`"closeAllConnections" in server` (the feature test servers use before
calling it) was refused for an http.Server and the other native handles.
A member Node's declarations give the class is on its prototype, so the
test now answers true after evaluating the receiver. Undeclared names
keep the refusal, since internal fields can still be present.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A module namespace converted to an untyped object, and a computed
namespace read, use the module's resolved exports, which include the
members of `export *` declarations.
- `super(message, options)` through a runtime Error parent installs the
cause as Error does: an inherited `cause` counts, the value is read
through its getter, and the getter's exception propagates.
- `value instanceof Error` on an instance of a class whose heritage is
evaluated at run time tests that class's prototype chain for
Error.prototype. A program with such a class checks prototype chains
for `instanceof Error` on untyped values.
- The cache of names written on the global object is a Lowerer field
instead of a WeakMap keyed by the Lowerer.
- errors.test.ts: `"prototype" in Map` answers from the builtin
constructor's keys now, so it leaves the refused reads and joins a
check of `in` probes against Node's answers.
Hono's mergePath reads base?.at(-1) on an untyped parameter. The
checked-dynamic method dispatch answered at() on strings with a
not-supported error. It now returns the UTF-16 code unit at the index,
counting from the end for a negative index, and undefined outside the
string, as String.prototype.at does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Math.min(...src) and Math.max(...src) over an untyped source now take its
values the way a spread does: arrays, strings, bytes and collections pack,
a native iterator (a Map's keys()) drains, and other iterables (a generator,
an object with a Symbol.iterator method) step their iterator to the end.
Before, only the packing kinds were accepted and every other iterable threw
the spread TypeError.
Lowering collects a function-local class with the body declaring it, so
a local subclass whose function lowers after its base's constructor was
missing from new.target's dispatch, which then answered with the base for
its instances. The refusal no longer depends on that order: the program's
function-local classes are found once, and one that extends the
constructor's class, directly or through other classes its extends
clauses name, refuses new.target as a collected one does.
- An enumerable getter or setter on an array printed as undefined: the
property loop rendered the accessor's unused data slot. It now prints
[Getter], [Setter] or [Getter/Setter], as util.inspect does.
- Object.defineProperty on a live native array with a number key that is
not an array index (-3, 1.5) skipped the numeric-property fence and
lost the property on commit. A number key now takes the same fence as
its string spelling.
A local number[] candidate whose stores are exact integers but not all
proven int32s (a distance array updated with dist[v] = dist[u]! + 1), and
that is only ever allocated by new Array(n).fill(v), now holds SCR_ELEM_I32
slots when n is at least 4096. A shorter fill creates doubles, which fit a
typical L1 data cache. The first store of a value that is not an int32
widens the array to doubles in place (scr_arr_widen_i32).
An innermost loop that accesses such arrays tests their kinds once on
entry (backend/llvm/int32-kind-loops.ts). Its fast copy reads and writes
them as int32 arrays; a store that would widen one leaves for a copy that
re-executes it with kind tests and finishes the loop on doubles. When the
arrays already hold doubles, a copy accesses them as double arrays. Other
accesses test the kind each time.
Only these arrays take kind tests: every other array, and every program
without one, emits the same code as before.
An element index the checker types as a number can hold undefined at run
time (an element read from a holey array). JavaScript then names the
array's "undefined" property, but the index converted with ToNumber, so
such reads and writes used the "NaN" property: Node prints `10 0,7,0,7`
for a program that sets `values[NaN] = 10` and then writes through two
holes, the compiled program printed `7 0,7,0,7`.
The runtime's noncanonical property table, which holds the properties
named by non-index numbers, now spells one NaN payload
(scr_arr_undefined_key) "undefined". At array element reads, writes,
compound and update writes, destructuring targets and writes in value
position, an index that can be undefined is that key when it is
undefined. The property stays a typed entry of the array, so the Int32[]
contract checks cover it like any element store.
A typed array cannot hold the property: a write through an undefined
index throws the catchable SC1090 error where Node adds it.
Fixes#1640.
A response whose client disconnects while its body streams now cancels the
body's stream when the response closes, as the package does, so the
producer stops instead of being read until it ends. A response that fails
closes too and is cancelled the same way.
Response.json(data, { headers }) with init headers is written from its
Headers, as the package's Response.json passes them on as a Headers object
with the JSON content type added when they lack one. Before, the cached
path wrote only the init record and sent no Content-Type.
