@scriptc/compiler 0.0.12 → 0.0.14

package/dist/frontend/lowering/crypto-tables.d.ts

@@ -0,0 +1,7 @@
+export declare const CRYPTO_CONSTANTS: Record<string, number | string>;
+/** crypto.getCiphers() — Node v24.15.0 (OpenSSL 3.x) cipher names, sorted like Node answers them. */
+export declare const CRYPTO_CIPHERS: readonly string[];
+/** crypto.getHashes() — Node v24.15.0 digest names. */
+export declare const CRYPTO_HASHES: readonly string[];
+/** crypto.getCurves() — Node v24.15.0 EC curve names. */
+export declare const CRYPTO_CURVES: readonly string[];

package/dist/frontend/lowering/crypto-tables.js

@@ -0,0 +1,139 @@
+/* node:crypto introspection tables — Node v24.15.0 answers, generated with
+ *   node -p "require('crypto').constants"   (and getCiphers/getHashes/getCurves)
+ * crypto.constants bakes as literals at every access site (the http2.constants
+ * precedent — the object itself never materializes at runtime); the three name
+ * lists bake as fresh string[] literals at their call sites. defaultCipherList
+ * and defaultCoreCipherList are strings; every other member is a number. */
+export const CRYPTO_CONSTANTS = {
+    "OPENSSL_VERSION_NUMBER": 810549328,
+    "SSL_OP_ALL": 2147485776,
+    "SSL_OP_ALLOW_NO_DHE_KEX": 1024,
+    "SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION": 262144,
+    "SSL_OP_CIPHER_SERVER_PREFERENCE": 4194304,
+    "SSL_OP_CISCO_ANYCONNECT": 32768,
+    "SSL_OP_COOKIE_EXCHANGE": 8192,
+    "SSL_OP_CRYPTOPRO_TLSEXT_BUG": 2147483648,
+    "SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS": 2048,
+    "SSL_OP_LEGACY_SERVER_CONNECT": 4,
+    "SSL_OP_NO_COMPRESSION": 131072,
+    "SSL_OP_NO_ENCRYPT_THEN_MAC": 524288,
+    "SSL_OP_NO_QUERY_MTU": 4096,
+    "SSL_OP_NO_RENEGOTIATION": 1073741824,
+    "SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION": 65536,
+    "SSL_OP_NO_SSLv2": 0,
+    "SSL_OP_NO_SSLv3": 33554432,
+    "SSL_OP_NO_TICKET": 16384,
+    "SSL_OP_NO_TLSv1": 67108864,
+    "SSL_OP_NO_TLSv1_1": 268435456,
+    "SSL_OP_NO_TLSv1_2": 134217728,
+    "SSL_OP_NO_TLSv1_3": 536870912,
+    "SSL_OP_PRIORITIZE_CHACHA": 2097152,
+    "SSL_OP_TLS_ROLLBACK_BUG": 8388608,
+    "ENGINE_METHOD_RSA": 1,
+    "ENGINE_METHOD_DSA": 2,
+    "ENGINE_METHOD_DH": 4,
+    "ENGINE_METHOD_RAND": 8,
+    "ENGINE_METHOD_EC": 2048,
+    "ENGINE_METHOD_CIPHERS": 64,
+    "ENGINE_METHOD_DIGESTS": 128,
+    "ENGINE_METHOD_PKEY_METHS": 512,
+    "ENGINE_METHOD_PKEY_ASN1_METHS": 1024,
+    "ENGINE_METHOD_ALL": 65535,
+    "ENGINE_METHOD_NONE": 0,
+    "DH_CHECK_P_NOT_SAFE_PRIME": 2,
+    "DH_CHECK_P_NOT_PRIME": 1,
+    "DH_UNABLE_TO_CHECK_GENERATOR": 4,
+    "DH_NOT_SUITABLE_GENERATOR": 8,
+    "RSA_PKCS1_PADDING": 1,
+    "RSA_NO_PADDING": 3,
+    "RSA_PKCS1_OAEP_PADDING": 4,
+    "RSA_X931_PADDING": 5,
+    "RSA_PKCS1_PSS_PADDING": 6,
+    "RSA_PSS_SALTLEN_DIGEST": -1,
+    "RSA_PSS_SALTLEN_MAX_SIGN": -2,
+    "RSA_PSS_SALTLEN_AUTO": -2,
+    "defaultCoreCipherList": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA",
+    "TLS1_VERSION": 769,
+    "TLS1_1_VERSION": 770,
+    "TLS1_2_VERSION": 771,
+    "TLS1_3_VERSION": 772,
+    "POINT_CONVERSION_COMPRESSED": 2,
+    "POINT_CONVERSION_UNCOMPRESSED": 4,
+    "POINT_CONVERSION_HYBRID": 6,
+    "defaultCipherList": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA",
+};
+/** crypto.getCiphers() — Node v24.15.0 (OpenSSL 3.x) cipher names, sorted like Node answers them. */
+export const CRYPTO_CIPHERS = [
+    "aes-128-cbc", "aes-128-ccm", "aes-128-cfb", "aes-128-cfb1", "aes-128-cfb8",
+    "aes-128-ctr", "aes-128-ecb", "aes-128-gcm", "aes-128-ocb", "aes-128-ofb",
+    "aes-128-xts", "aes-192-cbc", "aes-192-ccm", "aes-192-cfb", "aes-192-cfb1",
