@vaernjs/vaern 0.0.2 → 0.0.4

package/README.md

@@ -1,16 +1,33 @@
 # vaern
 
-**An agent-native JavaScript & TypeScript runtime** — capability sandboxing, tool-calling, MCP, deterministic replay and sovereignty enforcement built into the engine, not bolted on as a library.
+**An agent-native JavaScript & TypeScript runtime.** Vaern runs TypeScript directly, with `fetch` and an HTTP server built in, on an embedded QuickJS-ng engine driven by Rust and Tokio. Capability sandboxing, tool-calling, MCP and replayable runs are being built into the engine itself.
 
-A DevLogix project · licensed MIT
+[VaernJS](https://vaernjs.tech) is a [DevLogix](https://devlogix.com.pk) project · licensed MIT
 
 ---
 
-> ### Status: pre-release placeholder (v0.0.x)
+> ### Status: v0.0.4, early native runtime
 >
-> This version reserves the name and provides a working CLI entry point.
->
-> Running `vaern` today prints the roadmap. That is expected, not a bug. Run `vaern doctor` for install diagnostics.
+> This release ships the native `vaern` binary for Linux, macOS and Windows.
+> The API surface is small and will change before v1.0.
+
+**Works today**
+
+- `vaern run <file>`: JavaScript and TypeScript, with types stripped at load time
+- Relative ES module imports
+- `console`, `setTimeout` / `setInterval`, `queueMicrotask`
+- `process.argv`, `process.env`, `process.exit()`
+- `fetch` with `Headers`, `Response`, `AbortController`, redirects and timeouts (hyper and rustls)
+- `serve()` from `vaern:http`, an HTTP server with Web-standard `Request` / `Response` and streamed bodies
+- Uncaught exceptions, unhandled rejections and throwing timers exit non-zero with a `file:line:col` location
+
+**Not implemented yet**
+
+- `node:*` modules and npm package imports
+- Capability sandboxing (`vaern.toml`)
+- `agent()`, `tool()`, MCP, budgets and `vaern replay`
+
+TypeScript `enum`, `namespace` and decorators are rejected with a located error, because they emit runtime code that type stripping cannot produce.
 
 ---
 
@@ -21,53 +38,34 @@ npm install -g @vaernjs/vaern      # global CLI
 npx @vaernjs/vaern --version       # without installing
 ```
 
-From **v0.1.0** this pulls a single prebuilt binary for your platform via
-`optionalDependencies`, the same way `bun` and `esbuild` do. Nothing is
-downloaded in a `postinstall` script; the platform packages are ordinary npm
-packages gated by `os` and `cpu`.
-
-Supported platforms (v0.1.0+):
+npm installs one prebuilt binary for your platform through `optionalDependencies`, the same way `esbuild` does. Nothing is downloaded in a `postinstall` script; the platform packages are ordinary npm packages gated by `os` and `cpu`.
 
 | Platform | Package |
 |---|---|
-| Linux x86_64 | `vaern-linux-x64` |
-| Linux arm64 | `vaern-linux-arm64` |
-| macOS arm64 | `vaern-darwin-arm64` |
-| macOS x86_64 | `vaern-darwin-x64` |
-| Windows x86_64 | `vaern-win32-x64` |
+| Linux x86_64 | `@vaernjs/vaern-linux-x64` |
+| Linux arm64 | `@vaernjs/vaern-linux-arm64` |
+| macOS arm64 | `@vaernjs/vaern-darwin-arm64` |
+| macOS x86_64 | `@vaernjs/vaern-darwin-x64` |
+| Windows x86_64 | `@vaernjs/vaern-win32-x64` |
 
-Install with `--no-optional` or on an unsupported platform and you get the JS
-fallback, which explains itself instead of failing silently.
+Linux binaries need glibc 2.35 or newer. On an unsupported platform, or when optional dependencies are skipped, `vaern` falls back to a small diagnostics CLI. Run `vaern doctor` there to see why.
 
-## What vaern will do
+## Quick start
 
