@tishlang/tish-format 1.0.13 → 2.0.1

package/crates/tish_compile/src/types.rs

@@ -41,6 +41,8 @@ pub enum RustType {
         params: Vec<RustType>,
         returns: Box<RustType>,
     },
+    /// Tuple `(T0, T1, …)` for `[T0, T1]` tuple types — a native Rust tuple.
+    Tuple(Vec<RustType>),
 }
 
 impl RustType {
@@ -124,6 +126,38 @@ impl RustType {
                 // Other unions fall back to Value
                 RustType::Value
             }
+            // `[T0, T1]` -> a native Rust tuple `(T0, T1)`.
+            TypeAnnotation::Tuple(elems) => RustType::Tuple(
+                elems
+                    .iter()
+                    .map(|e| Self::from_annotation_with_aliases(e, aliases))
+                    .collect(),
+            ),
+            // A literal type lowers to its base primitive.
+            TypeAnnotation::Literal(lit) => match lit {
+                tishlang_ast::TypeLiteral::Str(_) => RustType::String,
+                tishlang_ast::TypeLiteral::Num(_) => RustType::F64,
+                tishlang_ast::TypeLiteral::Bool(_) => RustType::Bool,
+            },
+            // Intersection of object shapes (e.g. `interface X extends Y { … }` → `Y & { … }`):
+            // merge the fields into one shape. Registered as a `type` alias, this becomes a native
+            // struct. Any non-object member → can't merge → fall back to boxed `Value`.
+            TypeAnnotation::Intersection(parts) => {
+                let mut fields: Vec<(Arc<str>, RustType)> = Vec::new();
+                for p in parts {
+                    match Self::from_annotation_with_aliases(p, aliases) {
+                        RustType::Object(fs) | RustType::Named { fields: fs, .. } => {
+                            for (k, v) in fs {
+                                if !fields.iter().any(|(ek, _)| *ek == k) {
+                                    fields.push((k, v));
+                                }
+                            }
+                        }
+                        _ => return RustType::Value,
+                    }
+                }
+                RustType::Object(fields)
+            }
         }
     }
 
@@ -145,6 +179,15 @@ impl RustType {
                 BinOp::Add | BinOp::Sub | BinOp::Mul | BinOp::Div | BinOp::Mod | BinOp::Pow => {
                     Some(RustType::F64)
                 }
+                // Bitwise / shift ops: JS coerces both sides to int32, computes, and
+                // returns a Number — so the native result is still F64. Big win for
+                // crypto/hashing loops that would otherwise box every `^`/`>>>`.
+                BinOp::BitAnd
+                | BinOp::BitOr
+                | BinOp::BitXor
+                | BinOp::Shl
+                | BinOp::Shr
+                | BinOp::UShr => Some(RustType::F64),
                 BinOp::Lt
                 | BinOp::Le
                 | BinOp::Gt
@@ -159,6 +202,16 @@ impl RustType {
                 BinOp::StrictEq | BinOp::StrictNe => Some(RustType::Bool),
                 _ => None,
             }
+        } else if lhs == &RustType::String && rhs == &RustType::String {
+            // M2: native string concat + value equality. `+` concatenates; `===`/`!==` compare by
+            // value (byte-identical to JS and to the boxed `Value::String` path). Relational
+            // `< <= > >=` deliberately stay on the boxed path: JS orders strings by UTF-16 code
+            // units while Rust `String` orders by UTF-8 bytes — they diverge outside the BMP.
+            match op {
+                BinOp::Add => Some(RustType::String),
+                BinOp::StrictEq | BinOp::StrictNe => Some(RustType::Bool),
+                _ => None,
+            }
         } else {
             None
         }
@@ -188,6 +241,7 @@ impl RustType {
                     returns.to_rust_type_str()
                 )
             }
+            RustType::Tuple(elems) => tuple_text(&elems.iter().map(|e| e.to_rust_type_str()).collect::<Vec<_>>()),
         }
     }
 
@@ -220,12 +274,33 @@ impl RustType {
                 )
             }
             RustType::Function { .. } => "Value::Null".to_string(),
+            RustType::Tuple(elems) => {
+                tuple_text(&elems.iter().map(|e| e.default_value()).collect::<Vec<_>>())
+            }
         }
     }
 