+    "aes-192-cfb8", "aes-192-ctr", "aes-192-ecb", "aes-192-gcm", "aes-192-ocb",
+    "aes-192-ofb", "aes-256-cbc", "aes-256-ccm", "aes-256-cfb", "aes-256-cfb1",
+    "aes-256-cfb8", "aes-256-ctr", "aes-256-ecb", "aes-256-gcm", "aes-256-ocb",
+    "aes-256-ofb", "aes-256-xts", "aes128", "aes128-wrap", "aes128-wrap-pad",
+    "aes192", "aes192-wrap", "aes192-wrap-pad", "aes256", "aes256-wrap",
+    "aes256-wrap-pad", "aria-128-cbc", "aria-128-ccm", "aria-128-cfb",
+    "aria-128-cfb1", "aria-128-cfb8", "aria-128-ctr", "aria-128-ecb",
+    "aria-128-gcm", "aria-128-ofb", "aria-192-cbc", "aria-192-ccm",
+    "aria-192-cfb", "aria-192-cfb1", "aria-192-cfb8", "aria-192-ctr",
+    "aria-192-ecb", "aria-192-gcm", "aria-192-ofb", "aria-256-cbc",
+    "aria-256-ccm", "aria-256-cfb", "aria-256-cfb1", "aria-256-cfb8",
+    "aria-256-ctr", "aria-256-ecb", "aria-256-gcm", "aria-256-ofb", "aria128",
+    "aria192", "aria256", "camellia-128-cbc", "camellia-128-cfb",
+    "camellia-128-cfb1", "camellia-128-cfb8", "camellia-128-ctr",
+    "camellia-128-ecb", "camellia-128-ofb", "camellia-192-cbc",
+    "camellia-192-cfb", "camellia-192-cfb1", "camellia-192-cfb8",
+    "camellia-192-ctr", "camellia-192-ecb", "camellia-192-ofb",
+    "camellia-256-cbc", "camellia-256-cfb", "camellia-256-cfb1",
+    "camellia-256-cfb8", "camellia-256-ctr", "camellia-256-ecb",
+    "camellia-256-ofb", "camellia128", "camellia192", "camellia256", "chacha20",
+    "chacha20-poly1305", "des-ede", "des-ede-cbc", "des-ede-cfb", "des-ede-ecb",
+    "des-ede-ofb", "des-ede3", "des-ede3-cbc", "des-ede3-cfb", "des-ede3-cfb1",
+    "des-ede3-cfb8", "des-ede3-ecb", "des-ede3-ofb", "des3", "des3-wrap",
+    "id-aes128-CCM", "id-aes128-GCM", "id-aes128-wrap", "id-aes128-wrap-pad",
+    "id-aes192-CCM", "id-aes192-GCM", "id-aes192-wrap", "id-aes192-wrap-pad",
+    "id-aes256-CCM", "id-aes256-GCM", "id-aes256-wrap", "id-aes256-wrap-pad",
+    "id-smime-alg-CMS3DESwrap", "sm4", "sm4-cbc", "sm4-cfb", "sm4-ctr",
+    "sm4-ecb", "sm4-ofb",
+];
+/** crypto.getHashes() — Node v24.15.0 digest names. */
+export const CRYPTO_HASHES = [
+    "RSA-MD5", "RSA-RIPEMD160", "RSA-SHA1", "RSA-SHA1-2", "RSA-SHA224",
+    "RSA-SHA256", "RSA-SHA3-224", "RSA-SHA3-256", "RSA-SHA3-384",
+    "RSA-SHA3-512", "RSA-SHA384", "RSA-SHA512", "RSA-SHA512/224",
+    "RSA-SHA512/256", "RSA-SM3", "blake2b512", "blake2s256",
+    "id-rsassa-pkcs1-v1_5-with-sha3-224", "id-rsassa-pkcs1-v1_5-with-sha3-256",
+    "id-rsassa-pkcs1-v1_5-with-sha3-384", "id-rsassa-pkcs1-v1_5-with-sha3-512",
+    "md5", "md5-sha1", "md5WithRSAEncryption", "ripemd", "ripemd160",
+    "ripemd160WithRSA", "rmd160", "sha1", "sha1WithRSAEncryption", "sha224",
+    "sha224WithRSAEncryption", "sha256", "sha256WithRSAEncryption", "sha3-224",
+    "sha3-256", "sha3-384", "sha3-512", "sha384", "sha384WithRSAEncryption",
+    "sha512", "sha512-224", "sha512-224WithRSAEncryption", "sha512-256",
+    "sha512-256WithRSAEncryption", "sha512WithRSAEncryption", "shake128",
+    "shake256", "sm3", "sm3WithRSAEncryption", "ssl3-md5", "ssl3-sha1",
+];
+/** crypto.getCurves() — Node v24.15.0 EC curve names. */
+export const CRYPTO_CURVES = [
+    "Oakley-EC2N-3", "Oakley-EC2N-4", "SM2", "brainpoolP160r1",
+    "brainpoolP160t1", "brainpoolP192r1", "brainpoolP192t1", "brainpoolP224r1",
+    "brainpoolP224t1", "brainpoolP256r1", "brainpoolP256t1", "brainpoolP320r1",
+    "brainpoolP320t1", "brainpoolP384r1", "brainpoolP384t1", "brainpoolP512r1",
+    "brainpoolP512t1", "c2pnb163v1", "c2pnb163v2", "c2pnb163v3", "c2pnb176v1",
+    "c2pnb208w1", "c2pnb272w1", "c2pnb304w1", "c2pnb368w1", "c2tnb191v1",
+    "c2tnb191v2", "c2tnb191v3", "c2tnb239v1", "c2tnb239v2", "c2tnb239v3",
+    "c2tnb359v1", "c2tnb431r1", "prime192v1", "prime192v2", "prime192v3",
