sorbet-runtime 0.5.6198 → 0.5.6539

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9ad14907c264d6ca3dae954f1bf9cdfdff0544411fad7a390fcb424465bf828
-  data.tar.gz: f02410f71f442e62a635881ec386a23911f1cb1a4d4c5eae77693d1a10a0695d
+  metadata.gz: 3594dc0c726d2a7189c7544226a6ced4240f4a6df2c18bdae635cc30bb223e7b
+  data.tar.gz: dae60008d7f685ecdf231edefdf0b01b595c597c6ae646e7ba7070eada079fa2
 SHA512:
-  metadata.gz: 1bb53ba112fb1793b4e138e1a65ed648e2e202af6e8ec79be17b444c11c02a63a7c385b0abb474e38dca78a03ad91f02149ff24b7c5f622f7d1943c4d4c846b1
-  data.tar.gz: bf301214903ea532fb931314c823f68a3017a2de5868f32d074a642664c4cf266864201d9ae4a62573a9713bb888d132cb0aadd23c77aaf628b8d443163bae36
+  metadata.gz: 519bf1b1c4f04792d88c817a9bb3a213b01e783a96597e1e328a8a5c9736e78ff7a0a93ef31d56787fd9468d09980e4670edffcd71f59ff299cc7a09a80a714b
+  data.tar.gz: 0150d316fb26d07fd0693d3b948dfaa6fe1979053dc12f9811c5c9c6d29b711affaa3e6be16a34a08fd6abf5a1db816b4872b7b655895353cdf65094f7e0ad5c

data/lib/sorbet-runtime.rb

@@ -19,7 +19,6 @@ require 'set'
 
 # These are pre-reqs for almost everything in here.
 require_relative 'types/configuration'
-require_relative 'types/profile'
 require_relative 'types/_types'
 require_relative 'types/private/decl_state'
 require_relative 'types/private/class_utils'

data/lib/types/_types.rb

@@ -147,6 +147,25 @@ module T
     Private::Casts.cast(value, type, cast_method: "T.let")
   end
 
+  # Tells the type checker to treat `self` in the current block as `type`.
+  # Useful for blocks that are captured and executed later with instance_exec.
+  # Use like:
+  #
+  #  seconds = lambda do
+  #    T.bind(self, NewBinding)
+  #    ...
+  #  end
+  #
+  # `T.bind` behaves like `T.cast` in that it is assumed to be true statically.
+  #
+  # If `checked` is true, raises an exception at runtime if the value
+  # doesn't match the type (this is the default).
+  def self.bind(value, type, checked: true)
+    return value unless checked
+
+    Private::Casts.cast(value, type, cast_method: "T.bind")
+  end
+
   # Tells the typechecker to ensure that `value` is of type `type` (if not, the typechecker will
   # fail). Use this for debugging typechecking errors, or to ensure that type information is
   # statically known and being checked appropriately. If `checked` is true, raises an exception at

data/lib/types/configuration.rb

@@ -2,6 +2,9 @@
 # frozen_string_literal: true
 
 module T::Configuration
+  # Cache this comparisonn to avoid two allocations all over the place.
+  AT_LEAST_RUBY_2_7 = Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('2.7')
+
   # Announces to Sorbet that we are currently in a test environment, so it
   # should treat any sigs which are marked `.checked(:tests)` as if they were
   # just a normal sig.
@@ -70,6 +73,37 @@ module T::Configuration
     @include_value_in_type_errors = true
   end
 
+  # Whether VM-defined prop serialization/deserialization routines can be enabled.
+  #
+  # @return [T::Boolean]
+  def self.can_enable_vm_prop_serde?
+    T::Props::Private::DeserializerGenerator.respond_to?(:generate2)
+  end
+
+  # Whether to use VM-defined prop serialization/deserialization routines.
+  #
+  # The default is to use runtime codegen inside sorbet-runtime itself.
+  #
+  # @return [T::Boolean]
+  def self.use_vm_prop_serde?
+    @use_vm_prop_serde || false
+  end
+
+  # Enable using VM-defined prop serialization/deserialization routines.
+  #
+  # This method is likely to break things outside of Stripe's systems.
+  def self.enable_vm_prop_serde
+    if !can_enable_vm_prop_serde?
+      hard_assert_handler('Ruby VM is not setup to use VM-defined prop serde')
+    end
+    @use_vm_prop_serde = true
+  end
+
+  # Disable using VM-defined prop serialization/deserialization routines.
+  def self.disable_vm_prop_serde
+    @use_vm_prop_serde = false
+  end
+
   # Configure the default checked level for a sig with no explicit `.checked`
   # builder. When unset, the default checked level is `:always`.
   #
@@ -395,7 +429,12 @@ module T::Configuration
   MODULE_NAME = Module.instance_method(:name)
   private_constant :MODULE_NAME
 