     /// Generate code to convert from Value to this native type.
     pub fn from_value_expr(&self, value_expr: &str) -> String {
         match self {
+            RustType::Tuple(elems) => {
+                // `Value::Array([..])` -> `(e0, e1, …)`, converting each slot from its `Value`.
+                let parts: Vec<String> = elems
+                    .iter()
+                    .enumerate()
+                    .map(|(i, e)| {
+                        e.from_value_expr(&format!(
+                            "_t.get({}).cloned().unwrap_or(Value::Null)",
+                            i
+                        ))
+                    })
+                    .collect();
+                format!(
+                    "match &{} {{ Value::Array(_a) => {{ let _t = _a.borrow(); {} }}, _ => panic!(\"expected tuple\") }}",
+                    value_expr,
+                    tuple_text(&parts)
+                )
+            }
             RustType::Value => value_expr.to_string(),
             RustType::F64 => format!(
                 "match &{} {{ Value::Number(n) => *n, _ => panic!(\"expected number\") }}",
@@ -277,6 +352,15 @@ impl RustType {
     /// Generate code to convert from this native type to Value.
     pub fn to_value_expr(&self, native_expr: &str) -> String {
         match self {
+            RustType::Tuple(elems) => {
+                // `(e0, e1, …)` -> `Value::Array([e0.into_value(), …])`.
+                let parts: Vec<String> = elems
+                    .iter()
+                    .enumerate()
+                    .map(|(i, e)| e.to_value_expr(&format!("{}.{}", native_expr, i)))
+                    .collect();
+                format!("Value::Array(VmRef::new(vec![{}]))", parts.join(", "))
+            }
             RustType::Value => native_expr.to_string(),
             RustType::F64 => format!("Value::Number({})", native_expr),
             RustType::String => format!("Value::String({}.clone().into())", native_expr),
@@ -311,7 +395,14 @@ impl RustType {
                     .iter()
                     .map(|(k, ty)| {
                         let access = format!("{}.{}", native_expr, field_ident(k));
-                        let v_expr = ty.to_value_expr(&access);
+                        // A `Value`-typed field (e.g. from a generic struct `Box<T>`) accessed
+                        // behind `&self` must be cloned — it isn't `Copy` and `to_value_expr(Value)`
+                        // is identity. Native field types clone/copy inside their own `to_value_expr`.
+                        let v_expr = if matches!(ty, RustType::Value) {
+                            format!("{}.clone()", access)
+                        } else {
+                            ty.to_value_expr(&access)
+                        };
                         format!(
                             "_om.insert(::std::sync::Arc::from({:?}), {});",
                             k.as_ref(),
@@ -320,8 +411,12 @@ impl RustType {
                     })
                     .collect::<Vec<_>>()
                     .join(" ");
+                // `Value::object` wraps the `ObjectMap` in an `ObjectData` (what `Value::Object`
+                // actually holds) — emitting `Value::Object(VmRef::new(_om))` directly is a type
+                // error (`ObjectMap` != `ObjectData`); only surfaced once a whole struct is boxed
+                // into a `Value`, e.g. passing it to a function.
                 format!(
-                    "{{ let mut _om = ObjectMap::default(); {} Value::Object(VmRef::new(_om)) }}",
+                    "{{ let mut _om = ObjectMap::default(); {} Value::object(_om) }}",
                     inserts
                 )
             }
@@ -332,6 +427,15 @@ impl RustType {
 
 /// Map a Tish type-alias name to the Rust struct identifier we emit.
 /// Prefixed so user names can never collide with runtime types like `Value`.
+/// Render a Rust tuple type/value from its parts, using the `(T,)` form for 1-tuples.
+fn tuple_text(parts: &[String]) -> String {
+    if parts.len() == 1 {
+        format!("({},)", parts[0])
+    } else {
+        format!("({})", parts.join(", "))
+    }
+}
+
 pub fn named_struct_ident(tish_name: &str) -> String {
     format!("TishStruct_{}", tish_name)
 }

