- '"k" in record' with a literal key naming no declared member of an
index-signature record (a match's named groups) takes the keyed
presence probe a runtime key takes.
- Spreading a fresh array literal (directly, through a conditional, or
through a const used only there) into push/unshift or an insertion
converts its elements into the destination's element layout; nothing
else can reach them, so the copy is unobservable.
- A const annotated with a type the checker reads as 'any' and
initialized by an empty object literal holds the checked-dynamic
object, so keyed writes fill it (the empty struct could hold nothing).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
http.request, https.request and get now accept options the compiler
cannot see as an object literal: a RequestOptions variable, a literal
that spreads one, or a literal that sets socketPath. The runtime reads
the record in the ClientRequest constructor's order with Node's errors;
documented options it does not implement throw the runtime fence when
they carry a value. https adds rejectUnauthorized, ca and servername.
socketPath dials a Unix domain socket in the net unit; the agent keys
its sockets by the path as Node's getName does, and the Host header
defaults to localhost. server.listen(path[, cb]) binds a Unix socket and
removes the socket file when the server closes; a numeric string is
still a port. Errors name the path ("connect ENOENT /path", "listen
EADDRINUSE: address already in use /path"). Windows reports ENOTSUP.
A TypeScript object literal with no contextual type that spreads a
checked-dynamic value maps to the checked dynamic, so
`const options = { ...location, path, timeout }` compiles.
A socket's 'lookup' event reaches its listeners with (err, address,
family, host) for each address a host name resolves to, or once with
the lookup error, before 'connect'. Only programs that listen for
'lookup' install the lookup records; elsewhere the hook sites are a NULL
check.
server.close((err) => ...) runs the callback with undefined at 'close',
or with ERR_SERVER_NOT_RUNNING when the server was not listening; a
server that never listened now emits 'close'. IncomingMessage 'data'
listeners may take string chunks after setEncoding, and res.end()
accepts a string-or-undefined chunk.
fetch's BodyInit and HeadersInit unions, as RequestInit-derived option
types spell them under @types/node, map to the checked dynamic, and a
URLSearchParams body is sent form-encoded, as by Node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- writeFile and outputFile with byte data and a mode open the file with
that mode, and writeJsonSync and outputJsonSync pass the mode.
- copySync and moveSync compare source and destination inodes and walk
the destination's parents, as copy and move do.
- The resolver parity sweep skips the project-import comparison for
shimmed packages.
- The JSON reader writes the byte order mark as an escape.
Replaces the single-parent "Merge main" squash (6ab9a5423) with a two-parent merge of the same tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fallback NodeJS stream interfaces declare Node's EventEmitter listener
signature for events beyond data/end, so checked JavaScript keeps its
contextual typing for process stream listeners. The child stdin fence
fixture becomes a differential test of the forms that now compile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings in #1433's review follow-up (now merged into #1413). In `key in
err`, own `stack` and Object.prototype keys answer true, keys built-in
errors keep outside their class fields stay fenced, and every other key
keeps this branch's answer: a declaring subclass or a runtime-set own
property.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings main in through the already-resolved stack merge (f4c6441ce: main
merged into #1413 and #1433). Main split lower-exprs.ts into
expressions/*: the review follow-up's Error 'in' keys (own 'stack',
Object.prototype keys, BUILTIN_ERROR_SLOT_KEYS gating the declared-member
fold) move to expressions/relational.ts, and the perfLoop feature keeps
main's rule table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An object literal that spreads an index-signature record but has
members outside the scalar join (an array of labels), an unknown-valued
spread (Record<string, unknown>), or a member a later spread may
overwrite with another type now maps to the checked-dynamic value: it is
built like a JavaScript object literal, so spreads copy their own keys
in order and later keyed writes land on the same object.
'c && { k: v }' spreads contribute k exactly when c is truthy even where
the checker's union of the two does not map (an AbortSignal member), and
a conditional spread onto an 'unknown' field leaves the checked-dynamic
undefined in its empty arm.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An object literal with get/set accessors converted to `any` or `unknown`
listed its reserved closure slots (`%get:x`) as data keys, so a dynamic
read of the accessor answered undefined without calling the getter, and
Object.keys and JSON.stringify listed the slot instead of the property.
The checked-dynamic copy now defines each accessor as one enumerable,
configurable property whose getter and setter are the slot closures, in
declaration order: the record shape records its accessor key order
(`accessorOrder`). Live views of such records build that copy, and
checking a copy back into the record reads the closures from the
accessor's getter and setter. Reads, writes, Object.keys,
Object.entries, JSON.stringify and property descriptors answer as in
Node.
