gofront 1.3.12 → 1.5.1

package/src/dev-server.js

@@ -1,7 +1,7 @@
 // Minimal dev server for gofront --serve watch mode.
 // Serves static files and pushes reload / error / css-update events via SSE.
 
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { createServer } from "node:http";
 import { extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { colors, log } from "./colors.js";
@@ -9,8 +9,10 @@ import { colors, log } from "./colors.js";
 export const MIME = {
 	".html": "text/html; charset=utf-8",
 	".js": "application/javascript; charset=utf-8",
+	".wasm": "application/wasm",
 	".css": "text/css; charset=utf-8",
 	".json": "application/json; charset=utf-8",
+	".map": "application/json; charset=utf-8",
 	".go": "text/plain; charset=utf-8",
 	".svg": "image/svg+xml",
 	".png": "image/png",
@@ -151,7 +153,11 @@ function handleSseRequest(req, res, clients, lastError = null) {
 	if (lastError)
 		res.write(`event: build-error\ndata: ${JSON.stringify(lastError)}\n\n`);
 	clients.add(res);
-	req.on?.("close", () => clients.delete(res));
+	const cleanup = () => clients.delete(res);
+	req.on?.("close", cleanup);
+	res.on?.("close", cleanup);
+	res.on?.("finish", cleanup);
+	res.on?.("error", cleanup);
 }
 
 function resolveStaticPath(serveDir, urlPath) {
@@ -161,49 +167,73 @@ function resolveStaticPath(serveDir, urlPath) {
 			: urlPath.startsWith("/")
 				? urlPath
 				: `/${urlPath}`;
-	const filePath = resolve(serveDir, `.${cleanPath}`);
-	if (!isInsideDir(resolve(serveDir), filePath)) return { forbidden: true };
+	const rootPath = existsSync(serveDir)
+		? realpathSync(resolve(serveDir))
+		: resolve(serveDir);
+	const filePath = resolve(rootPath, `.${cleanPath}`);
+	if (!isInsideDir(rootPath, filePath)) return { forbidden: true };
 
 	if (existsSync(filePath)) {
-		const stat = statSync(filePath);
+		const realTarget = realpathSync(filePath);
+		if (!isInsideDir(rootPath, realTarget)) return { forbidden: true };
+		const stat = statSync(realTarget);
 		if (stat.isDirectory()) {
-			const dirIndex = join(filePath, "index.html");
-			if (existsSync(dirIndex)) return { filePath: dirIndex };
-			const rootIndex = join(serveDir, "index.html");
-			if (existsSync(rootIndex)) return { filePath: rootIndex };
+			const dirIndex = join(realTarget, "index.html");
+			if (
+				existsSync(dirIndex) &&
+				isInsideDir(rootPath, realpathSync(dirIndex))
+			) {
+				return { filePath: dirIndex };
+			}
+			const rootIndex = join(rootPath, "index.html");
+			if (
+				existsSync(rootIndex) &&
+				isInsideDir(rootPath, realpathSync(rootIndex))
+			) {
+				return { filePath: rootIndex };
+			}
 			return { notFound: true };
 		}
-		return { filePath };
+		return { filePath: realTarget };
 	}
 
 	// SPA fallback: clean paths with no file extension fall back to index.html
 	if (!extname(cleanPath)) {
-		const indexPath = join(serveDir, "index.html");
+		const indexPath = join(rootPath, "index.html");
 		if (existsSync(indexPath)) return { filePath: indexPath };
 	}
 
 	return { notFound: true };
 }
 
-function sendStaticFile(res, filePath, shouldInject) {
+function sendStaticFile(res, filePath, shouldInject, req = null) {
 	try {
 		const ext = extname(filePath);
+		const isHead = req?.method === "HEAD";
 		if (ext === ".html") {
 			const data = readFileSync(filePath, "utf8");
 			const body = shouldInject ? injectLiveReload(data) : data;
 			res.writeHead(200, {
 				"Content-Type": MIME[".html"],
+				"X-Content-Type-Options": "nosniff",
 				"Cache-Control": "no-cache, no-store, must-revalidate",
 			});
-			res.end(body);
+			if (isHead) res.end();
+			else res.end(body);
 			return;
 		}
 