+    "prime239v1", "prime239v2", "prime239v3", "prime256v1", "secp112r1",
+    "secp112r2", "secp128r1", "secp128r2", "secp160k1", "secp160r1",
+    "secp160r2", "secp192k1", "secp224k1", "secp224r1", "secp256k1",
+    "secp384r1", "secp521r1", "sect113r1", "sect113r2", "sect131r1",
+    "sect131r2", "sect163k1", "sect163r1", "sect163r2", "sect193r1",
+    "sect193r2", "sect233k1", "sect233r1", "sect239k1", "sect283k1",
+    "sect283r1", "sect409k1", "sect409r1", "sect571k1", "sect571r1",
+    "wap-wsg-idm-ecid-wtls1", "wap-wsg-idm-ecid-wtls10",
+    "wap-wsg-idm-ecid-wtls11", "wap-wsg-idm-ecid-wtls12",
+    "wap-wsg-idm-ecid-wtls3", "wap-wsg-idm-ecid-wtls4",
+    "wap-wsg-idm-ecid-wtls5", "wap-wsg-idm-ecid-wtls6",
+    "wap-wsg-idm-ecid-wtls7", "wap-wsg-idm-ecid-wtls8",
+    "wap-wsg-idm-ecid-wtls9",
+];
+//# sourceMappingURL=crypto-tables.js.map

package/dist/frontend/lowering/crypto-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-tables.js","sourceRoot":"","sources":["../../../src/frontend/lowering/crypto-tables.ts"],"names":[],"mappings":"AAAA;;;;;4EAK4E;AAE5E,MAAM,CAAC,MAAM,gBAAgB,GAAoC;IAC/D,wBAAwB,EAAE,SAAS;IACnC,YAAY,EAAE,UAAU;IACxB,yBAAyB,EAAE,IAAI;IAC/B,0CAA0C,EAAE,MAAM;IAClD,iCAAiC,EAAE,OAAO;IAC1C,yBAAyB,EAAE,KAAK;IAChC,wBAAwB,EAAE,IAAI;IAC9B,6BAA6B,EAAE,UAAU;IACzC,oCAAoC,EAAE,IAAI;IAC1C,8BAA8B,EAAE,CAAC;IACjC,uBAAuB,EAAE,MAAM;IAC/B,4BAA4B,EAAE,MAAM;IACpC,qBAAqB,EAAE,IAAI;IAC3B,yBAAyB,EAAE,UAAU;IACrC,+CAA+C,EAAE,KAAK;IACtD,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,QAAQ;IAC3B,kBAAkB,EAAE,KAAK;IACzB,iBAAiB,EAAE,QAAQ;IAC3B,mBAAmB,EAAE,SAAS;IAC9B,mBAAmB,EAAE,SAAS;IAC9B,mBAAmB,EAAE,SAAS;IAC9B,0BAA0B,EAAE,OAAO;IACnC,yBAAyB,EAAE,OAAO;IAClC,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,CAAC;IACtB,kBAAkB,EAAE,CAAC;IACrB,oBAAoB,EAAE,CAAC;IACvB,kBAAkB,EAAE,IAAI;IACxB,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,0BAA0B,EAAE,GAAG;IAC/B,+BAA+B,EAAE,IAAI;IACrC,mBAAmB,EAAE,KAAK;IAC1B,oBAAoB,EAAE,CAAC;IACvB,2BAA2B,EAAE,CAAC;IAC9B,sBAAsB,EAAE,CAAC;IACzB,8BAA8B,EAAE,CAAC;IACjC,2BAA2B,EAAE,CAAC;IAC9B,mBAAmB,EAAE,CAAC;IACtB,gBAAgB,EAAE,CAAC;IACnB,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IACrB,uBAAuB,EAAE,CAAC;IAC1B,wBAAwB,EAAE,CAAC,CAAC;IAC5B,0BAA0B,EAAE,CAAC,CAAC;IAC9B,sBAAsB,EAAE,CAAC,CAAC;IAC1B,uBAAuB,EAAE,kaAAka;IAC3b,cAAc,EAAE,GAAG;IACnB,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,GAAG;IACrB,gBAAgB,EAAE,GAAG;IACrB,6BAA6B,EAAE,CAAC;IAChC,+BAA+B,EAAE,CAAC;IAClC,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,EAAE,kaAAka;CACxb,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc;IAC3E,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACzE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc;IAC1E,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAC1E,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc;IAC1E,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAC1E,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB;IACxE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa;IACnE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc;IACjE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc;IAC9D,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc;IAC9D,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS;IACzE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,kBAAkB;IAC5D,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB;IAC5D,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC1D,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;IAC5D,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;IAC1D,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB;IAC3D,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB;IAC3D,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU;IAC3E,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAC3E,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;IAC1E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW;IACpE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB;IACxE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB;IACxE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB;IACxE,0BAA0B,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;IAClE,SAAS,EAAE,SAAS;CACrB,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;IAClE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc;IAC5D,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB;IAC5D,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY;IACvD,oCAAoC,EAAE,oCAAoC;IAC1E,oCAAoC,EAAE,oCAAoC;IAC1E,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,QAAQ,EAAE,WAAW;IAChE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ;IACvE,yBAAyB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,UAAU;IAC1E,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,yBAAyB;IACvE,QAAQ,EAAE,YAAY,EAAE,6BAA6B,EAAE,YAAY;IACnE,6BAA6B,EAAE,yBAAyB,EAAE,UAAU;IACpE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW;CACnE,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB;IAC1D,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;IAC1E,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;IAC1E,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;IAC1E,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY;IACzE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY;IACpE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY;IACpE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY;IACpE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW;IACnE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAC/D,wBAAwB,EAAE,yBAAyB;IACnD,yBAAyB,EAAE,yBAAyB;IACpD,wBAAwB,EAAE,wBAAwB;IAClD,wBAAwB,EAAE,wBAAwB;IAClD,wBAAwB,EAAE,wBAAwB;IAClD,wBAAwB;CACzB,CAAC"}

package/dist/frontend/lowering/lower-builtins.d.ts

@@ -90,16 +90,18 @@ export declare function createRequireNamespaceDecl(L: Lowerer, nameNode: ts.Node
    * embedded it) and reports the requires-dynamic diagnostic in a static
    * build. Null when the callee is not a createRequire require. */
 export declare function lowerCreateRequireCall(L: Lowerer, call: ts.CallExpression, loc: SrcLoc): IrExpr | null;
-/** True when `node` denotes the http2.constants OBJECT — any of its
-   * spellings: `http2.constants` through a namespace/require binding, a
-   * destructured or member-bound `constants` alias from the http2 module,
-   * or `require("http2").constants` inline. The object itself never
-   * materializes; each member read bakes as its literal. */
-export declare function isHttp2ConstantsExpr(L: Lowerer, node: ts.Expression): boolean;
-/** `constants.NGHTTP2_CANCEL` (any http2.constants spelling) → the baked
-   * literal; unknown members fence by name. Null when the receiver is not
-   * the constants object (the property chain keeps trying). */
-export declare function lowerHttp2ConstantsProperty(L: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null;
+/** The module whose baked-constants OBJECT `node` denotes, or null — any
+   * of the spellings: `http2.constants`/`crypto.constants` through a
+   * namespace/require binding, a destructured or member-bound `constants`
+   * alias from the module, or `require("http2").constants` inline. The
+   * object itself never materializes; each member read bakes as its
+   * literal. */
+export declare function builtinConstantsModuleOf(L: Lowerer, node: ts.Expression): string | null;
+/** `constants.NGHTTP2_CANCEL` / `constants.SSL_OP_NO_TICKET` (any baked-
+   * constants spelling) → the literal; unknown members fence by name.
