@scriptc/compiler 0.4.8 → 0.4.9

package/dist/frontend/lowering/lower-server.js

@@ -4,7 +4,7 @@ import { dynUndefinedExpr, nodeThrowExpr, boolLit, numLit, strLit, varRef, } fro
 import * as ts from "../ts7/adapter.js";
 import { ladderFenceExpr } from "./lowerer.js";
 import { isJsSourceFile, locOf } from "../program.js";
-import { arrayOf, BOOL, BYTES_U8, canBoxFuncIntoDyn, canConvertToDyn, DYN, DYN_HANDLE_KINDS, F64, funcOf, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, NETSERVER_T, NETSOCKET_T, NULL_T, SECURECTX_T, STRING, UNDEFINED_T, typeKey, VOID, } from "../../ir/ir.js";
+import { arrayOf, BOOL, BYTES_U8, canBoxFuncIntoDyn, canConvertToDyn, DYN, DYN_HANDLE_KINDS, F64, funcOf, HTTP2SESSION_T, HTTP2STREAM_T, HTTPCLIENTREQ_T, HTTPREQ_T, HTTPRES_T, NETSERVER_T, NETSOCKET_T, NULL_T, SECURECTX_T, STRING, UNDEFINED_T, sortArms, typeKey, VOID, } from "../../ir/ir.js";
 import { AGENT_DOCUMENTED_OPTIONS, HTTPS_AGENT_DOCUMENTED_OPTIONS, builtinFenceHintOf, builtinModuleFnOf, fenceOrDropOptionKey, HTTP_CLIENT_DOCUMENTED_OPTIONS, HTTP_SERVER_DOCUMENTED_OPTIONS, HTTP2_SECURE_SERVER_DOCUMENTED_OPTIONS, HTTPS_CLIENT_DOCUMENTED_OPTIONS, sideEffectFreeOptionValue, TLS_SERVER_DOCUMENTED_OPTIONS, } from "./surfaces.js";
 import { conditionalSpreadOf, lowerDynObjectLiteral } from "./expressions/object-literals.js";
 import { resultIsDiscarded } from "./call-position.js";
@@ -424,7 +424,7 @@ function headerParamShapeId(cbT, idx) {
  * with no static param type to read the shape from). */
 function canonicalHeaderRecord(lowerer) {
     const arms = [F64, STRING, arrayOf(STRING), UNDEFINED_T];
-    arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+    sortArms(arms);
     const slot = { kind: "union", unionId: lowerer.unions.intern(arms) };
     const shapeId = lowerer.shapes.intern([], false, slot, []);
     return { type: { kind: "record", shapeId }, shapeId };
@@ -4136,6 +4136,9 @@ function lowerHttpModuleCall(lowerer, expr, bi, loc) {
  * Buffers (fs.readFileSync either way — portless reads Buffers) — a
  * runtime-valued (dyn) entry rides the tls.pemDyn extraction, throwing
  * the fence at runtime for non-PEM kinds (the divergence-66 stance).
+ * With an SNICallback the default pair may be absent (Node serves each
+ * handshake from the answered context), so a missing cert or key lowers
+ * to an empty value the runtime reads as "no default material".
  * Every other key fences by name; SNICallback gets the pointed hint. */
 function lowerTlsServerOptions(lowerer, node, what, allowSni = false) {
     if (!ts.isObjectLiteralExpression(node)) {
@@ -4187,7 +4190,7 @@ function lowerTlsServerOptions(lowerer, node, what, allowSni = false) {
                 continue;
             }
             fenceOrDropOptionKey(lowerer, prop, k, what, TLS_SERVER_DOCUMENTED_OPTIONS, "cert and key (PEM strings or Buffers) are the supported options", {
-                SNICallback: "SNICallback lowers on tls.createServer and http2.createSecureServer({ allowHTTP1: true, ... }) — serve one cert/key pair here",
+                SNICallback: "SNICallback lowers on tls.createServer (with or without a default cert/key pair) and on http2.createSecureServer({ allowHTTP1: true, ... })",
             });
             continue; // an undocumented key, dropped like Node drops it
         }
@@ -4226,7 +4229,24 @@ function lowerTlsServerOptions(lowerer, node, what, allowSni = false) {
             key = v;
     }
     if (cert === null || key === null) {
-        lowerer.noLowering(`${what} without both cert and key`, node, "the supported options object is { cert, key } (PEM strings or Buffers)");
+        if (sni === undefined) {
+            lowerer.noLowering(`${what} without both cert and key`, node, "the supported options object is { cert, key } (PEM strings or Buffers), or { SNICallback } to serve every handshake from the callback's context");
+        }
+        // Node accepts SNICallback without a default pair: the default context
+        // then serves no certificate and the answered context supplies the
+        // handshake's. An empty value carries "absent" to the runtime.