 		const data = readFileSync(filePath);
 		res.writeHead(200, {
 			"Content-Type": MIME[ext] ?? "application/octet-stream",
-			"Cache-Control": "no-cache, no-store, must-revalidate",
+			"X-Content-Type-Options": "nosniff",
+			"Cache-Control":
+				ext === ".wasm" ? "no-store" : "no-cache, no-store, must-revalidate",
 		});
+		if (isHead) {
+			res.end();
+			return;
+		}
 		res.end(data);
 	} catch {
 		res.writeHead(500, { "Content-Type": "text/plain" });
@@ -218,7 +248,18 @@ export function handleDevRequest(
 	clients = new Set(),
 	options = {},
 ) {
+	if (req.method && req.method !== "GET" && req.method !== "HEAD") {
+		res.writeHead(405, { "Content-Type": "text/plain", Allow: "GET, HEAD" });
+		res.end("Method Not Allowed");
+		return;
+	}
+
 	if (req.url === "/_gofront/events") {
+		if (req.method && req.method !== "GET") {
+			res.writeHead(405, { "Content-Type": "text/plain", Allow: "GET" });
+			res.end("Method Not Allowed");
+			return;
+		}
 		handleSseRequest(req, res, clients, options.getLastError?.() ?? null);
 		return;
 	}
@@ -240,7 +281,7 @@ export function handleDevRequest(
 		return;
 	}
 
-	sendStaticFile(res, resolved.filePath, options.injectReload ?? true);
+	sendStaticFile(res, resolved.filePath, options.injectReload ?? true, req);
 }
 
 function broadcastToClients(clients, event, payload) {

package/src/index.js

@@ -18,12 +18,13 @@ import { createRequire } from "node:module";
 const _require = createRequire(import.meta.url);
 const { version } = _require("../package.json");
 
-import { mkdirSync, statSync, watch, writeFileSync } from "node:fs";
+import { statSync, watch } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { copyAssets } from "./asset-manager.js";
 import {
 	formatBuildSummary,
 	formatPrepSummary,
+	formatWrittenDesc,
 	handleBuild,
 	handleCheck,
 	handleDev,
@@ -37,6 +38,7 @@ import {
 	parsePrepArgs,
 	parseTestArgs,
 	runCompile,
+	writeCompileOutput,
 } from "./cli-core.js";
 import { colors, formatDiagnostic, log, ms, stamp } from "./colors.js";
 import { createDevServer } from "./dev-server.js";
@@ -56,14 +58,14 @@ GoFront — a Go-inspired language that compiles to JavaScript
 
 Usage:
   gofront dev [dir] [options]    Start dev server with live reload (default port 3000)
-  gofront build [dir] [options]  Build production bundle (-o <dir>, --pwa, --minify)
+  gofront build [dir] [options]  Build production bundle (-o <dir>, --pwa, --minify, --emit-wat)
   gofront check [dir|dir/...]    Type-check only (dir/... recurses into every package)
   gofront test [dir|dir/...] [--dom]  Run unit tests (-v verbose, -run <regex>)
   gofront prep [dir] [--minify]  Copy static assets and bundle vendor dependencies
   gofront init [dir]             Scaffold a new GoFront project
   gofront <file.go>              Compile single file and print to stdout
   gofront <dir>  (or gofront .)  Compile all *.go in directory as one bundle
-  gofront <input> -o out.js      Compile and write to file
+  gofront <input> -o out.js      Compile and write to file (wasm packages also emit app.wasm)
   gofront <input> --check        Type-check only
   gofront <input> --watch        Watch for changes and recompile
   gofront <input> -o out.js --serve          Watch + serve with live reload (default port 3000)
@@ -180,7 +182,7 @@ if (args[0] === "dev") {
 		if (dev.initialError) {
 			log.error(dev.initialError.message);
 		} else {
-			log.ok(`— wrote ${colors.cyan(dev.outputFile)}`);
+			log.ok(`— wrote ${formatWrittenDesc(dev.written, dev.outputFile)}`);
 		}
 		log.info(
 			`dev server running → ${colors.cyan(`http://localhost:${dev.port}`)}`,
@@ -276,15 +278,21 @@ if (!watchMode) {
 
