is carried
+         * rather than computed.
+         *
+         * For the **view** form it is the *pointer's*, because that is what the value
+         * is: the extent says nothing about how the address is aligned.
          */
         private fixedAlignLog2;
         /** Respective non-nullable type, if nullable. */
@@ -2405,7 +2480,15 @@ declare module "types:tensionscript/src/types" {
         get exceptVoid(): Type;
         /** Size in bytes. */
         get byteSize(): number;
-        /** Gets this type's logarithmic alignment in memory. */
+        /**
+         * Gets this type's logarithmic alignment in memory.
+         *
+         * An `UnmanagedArray` deliberately does **not** take the {@link fixedAlignLog2}
+         * branch. It is one pointer, so its alignment is the pointer's -- which is what
+         * the `byteSize` fallback already yields, since this kind's `size` is the
+         * pointer's and not the element's replicated. There is no element alignment to
+         * borrow here; the element is not stored in this type.
+         */
         get alignLog2(): number;
         /** Tests if this type represents a basic value. */
         get isValue(): boolean;
@@ -2456,6 +2539,34 @@ declare module "types:tensionscript/src/types" {
         get isManaged(): boolean;
         /** Tests if this is a class type explicitly annotated as unmanaged. */
         get isUnmanaged(): boolean;
+        /**
+         * This type's extent in bytes when it is stored **inline**, rather than by
+         * reference.
+         *
+         * For a scalar the two are the same number, and for an ordinary class neither
+         * is what an inline array wants -- a class element is stored as its 4-byte
+         * reference, so `byteSize` is right there. The one case where `byteSize` is
+         * **wrong** is a C-layout record (`@unmanaged` / `@managed struct`, and
+         * `@inline struct`, which the parser also flags `@unmanaged`): there
+         * `byteSize` is the reference width (4) while the bytes an inline element
+         * actually occupies are the record's layout size, `Class#nextMemoryOffset`.
+         *
+         * That is the same pair `builtin_sizeof` distinguishes
+         * (`builtins.ts`, the `Unmanaged | ManagedStruct` branch), and it is why
+         * `sizeof<Props>()` answered 16 while `sizeof<[Props * 4]>()` answered 16
+         * instead of 64: the array's size was built from the reference width.
+         */
+        get inlineExtentBytes(): number;
+        /**
+         * This type's alignment as a log2 when it is stored inline.
+         *
+         * A record's alignment is the strongest of its fields', accumulated while the
+         * resolver lays it out (`Class#alignLog2`), and **not** `Type#alignLog2` —
+         * which reads the class's 4-byte reference size and would report 2 for every
+         * record, including one aligned to 8. The same distinction `builtin_alignof`
+         * makes, for the same reason.
+         */
+        get inlineAlignLog2(): number;
         get isMemory(): boolean;
         /** Gets the corresponding non-nullable type. */
         get nonNullableType(): Type;
@@ -2530,21 +2641,90 @@ declare module "types:tensionscript/src/types" {
         /** A 32-bit float. */
         static readonly f32: Type;
         /** A 64-bit float. */
-        /** Interned fixed-array types, keyed by element type and length. */
+        /** Interned fixed-array types, keyed by model, element type and length. */
         private static _fixedArrays;
         /**
-         * Gets the {@link TypeKind.FixedArray} of `elementType` repeated `length` times.
-         *
-         * Interned: the same element and length always yield the same `Type`, so
-         * `offsetof`, `alignof`, `sizeof` and field lookup can compare by identity the
-         * way they do for every other type. Size is the element's byte size times the
-         * length, and the alignment is the element's -- carried in
-         * {@link fixedAlignLog2} rather than derived from the total, because a total
-         * is not a power of two for the lengths records actually have (`f32[6]`).
+         * Gets the {@link TypeKind.FixedArray} of `elementType` repeated `length`
+         * times, in the storage named by `memoryModel`.
+         *
+         * Interned: the same `(model, element, length)` always yields the same `Type`,
+         * so `offsetof`, `alignof`, `sizeof` and field lookup can compare by identity
+         * the way they do for every other type.
+         *
+         * **The model is part of the identity**, and that is the point of Landing
+         * 5a.5. Before it, this function had one axis (element, length) and the memory
+         * model was dropped, so `[u32 * 4]` and `@unmanaged [u32 * 4]` were the same
+         * Type object — measured: both compiled, both `sizeof` 16, and all four
+         * spellings (`[T * N]`, `@unmanaged [T * N]`, `@managed [T * N]`,
+         * `@inline [T * N]`) emitted byte-identical code. A prefix that changes
+         * nothing is worse than one that is refused, because it reads as if it means
+         * something.
+         *
+         * The two honourable forms differ in both size and alignment:
+         *
+         *   value  (`Any` / `Inline`) — inline elements: `elementSize * length` bytes,
+         *                               aligned as the element is
+         *   view   (`Unmanaged`)      — one address: `pointerSize` bits, aligned as a
+         *                               pointer is
+         *   heap   (`Managed`)        — one GC reference, same shape as the view; the
+         *                               form itself is refused until Landing 5c, but
+         *                               the Type can be built so that `sizeof` answers
+         *                               the truth before the refusal fires
+         *
+         * `pointerSize` is in **bits**, matching `Type.size`.
          */
-        static fixedArray(elementType: Type, length: number): Type;
+        static fixedArray(elementType: Type, length: number, memoryModel: MemoryModelCode, pointerSize: number): Type;
         /** Gets the element type of a {@link TypeKind.FixedArray}. */
         get fixedArrayElementType(): Type;
+        /** Interned unmanaged-array types, keyed by element type and pointer width. */
+        private static _unmanagedArrays;
+        /**
+         * Gets the {@link TypeKind.UnmanagedArray} of `elementType`: a pointer to a run
+         * of `elementType`, with no length.
+         *
+         * `pointerSize` is `options.usizeType.size` -- 32 or 64 bits. It is a
+         * parameter rather than a constant because a `Type` carries its own size, and
+         * `size` here must be the **pointer's**, not the element's: there is no extent
+         * to measure. It is part of the cache key for the same reason -- `equals`
+         * compares element types only, so two types differing solely in pointer width
+         * must not be the same object.