package/crates/tish_compile_js/src/codegen.rs

@@ -143,6 +143,13 @@ impl Codegen {
                 self.indent -= 1;
                 self.writeln("}");
             }
+            // Comma-declarators: emit each declarator as its own JS statement in the
+            // current scope (no wrapping braces).
+            Statement::Multi { statements, .. } => {
+                for s in statements {
+                    self.emit_statement(s)?;
+                }
+            }
             Statement::VarDecl {
                 name,
                 mutable,
@@ -225,6 +232,34 @@ impl Codegen {
                             let ex = self.emit_expr(expr)?;
                             header.push_str(&ex);
                         }
+                        // Comma-declarators (`for (let i = 0, n = len; …)`): emit JS-native
+                        // `let i = 0, n = len` — one keyword, declarators joined by `, `.
+                        Statement::Multi { statements, .. } => {
+                            let mut decl_kw = "let";
+                            let mut parts: Vec<String> = Vec::new();
+                            for (idx, st) in statements.iter().enumerate() {
+                                let Statement::VarDecl {
+                                    name,
+                                    mutable,
+                                    init: opt_init,
+                                    ..
+                                } = st
+                                else {
+                                    return Err(CompileError::new("Unsupported for init"));
+                                };
+                                if idx == 0 {
+                                    decl_kw = if *mutable { "let" } else { "const" };
+                                }
+                                let escaped = Self::escape_ident(name.as_ref());
+                                if let Some(e) = opt_init {
+                                    let ex = self.emit_expr(e)?;
+                                    parts.push(format!("{} = {}", escaped, ex));
+                                } else {
+                                    parts.push(escaped);
+                                }
+                            }
+                            header.push_str(&format!("{} {}", decl_kw, parts.join(", ")));
+                        }
                         _ => return Err(CompileError::new("Unsupported for init")),
                     }
                 }
@@ -488,6 +523,7 @@ impl Codegen {
                     BinOp::BitXor => "^",
                     BinOp::Shl => "<<",
                     BinOp::Shr => ">>",
+                    BinOp::UShr => ">>>",
                     BinOp::In => {
                         // key in object (property/index existence check)
                         return Ok(format!("({} in {})", l, r));
@@ -616,6 +652,37 @@ impl Codegen {
                 let o = self.emit_expr(operand)?;
                 format!("(typeof {})", o)
             }
+            Expr::Delete { target, .. } => {
+                // Emit the raw property *reference*, not a value: `emit_expr` wraps Index /
+                // optional reads in `(… ?? null)`, and `delete (x ?? null)` is a no-op. So
+                // reconstruct `obj.name` / `obj[key]` directly here.
+                match target.as_ref() {
+                    Expr::Member { object, prop: MemberProp::Name { name, .. }, .. } => {
+                        let obj = self.emit_expr(object)?;
+                        if name.parse::<u32>().is_ok()
+                            || !name.chars().all(|c| c.is_alphanumeric() || c == '_')
+                        {
+                            format!("(delete {}[{:?}])", obj, name.as_ref())
+                        } else {
+                            format!("(delete {}.{})", obj, name.as_ref())
+                        }
+                    }
+                    Expr::Member { object, prop: MemberProp::Expr(key), .. } => {
+                        let obj = self.emit_expr(object)?;
+                        let k = self.emit_expr(key)?;
+                        format!("(delete {}[{}])", obj, k)
+                    }
+                    Expr::Index { object, index, .. } => {
+                        let obj = self.emit_expr(object)?;
+                        let idx = self.emit_expr(index)?;
+                        format!("(delete {}[{}])", obj, idx)
+                    }
+                    _ => {
+                        let t = self.emit_expr(target)?;
+                        format!("(delete {})", t)
+                    }
+                }
+            }
             Expr::PostfixInc { name, .. } => {
                 format!("{}++", Self::escape_ident(name.as_ref()))
             }

package/crates/tish_compile_js/src/tests_jsx.rs

@@ -27,6 +27,70 @@ mod tests {
         assert!(js.contains("h(Fragment, null, ["));
     }
 