-  @default_module_name_mangler = ->(type) {MODULE_NAME.bind(type).call}
+  if T::Configuration::AT_LEAST_RUBY_2_7
+    @default_module_name_mangler = ->(type) {MODULE_NAME.bind_call(type)}
+  else
+    @default_module_name_mangler = ->(type) {MODULE_NAME.bind(type).call}
+  end
+
   @module_name_mangler = nil
 
   def self.module_name_mangler
@@ -412,6 +451,48 @@ module T::Configuration
     @module_name_mangler = handler
   end
 
+  # Set to a PII handler function. This will be called with the `sensitivity:`
+  # annotations on things that use `T::Props` and can modify them ahead-of-time.
+  #
+  # @param [Lambda, Proc, nil] value Proc that takes a hash mapping symbols to the
+  # prop values. Pass nil to avoid changing `sensitivity:` annotations.
+  def self.normalize_sensitivity_and_pii_handler=(handler)
+    @sensitivity_and_pii_handler = handler
+  end
+
+  def self.normalize_sensitivity_and_pii_handler
+    @sensitivity_and_pii_handler
+  end
+
+  @redaction_handler = nil
+  # Set to a redaction handling function. This will be called when the
+  # `_redacted` version of a prop reader is used. By default this is set to
+  # `nil` and will raise an exception when the redacted version of a prop is
+  # accessed.
+  #
+  # @param [Lambda, Proc, nil] value Proc that converts a value into its
+  # redacted version according to the spec passed as the second argument.
+  def self.redaction_handler=(handler)
+    @redaction_handler = handler
+  end
+
+  def self.redaction_handler
+    @redaction_handler
+  end
+
+  # Set to a function which can get the 'owner' of a class. This is
+  # used in reporting deserialization errors
+  #
+  # @param [Lambda, Proc, nil] value Proc that takes a class and
+  # produces its owner, or `nil` if it does not have one.
+  def self.class_owner_finder=(handler)
+    @class_owner_finder = handler
+  end
+
+  def self.class_owner_finder
+    @class_owner_finder
+  end
+
   # Temporarily disable ruby warnings while executing the given block. This is
   # useful when doing something that would normally cause a warning to be
   # emitted in Ruby verbose mode ($VERBOSE = true).

data/lib/types/generic.rb

@@ -2,7 +2,6 @@
 # typed: true
 
 # Use as a mixin with extend (`extend T::Generic`).
-# Docs at https://hackpad.corp.stripe.com/Type-Validation-in-pay-server-1JaoTHir5Mo.
 module T::Generic
   include T::Helpers
   include Kernel

data/lib/types/helpers.rb

@@ -33,7 +33,24 @@ module T::Helpers
   #  end
   #
   # Except that it is statically analyzed by sorbet.
-  def mixes_in_class_methods(mod)
-    Private::Mixins.declare_mixes_in_class_methods(self, mod)
+  def mixes_in_class_methods(mod, *mods)
+    Private::Mixins.declare_mixes_in_class_methods(self, [mod].concat(mods))
   end
+
+  # Specify an inclusion or inheritance requirement for `self`.
+  #
+  # Example:
+  #
+  #   module MyHelper
+  #     extend T::Helpers
+  #
+  #     requires_ancestor Kernel
+  #   end
+  #
+  #   class MyClass < BasicObject # error: `MyClass` must include `Kernel` (required by `MyHelper`)
+  #     include MyHelper
+  #   end
+  #
+  # TODO: implement the checks in sorbet-runtime.
+  def requires_ancestor(mod, *mods); end
 end