+         *
+         * Unlike {@link Type.fixedArray} this consults nothing about the element but
+         * its identity: the count is unknown, which is the entire point of the kind.
+         *
+         * The cache is validated by **identity** of the element, not just by the key.
+         * This is what keeps interning a per-program property rather than a
+         * per-process one: the map is a static that outlives a `Program`, so a second
+         * `asc.main` in the same process (which is exactly what the compiler test
+         * harness does -- debug then release) would otherwise be handed the first
+         * program's `Type`, whose `unmanagedElementType` carries the first program's
+         * `Class`. A property read through that class then emitted a call to a getter
+         * the new module never compiled, and the module failed to validate:
+         * `wasm-validator error ... call target must exist`.
+         *
+         * So a cached entry is returned only when its element is the *same object* the
+         * current program just resolved. Within one program that is always true --
+         * `resolveType` interns a record's `Type` -- so interning still holds there.
+         */
+        static unmanagedArray(elementType: Type, pointerSize: number): Type;
+        /** Gets the element type of a {@link TypeKind.UnmanagedArray}. */
+        get unmanagedArrayElementType(): Type;
+        /** Interned dynamic-array types, keyed by model, element and pointer width. */
+        private static _dynamicArrays;
+        /**
+         * Gets the {@link TypeKind.DynamicArray} of `elementType`.
+         *
+         * The key carries the **model** as well as the element, because `equals`
+         * compares both: two models over one element are different types, and
+         * interning them together would make them the same object.
+         *
+         * Like {@link Type.unmanagedArray} the entry is validated by element identity
+         * on the way out — the map outlives a `Program`, so a second compile in one
+         * process must not be handed the first one's element `Class`.
+         */
+        static dynamicArray(elementType: Type, memoryModel: MemoryModelCode, pointerSize: number): Type;
+        /** Gets the element type of a {@link TypeKind.DynamicArray}. */
+        get dynamicElementType(): Type;
         static readonly f64: Type;
         /** A 128-bit vector. */
         static readonly v128: Type;
@@ -3259,7 +3439,83 @@ declare module "types:tensionscript/src/resolver" {
          * collection wants `Array<T>`, and letting `T[N]` hold references would make
          * `@unmanaged` records carry GC edges they cannot describe. Refused by name.
          */
+        /**
+         * Turns on `Feature.MultiValue` the first time a value-form `[T * N]` return
+         * type is resolved.
+         *
+         * **At resolution, not at emission.** The module's feature flags are computed
+         * once, in `Compiler`'s constructor (`module.setFeatures`), and a return is
+         * emitted long after that — so this sets the option *and* re-sets the module's
+         * flags, which `setFeatures` supports (`module.ts`). Measuring that
+         * re-settability is what this hook rests on: with a write-once flags word this
+         * would have needed a deferred second pass.
+         *
+         * Policy is **auto-enable** rather than a required flag: a consumer who writes
+         * `function make(): [T * N]` should not have to know that the emitter lowers it
+         * to multivalue results. The trade is that the module's declared feature set
+         * depends on its source, which is exactly the contract `--exportRuntime`
+         * already sets. A module that never returns one never gets the flag.
+         *
+         * Idempotent: `features` is a bitmask, and re-setting the same flags is a
+         * no-op for binaryen.
+         */
+        private enableMultiValueForArrayReturn;
+        /** Whether `type` is a fixed array in its **value** form — N inline elements
+         *  with no address of their own — as opposed to the `@unmanaged` view (a
+         *  pointer) or the `@managed` heap form (Landing 5c). */
+        private isValueFormFixedArray;
         private resolveFixedArrayType;
+        /**
+         * Resolves an {@link UnmanagedArrayTypeNode} to a
+         * {@link TypeKind.UnmanagedArray}.
+         *
+         * Deliberately **not** a copy of {@link resolveFixedArrayType}: none of that
+         * function's refusals belong here, and copying them would refuse the form's
+         * whole purpose.
+         *
+         * A fixed array *contains* its elements, so a record element would claim `N`
+         * records sit inline -- refused by name (`resolver.ts`, the `AS100` record
+         * arm). An unmanaged array contains one address, so a record element is the
+         * ordinary case: `[BodyState *]` is a pointer to a run of records, which is
+         * exactly what the collision solver needs and what `BodyState[N]` cannot say.
+         *
+         * What *is* refused is an element with no bytes to point at, which is the same
+         * `byteSize` question `sizeof` asks. An `@inline` element is admitted here on
+         * purpose: it is a value type with a layout, and a pointer to it is a pointer
+         * to those bytes -- the refusal that applies to it is the *field* form's, not
+         * the pointer's.
+         *
+         * A **GC-managed** element is refused (see the arm below). Measured before it
+         * existed: `[Foo *]` over a `class Foo` compiled and emitted
+         * `base + i*4`, `i32.load`, `call Foo#get:x` -- the buffer holds bare
+         * references that nothing scans.
+         */
+        private resolveUnmanagedArrayType;
+        /**
+         * Resolves a {@link DynamicArrayTypeNode} to a {@link TypeKind.DynamicArray}.
+         *
+         * The type is **one pointer** to a `[u32 length][pad][data]` header; the length
+         * is not in the type, which is the whole point — it is a runtime value, read
+         * from the buffer. `n` is spelling here and a binding where a function scope
+         * exists (see `Program#bindDynamicLengthLocals`).
+         *
+         * Three refusals, each for a different reason:
+         *
+         * - **`@managed`** is Landing 4d. The buffer would need a collector-visible
+         *   header, which this landing does not produce.
+         *
+         * - **No model at all** cannot be honoured by any emitter: an inline
+         *   runtime-length array would need variable stack allocation, which WASM does
+         *   not have. Naming a model is the source saying where the bytes live.
+         *
+         * - **A GC-managed element** is the same hazard Landing 3's CX1 closed for
+         *   `[T *]`: the buffer is not scanned, so a reference stored in it is not a
+         *   root.
+         *
+         * An `@inline` element is accepted: it is a value type, so its extent is
+         * `byteSize` and Landing 3 measured that stride works.