 ```ts
-// courier.ts
-import { agent, tool } from "vaern:agent";
-
-const traffic = tool({
-  name: "traffic",
-  schema: { city: "string", at: "string" },
-  run: async ({ city, at }) =>
-    (await fetch(`https://api.example.pk/v2/${city}?at=${at}`)).json(),
-});
-
-const courier = agent({
-  name: "courier-copilot",
-  model: "any-openai-compatible-endpoint",
-  tools: [traffic],
-  sandbox: "vaern.toml",                 // capability policy, enforced by the engine
-  replay: "deterministic",               // every effect journalled at the engine boundary
-  budget: { tokens: 250_000, usd: 5 },   // hard stop — not an alert
-});
-
-console.log(await courier.run("Reroute today's Lahore deliveries around the fog."));
+// latest.ts
+interface Manifest {
+  name: string;
+  version: string;
+}
+
+const res = await fetch("https://registry.npmjs.org/@vaernjs/vaern/latest");
+const pkg = (await res.json()) as Manifest;
+console.log(`${pkg.name} ${pkg.version}, HTTP ${res.status}`);
 ```
 
 ```bash
-vaern run courier.ts
-vaern audit export --run 7f3a --format sbp --sign
-vaern replay 7f3a --diff
+vaern run latest.ts
 ```
 
 ## Programmatic use
@@ -78,30 +76,26 @@ const { binaryPath, hasNativeBinary, vaern } = require("@vaernjs/vaern");
 if (hasNativeBinary()) vaern(["run", "app.ts"]);
 ```
 
-## Roadmap
-
-| | Milestone |
-|---|---|
-| **M1** | `vaern run hello.ts` — TypeScript, `fetch`, timers, `console`, HTTP server |
-| **M2** | capability enforcer + `vaern.toml`; `node:fs` / `node:http` / `node:path` subset |
-| **M3** | `agent()`, `tool()`, MCP client/server, budgets, effect journal, `vaern replay` |
-| **M4** | residency egress guard, hash-chained audit, PK-PKI signing, `ur-PK` i18n |
-| **M5** | honest public benchmarks (including losses), docs site, external production users |
+## Links
 
-We publish benchmarks we lose. A runtime that hides a benchmark is hiding something else.
+- Website: <a href="https://vaernjs.tech">vaernjs.tech</a>
+- DevLogix: <a href="https://devlogix.com.pk">devlogix.com.pk</a>
+- Repository: <a href="https://github.com/vaernjs/vaern">github.com/vaernjs/vaern</a>
+- Issues: <a href="https://github.com/vaernjs/vaern/issues">github.com/vaernjs/vaern/issues</a>
+- npm: <a href="https://www.npmjs.com/package/@vaernjs/vaern">@vaernjs/vaern</a>
 
 ## Licence
 
-MIT License. Copyright (c) 2026 DEVLOGIX TECHNOLOGY (PRIVATE) LIMITED.
+MIT License. Copyright (c) 2026 DEVLOGIX TECHNOLOGY (PRIVATE) LIMITED ([DevLogix](https://devlogix.com.pk)).
 See [`LICENSE`](./LICENSE).
 
 ## Development
 
 ```bash
 git clone https://github.com/vaernjs/vaern.git && cd vaern
-npm install
+cargo build --release
 npm run check          # pre-publish validation
 npm run pack:dry       # inspect exactly what would be published
 ```
 
-Issues and pull requests welcome — we would rather be corrected now than wrong later.
+Issues and pull requests welcome. We would rather be corrected now than wrong later.