 	if (outputFile) {
 		try {
-			mkdirSync(dirname(resolve(outputFile)), { recursive: true });
-			writeFileSync(outputFile, `${js}\n`);
-			log.info(`wrote ${colors.cyan(outputFile)} ${ms(elapsedMs)}`);
+			const written = writeCompileOutput(resolve(outputFile), result, js);
+			log.info(
+				`wrote ${formatWrittenDesc(written, outputFile)} ${ms(elapsedMs)}`,
+			);
 		} catch (e) {
 			log.fail(`cannot write '${outputFile}': ${e.message}`);
 			process.exit(1);
 		}
 	} else {
 		console.log(js);
+		if (result.wasm) {
+			log.warn(
+				"wasm packages were linked but app.wasm needs -o <file> to be written",
+			);
+		}
 	}
 
 	if (copyAssetsFlag) {
@@ -328,9 +336,9 @@ function buildOnce(changedFile = null) {
 		const changeNote = changedFile ? ` — ${changedFile} changed` : "";
 		const timing = colors.dim(`(${elapsedMs}ms${changeNote})`);
 		if (outputFile) {
-			writeFileSync(outputFile, `${js}\n`);
+			const written = writeCompileOutput(resolve(outputFile), result, js);
 			console.error(
-				`${stamp()} ${colors.bold("gofront:")} ${colors.green("OK")} — wrote ${colors.cyan(outputFile)} ${timing}`,
+				`${stamp()} ${colors.bold("gofront:")} ${colors.green("OK")} — wrote ${formatWrittenDesc(written, outputFile)} ${timing}`,
 			);
 		} else {
 			// Clear screen then print

package/src/lexer.js

@@ -111,6 +111,8 @@ export class Lexer {
 		this.col = 1;
 		this.tokens = [];
 		this.filename = filename;
+		this.target = null;
+		this.targetDirective = null;
 	}
 
 	// ── Primitives ──────────────────────────────────────────────
@@ -150,8 +152,22 @@ export class Lexer {
 			if (ch === " " || ch === "\t" || ch === "\r") {
 				this.advance();
 			} else if (ch === "/" && this.peek(1) === "/") {
+				const start = this.pos;
+				const line = this.line,
+					col = this.col;
 				while (this.pos < this.src.length && this.peek() !== "\n")
 					this.advance();
+				const comment = this.src.slice(start, this.pos);
+				const match = comment.match(/^\/\/gofront:target\s+(\S+)/);
+				if (match) {
+					this.target = match[1];
+					this.targetDirective = {
+						value: match[1],
+						line,
+						col,
+						beforePackage: this.tokens.length === 0,
+					};
+				}
 			} else if (ch === "/" && this.peek(1) === "*") {
 				const startLine = this.line,
 					startCol = this.col;
@@ -472,6 +488,8 @@ export class Lexer {
 
 		if (this.shouldSemi()) this.push(T.SEMICOLON, ";", this.line, this.col);
 		this.push(T.EOF, "", this.line, this.col);
+		this.tokens.target = this.target;
+		this.tokens.targetDirective = this.targetDirective;
 		return this.tokens;
 	}
 	_readPlusOp(l, c) {

package/src/lower/boxing.js

@@ -0,0 +1,36 @@
+// src/lower/boxing.js
+// Identifies address-taken scalar variables that require heap boxing ({ value: x }).
+
+export function isReferenceType(t) {
+	if (!t) return false;
+	const base = t.kind === "named" ? t.underlying : t;
+	return (
+		base?.kind === "struct" ||
+		base?.kind === "slice" ||
+		base?.kind === "map" ||
+		base?.kind === "func" ||
+		base?.kind === "interface"
+	);
+}
+
+// Scan AST node for _addressTaken idents on scalars and populate a Set of boxed variable names.
+export function scanAddressTaken(node, boxedVars = new Set()) {
+	if (!node || typeof node !== "object") return boxedVars;
+	if (Array.isArray(node)) {
+		for (const child of node) scanAddressTaken(child, boxedVars);
+		return boxedVars;
+	}
+	// &x — the operand ident will have _addressTaken set by typechecker
+	if (node.kind === "Ident" && node._addressTaken) {
+		const t = node._type;
+		if (t && !isReferenceType(t)) {
+			boxedVars.add(node.name);
+		}
+	}
+	// Recurse into FuncLit too — closures may take address of outer vars
+	for (const key of Object.keys(node)) {
+		if (key.startsWith("_")) continue;
+		scanAddressTaken(node[key], boxedVars);
+	}
+	return boxedVars;
+}