- A builtin alias whose replacement starts with a global the file
declares (`process`, `Array`) keeps the package's own module: the
replacement would read the local binding.
- A polyfill package the project marks unloaded has no builtin alias, so
its require throws MODULE_NOT_FOUND.
- The undici shim rejects a Host header value with characters outside
the header value set (CR, LF and other controls) with `invalid <key>
header`, as undici 5.19.1 and later and 7.x do, before the client
writes it into the request head.
- Format lowerer.ts and type-mapper.ts.
child.stdout.pipe(), stream events and writes beyond write(string) on a
NodeJS stream interface slot, and pipes into a child's stdin now lower
the program with the general representation instead of fencing. The
fallback ChildStdin is a NodeJS.WritableStream, and the coverage
remainder relowers its unreached code the same way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A call that resolves to an overload signature of a generic function or
method with an implementation (`load<T>(k, map: Mapper<T>): Promise<T>;
load(k): Promise<Reply>; load<T>(k, map?) {...}`) monomorphizes the
implementation under the bindings the overload's resolved signature
proves; a type parameter the overload never mentions is unknown, and
parameters the overload omits must be optional in the implementation.
It was refused.
- `view.m(...)` where `view` is a `Pick`/`Omit` view of a program class
and `m` is a generic (or generically overloaded) method extracts the
instance from the view's live receiver and calls the method statically,
instead of a runtime refusal reading the method through the untyped
view.
- Binding inference pairs the arms of `T | Promise<T>` with an
instantiated `R | Promise<R>`, and `unknown | Promise<unknown>` maps to
the checked-dynamic value the checker reduces it to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A bundle that embeds fs-extra (build-utils does) compiled the package's
own JavaScript, whose computed export table and graceful-fs internals the
static model cannot follow. A __commonJS chunk whose key names a shimmed
package's main file at a supported version now requires the shim
instead, through a forwarder declaration beside the bundle: the checker
follows it to the shim (a package's JavaScript cannot load TypeScript
sources directly), and module resolution answers the shim for its path.
The package's other chunks are no longer reached. Calls through such a
require of a TypeScript module lower when the export never reads `this`
(require() answers the module's namespace).
package-shim-guard.test.ts compiles every registered shim module under
both type worlds and fails on any lowering diagnostic or fence inside the
shims, reached or not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Writes and deletes of `code` through an error's checked-dynamic node (a
`catch (e: any)` binding, a reflective write) changed only the node, so
typed `err.code` reads kept the old value. The slot sync that already
covered name, message, stack and cause now covers code: a string takes
the slot, any other value or a delete clears it. A write, delete or
Object.assign through an Error subclass's typed view now syncs the
slots the subclass inherits from Error after the class commit, which
writes only declared fields.
`'code' in err` read the code slot, so an own `code` set to undefined
answered false. It now asks the runtime: the slot holds a string, or the
error has an own `code` property on its node.
A callback passed to a generic call without a return annotation can
return values the checker unifies into a narrower result type ('return
items' beside 'return items.map((i) => ({ ...i, extra }))' infers
Item[]). Converting the extended objects into that type copied them
and dropped the added members, which Node keeps and a later wider view
reads back. Such a return is now refused by name, pointing at the
annotation that keeps the members.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#1490 also took records with accessor slots out of the dyn-convertible
domain, which refused passing such a literal where `unknown` is
expected. Native APIs read these values through their accessor slots:
fileURLToPath, fileURLToPathBuffer and pathToFileURL call the `windows`
getter of an options object, so tests/corpus/node24-file-url-options.ts
stopped compiling.
Records with accessor slots convert to checked-dynamic values again.
JSON.stringify of their typed values stays refused, since the typed
serializer cannot invoke the getter.
A value thrown from `unknown` storage (`throw values[i]`) that holds a
number, string or boolean now throws as that primitive, like a statically
typed `throw 5`. Before, it threw as a checked-dynamic reference, so
`typeof e === "number"` (and "string"/"boolean") on the catch
binding answered false and the narrowed reads were unreachable. A
primitive has no identity to keep, and reading the binding as `unknown`
converts it back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- `new Promise(run)` where `run` is a JavaScript function value whose
parameters are untyped (the retry-helper shape `function run(resolve,
reject) {...}; return new Promise(run)`) gets an adapter executor: it
receives the native resolve/reject pair and calls the original with
both boxed as checked-dynamic function values. This was a deferred
runtime refusal inside such packages.