package/bin/vaern.cjs

@@ -6,18 +6,18 @@
  *
  * Two modes, chosen at runtime:
  *
- *   NATIVE     A platform package (vaern-<os>-<arch>) shipped a real binary.
+ *   NATIVE     A platform package (@vaernjs/vaern-<os>-<arch>) shipped a real binary.
  *              We exec it and get out of the way, forwarding stdio, signals
- *              and the exit code. This is the normal path from v0.1.0.
+ *              and the exit code. This is the normal path from v0.0.4.
  *
- *   FALLBACK   No binary for this platform yet (the v0.0.x placeholder
- *              releases, an unsupported platform, or `npm i --no-optional`).
+ *   FALLBACK   No binary for this platform (an unsupported platform, or
+ *              optional dependencies skipped with `npm i --omit=optional`).
  *              We serve a small built-in CLI so the command never dies with
  *              "command not found".
  *
  * Resolution order for the native binary:
  *   1. $VAERN_BINARY               (explicit override — used by CI and by `cargo run` during dev)
- *   2. vaern-<os>-<arch> package   (the normal npm install path)
+ *   2. @vaernjs/vaern-<os>-<arch>   (the normal npm install path)
  *   3. ../vendor/vaern             (repo-local build dropped in by `just build`)
  *   4. FALLBACK
  *
@@ -36,7 +36,7 @@ const require_ = createRequire(__filename);
 const pkg = require_("../package.json");
 
 const EXE = process.platform === "win32" ? ".exe" : "";
-const PLATFORM_PKG = `vaern-${process.platform}-${process.arch}`;
+const PLATFORM_PKG = `@vaernjs/vaern-${process.platform}-${process.arch}`;
 
 /* ------------------------------------------------------------------ */
 /* native binary resolution                                            */
@@ -138,24 +138,23 @@ function execNative(binary, args) {
 /* ------------------------------------------------------------------ */
 
 const BANNER = `vaern ${pkg.version} — an agent-native JavaScript & TypeScript runtime
-A DevLogix project · licensed MIT
+VaernJS https://vaernjs.tech · a DevLogix project https://devlogix.com.pk · licensed MIT
 `;
 
 const ROADMAP = `
-vaern is in active development.
-
-  M1  weeks 3-6     vaern run hello.ts — TypeScript, fetch, timers, console, HTTP server
-  M2  weeks 7-10    capability enforcer + vaern.toml (deny by default)
-  M3  weeks 11-14   agent(), tool(), MCP client/server, budgets, effect journal, vaern replay
-  M4  weeks 15-20   sovereignty: residency guard, hash-chained audit, PK-PKI signing, ur-PK i18n
-  M5  weeks 21-26   honest public benchmarks, docs, first external production users
-
-Manifesto:   https://github.com/vaernjs/vaern
+  M1  vaern run hello.ts — TypeScript, fetch, timers, console, HTTP server (shipping in 0.0.x)
+  M2  capability enforcer + vaern.toml (deny by default)
+  M3  agent(), tool(), MCP client/server, budgets, effect journal, vaern replay
+  M4  sovereignty: residency guard, hash-chained audit, PK-PKI signing, ur-PK i18n
+  M5  honest public benchmarks, docs, first external production users
+
+Website:     https://vaernjs.tech
+DevLogix:    https://devlogix.com.pk
 Repository:  ${pkg.repository ? String(pkg.repository.url).replace(/^git\+/, "") : "https://github.com/vaernjs/vaern"}
 Issues:      ${pkg.bugs ? pkg.bugs.url : ""}
 
-This placeholder release exists to reserve the name on npm and to give the CLI
-a working entry point. The native runtime binary lands in M1 (v0.1.0).
+The native runtime ships in the platform package ${PLATFORM_PKG}. This message
+means it is not installed. Run \`vaern doctor\` for details.
 `;
 
 function fallback(args) {
@@ -178,11 +177,13 @@ function fallback(args) {
 platform:        ${process.platform}-${process.arch}
 expected package: ${PLATFORM_PKG}
 node:            ${process.version}
-native binary:   NOT PRESENT (placeholder release)
+native binary:   NOT FOUND
 $VAERN_BINARY:   ${process.env.VAERN_BINARY || "(unset)"}
 
-Nothing is wrong. The native binary ships in v0.1.0 (milestone M1).
-Until then, install is expected to fall back to this message.
+Native binaries are published for linux-x64, linux-arm64, darwin-x64,
+darwin-arm64 and win32-x64. If your platform is listed, optional dependencies
+were probably skipped: reinstall without --omit=optional / --no-optional, or
+point $VAERN_BINARY at a vaern binary.
 `);
     process.exit(0);
   }
@@ -191,8 +192,8 @@ Until then, install is expected to fall back to this message.
     `${BANNER}
 vaern: unknown command '${a}'
 
-The native runtime binary is not available for ${process.platform}-${process.arch}
-in this release. Expected platform package: ${PLATFORM_PKG}.
+The native runtime binary is not installed for ${process.platform}-${process.arch}.
+Expected platform package: ${PLATFORM_PKG}.
 