+         */
+        private resolveDynamicArrayType;
         private resolveTupleType;
         private resolveBuiltinNotNullableType;
         /** Resolves a type name to the program element it refers to. */
@@ -3372,6 +3628,28 @@ declare module "types:tensionscript/src/resolver" {
         private lookupPropertyAccessExpression;
         /** Resolves a property access expression to its static type. */
         private resolvePropertyAccessExpression;
+        /**
+         * The element type of an array-kind receiver, or `null` when `type` is not one.
+         *
+         * Three kinds answer here, and they are one family even though only two are a
+         * `TypeKind`:
+         *
+         * - `[T *]` — `TypeKind.UnmanagedArray`, element on the type;
+         * - `@unmanaged @dynamic [T * n]` — `TypeKind.DynamicArray`, element on the type;
+         * - `@managed @dynamic [T * n]` — a **class reference** to the std
+         *   `DynamicArray<T>` descriptor (Landing 4d.1), so the element is the class's
+         *   type argument.
+         *
+         * The third case is why this is a helper. Landing 2 added the first arm by
+         * hand, Landing 4b added the second by hand, and the managed form would be the
+         * third copy of the same two-line idea — in two places, since the element is
+         * wanted both as a *type* (`resolveElementAccessExpression`) and as an
+         * *element* (`lookupElementAccessExpression`, which peels `y[i].field` through
+         * the element's class). One definition, three kinds, two consumers.
+         */
+        private arrayKindElementType;
+        /** Whether `classReference` is the std `DynamicArray<T>` descriptor class. */
+        private isManagedDynamicArrayClass;
         /** Looks up the program element the specified element access expression refers to. */
         private lookupElementAccessExpression;
         /** Resolves an element access expression to its static type. */
@@ -3642,6 +3920,25 @@ declare module "types:tensionscript/src/parser" {
         finish(): void;
         /** Parses a type name. */
         parseTypeName(tn: Tokenizer): TypeName | null;
+        /**
+         * Whether a `[` at the start of a type begins the unmanaged-array family
+         * (`[T *]`, `[T * N]`) rather than a tuple.
+         *
+         * The discriminator is one token after the element type: `*` commits, and
+         * anything else (`]`, `,`, `:`, `|`) belongs to the tuple arm. The lookahead
+         * speculates with errors suppressed and rewinds either way -- the same shape
+         * as `tryParseFunctionType` / `tryParseSignatureIsSignature`, and the reason
+         * the tuple arm's body needs no change: it is entered with the tokenizer
+         * exactly where its own `tn.skip(Token.CloseBracket)` expects it.
+         *
+         * A pre-type decorator is excluded before speculating. `parseType`'s decorator
+         * arm reports `AS212` ("Decorator '@x' is not valid here") *before*
+         * `suppressErrors` is consulted, so speculating into `[@unmanaged T *]` would
+         * emit a diagnostic for a form this family does not accept anyway -- and then
+         * emit the tuple/`Type expected` error on the rewind, giving two errors for
+         * one mistake.
+         */
+        startsUnmanagedArrayType(tn: Tokenizer): boolean;
         /** Parses a type. */
         parseType(tn: Tokenizer, acceptParenthesized?: boolean, suppressErrors?: boolean): TypeNode | null;
         private tryParseSignatureIsSignature;
@@ -3813,7 +4110,7 @@ declare module "types:tensionscript/src/program" {
     import { Type, Signature } from "types:tensionscript/src/types";
     import { Token } from "types:tensionscript/src/tokenizer";
     import { Node, Source, DecoratorNode, DecoratorKind, TypeParameterNode, TypeNode, NamedTypeNode, FunctionTypeNode, ArrowKind, Expression, IdentifierExpression, Statement, ClassDeclaration, DeclarationStatement, EnumDeclaration, EnumValueDeclaration, FieldDeclaration, FunctionDeclaration, InterfaceDeclaration, NamespaceDeclaration, TypeDeclaration, VariableDeclaration, VariableLikeDeclarationStatement } from "types:tensionscript/src/ast";
-    import { Module, ExpressionRef, FunctionRef, MemorySegment } from "types:tensionscript/src/module";
+    import { Module, ExpressionRef, FunctionRef, MemorySegment, TypeRef } from "types:tensionscript/src/module";
     import { Resolver } from "types:tensionscript/src/resolver";
     import { Flow } from "types:tensionscript/src/flow";
     import { Parser } from "types:tensionscript/src/parser";
@@ -3941,6 +4238,17 @@ declare module "types:tensionscript/src/program" {
         /** Gets the standard `StaticArray` prototype. */
         get staticArrayPrototype(): ClassPrototype;
         private _staticArrayPrototype;
+        /**
+         * Gets the `DynamicArray` prototype — the descriptor class behind
+         * `@managed @dynamic [T * n]`.
+         *
+         * Follows `staticArrayPrototype` exactly: a lazily-cached `require` of the
+         * std prototype, so `@managed @dynamic [T * n]` can resolve through
+         * `resolveClass(program.dynamicArrayPrototype, [elementType])` and come back
+         * as an ordinary generic class instance.
+         */
+        get dynamicArrayPrototype(): ClassPrototype;
+        private _dynamicArrayPrototype;
         /** Gets the standard `Set` prototype. */
         get setPrototype(): ClassPrototype;
         private _setPrototype;
@@ -4586,6 +4894,29 @@ declare module "types:tensionscript/src/program" {
          * therefore cannot alias.
          */
         fieldLocals: Map<string, Local> | null;
+        /**
+         * The WASM slot type for this local, when it is **not** what {@link type}
+         * says it is.
+         *
+         * `type` answers "what does the source see" — a record, so `p.field` resolves;
+         * an array, so `arr[i]` resolves. The slot is a different question, and for
+         * most locals the two agree. Three cases where they do not:
+         *
+         * - **view local** (`isViewLocal`) — the slot is the pointer; handled below by
+         *   substituting `usizeType`, because a pointer *is* a type.
+         * - **multivalue tuple** — the slot is the `TypeRef` binaryen makes for a
+         *   multi-result signature. That has **no `Type` at all**: `createType(refs)`
+         *   answers a `TypeRef` the type system cannot describe. Hence an override
+         *   rather than a substitution — this is the one local whose slot cannot be
+         *   named by a `Type`.