package/src/lower/captures.js

@@ -0,0 +1,179 @@
+// src/lower/captures.js
+// Identifies free variables captured by closures and determines which ones
+// are mutated and thus require heap-allocated environment cells for WASM closures.
+
+import { collectMutatedVars, nodeMutatesVar } from "./ownership.js";
+
+/**
+ * Result of capture analysis on a function or closure.
+ */
+export class CaptureAnalysis {
+	constructor() {
+		// Map<FuncLit, Set<string>>: free variables captured by each closure
+		this.capturesByClosure = new Map();
+		// Set<string>: variables in the enclosing scope that are captured AND mutated
+		this.mutatedCaptures = new Set();
+	}
+}
+
+/**
+ * Finds all variable declarations in a block or list of statements.
+ */
+export function collectDeclaredNames(node, names = new Set()) {
+	if (!node || typeof node !== "object") return names;
+	if (Array.isArray(node)) {
+		for (const item of node) collectDeclaredNames(item, names);
+		return names;
+	}
+
+	if (node.kind === "VarDecl" || node.kind === "ConstDecl") {
+		for (const spec of node.decls ?? []) {
+			for (const name of spec.names ?? []) names.add(name);
+		}
+	} else if (node.kind === "DefineStmt") {
+		for (const lhs of node.lhs ?? []) {
+			if (lhs.kind === "Ident") names.add(lhs.name);
+		}
+	} else if (node.kind === "TypeSwitchStmt" && node.assign) {
+		names.add(node.assign);
+	}
+
+	// Do not descend into nested functions when collecting local declarations
+	if (node.kind === "FuncLit") return names;
+
+	for (const key of Object.keys(node)) {
+		if (key.startsWith("_")) continue;
+		collectDeclaredNames(node[key], names);
+	}
+	return names;
+}
+
+/**
+ * Finds all identifier references in a node that are not shadowed by inner declarations.
+ */
+export function collectReferencedNames(node, localDecls, refs = new Set()) {
+	if (!node || typeof node !== "object") return refs;
+	if (Array.isArray(node)) {
+		for (const item of node) collectReferencedNames(item, localDecls, refs);
+		return refs;
+	}
+
+	// In struct literals, field names in KeyValueExpr are not variable references
+	if (node.kind === "KeyValueExpr") {
+		collectReferencedNames(node.value, localDecls, refs);
+		return refs;
+	}
+
+	if (node.kind === "FuncLit") {
+		const innerLocals = new Set(localDecls);
+		for (const p of node.params ?? []) {
+			if (p.name && p.name !== "_") innerLocals.add(p.name);
+		}
+		for (const r of node.returnType?._namedReturns ?? []) {
+			if (r.name && r.name !== "_") innerLocals.add(r.name);
+		}
+		collectDeclaredNames(node.body, innerLocals);
+		for (const key of Object.keys(node)) {
+			if (key.startsWith("_")) continue;
+			collectReferencedNames(node[key], innerLocals, refs);
+		}
+		return refs;
+	}
+
+	if (
+		node.kind === "Ident" &&
+		!localDecls.has(node.name) &&
+		node.name !== "_"
+	) {
+		refs.add(node.name);
+	}
+
+	// For nested closures, free variables are also referenced
+	for (const key of Object.keys(node)) {
+		if (key.startsWith("_")) continue;
+		collectReferencedNames(node[key], localDecls, refs);
+	}
+	return refs;
+}
+
+/**
+ * Analyzes a function or method declaration for closures and their captured variables.
+ * @param {Object} fnDecl AST FuncDecl or FuncLit node
+ * @returns {CaptureAnalysis}
+ */
+export function analyzeCaptures(fnDecl) {
+	const result = new CaptureAnalysis();
+	if (!fnDecl?.body) return result;
+
+	// Collect parameters, receiver and named returns of the root function
+	const rootScope = new Set();
+	if (fnDecl.recvName && fnDecl.recvName !== "_") {
+		rootScope.add(fnDecl.recvName);
+	}
+	for (const p of fnDecl.params ?? []) {
+		if (p.name && p.name !== "_") rootScope.add(p.name);
+	}
+	for (const r of fnDecl.returnType?._namedReturns ?? []) {
+		if (r.name && r.name !== "_") rootScope.add(r.name);
+	}
+	collectDeclaredNames(fnDecl.body, rootScope);
+
+	// Fast pre-collected set of all mutated variables in the entire function
+	const mutatedVars = collectMutatedVars(fnDecl.body);
+
+	// Traverse closures with lexical scope stack to properly handle arbitrary nesting
+	const walkClosures = (node, scopeStack) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const item of node) walkClosures(item, scopeStack);
+			return;
+		}
+
+		if (node.kind === "FuncLit") {
+			const closureLocals = new Set();
+			for (const p of node.params ?? []) {
+				if (p.name && p.name !== "_") closureLocals.add(p.name);
+			}
+			for (const r of node.returnType?._namedReturns ?? []) {
+				if (r.name && r.name !== "_") closureLocals.add(r.name);
+			}
+			collectDeclaredNames(node.body, closureLocals);
+
+			// Visible outer variables from all enclosing ancestor scopes
+			const allOuterScope = new Set();
+			for (const scope of scopeStack) {
+				for (const name of scope) allOuterScope.add(name);
+			}
+
+			const allRefs = collectReferencedNames(node.body, closureLocals);
+			const captured = new Set();
+			for (const ref of allRefs) {
+				if (allOuterScope.has(ref)) {
+					captured.add(ref);
+				}
+			}
+			result.capturesByClosure.set(node, captured);
+
+			for (const varName of captured) {
+				if (
+					mutatedVars.has(varName) ||
+					nodeMutatesVar(fnDecl.body, varName) ||
+					nodeMutatesVar(node.body, varName)
+				) {
+					result.mutatedCaptures.add(varName);
+				}
+			}
+
+			walkClosures(node.body, [...scopeStack, closureLocals]);
+			return;
+		}
+
+		for (const key of Object.keys(node)) {
+			if (key.startsWith("_")) continue;
+			walkClosures(node[key], scopeStack);
+		}
+	};
+
+	walkClosures(fnDecl.body, [rootScope]);
+	return result;
+}