+   * Null when the receiver is not a baked constants object (the property
+   * chain keeps trying). */
+export declare function lowerBuiltinConstantsProperty(L: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null;
 /** True for any spelling of node:perf_hooks' `performance` object — the
    * named import binding, a namespace/default-import member, the require
    * twins (all through the shared builtin tables), or the GLOBAL Node
@@ -116,16 +118,17 @@ export declare function isPerfHooksPerformanceExpr(L: Lowerer, node: ts.Expressi
    * value. Other members on the performance object fence by name; null
    * for non-perf_hooks callees (the call chain keeps trying). */
 export declare function lowerPerfHooksCall(L: Lowerer, expr: ts.CallExpression, access: ts.PropertyAccessExpression): IrExpr | null;
-/** True for `const { NGHTTP2_CANCEL, ... } = http2.constants` — a plain
-   * object destructure (identifier elements, renames allowed, no rest/
-   * defaults/nesting) over the constants object whose every name is in
-   * the table. The declaration is alias plumbing with no storage
-   * (lowerVarDecl and collectGlobals both skip it); each USE reads its
-   * baked literal (http2ConstantBindingOf). */
-export declare function http2ConstantsDestructureDecl(L: Lowerer, nameNode: ts.Node, init: ts.Expression | undefined): boolean;
-/** Resolves an identifier bound by an http2ConstantsDestructureDecl to its
-   * baked literal value. Null for every other binding. */
-export declare function http2ConstantBindingOf(L: Lowerer, ident: ts.Identifier): IrExpr | null;
+/** True for `const { NGHTTP2_CANCEL, ... } = http2.constants` (and the
+   * crypto.constants twin) — a plain object destructure (identifier
+   * elements, renames allowed, no rest/defaults/nesting) over a baked
+   * constants object whose every name is in its table. The declaration is
+   * alias plumbing with no storage (lowerVarDecl and collectGlobals both
+   * skip it); each USE reads its baked literal
+   * (builtinConstantBindingOf). */
+export declare function builtinConstantsDestructureDecl(L: Lowerer, nameNode: ts.Node, init: ts.Expression | undefined): boolean;
+/** Resolves an identifier bound by a builtinConstantsDestructureDecl to
+   * its baked literal value. Null for every other binding. */
+export declare function builtinConstantBindingOf(L: Lowerer, ident: ts.Identifier): IrExpr | null;
 /** One builtin-module function call → its libCall. Completes the call to
    * the table's exact shape: variadicPack functions (path.join/resolve)
    * accept any arity — or ONE spread of a string[] — and pack the
@@ -326,6 +329,21 @@ export declare function fencedBuiltinImportOf(L: Lowerer, ident: ts.Identifier):
    * bare randomBytes(n) — fences with the Buffer story. Null when this
    * isn't a toString on a crypto.randomBytes call. */
 export declare function lowerCryptoComposedCall(L: Lowerer, call: ts.CallExpression, access: ts.PropertyAccessExpression): IrExpr | null;
+/** The node:crypto introspection statics — build-time constants of the
+   * compiled runtime, baked at the call site (the http2.constants stance
+   * extended to calls): getFips() answers 0 (no FIPS provider can ever
+   * load into a compiled binary — Node's own answer for a non-FIPS
+   * build), and getCiphers()/getHashes()/getCurves() answer Node v24's
+   * name lists as fresh string[] literals. The lists are INTROSPECTION
+   * data (Node's contract is "names the provider recognizes"); the
+   * operations behind the names keep their per-member fences — a program
+   * that probes the list and then constructs a cipher fences at the
+   * construction site, never here. Null for other members (the dispatch
+   * keeps trying). */
+export declare function lowerCryptoModuleCall(L: Lowerer, expr: ts.CallExpression, bi: {
+    module: string;
+    member: string;
+}, loc: SrcLoc): IrExpr | null;
 /** Method calls on URL-typed receivers: `u.toString()` is Node's href
    * serialization (the href getter's libCall). Everything else the lib
    * declares fences member-qualified. Null for non-URL receivers. */