+         *
+         * {@link TypeRef.None} for every other local, so the ordinary case costs
+         * nothing — the same reasoning as {@link fieldLocals}. A sentinel rather than
+         * `| null` because `TypeRef` is an integer type and cannot be nullable here
+         * (measured: `AS204: Type 'TypeRef' cannot be nullable` when the self-hosted
+         * compiler parsed this declaration).
+         */
+        typeRefOverride: TypeRef;
         /**
          * Whether this local is a **view parameter**: `a: @unmanaged T` where `T` is
          * an inline type.
@@ -4607,6 +4938,15 @@ declare module "types:tensionscript/src/program" {
          * is what gives it one `i32` slot instead of the record's reference type.
          */
         isViewLocal: boolean;
+        /**
+         * Whether this local is a **dynamic-array length binding** — the `n` in
+         * `[T * n]`, introduced by the signature rather than written as a declaration.
+         *
+         * It is read-only by construction: its value comes from the buffer header at
+         * function entry, so assigning it would make the compiler's idea of the length
+         * disagree with the buffer's. The assignment and shadowing rules key on this.
+         */
+        isDynamicLength: boolean;
         /** Constructs a new local variable. */
         constructor(
         /** Simple name. */
@@ -4732,6 +5072,23 @@ declare module "types:tensionscript/src/program" {
          * one structure regardless of where the leaves' storage came from.
          */
         bindSroaParameterLeaves(type: Type, path: string, into: Map<string, Local>, localIndex: number, flow: Flow): BindResult;
+        /**
+         * Binds a value-form `[T * N]` parameter's **leaves** to the WASM parameters
+         * that carry them.
+         *
+         * The array sibling of {@link bindSroaParameterLeaves}, and the same tree
+         * shape `fillSroaArrayLocals` builds for a local: the map is keyed `"0"`,
+         * `"1"`, ... and a record element is a placeholder carrying its field leaves.
+         * What differs is where the leaves' storage comes from — incoming parameters
+         * here, fresh locals there.
+         *
+         * Element-major, matching `Signature.leafTypesOf` and the caller's operand
+         * order. A parameter is a **value** for the callee's whole body: nothing is
+         * written back, so a store to `arr[0].x` is invisible to the caller. That is
+         * the copy semantics the representation is for, and it costs nothing extra —
+         * the leaves are separate slots precisely because the value has no address.
+         */
+        bindSroaArrayParameterLeaves(type: Type, path: string, into: Map<string, Local>, localIndex: number, flow: Flow): BindResult;
         /** Constructs a new concrete function. */
         constructor(
         /** Name incl. type parameters, i.e. `foo<i32>`. */
@@ -4744,8 +5101,23 @@ declare module "types:tensionscript/src/program" {
         signature: Signature, // pre-resolved
         /** Contextual type arguments inherited from its parent class, if any. */
         contextualTypeArguments?: Map<string, Type> | null);
-        /** Gets the types of additional locals that are not parameters. */
-        getNonParameterLocalTypes(): Type[];
+        /**
+         * The **WASM slot types** of the additional locals that are not parameters.
+         *
+         * Named for the refs rather than the types because that is what it now
+         * answers: most slots are `local.type.toRef()`, but a multivalue tuple's slot
+         * is a `TypeRef` with no `Type` behind it ({@link Local.typeRefOverride}), and
+         * a view local's slot is the pointer rather than the record it names. Callers
+         * feed this straight to `Module#addFunction`'s `varTypes`, which is a
+         * `TypeRef[]` — so the conversion belongs here, where the slot is decided,
+         * rather than at each of them.
+         *
+         * Renamed from `getNonParameterLocalTypes` when the tuple override landed:
+         * four call sites all wrapped the old answer in `typesToRefs`, and renaming
+         * means a caller that was missed fails to compile instead of silently
+         * declaring a slot of the wrong type.
+         */
+        getNonParameterLocalTypeRefs(): TypeRef[];
         /** Gets the name of the parameter at the specified index. */
         getParameterName(index: number): string;
         /** Creates a stub for use with this function, i.e. for varargs or override calls. */
@@ -5859,6 +6231,15 @@ declare module "types:tensionscript/src/compiler" {
         indexExpression: Expression | null, 
         /** Whether to tee the value. */
         tee: boolean): ExpressionRef;
+        /**
+         * The {@link DynamicArrayTypeNode} a declaration names, if it names one.
+         *
+         * Two spellings carry the length's name: the annotation (`const y: [T * n]`)
+         * and `changetype`'s type argument (`const y = changetype<[T * n]>(p)`). Both
+         * are read here so the local-position binding does not depend on which one the
+         * source chose.
+         */
+        private dynamicArrayTypeNodeOf;
         /** Makes an assignment to a local, keeping track of wrap and null states. */
         private makeLocalAssignment;
         /** Makes an assignment to a global. */
@@ -5931,6 +6312,177 @@ declare module "types:tensionscript/src/compiler" {
         /** Creates an indirect call to a first-class function. */
         makeCallIndirect(signature: Signature, functionArg: ExpressionRef, reportNode: Node, operands?: ExpressionRef[] | null, immediatelyDropped?: boolean): ExpressionRef;
         private compileCommaExpression;
+        /**
+         * The byte extent of one element of a `[T *]` — the stride `y[i]` walks by.
+         *
+         * For a scalar this is `Type.byteSize`. For a record it is **not**: an
+         * `@unmanaged`/`@managed` record's `Type` is reference-like, so its `byteSize`
+         * is the 4-byte address, and the extent lives on the `Class` that laid the
+         * fields out. `builtin_sizeof` already answers this way for the same reason
+         * (`builtins.ts`, the `Unmanaged | ManagedStruct` branch answers
+         * `nextMemoryOffset`), so the two cannot disagree about how big a record is.
+         *
+         * An `@inline struct` needs no arm: it *is* a value type, so its
+         * `byteSize` is already the extent. Measured — `[Inl *]` over
+         * `@inline struct Inl { x: f64; y: f64 }` strides 16, which is
+         * `sizeof<Inl>()`.
