@scriptc/compiler 0.4.0 → 0.4.2

package/dist/frontend/lowering/lower-server.js

@@ -1,3 +1,4 @@
+import { keyedHelperName } from "./stable-names.js";
 import { dynUndefinedExpr, nodeThrowExpr, boolLit, numLit, strLit, varRef, } from "../../ir/build.js";
 import * as ts from "../ts7/adapter.js";
 import { ladderFenceExpr } from "./lowerer.js";
@@ -124,7 +125,7 @@ export function voidizedCallback(lowerer, cb, loc) {
     const toT = funcOf([...fromT.params], VOID);
     const key = `server.voidcb:${typeKey(fromT)}`;
     const existing = lowerer.arrHofHelpers.get(key);
-    const name = existing ?? `%server.voidcb.${lowerer.arrHofHelpers.size}`;
+    const name = existing ?? keyedHelperName(lowerer, "%server.voidcb", key);
     if (!existing) {
         lowerer.arrHofHelpers.set(key, name);
         const impl = `${name}.impl`;
@@ -197,7 +198,7 @@ function lowerSocketDynListener(lowerer, node, what) {
 function receiverReturningCall(lowerer, fn, callArgs, recvT, loc, opts) {
     const key = `server.recvret:${fn}:${opts?.prefix?.fn ?? ""}:${(opts?.mainArgIndices ?? []).join(".")}:${callArgs.map((a) => typeKey(a.type)).join(",")}`;
     const existing = lowerer.arrHofHelpers.get(key);
-    const name = existing ?? `%server.recvret.${lowerer.arrHofHelpers.size}`;
+    const name = existing ?? keyedHelperName(lowerer, "%server.recvret", key);
     if (!existing) {
         lowerer.arrHofHelpers.set(key, name);
         const params = callArgs.map((a, i) => ({ localId: `p${i}.0`, name: `p${i}`, type: a.type }));
@@ -472,7 +473,7 @@ function h2HeadersCallbackAdapter(lowerer, node, what, handleKind, withStatus, l
     const toT = funcOf(abiParams.map((p) => p.type), VOID);
     const key = `h2.hdrcb:${handleKind}:${withStatus}:${typeKey(fromT)}:${shapeId ?? ""}`;
     const existing = lowerer.arrHofHelpers.get(key);
-    const name = existing ?? `%h2.hdrcb.${lowerer.arrHofHelpers.size}`;
+    const name = existing ?? keyedHelperName(lowerer, "%h2.hdrcb", key);
     if (!existing) {
         lowerer.arrHofHelpers.set(key, name);
         const impl = `${name}.impl`;
@@ -758,6 +759,7 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
     let port = null;
     let host = null;
     let lookup = null;
+    let dynLookup = null;
     let autoSelect = false;
     let attempt = null;
     let optionThrow = null;
@@ -840,7 +842,19 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
                 lowerer.noLowering(`${member} with a shorthand lookup option`, prop, "spell it out: lookup: theResolver");
             }
             lookup = lowerer.lowerExpr(initializer);
-            if (!lookupFnShapeOk(lowerer, lookup.type)) {
+            // A lookup of Node's own type (net.LookupFunction: options and a
+            // callback taking an address string or list) crosses as a checked-
+            // dynamic function the runtime calls the way Node's dial does.
+            if (!lookupFnShapeOk(lowerer, lookup.type) &&
+                lookup.type.kind === "func" &&
+                lookup.type.params.length === 3 &&
+                canBoxFuncIntoDyn(lookup.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+                dynLookup = { kind: "dynFrom", value: lookup, type: DYN, loc: locOf(initializer) };
+            }
+            else if (lookup.type.kind === "dyn") {
+                dynLookup = lookup;
+            }
+            else if (!lookupFnShapeOk(lowerer, lookup.type)) {
                 lowerer.noLowering(`a ${member} 'lookup' option of '${lowerer.fmt(lookup.type)}' values`, prop, "the lowered resolver is (hostname: string, options: unknown, callback: (err: NodeJS.ErrnoException | null, addresses: { address: string; family: number }[]) => void) => void");
             }
         }
@@ -869,6 +883,18 @@ function lowerNetConnectOptions(lowerer, expr, member, loc) {
             loc,
         };
     }
+    if (dynLookup !== null) {
+        if (args.length !== 1) {
+            lowerer.noLowering(`${member} with a lookup and a connect listener`, expr, "register the listener separately: socket.once('connect', ...)");
+        }
+        return {
+            kind: "libCall",
+            fn: "net.connectLookupDyn",
+            args: [port, host, dynLookup],
+            type: NETSOCKET_T,
+            loc,
+        };
+    }
     if (lookup !== null) {
         if (!autoSelect) {
             lowerer.noLowering(`${member} with a lookup but no autoSelectFamily: true`, optsNode, "the lookup form dials every answered address in order — Node does that under autoSelectFamily: true, so spell it");
@@ -2293,6 +2319,18 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                 loc,
             };
         }
+        if (event === "secure") {
+            // The handshake's completion on a TLS socket (after secureConnect on
+            // a client); plain sockets never fire it.