data/lib/types/non_forcing_constants.rb

@@ -2,18 +2,26 @@
 # typed: strict
 
 module T::NonForcingConstants
+  T::Sig::WithoutRuntime.sig {returns(T::Boolean)}
+  private_class_method def self.stripe_packages_enabled?
+    const_defined?('StripePackages') && const_get('StripePackages').enabled?
+  end
+
   # NOTE: This method is documented on the RBI in Sorbet's payload, so that it
   # shows up in the hover/completion documentation via LSP.
   T::Sig::WithoutRuntime.sig {params(val: BasicObject, klass: String, package: T.nilable(String)).returns(T::Boolean)}
   def self.non_forcing_is_a?(val, klass, package: nil)
-    # TODO(gdritter): once we have a runtime implementation of
-    # packages, we'll need to actually handle the `package` argument
-    # here.
     method_name = "T::NonForcingConstants.non_forcing_is_a?"
     if klass.empty?
       raise ArgumentError.new("The string given to `#{method_name}` must not be empty")
     end
 
+    # TODO(gdritter): this might not be want we want in a multipackage
+    # world; revisit this implementation we move on from the monopackage
+    if stripe_packages_enabled?
+      klass = "PkgRegistry::#{package}::#{klass}"
+    end
+
     current_klass = T.let(nil, T.nilable(Module))
     current_prefix = T.let(nil, T.nilable(String))
 

data/lib/types/private/final.rb

@@ -37,7 +37,6 @@ module T::Private::Final
     mod.extend(mod.is_a?(Class) ? NoInherit : NoIncludeExtend)
     mark_as_final_module(mod)
     mark_as_final_module(mod.singleton_class)
-    T::Private::Methods.add_module_with_final(mod)
     T::Private::Methods.install_hooks(mod)
   end
 

data/lib/types/private/methods/_methods.rb

@@ -6,19 +6,21 @@ module T::Private::Methods
   @signatures_by_method = {}
   @sig_wrappers = {}
   @sigs_that_raised = {}
-  # the info about whether a method is final is not stored in a DeclBuilder nor a Signature, but instead right here.
-  # this is because final checks are special:
-  # - they are done possibly before any sig block has run.
-  # - they are done even if the method being defined doesn't have a sig.
-  @final_methods = Set.new
-  # a non-singleton is a module for which at least one of the following is true:
-  # - is declared final
-  # - defines a method that is declared final
-  # - includes an non-singleton
-  # - extends an non-singleton
-  # a singleton is the singleton_class of a non-singleton.
-  # modules_with_final is the set of singletons and non-singletons.
-  @modules_with_final = Set.new
+  # stores method names that were declared final without regard for where.
+  # enables early rejection of names that we know can't induce final method violations.
+  @was_ever_final_names = Set.new
+  # maps from modules to the set of final methods declared in that module.
+  # we also overload entries slightly: if the value is nil, that means that the
+  # module has final methods somewhere along its ancestor chain, but does not itself
+  # have any final methods.
+  #
+  # we need the latter information to know whether we need to check along the ancestor
+  # chain for final method violations.  we need the former information because we
+  # care about exactly where a final method is defined (e.g. including the same module
+  # twice is permitted).  we could do this with two tables, but it seems slightly
+  # cleaner with a single table.
+  # Effectively T::Hash[Module, T.nilable(Set))]
+  @modules_with_final = Hash.new { |hash, key| hash[key] = nil }
   # this stores the old [included, extended] hooks for Module and inherited hook for Class that we override when
   # enabling final checks for when those hooks are called. the 'hooks' here don't have anything to do with the 'hooks'
   # in installed_hooks.
@@ -27,29 +29,51 @@ module T::Private::Methods
   ARG_NOT_PROVIDED = Object.new
   PROC_TYPE = Object.new
 
-  DeclarationBlock = Struct.new(:mod, :loc, :blk, :final)
+  DeclarationBlock = Struct.new(:mod, :loc, :blk, :final, :raw)
+
+  def self.declare_sig(mod, loc, arg, &blk)
+    T::Private::DeclState.current.active_declaration = _declare_sig_internal(mod, loc, arg, &blk)
+
+    nil
+  end
+
+  # See tests for how to use this.  But you shouldn't be using this.
+  def self._declare_sig(mod, arg=nil, &blk)
+    _declare_sig_internal(mod, caller_locations(1, 1).first, arg, raw: true, &blk)
+  end
 