package/dist/frontend/lowering/lower-builtins.js

@@ -15,6 +15,7 @@ import { invalidJsonModuleDiag, requiresDynamicImportDiag } from "../../diagnost
 import { builtinModuleFnOf, FS_READDIR_DOCUMENTED_OPTIONS, FS_WATCH_DOCUMENTED_OPTIONS, FS_WRITE_FILE_DOCUMENTED_OPTIONS, QS_PARSE_DOCUMENTED_OPTIONS, QS_STRINGIFY_DOCUMENTED_OPTIONS, READLINE_DOCUMENTED_OPTIONS, builtinConstLit, fenceOrDropOptionKey, isChildSurfaceMember, } from "./surfaces.js";
 import { conditionalSpreadOf, lowerDynObjectLiteral } from "./lower-exprs.js";
 import { HTTP2_CONSTANTS } from "./http2-constants.js";
+import { CRYPTO_CIPHERS, CRYPTO_CONSTANTS, CRYPTO_CURVES, CRYPTO_HASHES } from "./crypto-tables.js";
 import { timerStyleCallback } from "./lower-calls.js";
 import { registerHttpClientFnBinding } from "./lower-server.js";
 import { BOOL, BYTES_U8, CHILD_T, CHILDSTREAM_T, DYN, F64, FSWATCHER_T, PROCSTREAM_T, JSVAL, NULL_T, SEARCH_PARAMS_T, SPAWNRES_T, STRING, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, funcOf, isUnitType, typeEquals, typeKey } from "../../ir/nodes.js";
@@ -376,38 +377,60 @@ export function lowerCreateRequireCall(L, call, loc) {
         loc,
     };
 }
-/** True when `node` denotes the http2.constants OBJECT — any of its
-   * spellings: `http2.constants` through a namespace/require binding, a
-   * destructured or member-bound `constants` alias from the http2 module,
-   * or `require("http2").constants` inline. The object itself never
-   * materializes; each member read bakes as its literal. */
-export function isHttp2ConstantsExpr(L, node) {
+/** The builtin modules whose `constants` object bakes as literals at
+   * every access site (the fs.constants precedent, scaled up): http2's
+   * full Node v24 table, and crypto's OpenSSL-constant table. The object
+   * itself never materializes at runtime. */
+const BUILTIN_CONSTANTS_TABLES = {
+    http2: {
+        table: HTTP2_CONSTANTS,
+        hint: "the table bakes Node v24's 240 members as literals — this name is not one of them",
+    },
+    crypto: {
+        table: CRYPTO_CONSTANTS,
+        hint: "the table bakes Node v24's crypto.constants members as literals — this name is not one of them",
+    },
+};
+/** The module whose baked-constants OBJECT `node` denotes, or null — any
+   * of the spellings: `http2.constants`/`crypto.constants` through a
+   * namespace/require binding, a destructured or member-bound `constants`
+   * alias from the module, or `require("http2").constants` inline. The
+   * object itself never materializes; each member read bakes as its
+   * literal. */
+export function builtinConstantsModuleOf(L, node) {
+    let module = null;
     if (ts.isPropertyAccessExpression(node) && !node.questionDotToken) {
         if (node.name.text !== "constants")
-            return false;
+            return null;
         const bi = L.builtinMemberOf(node);
-        if (bi && bi.module === "http2")
-            return true;
-        const spec = requireSpecOf(node.expression);
-        return spec !== null && canonicalBuiltinModule(spec) === "http2";
+        if (bi)
+            module = bi.module;
+        else {
+            const spec = requireSpecOf(node.expression);
+            module = spec !== null ? canonicalBuiltinModule(spec) : null;
+        }
     }
-    if (ts.isIdentifier(node)) {
+    else if (ts.isIdentifier(node)) {
         const bi = builtinImportOf(L, node);
-        return bi !== null && bi.module === "http2" && bi.member === "constants";
+        if (bi !== null && bi.member === "constants")
+            module = bi.module;
     }
-    return false;
+    return module !== null && own(BUILTIN_CONSTANTS_TABLES, module) !== undefined ? module : null;
 }
-/** `constants.NGHTTP2_CANCEL` (any http2.constants spelling) → the baked
-   * literal; unknown members fence by name. Null when the receiver is not
-   * the constants object (the property chain keeps trying). */
-export function lowerHttp2ConstantsProperty(L, expr) {
+/** `constants.NGHTTP2_CANCEL` / `constants.SSL_OP_NO_TICKET` (any baked-
+   * constants spelling) → the literal; unknown members fence by name.