+    #[test]
+    fn jsx_keyword_text_after_child_element() {
+        // #108: a text run *after* a nested child element must be lexed as JSX text, so a bare
+        // reserved keyword (`as`, `in`, `if`, `return`, `let`) in that run is plain text, not a
+        // keyword token. Text-only children already worked; the bug was failing to re-enter
+        // JSX-text mode once a child element had closed.
+        for kw in ["as", "in", "if", "return", "let"] {
+            let src = format!("fn V() {{ return <div><span>x</span> {kw} JSON</div> }}");
+            let program =
+                parse(&src).unwrap_or_else(|e| panic!("parse failed for trailing `{kw}`: {e}"));
+            let js = compile_with_jsx(&program, false).unwrap();
+            let expected = format!("[h(\"span\", null, [\"x\"]), \" {kw} JSON\"]");
+            assert!(
+                js.contains(&expected),
+                "trailing `{kw}` after child element: expected {expected:?} in output, got: {js}"
+            );
+        }
+    }
+
+    #[test]
+    fn jsx_text_between_and_after_multiple_children() {
+        // Text both between and after child elements stays text (incl. a keyword run between).
+        let src = r#"fn V() { return <div><span>x</span> as <b>y</b> in z</div> }"#;
+        let program = parse(src).unwrap();
+        let js = compile_with_jsx(&program, false).unwrap();
+        assert!(
+            js.contains(
+                "[h(\"span\", null, [\"x\"]), \" as \", h(\"b\", null, [\"y\"]), \" in z\"]"
+            ),
+            "{js}"
+        );
+    }
+
+    #[test]
+    fn jsx_self_closing_child_then_keyword_text() {
+        // A self-closing child (`<br/>`) followed by keyword text must also re-enter text mode.
+        let src = r#"fn V() { return <div><br/> as JSON</div> }"#;
+        let program = parse(src).unwrap();
+        let js = compile_with_jsx(&program, false).unwrap();
+        assert!(
+            js.contains("[h(\"br\", null, []), \" as JSON\"]"),
+            "{js}"
+        );
+    }
+
+    #[test]
+    fn jsx_child_element_inside_expr_container_not_text_mode() {
+        // Re-entering JSX text mode after a child closes must NOT happen when that child lived
+        // inside a `{…}` expression container — otherwise the `)`/`,` that follows is swallowed as
+        // JsxText ("Expected RParen, got JsxText"). Regression for the #108 fix itself, caught by
+        // the downstream suite (tish-audio / tish-midi use `{items.map(x => <li>{x}</li>)}`).
+        let src = r#"fn V(items) { return <ul>{items.map(x => <li>{x}</li>)}</ul> }"#;
+        let program = parse(src).expect("map-in-container must parse");
+        let js = compile_with_jsx(&program, false).unwrap();
+        assert!(js.contains("h(\"ul\""), "{js}");
+        assert!(js.contains(".map("), "{js}");
+
+        // And the combined case: a `{…}` container followed by trailing keyword text.
+        let src2 = r#"fn V(items) { return <div>{items.map(x => <span>{x}</span>)} as JSON</div> }"#;
+        let program2 = parse(src2).expect("container-then-text must parse");
+        let js2 = compile_with_jsx(&program2, false).unwrap();
+        assert!(js2.contains("\" as JSON\""), "{js2}");
+    }
+
     #[test]
     fn jsx_text_whitespace_coalesced() {
         let src = r#"fn X() { return <p>First paragraph</p> }"#;

package/crates/tish_core/Cargo.toml

@@ -16,11 +16,17 @@ regex = ["dep:fancy-regex"]
 # most notably `tishlang_runtime/http`, which dispatches HTTP handlers
 # across a worker pool. Off by default so wasm / wasi / cranelift / llvm /
 # interpreter builds pay no atomic-ref-count or mutex overhead.
-send-values = []
+send-values = ["dep:parking_lot"]
 
 [dependencies]
 ahash = "0.8.11"
+arcstr = "1"
+smallvec = "1"
+indexmap = "2"
 fancy-regex = { version = "0.17.0", optional = true }
+# Only under `send-values` (the Arc<Mutex> path): parking_lot's uncontended lock is a
+# single atomic with no pthread syscall — profiled as a top cost on object/array access.
+parking_lot = { version = "0.12", optional = true }
 