-  def self.declare_sig(mod, arg, &blk)
+  private_class_method def self._declare_sig_internal(mod, loc, arg, raw: false, &blk)
     install_hooks(mod)
 
     if T::Private::DeclState.current.active_declaration
       T::Private::DeclState.current.reset!
-      raise "You called sig twice without declaring a method inbetween"
+      raise "You called sig twice without declaring a method in between"
     end
 
     if !arg.nil? && arg != :final
       raise "Invalid argument to `sig`: #{arg}"
     end
 
-    loc = caller_locations(2, 1).first
-
-    T::Private::DeclState.current.active_declaration = DeclarationBlock.new(mod, loc, blk, arg == :final)
+    DeclarationBlock.new(mod, loc, blk, arg == :final, raw)
+  end
 
-    nil
+  def self._with_declared_signature(mod, declblock, &blk)
+    # If declblock is provided, this code is equivalent to the check in
+    # _declare_sig_internal, above.
+    # If declblock is not provided and we have an active declaration, we are
+    # obviously doing something wrong.
+    if T::Private::DeclState.current.active_declaration
+      T::Private::DeclState.current.reset!
+      raise "You called sig twice without declaring a method in between"
+    end
+    if declblock
+      T::Private::DeclState.current.active_declaration = declblock
+    end
+    mod.module_exec(&blk)
   end
 
   def self.start_proc
-    DeclBuilder.new(PROC_TYPE)
+    DeclBuilder.new(PROC_TYPE, false)
   end
 
   def self.finalize_proc(decl)
@@ -75,40 +99,6 @@ module T::Private::Methods
     T::Types::Proc.new(decl.params, decl.returns)
   end
 
-  # See docs at T::Utils.register_forwarder.
-  def self.register_forwarder(from_method, to_method, mode: Modes.overridable, remove_first_param: false)
-    # Normalize the method (see comment in signature_for_key).
-    from_method = from_method.owner.instance_method(from_method.name)
-
-    from_key = method_to_key(from_method)
-    maybe_run_sig_block_for_key(from_key)
-    if @signatures_by_method.key?(from_key)
-      raise "#{from_method} already has a method signature"
-    end
-
-    from_params = from_method.parameters
-    if from_params.length != 2 || from_params[0][0] != :rest || from_params[1][0] != :block
-      raise "forwarder methods should take a single splat param and a block param. `#{from_method}` " \
-            "takes these params: #{from_params}. For help, ask #dev-productivity."
-    end
-
-    # If there's already a signature for to_method, we get `parameters` from there, to enable
-    # chained forwarding. NB: we don't use `signature_for_key` here, because the normalization it
-    # does is broken when `to_method` has been clobbered by another method.
-    to_key = method_to_key(to_method)
-    maybe_run_sig_block_for_key(to_key)
-    to_params = @signatures_by_method[to_key]&.parameters || to_method.parameters
-
-    if remove_first_param
-      to_params = to_params[1..-1]
-    end
-
-    # We don't bother trying to preserve any types from to_signature because this won't be
-    # statically analyzed, and the types will just get checked when the forwarding happens.
-    from_signature = Signature.new_untyped(method: from_method, mode: mode, parameters: to_params)
-    @signatures_by_method[from_key] = from_signature
-  end
-
   # Returns the signature for a method whose definition was preceded by `sig`.
   #
   # @param method [UnboundMethod]
@@ -130,46 +120,86 @@ module T::Private::Methods
   # when target includes a module with instance methods source_method_names, ensure there is zero intersection between
   # the final instance methods of target and source_method_names. so, for every m in source_method_names, check if there
   # is already a method defined on one of target_ancestors with the same name that is final.
-  def self._check_final_ancestors(target, target_ancestors, source_method_names)
-    if !module_with_final?(target)
-      return
-    end
-    # use reverse_each to check farther-up ancestors first, for better error messages. we could avoid this if we were on
-    # the version of ruby that adds the optional argument to method_defined? that allows you to exclude ancestors.
+  #
+  # we assume that source_method_names has already been filtered to only include method
+  # names that were declared final at one point.
+  def self._check_final_ancestors(target, target_ancestors, source_method_names, source)
+    source_ancestors = nil
+    # use reverse_each to check farther-up ancestors first, for better error messages.
     target_ancestors.reverse_each do |ancestor|
+      final_methods = @modules_with_final.fetch(ancestor, nil)
+      # In this case, either ancestor didn't have any final methods anywhere in its
+      # ancestor chain, or ancestor did have final methods somewhere in its ancestor
+      # chain, but no final methods defined in ancestor itself.  Either way, there
+      # are no final methods to check here, so we can move on to the next ancestor.
+      next unless final_methods
       source_method_names.each do |method_name|
-        # the usage of method_owner_and_name_to_key(ancestor, method_name) instead of
-        # method_to_key(ancestor.instance_method(method_name)) is not (just) an optimization, but also required for
-        # correctness, since ancestor.method_defined?(method_name) may return true even if method_name is not defined
-        # directly on ancestor but instead an ancestor of ancestor.
-        if (ancestor.method_defined?(method_name) ||
-            ancestor.private_method_defined?(method_name) ||
-            ancestor.protected_method_defined?(method_name)) &&
-           final_method?(method_owner_and_name_to_key(ancestor, method_name))
-          raise(
-            "The method `#{method_name}` on #{ancestor} was declared as final and cannot be " +
-            (target == ancestor ? "redefined" : "overridden in #{target}")
-          )
+        next unless final_methods.include?(method_name)
+
+        # If we get here, we are defining a method that some ancestor declared as
+        # final.  however, we permit a final method to be defined multiple
+        # times if it is the same final method being defined each time.
+        if source
+          if !source_ancestors
+            source_ancestors = source.ancestors
+            # filter out things without actual final methods just to make sure that
+            # the below checks (which should be uncommon) go as quickly as possible.
+            source_ancestors.select! do |a|
+              @modules_with_final.fetch(a, nil)
+            end
+          end
+          # final-ness means that there should be no more than one index for which
+          # the below block returns true.
+          defining_ancestor_idx = source_ancestors.index do |a|
+            @modules_with_final.fetch(a).include?(method_name)
+          end
+          next if defining_ancestor_idx && source_ancestors[defining_ancestor_idx] == ancestor
         end
-      end
-    end
-  end
 