package/src/lower/embedding.js

@@ -0,0 +1,30 @@
+// src/lower/embedding.js
+// Computes promoted methods and delegation stubs for embedded structs.
+
+export function computeEmbeddedStubs(name, methodDecls, checker) {
+	if (!checker) return [];
+	const resolvedType = checker.types.get(name)?.underlying;
+	if (resolvedType?.kind !== "struct" || !resolvedType._embeds) return [];
+
+	const declared = new Set(methodDecls.map((m) => m.name));
+	const stubs = [];
+
+	for (const embed of resolvedType._embeds) {
+		const embedName = embed.kind === "named" ? embed.name : null;
+		if (!embedName) continue;
+		const embedBase = embed.kind === "named" ? embed.underlying : embed;
+		if (embedBase?.kind !== "struct" || !embedBase.methods) continue;
+
+		for (const [mName] of embedBase.methods.entries()) {
+			if (!declared.has(mName)) {
+				stubs.push({
+					methodName: mName,
+					embedName,
+				});
+				declared.add(mName); // Prevent duplicate stubs for diamond embeds
+			}
+		}
+	}
+
+	return stubs;
+}

package/src/lower/escape.js

@@ -0,0 +1,169 @@
+// src/lower/escape.js
+// Analyzes pointer retention / escaping for arguments across the WASM boundary.
+// In GoFront's hybrid model, `*T` where T is a `both` type (e.g. `*mathx.Vec3`) uses
+// copy-in/copy-out per call. If the WASM side retains the pointer beyond the call,
+// it is flagged as an escape error.
+
+import { collectDeclaredNames } from "./captures.js";
+import { rootIdentName } from "./ownership.js";
+
+/**
+ * Checks whether an expression evaluates to one of the target pointer variables
+ * (or an interior pointer into them).
+ *
+ * @param {Object} expr AST expression node
+ * @param {Set<string>} targetNames Set of identifier names being tracked
+ * @returns {boolean}
+ */
+export function evaluatesToPointer(expr, targetNames) {
+	if (!expr || typeof expr !== "object") return false;
+	if (expr.kind === "Ident") {
+		return targetNames.has(expr.name);
+	}
+	if (expr.kind === "ParenExpr" || expr.kind === "TypeAssertExpr") {
+		return evaluatesToPointer(expr.expr, targetNames);
+	}
+	// Type conversions: (*Vec3)(p)
+	if (expr.kind === "CallExpr" && expr.args?.length === 1) {
+		return evaluatesToPointer(expr.args[0], targetNames);
+	}
+	// Interior pointer: &p.Field or &p[i] retains a pointer into p, or &CompositeLit holding p
+	if (expr.kind === "UnaryExpr" && expr.op === "&") {
+		const root = rootIdentName(expr.operand);
+		if (root != null && targetNames.has(root)) return true;
+		return evaluatesToPointer(expr.operand, targetNames);
+	}
+	// Composite literal holding pointer: Holder{ P: p } or []*Vec{ p }
+	if (expr.kind === "CompositeLit") {
+		for (const elem of expr.elems ?? []) {
+			const val = elem.kind === "KeyValueExpr" ? elem.value : elem;
+			if (evaluatesToPointer(val, targetNames)) return true;
+		}
+	}
+	return false;
+}
+
+/**
+ * Checks if a parameter identifier escapes or is retained in `body`.
+ * A parameter `name` is considered retained if it:
+ * - is returned from the function
+ * - is assigned to a package global or external object field
+ * - is stored into a struct field or slice/map element (e.g., `obj.field = p`, `arr[i] = p`)