+            const { cb } = lowerCallbackArg(lowerer, args[1], "secure listeners", 0, () => false, "use ()", []);
+            return {
+                kind: "libCall",
+                fn: "tls.sockOnSecure",
+                args: [receiver, cb, once],
+                type: VOID,
+                loc,
+            };
+        }
         if (event === "session") {
             // The received-ticket event: fires once per TLS client socket with
             // the serialized session (a Buffer); plain sockets never fire it.
@@ -2305,7 +2343,7 @@ function lowerNetSocketMethodCall(lowerer, call, access) {
                 loc,
             };
         }
-        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "lookup", "ready", "timeout", "readable", "secureConnect", and "session" are the supported socket events (as literals)');
+        lowerer.noLowering(`socket.${name}(${event === null ? "non-literal event" : `"${event}"`}, ...)`, args[0], '"data", "end", "close", "error", "connect", "lookup", "ready", "timeout", "readable", "secureConnect", "secure", and "session" are the supported socket events (as literals)');
     }
     lowerer.noLowering(`Socket.${name}`, call, "write, end, destroy, pipe, setTimeout, setKeepAlive, setNoDelay, the address fields, read, unshift, and on/once of data/end/close/error/connect/ready/timeout/readable are the supported Socket members", lowerer.checker.getSymbolAtLocation(access.name));
 }
@@ -2745,7 +2783,7 @@ export function lowerCompatReqStreamOptionalCall(lowerer, call) {
         type: unionT,
         loc,
     };
-    const id = `chain.${lowerer.chainCounter++}`;
+    const id = lowerer.closureName(loc, "", "chain");
     const body = lowerH2StreamMethodCall(lowerer, call, call.expression, {
         kind: "chainRecv",
         id,
@@ -3463,7 +3501,7 @@ function lowerHttpCreateServerForms(lowerer, expr, what, loc) {
     const hasMax = opts.maxHeaderSize !== null;
     const key = `server.opts:${opts.joinDup ? 1 : 0}:${opts.allowMissingHost ? 1 : 0}:${hasBuffer ? 1 : 0}:${hasMax ? 1 : 0}`;
     const existing = lowerer.arrHofHelpers.get(key);
-    const name = existing ?? `%server.opts.${lowerer.arrHofHelpers.size}`;
+    const name = existing ?? keyedHelperName(lowerer, "%server.opts", key);
     if (!existing) {
         lowerer.arrHofHelpers.set(key, name);
         const params = [
@@ -3685,6 +3723,96 @@ export function lowerHttpServerNew(lowerer, expr) {
         return null;
     return lowerHttpCreateServerForms(lowerer, expr, "new http.Server", locOf(expr));
 }
+/** `new tls.TLSSocket(socket, options)` in server mode: a new TLS socket
+ * takes over the socket's connection and runs the server handshake
+ * (scr_tls_wrap_socket). The options record reads at runtime, the
+ * tls.connect precedent. A literal's secureContext member is a
+ * SecureContext handle, which the checked-dynamic record cannot hold, so
+ * it passes as its own argument; members after it must be free of side
+ * effects, because it is read after them. Node never starts the handshake
+ * of a client-mode TLSSocket, so a literal without isServer: true fences
+ * here. */
+export function lowerTlsSocketNew(lowerer, expr) {
+    const callee = expr.expression;
+    const isTlsSocket = (ts.isPropertyAccessExpression(callee) &&
+        callee.name.text === "TLSSocket" &&
+        lowerer.builtinMemberOf(callee)?.module === "tls") ||
+        (ts.isIdentifier(callee) &&
+            lowerer.builtinImportOf(callee)?.module === "tls" &&
+            lowerer.builtinImportOf(callee)?.member === "TLSSocket");
+    if (!isTlsSocket)
+        return null;
+    const loc = locOf(expr);
+    const HINT = "the supported forms are new tls.TLSSocket(socket, { isServer: true, cert, key }) and new tls.TLSSocket(socket, { isServer: true, secureContext })";
+    const args = expr.arguments?.nodes ?? [];