-  private_class_method def self.add_final_method(method_key)
-    @final_methods.add(method_key)
-  end
+        definition_file, definition_line = T::Private::Methods.signature_for_method(ancestor.instance_method(method_name)).method.source_location
+        is_redefined = target == ancestor
+        caller_loc = caller_locations&.find {|l| !l.to_s.match?(%r{sorbet-runtime[^/]*/lib/}) }
+        extra_info = "\n"
+        if caller_loc
+          extra_info = (is_redefined ? "Redefined" : "Overridden") + " here: #{caller_loc.path}:#{caller_loc.lineno}\n"
+        end
 
-  private_class_method def self.final_method?(method_key)
-    @final_methods.include?(method_key)
+        error_message = "The method `#{method_name}` on #{ancestor} was declared as final and cannot be " +
+                        (is_redefined ? "redefined" : "overridden in #{target}")
+        pretty_message = "#{error_message}\n" \
+                         "Made final here: #{definition_file}:#{definition_line}\n" \
+                         "#{extra_info}"
+
+        begin
+          raise pretty_message
+        rescue => e
+          # sig_validation_error_handler raises by default; on the off chance that
+          # it doesn't raise, we need to ensure that the rest of signature building
+          # sees a consistent state.  This sig failed to validate, so we should get
+          # rid of it.  If we don't do this, errors of the form "You called sig
+          # twice without declaring a method in between" will non-deterministically
+          # crop up in tests.
+          T::Private::DeclState.current.reset!
+          T::Configuration.sig_validation_error_handler(e, {})
+        end
+      end
+    end
   end
 
-  def self.add_module_with_final(mod)
-    @modules_with_final.add(mod)
-    @modules_with_final.add(mod.singleton_class)
+  def self.add_module_with_final_method(mod, method_name, is_singleton_method)
+    m = is_singleton_method ? mod.singleton_class : mod
+    methods = @modules_with_final[m]
+    if methods.nil?
+      methods = Set.new
+      @modules_with_final[m] = methods
+    end
+    methods.add(method_name)
   end
 