 [target.wasm32-unknown-unknown.dependencies]
 getrandom = { version = "0.3", features = ["wasm_js"] }

package/crates/tish_core/src/console_style.rs

@@ -48,6 +48,7 @@ pub fn format_value_styled(value: &Value, colors: bool) -> String {
 
 /// `quote_strings`: when true (REPL / inspect), strings render as quoted literals. When false
 /// (top-level `console.log` arguments), strings render raw like Node.
+#[allow(clippy::only_used_in_recursion)] // `colors` is always true here; threaded for recursive symmetry
 fn format_value_styled_inner(value: &Value, colors: bool, quote_strings: bool) -> String {
     match value {
         Value::Number(n) => {
@@ -67,7 +68,7 @@ fn format_value_styled_inner(value: &Value, colors: bool, quote_strings: bool) -
                 let escaped = escape_string_for_display(s);
                 format!("{STRING}\"{escaped}\"{RESET}")
             } else {
-                format!("{STRING}{}{RESET}", s.as_ref())
+                format!("{STRING}{}{RESET}", s.as_str())
             }
         }
         Value::Bool(b) => format!("{BOOLEAN}{b}{RESET}"),
@@ -81,6 +82,15 @@ fn format_value_styled_inner(value: &Value, colors: bool, quote_strings: bool) -
             let sep = format!("{PUNCT}, {RESET}");
             format!("{PUNCT}[{RESET}{}{PUNCT}]{RESET}", inner.join(&sep))
         }
+        Value::NumberArray(arr) => {
+            let sep = format!("{PUNCT}, {RESET}");
+            let inner: Vec<String> = arr
+                .borrow()
+                .iter()
+                .map(|n| format_value_styled_inner(&Value::Number(*n), colors, true))
+                .collect();
+            format!("{PUNCT}[{RESET}{}{PUNCT}]{RESET}", inner.join(&sep))
+        }
         Value::Object(obj) => {
             let inner: Vec<String> = obj
                 .borrow()

package/crates/tish_core/src/json.rs

@@ -9,7 +9,7 @@ pub fn json_parse(json: &str) -> Result<Value, String> {
     if json.is_empty() {
         return Err("SyntaxError: Unexpected end of JSON input".to_string());
     }
-    let (value, rest) = parse_value(json)?;
+    let (value, rest) = parse_value(json, 0)?;
     if !rest.trim().is_empty() {
         return Err("SyntaxError: Unexpected token at end of JSON".to_string());
     }
@@ -66,22 +66,36 @@ pub fn json_stringify_into(buf: &mut String, value: &Value) {
             }
             buf.push(']');
         }
+        Value::NumberArray(arr) => {
+            let borrowed = arr.borrow();
+            buf.push('[');
+            use std::fmt::Write;
+            for (i, n) in borrowed.iter().enumerate() {
+                if i > 0 {
+                    buf.push(',');
+                }
+                if n.is_nan() || n.is_infinite() {
+                    buf.push_str("null");
+                } else {
+                    let _ = write!(buf, "{}", n);
+                }
+            }
+            buf.push(']');
+        }
         Value::Object(obj) => {
             let borrowed = obj.borrow();
-            // Sort keys for deterministic output. Pre-allocate to avoid
-            // a fresh `Vec` realloc inside `keys().collect()`.
-            let mut keys: Vec<&Arc<str>> = Vec::with_capacity(borrowed.strings.len());
-            keys.extend(borrowed.strings.keys());
-            keys.sort_unstable_by(|a, b| a.as_ref().cmp(b.as_ref()));
+            // Iterate in insertion order (PropMap preserves it) — matches JS/Node
+            // and `Object.keys`. No intermediate key Vec, no sort: one fewer
+            // allocation per object on the JSON hot path (e.g. TFB /json, /db).
             buf.push('{');
-            for (i, key) in keys.into_iter().enumerate() {
+            for (i, (key, val)) in borrowed.strings.iter().enumerate() {
                 if i > 0 {
                     buf.push(',');
                 }
                 buf.push('"');
                 escape_json_string_into(buf, key);
                 buf.push_str("\":");
-                json_stringify_into(buf, borrowed.strings.get(key).unwrap());
+                json_stringify_into(buf, val);
             }
             buf.push('}');
         }
@@ -134,14 +148,12 @@ fn escape_json_string_into(buf: &mut String, s: &str) {
     }
 }
 