+    if (args.length !== 2 || args.some(ts.isSpreadElement)) {
+        lowerer.noLowering(`new tls.TLSSocket with ${args.length} argument(s)`, expr, HINT);
+    }
+    const socket = lowerer.lowerExpr(args[0]);
+    if (socket.type.kind !== "netSocket") {
+        lowerer.noLowering(`new tls.TLSSocket over a '${lowerer.fmt(socket.type)}' value`, args[0], "the wrapped value must be a net.Socket (a server connection or an http CONNECT socket)");
+    }
+    let optsNode = args[1];
+    while (ts.isParenthesizedExpression(optsNode))
+        optsNode = optsNode.expression;
+    if (!ts.isObjectLiteralExpression(optsNode)) {
+        const o = lowerer.lowerExpr(optsNode);
+        const opts = o.type.kind === "dyn"
+            ? o
+            : canConvertToDyn(o.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))
+                ? { kind: "dynFrom", value: o, type: DYN, loc }
+                : lowerer.noLowering(`new tls.TLSSocket with a '${lowerer.fmt(o.type)}' options record`, optsNode, `${HINT} — a secureContext member lowers in an options object literal`);
+        return { kind: "libCall", fn: "tls.wrapSocket", args: [socket, opts], type: NETSOCKET_T, loc };
+    }
+    const props = optsNode.properties.nodes;
+    const nameOf = (p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
+        (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name))
+        ? p.name.text
+        : null;
+    const isServer = props.find((p) => nameOf(p) === "isServer");
+    if (isServer === undefined ||
+        (ts.isPropertyAssignment(isServer) && isServer.initializer.kind === ts.SyntaxKind.FalseKeyword)) {
+        lowerer.noLowering("new tls.TLSSocket in client mode", optsNode, "Node starts no handshake for a client-mode TLSSocket — pass isServer: true for the server side; tls.connect makes client sockets");
+    }
+    const ctxIndex = props.findIndex((p) => nameOf(p) === "secureContext");
+    if (ctxIndex < 0) {
+        const opts = lowerDynObjectLiteral(lowerer, optsNode);
+        return { kind: "libCall", fn: "tls.wrapSocket", args: [socket, opts], type: NETSOCKET_T, loc };
+    }
+    const ctxProp = props[ctxIndex];
+    const ctxNode = ts.isShorthandPropertyAssignment(ctxProp)
+        ? ctxProp.name
+        : ctxProp.initializer;
+    for (const p of props.slice(ctxIndex + 1)) {
+        const pure = ts.isShorthandPropertyAssignment(p) ||
+            (ts.isPropertyAssignment(p) && sideEffectFreeOptionValue(p.initializer));
+        if (!pure) {
+            lowerer.noLowering("a new tls.TLSSocket options literal with side effects after secureContext", p, "secureContext is read after the other members — move it to the end of the object");
+        }
+    }
+    let ctx = null;
+    const opts = lowerDynObjectLiteral(lowerer, optsNode, (node, value) => {
+        if (node !== ctxNode)
+            return lowerer.coerceToExpected(value, DYN);
+        if (value.type.kind !== "secureCtx") {
+            lowerer.noLowering(`a '${lowerer.fmt(value.type)}' secureContext`, node, "pass a tls.createSecureContext({ cert, key }) result");
+        }
+        ctx = value;
+        return {
+            kind: "dynFrom",
+            value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc },
+            type: DYN,
+            loc,
+        };
+    });
+    return {
+        kind: "libCall",
+        fn: "tls.wrapSocketCtx",
+        args: [socket, opts, ctx],
+        type: NETSOCKET_T,
+        loc,
+    };
+}
 /** Module-function calls on http import bindings: createServer([options][,
  * handler]) and the call-form Server (Node's constructor works without
  * `new` — test/parallel's http.Server(fn) spelling). The handler takes
@@ -3733,13 +3861,15 @@ function lowerHttpModuleCall(lowerer, expr, bi, loc) {
  * runtime-valued (dyn) entry rides the tls.pemDyn extraction, throwing
  * the fence at runtime for non-PEM kinds (the divergence-66 stance).