+        const absent = () => ({ kind: "strLit", value: "", type: STRING, loc });
+        if (cert === null)
+            cert = absent();
+        if (key === null)
+            key = absent();
+        // No cert/key entry followed the callback, so the saved read is
+        // attached to the callback argument: it then runs after the entries
+        // that did precede it, as the literal evaluated them.
+        if (pendingSni !== null) {
+            sni = { kind: "seqExpr", stmts: [pendingSni], result: sni, type: sni.type, loc };
+            pendingSni = null;
+        }
     }
     return sni === undefined ? { cert, key } : { cert, key, sni };
 }
@@ -4561,14 +4581,66 @@ export function lowerTlsRootCertificates(lowerer, bi, loc) {
         return null;
     return { kind: "libCall", fn: "tlsca.root", args: [], type: arrayOf(STRING), loc };
 }
+/** True when a declaration runs at most once, as a statement of the module
+ * body itself. A declaration inside a loop runs once per iteration and each
+ * iteration has its own binding in JS, so it takes the hidden-local storage
+ * instead: its declaration statement allocates the box every pass, and the
+ * closures made in a pass keep that pass's box. */
+function moduleScopeDecl(decl) {
+    for (let node = decl.parent; node !== undefined; node = node.parent) {
+        if (ts.isSourceFile(node))
+            return true;
+        if (ts.isFunctionLike(node))
+            return false;
+        if (ts.isForStatement(node) ||
+            ts.isForOfStatement(node) ||
+            ts.isForInStatement(node) ||
+            ts.isWhileStatement(node) ||
+            ts.isDoStatement(node)) {
+            return false;
+        }
+    }
+    return false;
+}
 export function httpClientFnBindingOf(lowerer, sym) {
     return lowerer.httpClientFnBindings.get(sym);
 }
 /** The { module, member } of an http/https client-function REFERENCE
  * (`https.request` through a namespace import, or a named `request`
  * import binding) — null for anything else. */
-function clientFnRefOf(lowerer, node) {
-    const e = node;
+function clientFnRefOf(lowerer, node, seen = new Set()) {
+    let e = node;
+    while (ts.isParenthesizedExpression(e))
+        e = e.expression;
+    if (ts.isIdentifier(e)) {
+        // An alias of a client function (`const httpsRequest = https.request`),
+        // registered or not yet lowered: a const binding names the same
+        // function the declaration's initializer names. An import binding
+        // resolves through to the exporting declaration.
+        let sym = lowerer.resolveValueSymbol(e);
+        if (sym && (sym.flags & ts.SymbolFlags.Alias) !== 0) {
+            try {
+                sym = lowerer.checker.getAliasedSymbol(sym);
+            }
+            catch {
+                // Leave the alias symbol in place; its declarations decide.