+         *
+         * Measured, and the reason this helper exists: using `byteSize` directly gave
+         * a stride of 4 for a two-`f64` record of 16 bytes — the same "alignment or
+         * reference size instead of the extent" mistake the fixed-array arm avoids
+         * only because it refuses records outright.
+         */
+        private unmanagedArrayElementSize;
+        /**
+         * Whether `type` is a record whose elements live **at** the address rather
+         * than being a value loaded from it: `@unmanaged`, `@managed` or `@inline`.
+         *
+         * This is the discriminator between "the address is the element" and "load the
+         * element from the address", and it is deliberately about the *element kind*
+         * rather than about type equality — see {@link compileUnmanagedArrayElementAccess}.
+         */
+        private isRecordValueType;
+        /**
+         * The header an `@unmanaged @dynamic [T * n]` buffer carries in front of its
+         * elements: `align_up(4, alignof(T))`.
+         *
+         * Four bytes hold the `u32` length; anything needing stronger alignment than
+         * that gets padding after it. So `u32` elements sit at `ptr + 4`, and a
+         * two-`f64` record sits at `ptr + 8`.
+         *
+         * Reported in Landing 4a: **no header-size helper existed**, because nothing
+         * in 4a needed one — `.length` reads offset 0, and 4a's own V5 recorded that
+         * the constant could not be observed from outside. This is its first
+         * definition; `.length` and the element address both go through it so they
+         * cannot drift.
+         *
+         * A record's alignment is `Class#alignLog2` rather than `Type#alignLog2` for
+         * the same reason its size is `nextMemoryOffset`: a record's `Type` is
+         * reference-like and would report the 4-byte pointer's alignment for every
+         * record, including the `f64`-only ones that are aligned 8.
+         */
+        /**
+         * Whether `type` is the **managed** dynamic-array descriptor — the std
+         * `DynamicArray<T>` class that `@managed @dynamic [T * n]` resolves to
+         * (Landing 4d.1).
+         *
+         * Answered by class identity rather than by a memory-model field, because the
+         * managed form is a class reference now: its `Type` is the class instance's
+         * type, and the "model" is implicit in `isManaged`. That is the whole point of
+         * the redesign — `TypeKind.DynamicArray` carries `TypeFlags.None` and is not
+         * traced, so a descriptor stored as one would not be rooted.
+         */
+        /**
+         * The element type of either dynamic-array form.
+         *
+         * `@unmanaged @dynamic [T * n]` carries the element on its type;
+         * `@managed @dynamic [T * n]` is a `DynamicArray<T>` class reference, so the
+         * element is the class's type argument. One accessor for both, because every
+         * consumer below — access, compound, increment — would otherwise branch.
+         */
+        private dynamicArrayElementOf;
+        private isManagedDynamicArrayType;
+        private dynamicArrayHeaderSize;
+        /**
+         * Compiles the byte address of `y[i]` for a dynamic array:
+         * `ptr + headerSize + i*sizeof(T)`.
+         *
+         * Shared by the read and the write arm, so the two cannot disagree about which
+         * bytes they address — the same split the fixed and unmanaged arms use.
+         *
+         * Two constants, each of which was a bug somewhere else in this family:
+         *
+         * - **`headerSize` is present.** It is what separates a dynamic array from a
+         *   `[T *]`: the data starts after the length word and its padding.
+         * - **The stride is a multiply by the element's extent**, not a shift by its
+         *   alignment. For a two-`f64` record those differ (16 vs 8), which is Landing
+         *   2's lesson and the reason `unmanagedArrayElementSize` exists.
+         */
+        private compileDynamicArrayElementAddress;
+        /**
+         * The bounds check an `@unmanaged @dynamic [T * n]` access performs before it
+         * touches memory: `if ((u32)index >= (u32)length) trap`.
+         *
+         * **Unsigned** on purpose. A negative index is a huge `u32`, so it fails the
+         * same comparison as any other out-of-range value — one check covers both ends
+         * without a second comparison, and `y[-1]` cannot walk backwards out of the
+         * buffer.
+         *
+         * The length comes from the header directly rather than from the `n` binding.
+         * `n` is a snapshot taken at entry (D5 of 4a); the header is what the buffer
+         * currently says, and a bounds check is about the memory that exists now.
+         *
+         * The message is a literal: `makeAbort` takes a string expression, and nothing
+         * in this compiler formats an index and a length into one (measured — 4a's
+         * `changetype` trap is the same shape). Naming the two causes would mean
+         * building a string at every check.
+         */
+        private compileDynamicArrayBoundsCheck;
+        /**
+         * Compiles the byte address of `y[i]` for an unmanaged array: `base + i*sizeof(T)`.
+         *
+         * Shared by the read and the write arm, so the two cannot disagree about which
+         * bytes they address — the same reason `compileFixedArrayElementAccess` and
+         * `compileFixedArrayElementAddress` are split.
+         *
+         * The stride is a **multiply**, not the fixed-array arm's `1 << alignof(T)`.
+         * That shift is right only for the elements the fixed arm admits (records are
+         * refused there, so every element is a scalar, where size and alignment
+         * coincide). A record element is the ordinary case here, and for a record the
+         * two disagree: two `f64`s give `sizeof` 16 and `alignof` 8.
+         */
+        private compileUnmanagedArrayElementAddress;
+        /**
+         * Compiles `y[i]` for an unmanaged array, `[T *]` — both directions.
+         *
+         * Two things separate this from {@link compileFixedArrayElementAccess}:
+         *
+         * - **The stride is a multiply** (see the address helper).
+         *
+         * - **A record element compiles to an address, not a load.** A record's
+         *   `toRef` is the 4-byte reference, so loading there would read the record's
+         *   first four bytes and call them a pointer. So the address is yielded typed
+         *   as the element, and `.field` on it resolves through the record's own
+         *   accessor — a load or a store at `addr + offsetof`. **That is also how a
+         *   field write works**: `y[i].x = v` reaches the property setter, whose
+         *   `this` is this address. No separate arm.
+         *
+         * Reads are unchecked. `*` says the length is unknown, so there is nothing to
+         * check against; `@dynamic` is where a checked form lives.