+ * - is captured by a closure that outlives or is returned from the function
+ *
+ * @param {Object} body AST block of the function
+ * @param {string} paramName Name of the parameter to check
+ * @returns {boolean} True if param escapes/is retained, false if only used locally in-place
+ */
+export function paramEscapes(body, paramName) {
+	if (!body || !paramName || paramName === "_") return false;
+
+	const aliases = new Set([paramName]);
+	const localNames = new Set([paramName]);
+	collectDeclaredNames(body, localNames);
+
+	let escapes = false;
+
+	const walk = (node) => {
+		if (escapes || !node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+
+		// 1. Returning the pointer
+		if (node.kind === "ReturnStmt") {
+			for (const res of node.values ?? node.results ?? []) {
+				if (evaluatesToPointer(res, aliases)) {
+					escapes = true;
+					return;
+				}
+			}
+		}
+
+		// 2. Assigning the pointer:
+		// Storing into a field, index, or package-level global escapes.
+		// Storing into a local variable aliases the pointer.
+		if (node.kind === "AssignStmt") {
+			for (let i = 0; i < node.lhs.length; i++) {
+				const lhs = node.lhs[i];
+				const rhs = node.rhs?.[i];
+				if (!rhs) continue;
+				if (evaluatesToPointer(rhs, aliases)) {
+					// Storing into a field or index: `target.field = p` or `arr[i] = p`
+					if (lhs.kind === "SelectorExpr" || lhs.kind === "IndexExpr") {
+						escapes = true;
+						return;
+					}
+					// If LHS is not a local variable declared in body, it's package-level / global
+					if (lhs.kind === "Ident") {
+						if (!localNames.has(lhs.name)) {
+							escapes = true;
+							return;
+						}
+						aliases.add(lhs.name);
+					}
+				}
+			}
+		}
+
+		// 3. Short variable definition: local alias `tmp := p`
+		if (node.kind === "DefineStmt") {
+			for (let i = 0; i < node.lhs.length; i++) {
+				const lhs = node.lhs[i];
+				const rhs = node.rhs?.[i];
+				if (rhs && evaluatesToPointer(rhs, aliases)) {
+					if (lhs.kind === "Ident") {
+						aliases.add(lhs.name);
+					}
+				}
+			}
+		}
+
+		// 4. Storing into append call: `slice = append(slice, p)`
+		const fnName = node.func?.name ?? node.fun?.name;
+		if (node.kind === "CallExpr" && fnName === "append") {
+			for (const arg of node.args?.slice(1) ?? []) {
+				if (evaluatesToPointer(arg, aliases)) {
+					escapes = true;
+					return;
+				}
+			}
+		}
+
+		// 5. Storing into a closure (FuncLit)
+		if (node.kind === "FuncLit") {
+			let captured = false;
+			const checkClosure = (cNode) => {
+				if (captured || !cNode || typeof cNode !== "object") return;
+				if (Array.isArray(cNode)) {
+					for (const item of cNode) checkClosure(item);
+					return;
+				}
+				if (cNode.kind === "Ident" && aliases.has(cNode.name)) {
+					captured = true;
+					return;
+				}
+				for (const k of Object.keys(cNode)) {
+					if (k.startsWith("_")) continue;
+					checkClosure(cNode[k]);
+				}
+			};
+			checkClosure(node.body);
+			if (captured) {
+				escapes = true;
+				return;
+			}
+			// Do not descend redundantly into closure body
+			return;
+		}
+
+		for (const key of Object.keys(node)) {
+			if (key.startsWith("_")) continue;
+			walk(node[key]);
+		}
+	};
+
+	walk(body);
+	return escapes;
+}