-  private_class_method def self.module_with_final?(mod)
-    @modules_with_final.include?(mod)
+  def self.note_module_deals_with_final(mod)
+    # Side-effectfully initialize the value if it's not already there
+    @modules_with_final[mod]
+    @modules_with_final[mod.singleton_class]
   end
 
   # Only public because it needs to get called below inside the replace_method blocks below.
@@ -184,7 +214,13 @@ module T::Private::Methods
     if T::Private::Final.final_module?(mod) && (current_declaration.nil? || !current_declaration.final)
       raise "#{mod} was declared as final but its method `#{method_name}` was not declared as final"
     end
-    _check_final_ancestors(mod, mod.ancestors, [method_name])
+    # Don't compute mod.ancestors if we don't need to bother checking final-ness.
+    if @was_ever_final_names.include?(method_name) && @modules_with_final.include?(mod)
+      _check_final_ancestors(mod, mod.ancestors, [method_name], nil)
+      # We need to fetch the active declaration again, as _check_final_ancestors
+      # may have reset it (see the comment in that method for details).
+      current_declaration = T::Private::DeclState.current.active_declaration
+    end
 
     if current_declaration.nil?
       return
@@ -207,41 +243,44 @@ module T::Private::Methods
     # which is called only on the *first* invocation.
     # This wrapper is very slow, so it will subsequently re-wrap with a much faster wrapper
     # (or unwrap back to the original method).
-    new_method = nil
-    T::Private::ClassUtils.replace_method(mod, method_name) do |*args, &blk|
-      method_sig = T::Private::Methods.maybe_run_sig_block_for_method(new_method)
-      method_sig ||= T::Private::Methods._handle_missing_method_signature(
-        self,
-        original_method,
-        __callee__,
-      )
-
-      # Should be the same logic as CallValidation.wrap_method_if_needed but we
-      # don't want that extra layer of indirection in the callstack
-      if method_sig.mode == T::Private::Methods::Modes.abstract
-        # We're in an interface method, keep going up the chain
-        if defined?(super)
-          super(*args, &blk)
+    key = method_owner_and_name_to_key(mod, method_name)
+    unless current_declaration.raw
+      T::Private::ClassUtils.replace_method(mod, method_name) do |*args, &blk|
+        method_sig = T::Private::Methods.maybe_run_sig_block_for_key(key)
+        method_sig ||= T::Private::Methods._handle_missing_method_signature(
+          self,
+          original_method,
+          __callee__,
+        )
+
+        # Should be the same logic as CallValidation.wrap_method_if_needed but we
+        # don't want that extra layer of indirection in the callstack
+        if method_sig.mode == T::Private::Methods::Modes.abstract
+          # We're in an interface method, keep going up the chain
+          if defined?(super)
+            super(*args, &blk)
+          else
+            raise NotImplementedError.new("The method `#{method_sig.method_name}` on #{mod} is declared as `abstract`. It does not have an implementation.")
+          end
+        # Note, this logic is duplicated (intentionally, for micro-perf) at `CallValidation.wrap_method_if_needed`,
+        # make sure to keep changes in sync.
+        elsif method_sig.check_level == :always || (method_sig.check_level == :tests && T::Private::RuntimeLevels.check_tests?)
+          CallValidation.validate_call(self, original_method, method_sig, args, blk)
+        elsif T::Configuration::AT_LEAST_RUBY_2_7
+          original_method.bind_call(self, *args, &blk)
         else
-          raise NotImplementedError.new("The method `#{method_sig.method_name}` on #{mod} is declared as `abstract`. It does not have an implementation.")
+          original_method.bind(self).call(*args, &blk)
         end
-      # Note, this logic is duplicated (intentionally, for micro-perf) at `CallValidation.wrap_method_if_needed`,
-      # make sure to keep changes in sync.
-      elsif method_sig.check_level == :always || (method_sig.check_level == :tests && T::Private::RuntimeLevels.check_tests?)
-        CallValidation.validate_call(self, original_method, method_sig, args, blk)
-      else
-        original_method.bind(self).call(*args, &blk)
       end
     end
 