 Try:   vaern doctor      show install diagnostics
        vaern roadmap     what is being built and when

package/index.d.ts

@@ -1,9 +1,9 @@
 import type { ChildProcess, SpawnOptions } from "node:child_process";
 
-/** Package version, e.g. "0.0.1". */
+/** Package version, e.g. "0.0.4". */
 export declare const version: string;
 
-/** Name of the platform package that carries the binary for this host, e.g. "vaern-linux-x64". */
+/** Name of the platform package that carries the binary for this host, e.g. "@vaernjs/vaern-linux-x64". */
 export declare const platformPackage: string;
 
 /** Absolute path to the native vaern binary, or null when this release has none. */

package/index.js

@@ -16,9 +16,9 @@ const require_ = createRequire(__filename);
 const pkg = require_("./package.json");
 
 const EXE = process.platform === "win32" ? ".exe" : "";
-const PLATFORM_PKG = `vaern-${process.platform}-${process.arch}`;
+const PLATFORM_PKG = `@vaernjs/vaern-${process.platform}-${process.arch}`;
 
-/** Package name that should carry the binary for this platform, e.g. `vaern-linux-x64`. */
+/** Package name that should carry the binary for this platform, e.g. `@vaernjs/vaern-linux-x64`. */
 const platformPackage = PLATFORM_PKG;
 
 /** Absolute path to the native binary, or null if this release has none. */

package/package.json

@@ -1,22 +1,21 @@
 {
   "name": "@vaernjs/vaern",
-  "version": "0.0.2",
-  "description": "Vaern — an agent-native JavaScript & TypeScript runtime with capability sandboxing, deterministic replay and sovereignty enforcement.",
+  "version": "0.0.4",
+  "description": "Vaern — an agent-native JavaScript & TypeScript runtime. Runs TypeScript directly, with fetch and an HTTP server built in.",
   "keywords": [
     "runtime",
     "javascript",
     "typescript",
     "agent",
     "agents",
-    "mcp",
-    "sandbox",
     "cli",
     "vaern",
     "devlogix"
   ],
   "license": "MIT",
   "author": {
-    "name": "DEVLOGIX TECHNOLOGY (PRIVATE) LIMITED"
+    "name": "DEVLOGIX TECHNOLOGY (PRIVATE) LIMITED",
+    "url": "https://devlogix.com.pk"
   },
   "repository": {
     "type": "git",
@@ -51,6 +50,13 @@
     "postinstall": "node scripts/postinstall.cjs",
     "prepublishOnly": "node ../../scripts/check-publish.mjs"
   },
+  "optionalDependencies": {
+    "@vaernjs/vaern-linux-x64": "0.0.4",
+    "@vaernjs/vaern-linux-arm64": "0.0.4",
+    "@vaernjs/vaern-darwin-arm64": "0.0.4",
+    "@vaernjs/vaern-darwin-x64": "0.0.4",
+    "@vaernjs/vaern-win32-x64": "0.0.4"
+  },
   "engines": {
     "node": ">=18.0.0"
   },

package/scripts/postinstall.cjs

@@ -33,7 +33,7 @@ function main() {
   if (process.platform === "win32") return done("windows — keeping the JS shim");
 
   const require_ = createRequire(__filename);
-  const platformPkg = `vaern-${process.platform}-${process.arch}`;
+  const platformPkg = `@vaernjs/vaern-${process.platform}-${process.arch}`;
 
   let binary;
   try {