  * Every other key fences by name; SNICallback gets the pointed hint. */
-function lowerTlsServerOptions(lowerer, node, what) {
+function lowerTlsServerOptions(lowerer, node, what, allowSni = false) {
     if (!ts.isObjectLiteralExpression(node)) {
         lowerer.noLowering(`${what} with a non-literal options argument`, node, "pass the options as an object literal: { cert, key }");
     }
     const loc = locOf(node);
     let cert = null;
     let key = null;
+    let sni;
+    let pendingSni = null;
     for (const prop of node.properties.nodes) {
         let initializer;
         if (ts.isPropertyAssignment(prop) &&
@@ -3753,6 +3883,25 @@ function lowerTlsServerOptions(lowerer, node, what) {
             lowerer.noLowering(`${what} options with computed keys or spreads`, prop, "each option must be a plain `name: value` (or shorthand) entry with a literal key");
         }
         const k = prop.name.text;
+        if (k === "SNICallback" && allowSni) {
+            const value = initializer !== null
+                ? lowerer.lowerExpr(initializer)
+                : lowerer.lowerShorthandValue(prop);
+            const checked = checkSniCallbackValue(lowerer, value, prop, what);
+            if (cert !== null && key !== null) {
+                sni = checked;
+            }
+            else {
+                // The runtime call reads cert and key first. A cert or key entry
+                // after the callback can change the binding the callback reads,
+                // so the callback is saved ahead of the next of them, in source
+                // order.
+                const saved = lowerer.declareHiddenLocal("%sniCallback", checked.type);
+                pendingSni = { kind: "varDecl", localId: saved.id, init: checked, loc: locOf(prop) };
+                sni = varRef(saved.id, checked.type, locOf(prop));
+            }
+            continue;
+        }
         if (k !== "cert" && k !== "key") {
             const init = ts.isPropertyAssignment(prop) ? prop.initializer : null;
             if ((k === "ca" || k === "rejectUnauthorized") &&
@@ -3767,7 +3916,7 @@ function lowerTlsServerOptions(lowerer, node, what) {
                 continue; // Node's false default, spelled out
             }
             fenceOrDropOptionKey(lowerer, prop, k, what, TLS_SERVER_DOCUMENTED_OPTIONS, "cert and key (PEM strings or Buffers) are the supported options", {
-                SNICallback: "SNICallback lowers only on http2.createSecureServer({ allowHTTP1: true, ... }) — serve one cert/key pair here",
+                SNICallback: "SNICallback lowers on tls.createServer and http2.createSecureServer({ allowHTTP1: true, ... }) — serve one cert/key pair here",
                 requestCert: "client-certificate handshakes are not modeled (SEMANTICS.md divergence 55) — requestCert: false is the lowered value",
             });
             continue; // an undocumented key, dropped like Node drops it
@@ -3797,6 +3946,10 @@ function lowerTlsServerOptions(lowerer, node, what) {
         else if (v.type.kind !== "string" && !(v.type.kind === "bytes" && v.type.elem === "u8")) {
             lowerer.noLowering(`a ${what} '${k}' option of '${lowerer.fmt(v.type)}' values`, prop, "cert/key are PEM strings or Buffers here");
         }
+        if (pendingSni !== null) {
+            v = { kind: "seqExpr", stmts: [pendingSni], result: v, type: v.type, loc };
+            pendingSni = null;
+        }
         if (k === "cert")
             cert = v;
         else
@@ -3805,7 +3958,7 @@ function lowerTlsServerOptions(lowerer, node, what) {
     if (cert === null || key === null) {
         lowerer.noLowering(`${what} without both cert and key`, node, "the supported options object is { cert, key } (PEM strings or Buffers)");
     }
-    return { cert, key };
+    return sni === undefined ? { cert, key } : { cert, key, sni };
 }
 /** The options argument of tls/https createServer, split three ways: an
  * object literal takes the static walk above; a RUNTIME (dyn) value — the
@@ -3832,20 +3985,35 @@ const TLS_VALIDATED_OPTIONS = new Set([
     "ticketKeys",
 ]);
 /** True when a literal options bag must ride the runtime walker: JS uses
- * it for the typed TLS validation ladders, and HTTPS uses it for
+ * it for the typed TLS validation ladders, HTTPS uses it for
  * keepAliveTimeoutBuffer so the HTTP option is consumed without losing