+         *
+         * A whole-record **write** is refused, keyed on the element being a record.
+         * The key is the element kind, not "both sides have the same type": a scalar
+         * element assignment (`a[i] = 5` over `[u32 *]`) is an ordinary store and must
+         * keep compiling. Refusing by type equality would have caught that case too,
+         * which is the trap this comment exists to keep shut.
+         */
+        private compileUnmanagedArrayElementAccess;
+        /**
+         * Compiles `y[i]` for an `@unmanaged @dynamic [T * n]` — both directions.
+         *
+         * Differs from {@link compileUnmanagedArrayElementAccess} in exactly one place,
+         * and it is the whole point of the kind: **the bounds check**. A `[T *]` has no
+         * length to check against, so its access is unchecked by contract; a dynamic
+         * array carries one in its header, and an index outside it is a diagnostic
+         * rather than whatever memory happens to follow.
+         *
+         * Everything else is the unmanaged arm's shape, deliberately:
+         *
+         * - a **record element** compiles to the address, typed as the element, so
+         *   `.field` reads and writes go through the record's own accessor — which is
+         *   also how `y[i].field = v` works, with no arm of its own;
+         * - a **scalar element** is loaded or stored at its own width;
+         * - a whole-record **write** is refused, keyed on the element being a record
+         *   rather than on type equality, so `a[i] = 5` over `[u32 * n]` still
+         *   compiles.
+         *
+         * Compound assignment and increment call this **twice** — once by way of the
+         * read the operator performs, once for the store — so the check is emitted
+         * twice. That is the smaller of the two correct shapes: sharing one check
+         * would mean threading the checked address through the operator's own codegen,
+         * which does not know this arm exists.
+         */
+        private compileDynamicArrayElementAccess;
         /**
          * Compiles `array[index]` for a `T[N]` inline array: read and write.
          *
@@ -6071,6 +6623,42 @@ declare module "types:tensionscript/src/compiler" {
         addDebugLocation(expr: ExpressionRef, range: Range): void;
         /** Checks whether a particular function signature is supported. */
         checkSignatureSupported(signature: Signature, reportNode: FunctionTypeNode): boolean;
+        /**
+         * The `[T * N]` half of signature support, kept separate so that a refusal
+         * can **stop** the function rather than merely be reported.
+         *
+         * `checkSignatureSupported` reports and compilation carries on — the right
+         * shape for a feature gate, whose codegen path can still produce a module.
+         * Not for this one: a value-form `[T * N]` parameter or return has no slot, so
+         * continuing reaches `Signature#paramRefs` / `#resultRefs`, which call
+         * `toRef`, which asserts for the value form by design. Measured before this
+         * split: `export function f(a: [u32 * 4]): u32` and
+         * `export function f(p: usize): [u32 * 4]` both crashed the compiler inside
+         * `toRef` instead of reporting.
+         */
+        private checkFixedArrayStorageInSignature;
+        /**
+         * Refuses a `[T * N]` that has no storage in the position it was written in.
+         *
+         * Landing 5a.5 made the memory model part of the Type, which splits the kind
+         * into three: the **view** (`@unmanaged [T * N]`, one address — works
+         * everywhere `@unmanaged T` works), the **heap** form (`@managed [T * N]`,
+         * Landing 5c) and the **value** form (`[T * N]`, `u32[N]`, `@inline [T * N]`
+         * — N inline elements, no address of its own).
+         *
+         * The value form exists and is laid out correctly: it is a record field's
+         * type, `sizeof` counts N × sizeof(T), and Landing 1's fixtures assert all of
+         * that. What it does not have is a **slot**. `toRef` asserts for it by design,
+         * so every position that needs a WASM local, parameter or result must be
+         * refused *before* that assert is reached — otherwise the compiler crashes
+         * where the answer is a diagnostic. Landing 5b gives the form inline storage
+         * (stack slot, copy at the ABI, sret) and these refusals come out.
+         *
+         * This mirrors `Program.checkInlineStructValue`, which refuses the same class
+         * of position for the same reason (a value with no address where one is
+         * needed). `position` names the site so the message says which case was hit.
+         */
+        private checkFixedArrayStoragePosition;
         /** Is `type` an `@inline struct`: a value carried as its fields, never as a
          *  pointer? */
         /**
@@ -6125,6 +6713,23 @@ declare module "types:tensionscript/src/compiler" {
          * there is no address to pass. Anything else refuses by name rather than
          * compiling a pointer.
          */
+        /**
+         * Expands a value-form `[T * N]` argument into one operand per element leaf.
+         *
+         * Two shapes reach here, and they differ in where the leaves come from:
+         *
+         * - **A value-form local** — push its SROA leaves. `pushSroaLeafOperands`
+         *   walks the map depth first through placeholders, which is exactly the
+         *   element-major order `paramRefs` declares.
+         * - **An array literal** — compile each element into its own operand. A record
+         *   element is several leaves and no literal names them (`{x, y}` goes through
+         *   the class path and *allocates*), so it is refused by name, matching
+         *   `fillSroaArrayFromLiteral`.
+         *
+         * Anything else — a call returning an array, a conditional — would need the
+         * value materialised somewhere, which is the return path, not this one.
+         */
+        private expandSroaArrayArgument;
         private expandSroaArgument;
         /**
          * The SROA local an expression names, or `null`.
@@ -6411,6 +7016,165 @@ declare module "types:tensionscript/src/compiler" {
          * has already reported why), and the caller has been told.
          */
         emitSroaStores(type: Type, fieldLocals: Map<string, Local>, dest: ExpressionRef, baseOffset: number, stmts: ExpressionRef[]): void;
+        /**
+         * Whether `type` is a fixed array in its **value** form — N inline elements,
+         * no address of its own — as opposed to the `@unmanaged` view (a pointer,
+         * Landing 5a.5) or the `@managed` heap form (Landing 5c).
+         */
+        isValueFormFixedArray(type: Type): boolean;
+        /**
+         * The largest `N` whose value-form array can be indexed with a **runtime**
+         * index.