+            }
+        }
+        if (sym && !seen.has(sym)) {
+            const projection = lowerer.staticCallables.get(sym);
+            if (projection?.kind === "client-function") {
+                return { module: projection.module, member: projection.member };
+            }
+            const decl = sym.declarations[0];
+            if (decl !== undefined &&
+                ts.isVariableDeclaration(decl) &&
+                (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0 &&
+                decl.initializer !== undefined) {
+                seen.add(sym);
+                return clientFnRefOf(lowerer, decl.initializer, seen);
+            }
+        }
+    }
     const bi = ts.isPropertyAccessExpression(e)
         ? lowerer.builtinMemberOf(e)
         : ts.isIdentifier(e)
@@ -4642,20 +4714,17 @@ function neverReassigned(lowerer, sym) {
     visit(root);
     return !written;
 }
-/** Recognizes `const x = cond ? <client A> : <client B>` where A and B
- * are the SAME member (request/get) of https and http (either order) —
- * registers the binding (calls lower; the declaration itself binds
- * nothing) and answers true. A matched ternary whose condition is not a
- * stable identifier fences pointedly; non-client ternaries answer false
- * (the ordinary decl path and its per-arm fences apply). */
-export function registerHttpClientFnBinding(lowerer, nameNode, init) {
+/** The `cond ? <client A> : <client B>` shape where A and B are the SAME
+ * member (request/get) of https and http (either order) — null for any
+ * other initializer. Every other pair fences pointedly. */
+function clientFnConditionalOf(lowerer, init) {
     if (!init)
-        return false;
+        return null;
     let e = init;
     while (ts.isParenthesizedExpression(e))
         e = e.expression;
     if (!ts.isConditionalExpression(e))
-        return false;
+        return null;
     const unwrap = (a) => {
         let x = a;
         while (ts.isParenthesizedExpression(x))
@@ -4665,30 +4734,110 @@ export function registerHttpClientFnBinding(lowerer, nameNode, init) {
     const t = clientFnRefOf(lowerer, unwrap(e.whenTrue));
     const f = clientFnRefOf(lowerer, unwrap(e.whenFalse));
     if (!t || !f)
-        return false;
+        return null;
     if (t.member !== f.member || t.module === f.module) {
         lowerer.noLowering("a conditional between these two client functions", e, "the lowered shape is `cond ? https.request : http.request` (or the .get pair, either order) — the same member of both modules");
     }
-    const cond = unwrap(e.condition);
-    const condSym = ts.isIdentifier(cond) ? lowerer.resolveValueSymbol(cond) : null;
-    if (!condSym || !neverReassigned(lowerer, condSym)) {
-        lowerer.noLowering("a client-function conditional with this condition shape", e.condition, "the condition must be a bare identifier whose binding is never reassigned (it re-evaluates at each call through the binding)");
+    return { cond: unwrap(e.condition), trueSecure: t.module === "https", member: t.member };
+}
+/** Whether a condition is a bare identifier over a never-reassigned
+ * binding: a pure, stable read that may be re-lowered at each call. */
+function stableConditionOf(lowerer, cond) {
+    const sym = ts.isIdentifier(cond) ? lowerer.resolveValueSymbol(cond) : null;
+    return sym !== null && neverReassigned(lowerer, sym);
+}
+/** Recognizes a `const x = cond ? <client A> : <client B>` declaration and
+ * registers it for the paths that emit no storage: calls lower as the
+ * runtime-secure client, the condition re-lowered per call. Only a stable
+ * identifier read qualifies here — every other condition is captured once
+ * by lowerHttpClientFnBindingDecl. Non-client ternaries answer false (the
+ * ordinary decl path and its per-arm fences apply). */
+export function registerHttpClientFnBinding(lowerer, nameNode, init) {
+    const shape = clientFnConditionalOf(lowerer, init);
+    if (!shape)
+        return false;
+    if (!stableConditionOf(lowerer, shape.cond)) {
+        lowerer.noLowering("a client-function conditional with this condition shape", shape.cond, "the condition is evaluated once at the declaration; this declaration form has no place to keep it — declare the binding as a const statement");