- A catch binding annotated `any` reads the caught value through its
checked-dynamic face, as an unannotated `unknown` one does: member
reads, expando writes, `delete` and `in` act on the thrown object, and
a rethrow keeps its identity. It was refused (SC1063).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bundled npm code (glob, yazl, from2, multistream) subclasses Node's
classes with constructor functions: util.inherits(Ctor, EventEmitter) and
EventEmitter.call(this). util.inherits received an identity token and
threw ERR_INVALID_ARG_TYPE, EventEmitter.call(this) and
EventEmitter.prototype were refused, and `this instanceof Ctor` against
a function was refused.
A new runtime unit (scr_dyn_builtin_class.c, linked by the new
dynBuiltinClass feature) provides EventEmitter, the legacy Stream and
the stream classes as untyped constructor functions with Node's
prototype chain. EventEmitter's prototype ports lib/events.js over the
object's own _events, _eventsCount and _maxListeners properties; Stream
adds the legacy pipe. util.inherits, Base.call/apply(this, ...),
Base.prototype, instanceof on untyped values and JavaScript value reads
of these classes use them. Constructing over a stream class throws
SC2020 where it runs. instanceof against a compiled constructor function
compares its prototype with the value's prototype chain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Destructuring an `any` value in TypeScript (a function typed `any`, an
awaited `any`, `JSON.parse`, an `any` table read) now goes through the
checked-dynamic value, as JavaScript sources and #1407's JS-declared
results already did. Object sources get V8's RequireObjectCoercible
TypeError for the spellings the assignment form reproduces.
- A method call or member read on a checker-`any` receiver whose value is
a fresh typed call result (`out.split("\n").map(...)`, `.pop()`,
`.length`) boxes that temporary and dispatches on the runtime kind,
only after every other lowering declined.
- `const { a, b: c } = ns` and `= await import("./m")` over a program
module bind each export the way `ns.a` reads it.
- A defaulted parameter of a program-source function, arrow or function
expression that the checker types `any` (a default under an
`(...args: any[]) => any` wrapper slot, where the contextual `any`
wins) is a dyn ABI slot in the callable's type.
- An async lambda whose signature answered a bare dyn result (a library
slot `A | Promise<A>` with A = any) produces Promise<unknown>.
- `761-any-objects` compiles and moves back to the corpus; the
retired-engine 2083/2104 snapshots shrink to their remaining fences.
- JavaScript `Promise.resolve(value)` (in a JavaScript file) over a dyn value holding a promise
answers that promise instead of wrapping it, so a TypeScript async
callback's result is adopted by JavaScript retry helpers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings main into the stack (thrown-value fixes, the lower-exprs split,
the checker helper removal). This branch's lower-exprs.ts hunks move to
expressions/relational.ts (`in` on errors), expressions/property-access.ts
(stdlib members of a structurally narrowed catch binding) and
expressions/narrowing.ts (assertions on an `any` catch binding); the
`this` blame, the `any` catch-binding read and the setPrototypeOf
feature test stay in lower-exprs.ts. The Error member read keeps both
this branch's intersection members and #1433's subclass-owned `code`.
Corpus 6407 and 6408 renumber to 6412 and 6413 (main has its own 6407
and 6408), and 6414 adds the thrown-value round trip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- An object literal that spreads an index-signature record (the
metric-tags idiom '{ ...tags, bucket, status }') maps to the pure
index-signature record joining the spread slots and member types: the
checker drops the signature, but the object holds every spread key.
Declared members read and write as keys of it.
- A conditional spread into an index-signature record adds no key when
it does not apply.
- '{ ...unknownValue }' into an index-signature record copies the
value's own keys through the checked extraction; null, undefined,
numbers and booleans spread nothing.
- 'return Promise.reject(e)' in an async function is typed by the
function's own result.
- A union of record layouts flowing into one record slot converts each
arm; fields the checker types 'undefined' alone lift into
undefined-armed slots.
- '(x as { m: T }).m' on a union of records reads the arms that declare
m and answers undefined for the others.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main replaced the runtime-feature scan with a rule table, the executable
unit list with a unit table and the module emission with emit-module.ts:
perfLoop becomes a rule (perf.idleTime, perf.loop*, perf.eld*), a unit
(scr_perf_loop.c) and emit-module's loop-start mark (readsLoopMetrics is
now public). The feature lists take both perfLoop and main's webcrypto.