+         *
+         * A runtime index on SROA leaves has no address to scale, so the element is
+         * selected with a `br_table` over one block per element. Past a handful of
+         * blocks that dispatch costs more than the thing it replaces: the caller who
+         * wants an arbitrary index over many elements wants a pointer, and
+         * `@unmanaged [T * N]` gives them one with no block at all. Eight is the
+         * boundary between the two. Landing 5d's spill strategy is what would lift it.
+         */
+        private static readonly VALUE_ARRAY_MAX_RUNTIME_INDEX;
+        /** Per-emission counter for the runtime-index block labels, so two accesses in
+         *  one function cannot collide (Binaryen requires unique block names). */
+        private sroaSelectId;
+        /**
+         * Fills `into` with one entry per **element** of a value-form `[T * N]`.
+         *
+         * The same shape `fillSroaFieldLocals` gives a record, with the index where
+         * the field name would be: the map is string-keyed and `"0"`, `"1"` are
+         * ordinary keys, so no new container is needed — only a new way to enumerate
+         * the entries.
+         *
+         * - A **scalar** element gets one WASM local, named `<path>$<index>`.
+         * - A **record** element is several leaves, so it gets the placeholder local
+         *   (`index -1`) carrying a nested map — exactly what a nested `@inline`
+         *   field gets, and for the same reason: `arr[i]` on a record names a whole
+         *   sub-value that no single local can hold, while `arr[i].x` descends one
+         *   hop to a leaf.
+         *
+         * Returns `false` when an element was refused, having reported why.
+         */
+        private fillSroaArrayLocals;
+        /**
+         * Compiles a value-form `[T * N]` local as SROA: one WASM local per element
+         * leaf, no local for the array itself, no store for the zero case.
+         *
+         * Returns `true` when the declaration was handled here (the caller must not
+         * fall through to the ordinary local path).
+         */
+        private compileSroaValueArrayLocal;
+        /**
+         * Stores an array literal's elements into a value-form array's leaves.
+         *
+         * A scalar element is compiled straight into its leaf. A **record** element is
+         * several leaves and a literal cannot name them one at a time, so it is
+         * refused by name here rather than compiled: the object-literal spelling
+         * (`{ x: 1.5, y: 2.5 }`) goes through the class path and *allocates* — measured,
+         * `const p: P = { x: 1.5 }` emitted `P#constructor` plus setters and needed
+         * `env.abort`, i.e. a heap record behind a pointer, which is not a value.
+         * Initialising the elements field by field (`arr[0].x = 10.5`) is the working
+         * route, and it is what the diagnostic says.
+         */
+        private fillSroaArrayFromLiteral;
+        /**
+         * The local behind `name`, when that local is a value-form `[T * N]` — i.e. a
+         * value stored as one WASM local per element leaf, with no slot of its own.
+         *
+         * Returns `null` for everything else, including the view form (which *is* an
+         * address and goes through the ordinary path).
+         */
+        private resolveSroaValueArray;
+        /**
+         * The compile-time value of an index expression, or `-1` when it is not a
+         * non-negative integer literal.
+         *
+         * `-1` is the "not constant" answer rather than an error: a runtime index is a
+         * legitimate access, it just takes the `br_table` path.
+         */
+        private constantIndexValue;
+        /**
+         * Indexes a value-form `[T * N]` local, whose elements are separate WASM
+         * locals.
+         *
+         * A **constant** index needs no dispatch at all: it names one leaf, and the
+         * access is `local.get` / `local.set` on it. A **runtime** index has no address
+         * to scale, so it is selected with a `br_table` over one block per element —
+         * bounded by {@link VALUE_ARRAY_MAX_RUNTIME_INDEX}, past which the caller wants
+         * a pointer view instead.
+         */
+        private compileSroaValueArrayElementAccess;
+        /**
+         * Selects one element leaf of a value-form array by a runtime index.
+         *
+         * The shape is one `br_table` with a block per element, each block yielding
+         * that element's leaf — the only way to choose between WASM locals at runtime,
+         * since they are not addressable. An index outside `[0, N)` is the caller's
+         * error, exactly as it is for `[T *]`: the extent is compile-time and there is
+         * no length on the value stack to check against.
+         */
+        private compileSroaValueArrayRuntimeIndex;
+        /**
+         * Reads `arr[i].field` where `arr` is a value-form array **of records** and `i`
+         * is a runtime index. Returns `0` when the shape does not apply.
+         *
+         * A record element is several leaves per candidate, so a single-value
+         * `br_table` cannot select one — but a *field* is one leaf per candidate, so
+         * the selection is per leaf: one block per element, each yielding that
+         * element's `<field>` leaf. Same block nesting as the scalar runtime index
+         * (`compileSroaValueArrayRuntimeIndex`), one hop lower.
+         *
+         * This is the shape the collision solver writes by hand today —
+         * `arr[i].x` with a runtime `i` over a run of records — which is why it is
+         * worth the dispatch rather than only supporting a constant index.
+         */
+        private compileSroaArrayLeafByRuntimeIndex;
+        /**
+         * Writes `arr[i].field = value` where `arr` is a value-form array of records
+         * and `i` is a runtime index. Returns `0` when the shape does not apply.
+         *
+         * The mirror of {@link compileSroaArrayLeafByRuntimeIndex}: one block per
+         * element, each storing into that element's `<field>` leaf. The value is
+         * materialised into a temp first — one WASM node cannot be the parent of N
+         * stores — which is the same reason the scalar runtime-index write does it.
+         */
+        private compileSroaArrayLeafStoreByRuntimeIndex;
+        /**
+         * Emits the `br_table` that selects one of `leafIndices` by a runtime index.
+         *
+         * The only way to choose between WASM locals at runtime, since locals are not
+         * addressable: one block per candidate, the body sitting **after** its block's
+         * `end` (where a branch target lands), element 0 as the fall-through.
+         *
+         * One helper rather than four. After Landing 5b.1 four call sites emitted this
+         * same nesting — scalar read, scalar write, record-field read, record-field
+         * write — differing only in which leaf each block touched. Params and returns
+         * would have added more, and a structural bug in one of them would have been
+         * invisible in the other three.