- * the literal's evaluation order. */
-function tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions = false) {
+ * the literal's evaluation order, and `runtimeKeys` names options only the
+ * runtime walk implements (tls.createServer's ALPNProtocols). */
+function tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions = false, runtimeKeys = new Set()) {
     const jsSource = isJsSourceFile(ts.getSourceFileOfNode(node));
     return node.properties.nodes.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
         (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) &&
         ((includeHttpTimeoutOptions && p.name.text === "keepAliveTimeoutBuffer") ||
+            runtimeKeys.has(p.name.text) ||
             (jsSource && TLS_VALIDATED_OPTIONS.has(p.name.text))));
 }
-function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptions = false) {
-    if (ts.isObjectLiteralExpression(node) &&
-        !tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions)) {
-        return lowerTlsServerOptions(lowerer, node, what);
+/** tls.createServer options the runtime walk implements and the literal
+ * cert/key lowering does not. */
+const TLS_SERVER_RUNTIME_OPTIONS = new Set([
+    "ALPNProtocols",
+    "minVersion",
+    "maxVersion",
+]);
+function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptions = false, runtimeKeys = new Set(), allowSni = false) {
+    if (ts.isObjectLiteralExpression(node)) {
+        if (!tlsLiteralNeedsRuntimeWalk(node, includeHttpTimeoutOptions, runtimeKeys))
+            return lowerTlsServerOptions(lowerer, node, what, allowSni);
+        const sniOption = node.properties.nodes.find((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
+            (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) &&
+            p.name.text === "SNICallback");
+        if (allowSni && sniOption !== undefined) {
+            lowerer.noLowering(`${what} with SNICallback and options the runtime walk reads`, sniOption, "SNICallback lowers with cert and key; ALPNProtocols, minVersion, maxVersion and the validated options are not combined with it yet");
+        }
     }
     const v = lowerer.lowerExpr(node);
     if (v.type.kind === "dyn")
@@ -3865,13 +4033,13 @@ function lowerTlsServerOptionsOrDyn(lowerer, node, what, includeHttpTimeoutOptio
  * connect(options[, cb]) and connect(port[, host][, options][, cb]) with
  * a RUNTIME options record (the checked-dynamic JS lane's shape — a dyn
  * value, or a record that converts): the runtime walk implements
- * port/host/rejectUnauthorized/ca/servername and throws the catchable
+ * port/host/socket/rejectUnauthorized/ca/servername/ALPNProtocols/minVersion/maxVersion/timeout and throws the catchable
  * fence for other documented members (the divergence-66 stance). The
  * callback (and 'secureConnect'/'connect' listeners) fires
  * post-handshake — Node's secureConnect timing. */
 function lowerTlsConnectCall(lowerer, expr, loc) {
     const args = expr.arguments.nodes;
-    const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/rejectUnauthorized/ca/servername";
+    const FORMS_HINT = "the supported forms are connect(options[, cb]) and connect(port[, host][, options][, cb]) — options implement port/host/socket/rejectUnauthorized/ca/servername/ALPNProtocols/minVersion/maxVersion/timeout";
     if (args.length < 1 || args.length > 4 || args.some(ts.isSpreadElement)) {
         lowerer.noLowering(`tls.connect with ${args.length} arguments`, expr, FORMS_HINT);
     }
@@ -3924,7 +4092,19 @@ function lowerTlsConnectCall(lowerer, expr, loc) {
     // The options value rides whole to the runtime walk: dyn passes
     // directly; a typed record that converts boxes into the checked-dynamic tree.
     let opts;
-    if (optsNode !== null) {
+    let literal = optsNode;
+    while (literal !== null && ts.isParenthesizedExpression(literal))
+        literal = literal.expression;
+    if (literal !== null &&
+        ts.isObjectLiteralExpression(literal) &&
+        literal.properties.nodes.some((p) => (ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)) &&
+            ts.isIdentifier(p.name) &&
+            p.name.text === "socket")) {
+        // A socket member is a handle the record form cannot box: the literal
+        // builds the checked-dynamic object member by member.