     }
     const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
-    if (symbol) {
+    if (symbol)
+        lowerer.httpClientFnBindings.set(symbol, shape);
+    return true;
+}
+/** The declaration of a `cond ? <client A> : <client B>` binding, which
+ * answers false when the initializer is not that shape. A stable
+ * identifier condition emits nothing (calls re-lower the pure read);
+ * every other condition is evaluated ONCE here, exactly Node's ternary,
+ * into a hidden bool that calls read. */
+export function lowerHttpClientFnBindingDecl(lowerer, decl) {
+    const shape = clientFnConditionalOf(lowerer, decl.initializer);
+    if (!shape)
+        return false;
+    const symbol = ts.isIdentifier(decl.name)
+        ? lowerer.checker.getSymbolAtLocation(decl.name)
+        : undefined;
+    if (!symbol)
+        return false;
+    if (stableConditionOf(lowerer, shape.cond)) {
+        lowerer.httpClientFnBindings.set(symbol, shape);
+        return null;
+    }
+    const loc = locOf(decl);
+    const secure = lowerer.lowerCondition(shape.cond);
+    if (moduleScopeDecl(decl)) {
+        const sf = ts.getSourceFileOfNode(decl);
+        const rawTag = lowerer.fileTag.get(sf) ?? "";
+        const tag = rawTag === "" ? "e." : rawTag.replace(/^%/, "");
+        const id = `%g.${tag}%clientFnSecure.${lowerer.globalsList.length}`;
+        lowerer.globalsList.push({ id, name: "%clientFnSecure", type: BOOL, mutable: true });
         lowerer.httpClientFnBindings.set(symbol, {
-            cond,
-            trueSecure: t.module === "https",
-            member: t.member,
+            ...shape,
+            secureStorage: { kind: "global", id },
         });
+        return { kind: "assign", localId: id, value: secure, loc };
     }
-    return true;
+    const local = lowerer.declareHiddenLocal("%clientFnSecure", BOOL);
+    lowerer.httpClientFnBindings.set(symbol, {
+        ...shape,
+        secureStorage: { kind: "local", local, owner: lowerer.ctx },
+    });
+    return { kind: "varDecl", localId: local.id, init: secure, loc };
+}
+/** A read of a binding's saved condition bool: the module global at module
+ * scope, or the hidden local itself at the declaring function and a threaded
+ * capture inside a function that one encloses. A local miss means the owner
+ * context is gone, which no declaration a use can reach should allow; it is
+ * surfaced as a fence rather than a reference the backend cannot see. */
+export function httpClientSecureRef(lowerer, binding, node, loc) {
+    const storage = binding.secureStorage;
+    if (storage.kind === "global")
+        return { kind: "varRef", localId: storage.id, type: BOOL, loc };
+    const local = lowerer.captureHiddenLocal(storage.local, storage.owner);
+    if (local === null) {
+        lowerer.noLowering("a client function chosen at run time, used outside the function that declared it", node, "declare the binding and use it inside the same function (a nested function in that function can use it)");
+    }
+    return { kind: "varRef", localId: local.id, type: BOOL, loc };
+}
+/** The client-function REFERENCE an expression names (a module member, a
+ * named import binding, or an immutable alias chain to either), for call
+ * sites that are not the direct member form. */
+export function httpClientFnRefOf(lowerer, node) {
+    return clientFnRefOf(lowerer, node);
 }
 /** A call THROUGH a registered requestFn binding: the http client
  * lowering with the RUNTIME-secure extras (the binding mode). */
 export function lowerHttpClientFnCall(lowerer, expr, binding, loc) {
     return lowerHttpClientCall(lowerer, expr, binding.member, loc, binding);
 }
+/** A call through an immutable alias of a client function
+ * (`const httpsRequest = https.request; httpsRequest(...)`): the same
+ * lowering a direct `https.request(...)` call gets, so the alias adds no
+ * runtime indirection and the secure defaults follow the module it names. */
+export function lowerHttpClientFnRefCall(lowerer, expr, ref, loc) {
+    return ref.module === "https"
+        ? lowerHttpsModuleCall(lowerer, expr, ref, loc)
+        : lowerHttpModuleCall(lowerer, expr, ref, loc);
+}
 /** Module-function calls on https import bindings: createServer(options,