+         *
+         * **A method, not a closure.** The self-hosted compiler refuses an arrow
+         * function that captures a local without a declared type — `AS100: a captured
+         * local without a declared type (closures lowering)` — so the four sites
+         * cannot share a callback.
+         *
+         * `storeValueLocal` is `-1` for a read; for a store it names the temp holding
+         * the value. A store's body cannot reuse the caller's expression tree: a WASM
+         * node has one parent, so N stores cannot share one subtree. `resultType` is
+         * `TypeRef.None` for a store, in which case the dispatch yields nothing.
+         */
+        private compileLeafIndexSelect;
+        /**
+         * Returns a value-form `[T * N]` value as WASM multivalue results.
+         *
+         * One result per element leaf, element-major — the order `resultRefs` declares
+         * and the caller's unpack indexes into. The leaves are read out of the value's
+         * SROA locals; a fresh array literal goes through the same path, because the
+         * literal binds to leaves before the return is compiled.
+         *
+         * Requires `Feature.MultiValue`, which `Resolver` turns on when it resolves
+         * this return type (`enableMultiValueOnce`), so a module that returns one of
+         * these always has the feature and a module that does not never does.
+         */
+        private compileMultivalueReturnStatement;
         private compileSroaLocal;
         /**
          * The instance fields of an `@inline struct`, in declaration order, or `null`
@@ -8855,7 +9619,26 @@ declare module "types:tensionscript/src/ast" {
         ExportMember = 67,
         SwitchCase = 68,
         IndexSignature = 69,
-        Comment = 70
+        Comment = 70,
+        /**
+         * `[T *]` — a pointer to T with unknown length.
+         *
+         * Appended at the end rather than beside {@link FixedArrayType}. `NodeKind`
+         * is a `const enum` with implicit numbering, so an insert would renumber every
+         * node kind after it; the compiler is self-hosted, so a partial rebuild could
+         * then disagree with `dist/` about what `NodeKind.Comment` means -- silently.
+         * The position carries no meaning.
+         */
+        UnmanagedArrayType = 71,
+        /**
+         * `@unmanaged @dynamic [T * n]` — a header-prefixed array whose length is a
+         * runtime value read from the buffer.
+         *
+         * Appended for the same reason {@link UnmanagedArrayType} was: this is an
+         * implicit-numbering `const enum`, so an insert would renumber every node kind
+         * after it.
+         */
+        DynamicArrayType = 72
     }
     /** Base class of all nodes. */
     export abstract class Node {
@@ -8873,6 +9656,8 @@ declare module "types:tensionscript/src/ast" {
         static createFunctionType(parameters: ParameterNode[], returnType: TypeNode, explicitThisType: NamedTypeNode | null, isNullable: boolean, range: Range): FunctionTypeNode;
         static createTupleType(elements: TypeNode[], elementNames: (IdentifierExpression | null)[] | null, isNullable: boolean, range: Range): TupleTypeNode;
         static createFixedArrayType(elementType: TypeNode, length: number, range: Range): FixedArrayTypeNode;
+        static createUnmanagedArrayType(elementType: TypeNode, range: Range): UnmanagedArrayTypeNode;
+        static createDynamicArrayType(elementType: TypeNode, lengthName: IdentifierExpression, memoryModel: MemoryModel, range: Range): DynamicArrayTypeNode;
         static createOmittedType(range: Range): NamedTypeNode;
         static createTypeParameter(name: IdentifierExpression, extendsType: NamedTypeNode | null, defaultType: NamedTypeNode | null, range: Range): TypeParameterNode;
         static createParameter(parameterKind: ParameterKind, name: IdentifierExpression, type: TypeNode, initializer: Expression | null, range: Range): ParameterNode;
@@ -9112,6 +9897,56 @@ declare module "types:tensionscript/src/ast" {
         /** Source range. */
         range: Range);
     }
+    /**
+     * Represents an unmanaged array type, `[T *]` — a pointer to `T` with no length.
+     *
+     * The difference from {@link FixedArrayTypeNode} is the missing `length`, and it
+     * is the whole difference: a fixed array *contains* its elements, so it has an
+     * extent the layout can size; this one *addresses* them, so its own size is the
+     * pointer's. That is why `[T *]` binds as one `i32` slot where `T[N]` has no
+     * reference representation at all (`Type#toRef` asserts on a fixed array).
+     *
+     * Not a reference: the collector owns nothing here, the address is the caller's.
+     * Not a value either: there is nothing to inline. `changetype` and a parameter
+     * are the two ways one comes into being.
+     */
+    export class UnmanagedArrayTypeNode extends TypeNode {
+        /** Element type. */
+        elementType: TypeNode;
+        constructor(
+        /** Element type. */
+        elementType: TypeNode, 
+        /** Source range. */
+        range: Range);
+    }
+    /**
+     * Represents a dynamic array type, `@unmanaged @dynamic [T * n]`.
+     *
+     * The `n` is **spelling, not an expression**: the parser cannot evaluate it (it
+     * has no symbol table), so it is carried as a name and the length is read at
+     * runtime from the buffer header. That is why the form is admissible at parse
+     * time without knowing whether `n` is a constant — resolution decides that, and
+     * `resolveDynamicArrayType` refuses a name that turns out to be compile-time.
+     *
+     * One i32 slot at the ABI, holding a pointer to `[u32 length][pad][T data[n]]`.
+     */
+    export class DynamicArrayTypeNode extends TypeNode {
+        /** Element type. */
+        elementType: TypeNode;
+        /** The length's name. Bound as a read-only local where a function scope exists. */
+        lengthName: IdentifierExpression;
+        /** Storage model of the buffer. `Unmanaged` for now; `Managed` is Landing 4d. */
+        dynamicMemoryModel: MemoryModel;
+        constructor(
+        /** Element type. */
+        elementType: TypeNode, 
+        /** The length's name. Bound as a read-only local where a function scope exists. */
+        lengthName: IdentifierExpression, 
+        /** Storage model of the buffer. `Unmanaged` for now; `Managed` is Landing 4d. */
+        dynamicMemoryModel: MemoryModel, 
+        /** Source range. */
+        range: Range);
+    }
     /** Represents a type parameter. */
     export class TypeParameterNode extends Node {
         /** Identifier reference. */