+        opts = lowerDynObjectLiteral(lowerer, literal);
+    }
+    else if (optsNode !== null) {
         const o = lowerer.lowerExpr(optsNode);
         if (o.type.kind === "dyn") {
             opts = o;
@@ -3967,10 +4147,24 @@ function lowerTlsModuleCall(lowerer, expr, bi, loc) {
         if (args.length < 1 || args.length > 2) {
             lowerer.noLowering(`createServer with ${args.length} arguments`, expr, "the supported form is createServer({ cert, key }, socket => ...)");
         }
-        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "tls.createServer");
+        const opts = lowerTlsServerOptionsOrDyn(lowerer, args[0], "tls.createServer", false, TLS_SERVER_RUNTIME_OPTIONS, true);
         if (args.length === 1) {
-            return opts.dyn !== undefined
-                ? { kind: "libCall", fn: "tls.createServerDyn", args: [opts.dyn], type: NETSERVER_T, loc }
+            if (opts.dyn !== undefined)
+                return {
+                    kind: "libCall",
+                    fn: "tls.createServerDyn",
+                    args: [opts.dyn],
+                    type: NETSERVER_T,
+                    loc,
+                };
+            return opts.sni !== undefined
+                ? {
+                    kind: "libCall",
+                    fn: "tls.createServerSni",
+                    args: [opts.cert, opts.key, opts.sni],
+                    type: NETSERVER_T,
+                    loc,
+                }
                 : {
                     kind: "libCall",
                     fn: "tls.createServer",
@@ -3980,13 +4174,21 @@ function lowerTlsModuleCall(lowerer, expr, bi, loc) {
                 };
         }
         const { cb } = lowerCallbackArg(lowerer, args[1], "secureConnection listeners", 1, (p) => p.kind === "netSocket", "use (socket) or ()", [NETSOCKET_T]);
-        return opts.dyn !== undefined
-            ? {
+        if (opts.dyn !== undefined)
+            return {
                 kind: "libCall",
                 fn: "tls.createServerDynCb",
                 args: [opts.dyn, cb],
                 type: NETSERVER_T,
                 loc,
+            };
+        return opts.sni !== undefined
+            ? {
+                kind: "libCall",
+                fn: "tls.createServerSniCb",
+                args: [opts.cert, opts.key, opts.sni, cb],
+                type: NETSERVER_T,
+                loc,
             }
             : {
                 kind: "libCall",
@@ -4279,6 +4481,40 @@ const HTTP2_IGNORED_TUNING_OPTIONS = new Set([
 const SNI_HINT = "SNICallback lowers as a direct option or the conditional spread " +
     "...(x ? { SNICallback: x } : {}) — the callback is (servername, cb) => void " +
     "with cb: (err: Error | null, ctx?: tls.SecureContext) => void";
+/** An SNICallback option value: (servername: string, cb) => void where cb
+ * is (err: Error | null, ctx?: SecureContext) => void, or that function
+ * unioned with undefined (no callback). cb may declare fewer params (the
+ * emitted answer thunk matches its ABI), but what it does declare must
+ * carry the arms the thunk decodes. */
+function lowerSniCallbackValue(lowerer, node, blame, what) {
+    return checkSniCallbackValue(lowerer, lowerer.lowerExpr(node), blame, what);
+}
+function checkSniCallbackValue(lowerer, v, blame, what) {
+    const shapeOk = (t) => {
+        if (t.kind !== "func" || t.ret.kind !== "void" || t.params.length !== 2)
+            return false;
+        if (t.params[0].kind !== "string")
+            return false;
+        const cbT = t.params[1];
+        if (cbT.kind !== "func" || cbT.ret.kind !== "void" || cbT.params.length > 2)
+            return false;
+        const armKinds = (u) => u.kind === "union" ? (lowerer.unions.get(u.unionId)?.arms ?? []).map((a) => a.kind) : [];
+        const p0 = cbT.params[0];
+        if (p0 !== undefined && !armKinds(p0).includes("nullT"))