-    new_method = mod.instance_method(method_name)
-    key = method_to_key(new_method)
     @sig_wrappers[key] = sig_block
     if current_declaration.final
-      add_final_method(key)
+      @was_ever_final_names.add(method_name)
       # use hook_mod, not mod, because for example, we want class C to be marked as having final if we def C.foo as
       # final. change this to mod to see some final_method tests fail.
-      add_module_with_final(hook_mod)
+      note_module_deals_with_final(hook_mod)
+      add_module_with_final_method(hook_mod, method_name, is_singleton_method)
     end
   end
 
@@ -305,7 +344,7 @@ module T::Private::Methods
   end
 
   def self.run_builder(declaration_block)
-    builder = DeclBuilder.new(declaration_block.mod)
+    builder = DeclBuilder.new(declaration_block.mod, declaration_block.raw)
     builder
       .instance_exec(&declaration_block.blk)
       .finalize!
@@ -336,6 +375,7 @@ module T::Private::Methods
         check_level: current_declaration.checked,
         on_failure: current_declaration.on_failure,
         override_allow_incompatible: current_declaration.override_allow_incompatible,
+        defined_raw: current_declaration.raw,
       )
 
       SignatureValidation.validate(signature)
@@ -373,7 +413,8 @@ module T::Private::Methods
     maybe_run_sig_block_for_key(method_to_key(method))
   end
 
-  private_class_method def self.maybe_run_sig_block_for_key(key)
+  # Only public so that it can be accessed in the closure for _on_method_added
+  def self.maybe_run_sig_block_for_key(key)
     run_sig_block_for_key(key) if has_sig_block_for_key(key)
   end
 
@@ -417,13 +458,28 @@ module T::Private::Methods
 
   # the module target is adding the methods from the module source to itself. we need to check that for all instance
   # methods M on source, M is not defined on any of target's ancestors.
-  def self._hook_impl(target, target_ancestors, source)
-    if !module_with_final?(target) && !module_with_final?(source)
+  def self._hook_impl(target, singleton_class, source)
+    # we do not need to call add_was_ever_final here, because we have already marked
+    # any such methods when source was originally defined.
+    if !@modules_with_final.include?(target)
+      if !@modules_with_final.include?(source)
+        return
+      end
+      note_module_deals_with_final(target)
+      install_hooks(target)
+      return
+    end
+
+    methods = source.instance_methods
+    methods.select! do |method_name|
+      @was_ever_final_names.include?(method_name)
+    end
+    if methods.empty?
       return
     end
-    add_module_with_final(target)
-    install_hooks(target)
-    _check_final_ancestors(target, target_ancestors - source.ancestors, source.instance_methods)
+
+    target_ancestors = singleton_class ? target.singleton_class.ancestors : target.ancestors
+    _check_final_ancestors(target, target_ancestors, methods, source)
   end
 
   def self.set_final_checks_on_hooks(enable)
@@ -437,15 +493,15 @@ module T::Private::Methods
     else
       old_included = T::Private::ClassUtils.replace_method(Module, :included) do |arg|
         old_included.bind(self).call(arg)
-        ::T::Private::Methods._hook_impl(arg, arg.ancestors, self)
+        ::T::Private::Methods._hook_impl(arg, false, self)
       end
       old_extended = T::Private::ClassUtils.replace_method(Module, :extended) do |arg|
         old_extended.bind(self).call(arg)
-        ::T::Private::Methods._hook_impl(arg, arg.singleton_class.ancestors, self)
+        ::T::Private::Methods._hook_impl(arg, true, self)
       end
       old_inherited = T::Private::ClassUtils.replace_method(Class, :inherited) do |arg|
         old_inherited.bind(self).call(arg)
-        ::T::Private::Methods._hook_impl(arg, arg.ancestors, self)
+        ::T::Private::Methods._hook_impl(arg, false, self)
       end
       @old_hooks = [old_included, old_extended, old_inherited]
     end
@@ -483,6 +539,12 @@ module T::Private::Methods
       return
     end
 
+    # See https://github.com/sorbet/sorbet/pull/3964 for an explanation of why this
+    # check (which theoretically should not be needed) is actually needed.
+    if !mod.is_a?(Module)
+      return
+    end
+
     if mod.singleton_class?
       mod.include(SingletonMethodHooks)
     else