-#[allow(dead_code)]
-fn escape_json_string(s: &str) -> String {
-    let mut buf = String::with_capacity(s.len());
-    escape_json_string_into(&mut buf, s);
-    buf
-}
+/// Max nesting depth for `JSON.parse`. Bounds recursion so deeply-nested untrusted
+/// input errors instead of overflowing the stack — a Rust stack overflow aborts the
+/// whole process (uncatchable, SIGABRT). 128 matches serde_json's default limit.
+const MAX_JSON_DEPTH: usize = 128;
 
-fn parse_value(input: &str) -> Result<(Value, &str), String> {
+fn parse_value(input: &str, depth: usize) -> Result<(Value, &str), String> {
     let input = input.trim_start();
     if input.is_empty() {
         return Err("Unexpected end of JSON input".to_string());
@@ -151,8 +163,8 @@ fn parse_value(input: &str) -> Result<(Value, &str), String> {
         'n' => parse_null(input),
         't' | 'f' => parse_bool(input),
         '"' => parse_string(input),
-        '[' => parse_array(input),
-        '{' => parse_object(input),
+        '[' => parse_array(input, depth),
+        '{' => parse_object(input, depth),
         c if c == '-' || c.is_ascii_digit() => parse_number(input),
         c => Err(format!("Unexpected character '{}' in JSON", c)),
     }
@@ -249,44 +261,46 @@ fn parse_string(input: &str) -> Result<(Value, &str), String> {
 }
 
 fn parse_number(input: &str) -> Result<(Value, &str), String> {
+    // Byte scan (all number chars are ASCII) — O(token), not O(remaining input).
+    // The old `input.chars().collect::<Vec<char>>()` per number made parsing an
+    // N-number array O(N^2): a CPU-exhaustion DoS on untrusted JSON.
+    let bytes = input.as_bytes();
     let mut end = 0;
-    let chars: Vec<char> = input.chars().collect();
 
-    if chars.get(end) == Some(&'-') {
+    if bytes.first() == Some(&b'-') {
         end += 1;
     }
-
-    while end < chars.len() && chars[end].is_ascii_digit() {
+    while end < bytes.len() && bytes[end].is_ascii_digit() {
         end += 1;
     }
-
-    if chars.get(end) == Some(&'.') {
+    if bytes.get(end) == Some(&b'.') {
         end += 1;
-        while end < chars.len() && chars[end].is_ascii_digit() {
+        while end < bytes.len() && bytes[end].is_ascii_digit() {
             end += 1;
         }
     }
-
-    if chars.get(end) == Some(&'e') || chars.get(end) == Some(&'E') {
+    if matches!(bytes.get(end), Some(&b'e') | Some(&b'E')) {
         end += 1;
-        if chars.get(end) == Some(&'+') || chars.get(end) == Some(&'-') {
+        if matches!(bytes.get(end), Some(&b'+') | Some(&b'-')) {
             end += 1;
         }
-        while end < chars.len() && chars[end].is_ascii_digit() {
+        while end < bytes.len() && bytes[end].is_ascii_digit() {
             end += 1;
         }
     }
 
-    let num_str: String = chars[..end].iter().collect();
-    let byte_len: usize = chars[..end].iter().map(|c| c.len_utf8()).sum();
-
+    // `end` lands on an ASCII boundary, so slicing `input` by byte index is valid.
+    let num_str = &input[..end];
     num_str
         .parse::<f64>()
-        .map(|n| (Value::Number(n), &input[byte_len..]))
+        .map(|n| (Value::Number(n), &input[end..]))
         .map_err(|_| format!("Invalid number: {}", num_str))
 }
 
-fn parse_array(input: &str) -> Result<(Value, &str), String> {
+fn parse_array(input: &str, depth: usize) -> Result<(Value, &str), String> {
+    if depth >= MAX_JSON_DEPTH {
+        return Err("JSON nesting too deep".to_string());
+    }
     let mut input = &input[1..]; // skip '['
     let mut items = Vec::new();
 