+   * Null when the receiver is not a baked constants object (the property
+   * chain keeps trying). */
+export function lowerBuiltinConstantsProperty(L, expr) {
     if (expr.questionDotToken)
         return null;
-    if (!isHttp2ConstantsExpr(L, expr.expression))
+    const module = builtinConstantsModuleOf(L, expr.expression);
+    if (module === null)
         return null;
-    const value = own(HTTP2_CONSTANTS, expr.name.text);
+    const entry = BUILTIN_CONSTANTS_TABLES[module];
+    const value = own(entry.table, expr.name.text);
     if (value === undefined) {
-        L.noLowering(`http2.constants.${expr.name.text}`, expr, "the table bakes Node v24's 240 members as literals — this name is not one of them");
+        L.noLowering(`${module}.constants.${expr.name.text}`, expr, entry.hint);
     }
     return builtinConstLit(value, locOf(expr));
 }
@@ -487,27 +510,30 @@ function perfNowFnValueOf(L) {
     }
     return name;
 }
-/** True for `const { NGHTTP2_CANCEL, ... } = http2.constants` — a plain
-   * object destructure (identifier elements, renames allowed, no rest/
-   * defaults/nesting) over the constants object whose every name is in
-   * the table. The declaration is alias plumbing with no storage
-   * (lowerVarDecl and collectGlobals both skip it); each USE reads its
-   * baked literal (http2ConstantBindingOf). */
-export function http2ConstantsDestructureDecl(L, nameNode, init) {
+/** True for `const { NGHTTP2_CANCEL, ... } = http2.constants` (and the
+   * crypto.constants twin) — a plain object destructure (identifier
+   * elements, renames allowed, no rest/defaults/nesting) over a baked
+   * constants object whose every name is in its table. The declaration is
+   * alias plumbing with no storage (lowerVarDecl and collectGlobals both
+   * skip it); each USE reads its baked literal
+   * (builtinConstantBindingOf). */
+export function builtinConstantsDestructureDecl(L, nameNode, init) {
     if (!ts.isObjectBindingPattern(nameNode) || !init)
         return false;
-    if (!isHttp2ConstantsExpr(L, init))
+    const module = builtinConstantsModuleOf(L, init);
+    if (module === null)
         return false;
+    const table = BUILTIN_CONSTANTS_TABLES[module].table;
     return nameNode.elements.every((el) => !el.dotDotDotToken &&
         el.initializer === undefined &&
         el.name !== undefined &&
         ts.isIdentifier(el.name) &&
         (el.propertyName === undefined || ts.isIdentifier(el.propertyName)) &&
-        own(HTTP2_CONSTANTS, (el.propertyName ?? el.name).text) !== undefined);
+        own(table, (el.propertyName ?? el.name).text) !== undefined);
 }
-/** Resolves an identifier bound by an http2ConstantsDestructureDecl to its
-   * baked literal value. Null for every other binding. */
-export function http2ConstantBindingOf(L, ident) {
+/** Resolves an identifier bound by a builtinConstantsDestructureDecl to
+   * its baked literal value. Null for every other binding. */
+export function builtinConstantBindingOf(L, ident) {
     const symbol = L.checker.getSymbolAtLocation(ident);
     const decl = symbol ? L.checker.declarationsOf(symbol)[0] : undefined;
     if (!decl || !ts.isBindingElement(decl) || decl.dotDotDotToken || decl.initializer)
@@ -517,14 +543,15 @@ export function http2ConstantBindingOf(L, ident) {
     const varDecl = decl.parent.parent;
     if (!ts.isVariableDeclaration(varDecl) || varDecl.initializer === undefined)
         return null;
-    if (!isHttp2ConstantsExpr(L, varDecl.initializer))
+    const module = builtinConstantsModuleOf(L, varDecl.initializer);
+    if (module === null)
         return null;
     const key = decl.propertyName && ts.isIdentifier(decl.propertyName)
         ? decl.propertyName.text
         : decl.name !== undefined && ts.isIdentifier(decl.name) ? decl.name.text : null;
     if (key === null)
         return null;
-    const value = own(HTTP2_CONSTANTS, key);
+    const value = own(BUILTIN_CONSTANTS_TABLES[module].table, key);
     if (value === undefined)
         return null;
     return builtinConstLit(value, locOf(ident));
@@ -3268,6 +3295,41 @@ function lowerHashDigestChain(L, call, access) {
     }
     L.noLowering(`Hash.update of '${dataIr ? L.fmt(dataIr) : L.checker.typeToString(L.typeOf(dataNode))}' values`, dataNode, "string and Buffer/Uint8Array inputs are the lowered update forms");
 }
+/** The node:crypto introspection statics — build-time constants of the
+   * compiled runtime, baked at the call site (the http2.constants stance