This branch's lower-exprs.ts hunks move to expressions/property-access.ts
(histogram readings), expressions/binary.ts (`??` with a function
default) and expressions/relational.ts (`in` over class members); the
caughtRead fallback stays in lower-exprs.ts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main split lower-exprs.ts into expressions/*; this branch's hunks move to
expressions/identifiers.ts (typed 'arguments') and
expressions/property-access.ts (static fn.name, forwarded tuple length,
'this'-parameter arity). Main removed the checker's declarationsOf,
valueDeclarationOf and signatureDeclaration helpers; the branch's uses
read symbol.declarations, symbol.valueDeclaration and
signature.declaration.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The promisified executor typed its call of the function as void, so a
function with a non-void return type failed to compile with SC9001. The
call now has the function's return type, and its value is discarded, as
in Node.
- monitorEventLoopDelay is lowered from the builtin call dispatch, by module and member, so aliased named imports, namespace members and destructured requires all reach it. Shorthand and possibly undefined resolutions take Node's default.
- The runtime validates the resolution as Node does (an integer of at least 1) and throws a catchable RangeError with ERR_OUT_OF_RANGE.
- `'stack' in err` and Object.prototype's keys are true for every Error. The declared-member fold applies only to keys some program class declares and that built-in errors don't carry in runtime slots; other keys stay fenced.
- Library mode's async_free gate refuses the event-loop metrics, which library links leave out. They join the perf_hooks fence family.
The position of an Error subclass's own `name` among its fields was found
from identifier keys only, so a quoted `"name"` field, other quoted
fields, and `this["name"] = ...` in a constructor were not seen, and
`name` was listed last. Field keys and constructor assignments now read
any statically spelled key: an identifier, a quoted string, a number in
its canonical spelling, or a computed string literal.
Structural conversion lifts a function into a union's function arm only
when cleanFuncAdaptable accepts the pair, and it refused every rest
signature. A typed-rest function assigned to `((m: string) => void) |
null`, an optional parameter of that type, or a `| undefined` binding
therefore failed with SC2003. cleanFuncAdaptable now accepts the pairs
the rest packing adapter serves, so these slots use the same adapter as
a plain fixed-parameter slot.
6445 covers the nullable, optional and undefined slots, and 6445 and
6446 get their corpus costs.
A comptime record value whose union has a discriminant takes the arm its
discriminant field names, so a value that fits two arms with overlapping
shapes gets that arm's tag and layout instead of the first arm it fits.
comptimeBakeable reports a record type reachable from its own fields as
not bakeable instead of recursing without end, so such a comptime result
reports SC1090, and the message names unions and that limit.
A read through a computed key now counts as a stack read when the program
contains the string "stack", so `e[key]` captures frames like `e.stack`
does. A key the program assembles from other strings or from data it
reads keeps the static answer.
structuredClone of an error held as `any` copies a stack that was already
formatted as a non-enumerable data property, as it did before the stack
became an accessor.
When a name or message getter throws while the stack is formatted, the
stack accessor propagates the exception instead of reading the missing
string.
The references of a cycle class were found by their spelling, so a class
imported under another name (`import { Sink as Alias }`) was never seen as
reached early, and neither was a let or const imported under another
name. An `extends` clause only counted when its expression was the bare
class name. A static method read as a value (`const f = Sink.m`) built a
closure that no check covered.
The early-binding scan and the class reference scan now also match each
file's local import names that resolve to the binding, and record them:
Node's ReferenceError names the binding the access spells, so the check
names the alias. The heritage check walks the whole `extends` expression.
A closure of a flagged class's static method checks the class like a
static call does.
The on-demand import scan tested each file's text for `import(` before
reading its calls, so `import /* note */ ("pkg")` was never followed:
the workspace package it loads and that package's npm dependencies were
left out of the module graph, and the dependency was refused with
SC2013. A file is now skipped only when it does not contain the keyword,
and its literal import() calls are read from the syntax. The
workspace-dynamic-import case loads its package with such a comment.
Node passes write and end callbacks an error argument (null on success),
but the native callbacks receive none, so an inline callback that names
the parameter read undefined. It now refuses where it is written. The
stream-shims npm case compiles now that stream subclasses are values;
its remaining scenarios are deferred refusals, so it is recorded as one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