@@ -296,7 +310,7 @@ fn parse_array(input: &str) -> Result<(Value, &str), String> {
     }
 
     loop {
-        let (value, rest) = parse_value(input)?;
+        let (value, rest) = parse_value(input, depth + 1)?;
         items.push(value);
         input = rest.trim_start();
 
@@ -308,7 +322,10 @@ fn parse_array(input: &str) -> Result<(Value, &str), String> {
     }
 }
 
-fn parse_object(input: &str) -> Result<(Value, &str), String> {
+fn parse_object(input: &str, depth: usize) -> Result<(Value, &str), String> {
+    if depth >= MAX_JSON_DEPTH {
+        return Err("JSON nesting too deep".to_string());
+    }
     let mut input = &input[1..]; // skip '{'
     let mut map = crate::ObjectMap::default();
 
@@ -328,7 +345,7 @@ fn parse_object(input: &str) -> Result<(Value, &str), String> {
 
         let (key_val, rest) = parse_string(input)?;
         let key: Arc<str> = match key_val {
-            Value::String(s) => s,
+            Value::String(s) => Arc::from(s.as_str()),
             _ => unreachable!(),
         };
 
@@ -338,7 +355,7 @@ fn parse_object(input: &str) -> Result<(Value, &str), String> {
         }
         input = &input[1..];
 
-        let (value, rest) = parse_value(input)?;
+        let (value, rest) = parse_value(input, depth + 1)?;
         map.insert(key, value);
         input = rest.trim_start();
 
@@ -366,7 +383,7 @@ mod tests {
         assert!(matches!(json_parse("false").unwrap(), Value::Bool(false)));
         assert!(matches!(json_parse("42").unwrap(), Value::Number(n) if n == 42.0));
         assert!(
-            matches!(json_parse("\"hello\"").unwrap(), Value::String(s) if s.as_ref() == "hello")
+            matches!(json_parse("\"hello\"").unwrap(), Value::String(s) if s.as_str() == "hello")
         );
     }
 
@@ -384,4 +401,30 @@ mod tests {
             _ => panic!("Expected objects"),
         }
     }
+
+    #[test]
+    fn deeply_nested_json_is_rejected_not_crash() {
+        // C1 regression: deeply-nested untrusted input must error at the depth limit,
+        // never recurse deep enough to overflow the stack (an uncatchable SIGABRT that
+        // would crash the whole process / HTTP worker).
+        let under = format!("{}{}", "[".repeat(100), "]".repeat(100));
+        assert!(json_parse(&under).is_ok(), "100 < limit should parse");
+        let over = format!("{}{}", "[".repeat(200), "]".repeat(200));
+        assert!(json_parse(&over).is_err(), "200 > limit must error");
+        // Pathological depth must still just error (fast), not overflow the stack.
+        let huge = format!("{}{}", "[".repeat(200_000), "]".repeat(200_000));
+        assert!(json_parse(&huge).is_err(), "huge depth must error, not crash");
+    }
+
+    #[test]
+    fn large_number_array_parses_correctly() {
+        // C2 regression: parse_number byte-scans (O(token)); the old chars().collect()
+        // over the whole remaining input made an N-number array O(N^2) — a CPU DoS.
+        let n = 50_000;
+        let body = format!("[{}]", vec!["7"; n].join(","));
+        match json_parse(&body).unwrap() {
+            Value::Array(arr) => assert_eq!(arr.borrow().len(), n),
+            _ => panic!("expected array"),
+        }
+    }
 }

package/crates/tish_core/src/lib.rs

@@ -6,12 +6,15 @@
 mod console_style;
 mod json;
 mod macros;
+mod shape;
 mod uri;
 mod value;
 mod vmref;
 
 pub use console_style::{format_value_styled, format_values_for_console, use_console_colors};
 pub use json::{json_parse, json_stringify, json_stringify_into};
+pub use shape::{ShapeId, DICT_SHAPE, EMPTY_SHAPE};
 pub use uri::{percent_decode, percent_encode};
+pub use arcstr::ArcStr;
 pub use value::*;
 pub use vmref::{VmReadGuard, VmRef, VmWriteGuard};