The hono-node-server case covers both: Response.json with and without an
init content type, and a client that destroys the response after the first
chunk of an endless stream.
@hono/node-server replaces the global Request and Response with
lightweight objects and reparents prototypes, tricks that only pay off
under V8 and that native compilation cannot follow. scriptc now compiles
the package from a built-in implementation (shims/hono-node-server/v2.ts)
over node:http and the native Request/Response/Headers: serve,
createAdaptorServer, getRequestListener and RequestError.
Responses are written the way the package writes them, byte for byte on
the wire: the general path (header record in Headers order, Set-Cookie
gathered, default content type, content length for bodies that finish
within the first reads, streamed bodies, error responses) and the
package's cached-response path for a Response that is still exactly its
constructor arguments. The runtime tracks that lightweight state on each
constructed Response (header form, raw plain-record headers, body length;
cleared by body and metadata reads, turned into Headers form by a headers
read) and exposes it to the shim through scriptcResponseLight.
The declaration entry of a shimmed package may now be a .d.mts/.d.cts
file. The npm case hono-node-server drives buffered, streamed, cookie,
header-form, HEAD, error-handler and URL cases against the real package
under Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The runtime format branch packed its arguments with a checked-dynamic
array literal, a dynamic operation: a console.log with a string first
argument put its function in the dynamic tier, and the property-bag
analysis read the format calls as possible dynamic stores. The held
arguments now go to the formatter as a native list of checked values
(insp.formatList and insp.formatPrimitives), which is a tier boundary, and
the format and inspect entries join the helpers that never store into a
class instance.
A first argument whose type may hold a string only through a union, or
whose checker type does not map, packed every argument as a checked value
and failed to compile when one did not convert (7380's
`console.log(top ? [...top] : "none", byName)`). It now takes the
held-argument form: the lowered value is tested for a substitution and
otherwise joins as before. In TypeScript an argument without a
checked-dynamic form is refused at compile time only when the joined
form cannot print it either; otherwise the branch that substitutes
throws SC2020, as in JavaScript.
An object or array literal that held an evolving `const xs = []` between
writes of different element types (`const box = { items: xs }` or
`const rows = [xs]` after `xs.push(1)`, before `xs.push("two")`) took the
element type the checker gives the array at that point, so it held a copy.
`box.items.length` and `box.items === xs` printed `1 false`, where Node
prints `2 true`. Such a literal now builds as a checked-dynamic literal that
keeps the array, and an unannotated binding of it takes the checked-dynamic
type. This covers shorthand properties (`{ xs }`), nested literals, spreads
of a literal holder, aliases of a holder and names destructured from one.
Element reads through an alias or holder (`rows[0]`, `alias[1]`) read the
checked-dynamic value instead of checking it against the checker's type,
which lists only the elements written before the alias or holder was taken.
A shorthand property now counts as a read of the array when its reads are
compared, so `{ xs }` before a write of another element type makes the
array checked-dynamic too.
Fixes#1641.
`Object.getPrototypeOf(a) === Object.getPrototypeOf(b)`, for two instances
held as unknown, compared fresh objects when their class has no prototype
data (no methods, or a subclass of Error), so it was false for instances of
one class. Each such class now has one stand-in object, created on first
use.
A subclass instance boxed at its base type answered with the base's
prototype, so instances of two sibling subclasses compared true. The answer
for a value boxed at a class now tests the class's subclasses, most
derived first, and answers with the prototype of the one the instance
belongs to.
A constructor's new.target dispatch skipped generic class families, so a
generic subclass instantiated only in a body lowered later answered with
the base's name, and `new.target === Base` held for its instances. A
family now has its own arm, tested by its instanceof interval, which holds
every instantiation: `new.target.name` reads the family's name and
comparisons with a program class are false. Under an instantiation, the
generic subclasses of its family are candidates too. `new.target` as a
value refuses generic subclasses, which have no common class value.
`new.target.name` reads a class's own static `name` field, which replaces
its name (a subclass has its own name); a static method `name` or a
non-string field is refused.