+            return false;
+        const p1 = cbT.params[1];
+        if (p1 !== undefined && !armKinds(p1).includes("secureCtx"))
+            return false;
+        return true;
+    };
+    const arms = v.type.kind === "union" ? (lowerer.unions.get(v.type.unionId)?.arms ?? []) : [];
+    const funcArm = v.type.kind === "func" ? v.type : arms.find((a) => a.kind === "func");
+    const unionOk = v.type.kind !== "union" || (arms.length === 2 && arms.some((a) => a.kind === "undefinedT"));
+    if (funcArm === undefined || !unionOk || !shapeOk(funcArm)) {
+        lowerer.noLowering(`a ${what} SNICallback of '${lowerer.fmt(v.type)}' values`, blame, SNI_HINT);
+    }
+    return v;
+}
 /** Strips parentheses and type assertions: the portless spelling wraps
  * an options spread as `...({ ... } as Record<string, unknown>)`. */
 function stripParensAndCasts(node) {
@@ -4490,41 +4726,8 @@ function lowerHttp2ModuleCall(lowerer, expr, bi, loc) {
         let sni = null;
         let allowHttp1 = false;
         let enableConnectProtocol = false;
-        // The SNICallback value shape: (servername: string, cb) => void where
-        // cb is (err: Error | null, ctx?: SecureContext) => void — cb may
-        // declare fewer params (the emitted answer thunk matches its ABI),
-        // but what it does declare must carry the arms the thunk decodes.
-        const sniShapeOk = (t) => {
-            if (t.kind !== "func" || t.ret.kind !== "void" || t.params.length !== 2)
-                return false;
-            if (t.params[0].kind !== "string")
-                return false;
-            const cbT = t.params[1];
-            if (cbT.kind !== "func" || cbT.ret.kind !== "void" || cbT.params.length > 2)
-                return false;
-            const armKinds = (u) => u.kind === "union" ? (lowerer.unions.get(u.unionId)?.arms ?? []).map((a) => a.kind) : [];
-            const p0 = cbT.params[0];
-            if (p0 !== undefined && !armKinds(p0).includes("nullT"))
-                return false;
-            const p1 = cbT.params[1];
-            if (p1 !== undefined && !armKinds(p1).includes("secureCtx"))
-                return false;
-            return true;
-        };
         const lowerSniValue = (node, blame) => {
-            const v = lowerer.lowerExpr(node);
-            const funcArm = v.type.kind === "func"
-                ? v.type
-                : v.type.kind === "union"
-                    ? (lowerer.unions.get(v.type.unionId)?.arms ?? []).find((a) => a.kind === "func")
-                    : undefined;
-            const unionOk = v.type.kind !== "union" ||
-                ((lowerer.unions.get(v.type.unionId)?.arms ?? []).length === 2 &&
-                    (lowerer.unions.get(v.type.unionId)?.arms ?? []).some((a) => a.kind === "undefinedT"));
-            if (funcArm === undefined || !unionOk || !sniShapeOk(funcArm)) {
-                lowerer.noLowering(`a createSecureServer SNICallback of '${lowerer.fmt(v.type)}' values`, blame, SNI_HINT);
-            }
-            sni = v;
+            sni = lowerSniCallbackValue(lowerer, node, blame, "createSecureServer");
         };
         const lowerOption = (prop) => {
             if (ts.isSpreadAssignment(prop)) {
@@ -6150,7 +6353,7 @@ function lowerHttpResMethodCall(lowerer, call, access) {
             const all = [...callArgs, cb];
             const key = `server.endcb:${fn}:${all.map((a) => typeKey(a.type)).join(",")}`;
             const existing = lowerer.arrHofHelpers.get(key);
-            const helper = existing ?? `%server.endcb.${lowerer.arrHofHelpers.size}`;
+            const helper = existing ?? keyedHelperName(lowerer, "%server.endcb", key);
             if (!existing) {
                 lowerer.arrHofHelpers.set(key, helper);
                 const params = all.map((a, i) => ({ localId: `p${i}.0`, name: `p${i}`, type: a.type }));