+   * extended to calls): getFips() answers 0 (no FIPS provider can ever
+   * load into a compiled binary — Node's own answer for a non-FIPS
+   * build), and getCiphers()/getHashes()/getCurves() answer Node v24's
+   * name lists as fresh string[] literals. The lists are INTROSPECTION
+   * data (Node's contract is "names the provider recognizes"); the
+   * operations behind the names keep their per-member fences — a program
+   * that probes the list and then constructs a cipher fences at the
+   * construction site, never here. Null for other members (the dispatch
+   * keeps trying). */
+export function lowerCryptoModuleCall(L, expr, bi, loc) {
+    if (bi.module !== "crypto")
+        return null;
+    const LISTS = {
+        getCiphers: CRYPTO_CIPHERS,
+        getHashes: CRYPTO_HASHES,
+        getCurves: CRYPTO_CURVES,
+    };
+    const list = own(LISTS, bi.member);
+    if (bi.member !== "getFips" && list === undefined)
+        return null;
+    if (expr.arguments.length !== 0) {
+        L.noLowering(`crypto.${bi.member} with ${expr.arguments.length} arguments`, expr);
+    }
+    if (bi.member === "getFips") {
+        return { kind: "numLit", value: 0, type: F64, loc };
+    }
+    return {
+        kind: "arrayLit",
+        elems: list.map((s) => ({ kind: "strLit", value: s, type: STRING, loc })),
+        type: arrayOf(STRING),
+        loc,
+    };
+}
 /** Method calls on URL-typed receivers: `u.toString()` is Node's href
    * serialization (the href getter's libCall). Everything else the lib
    * declares fences member-qualified. Null for non-URL receivers. */
@@ -4848,13 +4910,23 @@ export function lowerProcessMethodCall(L, call, access) {
         // the loop-end report dispatches it (reason, promise) per
         // never-observed rejection instead of printing and exiting 1
         // (scr_async.c; the end-of-turn timing is a SEMANTICS.md
-        // divergence). `once`/`off` forms have no removal story yet.
-        if (event === "unhandledRejection" && member === "on") {
+        // divergence). `once` auto-removes after one delivery and
+        // `off`/`removeListener` remove by closure identity — the warning
+        // registry's story. 'rejectionHandled' is the sibling registry:
+        // under the loop-exhaustion model its ONE firing window is a
+        // handler attached during an unhandledRejection listener (earlier
+        // handling never enters the report at all — the same documented
+        // divergence), dispatched synchronously with the promise.
+        if (event === "unhandledRejection" || event === "rejectionHandled") {
             if (!ts.isExpressionStatement(call.parent)) {
                 L.unsupported("SC1090", call, "chaining process listener registration (the result is void here — register each listener as its own statement)");
             }
             const cb = dcSubscriberArg(L, call.arguments[1]);
-            return { kind: "libCall", fn: "process.onUnhandledRejection", args: [cb], type: VOID, loc };
+            const onceArg = { kind: "boolLit", value: member === "once", type: BOOL, loc };
+            const fn = event === "unhandledRejection"
+                ? (isOff ? "process.offUnhandledRejection" : "process.onUnhandledRejection")
+                : (isOff ? "process.offRejectionHandled" : "process.onRejectionHandled");
+            return { kind: "libCall", fn, args: isOff ? [cb] : [cb, onceArg], type: VOID, loc };
         }
         // 'warning': the listener crosses as a dyn function; emitWarning
         // and the runtime deprecation sites dispatch synchronously
@@ -4873,7 +4945,7 @@ export function lowerProcessMethodCall(L, call, access) {
             };
         }
         if (signo === undefined && event !== "exit") {
-            L.noLowering(`process.${member}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, call.arguments[0], '"SIGINT", "SIGTERM", "exit", "warning", and "unhandledRejection" (on) are the supported process events (as literals)');
+            L.noLowering(`process.${member}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, call.arguments[0], '"SIGINT", "SIGTERM", "exit", "warning", "unhandledRejection", and "rejectionHandled" are the supported process events (as literals)');
         }
         if (!ts.isExpressionStatement(call.parent)) {
             L.unsupported("SC1090", call, "chaining process listener registration (the result is void here — register each listener as its own statement)");