A plain object a program passes into an island is an object-template
instance, which inherits from its implicit constructor's prototype object;
island code that checks for plain objects (jose's isObject:
Object.getPrototypeOf(o) === Object.prototype) rejected it. The instance now
inherits Object.prototype directly. Corpus 6826 checks it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A call of a String.prototype-only method name (trim, toLowerCase,
startsWith, ...) on a checker-untyped receiver was lowered as a string
call that throws unless the receiver is a string. A checked-dynamic
object can carry its own member of that name: zod's schemas assign
`trim` in their constructors, so `z.string().trim().min(1)` typed the
`trim()` result as a string and refused `.min` with SC1090. Untyped
receivers now take the runtime-kind dispatch that object-typed receivers
missing the member already use: a string runs the string lowering, any
other value calls its own member as Node does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A published bundle's JSDoc can name a type that only its .d.ts declares:
hono's bearerAuth carries `@template E` and `@returns {MiddlewareHandler<E>}`
without importing MiddlewareHandler. The checker types that result as its
error type, and a call of such a generic JavaScript function was refused
with SC2001 ("values of type 'MiddlewareHandler<E>' cannot be compiled").
The unresolved annotation is documentation, not a contract, so the call's
result is now checked-dynamic, as an `any` result of a TypeScript generic
already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
flush() on a zlib stream writes a zero-length chunk that _transform
recognizes by identity and compresses with that flush kind. Since
writes of a typed array that is not a Buffer reach _write as a Buffer
over the same bytes (as Node's Stream._uint8ArrayToBuffer does), the
sentinel, created as a plain Uint8Array, reached _transform as a new
Buffer. _transform then used the default NO_FLUSH, so flush() emitted
nothing: corpus 5374-zlib-stream-flush-params decoded an empty prefix
where Node decodes "hello ".
The sentinels are Buffers, as Node's kFlushBuffers are (Buffer.alloc(0)),
so write() passes them through unchanged.
The npm fixture stream-shims, whose test expected a deferred SC1090, now
runs to a later deferred refusal, SC2020 (write completion callbacks
taking the error argument); its expectation names that code.
A call into Node from an async fiber runs in a context of its own on Node's
stack while the calling fiber stays suspended in it, but runtime code that
Node called back there still ran as that fiber: scr_current named it, and
a fiber resumed from there saved its resumer in scr_loop_ctx and, under
ASan, its fake stack in the calling fiber's slot. The calling fiber's next
park then returned to a context that no longer existed, or under ASan
resumed with a fake stack the nested context had destroyed
(6870-node-island-server-fibers in dev mode, sanitized: SEGV in
nh_keep_done). The nested entry now runs host callbacks as the loop's code
does (no current fiber, the main exception cell and ALS slot) and puts the
calling fiber's state and the loop context back when it returns.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Programs that compile against a package shim (fs-extra, chalk, undici,
hot-shots) produced IR and LLVM that depended on where the compiler was
installed: lifted helper and closure names hashed the shim file's path
relative to the entry, the shared-helper location pass ordered candidate
sites by absolute path, and IR artifacts spelled every shim location as
an absolute path. Two checkouts of the same sources therefore emitted
different artifacts, and the zero-cost gate always reported
fs-extra-package as differing.
Files scriptc ships are now named by their place inside scriptc
(scriptc:shims/...) in structural positions, in the shared-helper
ordering, and in serialized IR artifacts. In-memory locations keep the
real path, so diagnostics and source lookups are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A gap fence inside a function body may never run, so it no longer makes its
package a Node island under --node-islands=auto: only fences in top-level
module code and fences that need the JavaScript runtime do. The package's
island class still decides after a failed build. Typed packages like jose
stay native (DECISIONS.md, 2026-10-21), so the corpus pins of jose and
run-node are gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`s[i]` with an index the frontend cannot prove in bounds reads the
character or undefined: temps for the string and the index, a range and
integer test, and a string-or-undefined union. A lexer that tests
`src[pos] === " "` or `c < "a"` on `const c = src[pos]` compared that
union with a union-wrapped literal, or boxed it for a dynamic
comparison, on every character.
Tests of such a read against a literal of one UTF-16 code unit now
compare `i === Math.floor(i) ? s.charCodeAt(i) : NaN` instead.
Undefined, like NaN, equals no literal and fails every ordered
comparison, and charCodeAt reads NaN out of range. A read of plain
operands is evaluated in place; others keep the read's temps.
An immutable local initialized from such a read, and used only in
those tests, in tests for undefined and in a switch over one-unit
cases, holds the code unit. Tests for undefined become NaN tests.
Copies of the local, such as a switch's discriminant temp, follow it.
The code-unit reads are charCodeAt reads, so a loop version can cover
them.