  * handler) and request/get — the http client lowering with the secure
  * extras (port 443 default, rejectUnauthorized, ca). */
@@ -5340,11 +5489,15 @@ function lowerUrlFormOptions(lowerer, node) {
 function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
     const binding = typeof secure === "object" ? secure : null;
     const secureish = binding !== null || secure === true;
-    /** A FRESH lowering of the binding's secure condition (pure identifier
-     * read — each use is its own IR). */
+    /** The binding's secure condition: the declaration-time capture when the
+     * condition was not a stable identifier read, otherwise a FRESH lowering
+     * of the pure identifier (each use is its own IR). */
     const secureExpr = () => {
-        const c = lowerer.lowerCondition(binding.cond);
-        return binding.trueSecure ? c : { kind: "unary", op: "!", operand: c, type: BOOL, loc };
+        const b = binding;
+        const c = b.secureStorage !== undefined
+            ? httpClientSecureRef(lowerer, b, expr, loc)
+            : lowerer.lowerCondition(b.cond);
+        return b.trueSecure ? c : { kind: "unary", op: "!", operand: c, type: BOOL, loc };
     };
     const args = expr.arguments.nodes;
     if (args.length < 1 || args.length > 3) {
@@ -5359,30 +5512,48 @@ function lowerHttpClientCall(lowerer, expr, member, loc, secure = false) {
         // Only the URL form has a middle options argument: (url, options, cb).
         lowerer.noLowering(`${member} with 3 arguments`, expr, `the supported forms are ${member}(options[, callback]) and ${member}(url, options[, callback])`);
     }
-    const runtimeOptions = binding === null ? runtimeRequestOptions(lowerer, optsNode, secureish) : null;
+    const runtimeOptions = runtimeRequestOptions(lowerer, optsNode, secureish);
     if (runtimeOptions !== null) {
         // The options record is read at run time (the ClientRequest
         // constructor's walk in the runtime): a RequestOptions variable, or a
-        // literal that spreads one or sets socketPath.
+        // literal that spreads one or sets socketPath. A binding's secure bool
+        // travels with the walk so the dial follows the same runtime choice.
         const autoEnd = boolLit(member === "get", loc);
         const secureDyn = secure === true;
-        if (args.length === 1) {
+        const call = (cb) => {
+            if (binding !== null) {
+                const secureArg = secureExpr();
+                return {
+                    kind: "libCall",
+                    fn: cb === null ? "https.requestFnDyn" : "https.requestFnDynCb",
+                    args: cb === null
+                        ? [secureArg, runtimeOptions, autoEnd]
+                        : [secureArg, runtimeOptions, autoEnd, cb],
+                    type: HTTPCLIENTREQ_T,
+                    loc,
+                };
+            }
+            if (cb === null) {
+                return {
+                    kind: "libCall",
+                    fn: secureDyn ? "https.requestDyn" : "http.requestDyn",
+                    args: [runtimeOptions, autoEnd],
+                    type: HTTPCLIENTREQ_T,
+                    loc,
+                };
+            }
             return {
                 kind: "libCall",
-                fn: secureDyn ? "https.requestDyn" : "http.requestDyn",
-                args: [runtimeOptions, autoEnd],
+                fn: secureDyn ? "https.requestDynCb" : "http.requestDynCb",
+                args: [runtimeOptions, autoEnd, cb],
                 type: HTTPCLIENTREQ_T,
                 loc,
             };
-        }
-        const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
-        return {
-            kind: "libCall",
-            fn: secureDyn ? "https.requestDynCb" : "http.requestDynCb",
-            args: [runtimeOptions, autoEnd, cb],
-            type: HTTPCLIENTREQ_T,
-            loc,
         };
+        if (args.length === 1)
+            return call(null);
+        const { cb } = lowerCallbackArg(lowerer, args[1], "response callbacks", 1, (p) => p.kind === "httpReq", "use (res) or ()", [HTTPREQ_T]);
+        return call(cb);
     }
     if (!ts.isObjectLiteralExpression(optsNode)) {
         const t = optsType;