functionalscript 0.44.0 → 0.46.0

package/fjs/media/type/proof.f.mjs

@@ -1,13 +1,18 @@
+/**
+ * @import { Vec } from '../../types/bit_vec/types.ts'
+ * @import { List } from '../../effects/list/types.ts'
+ * @import { IoChannel } from '../../effects/node/types.ts'
+ * @import { DetectMeta } from './types.ts'
+ */
+
 import { assert, assertEq } from '../../asserts/module.f.mjs'
 import { msb, u8ListToVec, vec8, repeat, empty } from '../../types/bit_vec/module.f.mjs'
-/** @import { Vec } from '../../types/bit_vec/types.ts' */
 import { runPure } from '../../effects/module.f.mjs'
 import { nonEmpty, empty as emptyList } from '../../effects/list/module.f.mjs'
-/** @import { List } from '../../effects/list/types.ts' */
-/** @import { Result } from '../../types/result/types.ts' */
-import { ok } from '../../types/result/module.f.mjs'
+import { pureError } from '../../effects/module.f.mjs'
+import { error, ok } from '../../types/result/module.f.mjs'
+import { ioError } from '../../effects/node/module.f.mjs'
 import { detect, detectStream, detectVec } from './module.f.mjs'
-/** @import { DetectMeta } from './types.ts' */
 
 // Builds a big-endian `Vec` from a list of byte values — mirrors how the CAS
 // store would hold the leading bytes of a stored blob.
@@ -16,12 +21,12 @@ const bytes = (...b) => u8ListToVec(msb)(b)
 
 // ── Streaming detector helpers ──────────────────────────────────────────────────
 
-// Builds a CAS-style read stream from a sequence of ok(chunk) items.
-/** @type {(...chunks: readonly Vec[]) => List<never, Result<Vec, unknown>>} */
+// Builds a CAS-style read stream from a sequence of chunks.
+/** @type {(...chunks: readonly Vec[]) => List<never, Vec, IoChannel>} */
 const stream = (...chunks) =>
     chunks.reduceRight(
-        (tail, c) => nonEmpty(ok(c), tail),
-        /** @type {List<never, Result<Vec, unknown>>} */ (emptyList()))
+        (tail, c) => nonEmpty(c, tail),
+        /** @satisfies {List<never, Vec, IoChannel>} */ (emptyList()))
 
 // Runs the streaming detector over the given chunks and unwraps the metadata.
 /** @type {(...chunks: readonly Vec[]) => DetectMeta} */
@@ -61,6 +66,11 @@ export const proof = {
     emptyZip: () =>
         assertEq(detect(bytes(0x50, 0x4b, 0x05, 0x06, 0x00, 0x00)), 'application/zip'),
 
+    // A spanned ZIP archive — the third "PK" variant, so every entry of the
+    // signature list has a case that fails if it is dropped.
+    spannedZip: () =>
+        assertEq(detect(bytes(0x50, 0x4b, 0x07, 0x08, 0x00, 0x00)), 'application/zip'),
+
     webp: () =>
         // "RIFF" + 4-byte size + "WEBP"
         assertEq(
@@ -76,6 +86,25 @@ export const proof = {
             null),
 
     // Plain ASCII text matches no signature.
+    // `detect` is the magic projection of `push`, and that only holds because
+    // `magicStep` leaves a non-`scan` state alone. These pin both absorbing
+    // states as fixed points from the outside, where `magicStep` is private.
+    settledMagicIsAFixedPoint: [
+        // `matched` survives whatever follows the signature — including bytes
+        // that would not extend it, and a long tail that would otherwise keep
+        // the fold running.
+        () => assertEq(detect(bytes(0xff, 0xd8, 0xff, 0x00, 0x01, 0x02)), 'image/jpeg'),
+        () => assertEq(detect(bytes(0xff, 0xd8, 0xff, ...Array(64).fill(0x41))), 'image/jpeg'),
+        // `dead` survives too. This is the case where `push` keeps folding
+        // after the magic state is settled — `isSettled` stays false while the
+        // UTF-8 factor is still valid text — so a `dead` magic is fed many more
+        // bytes here than `detect`'s old loop ever gave it.
+        () => assertEq(detect(bytes(0x41)), null),
+        () => assertEq(detect(bytes(0x41, ...Array(64).fill(0x42))), null),
+        // ...and the same input still reads as text through the full detector,
+        // confirming the fold really did continue past the dead magic.
+        () => assertEq(detectVec(bytes(0x41, ...Array(64).fill(0x42))).type, 'text'),
+    ],
     textIsNull: () =>
         assertEq(detect(bytes(0x68, 0x65, 0x6c, 0x6c, 0x6f)), null),
 
@@ -86,6 +115,38 @@ export const proof = {
     emptyIsNull: () =>
         assertEq(detect(empty), null),
 
+    // Every signature, one byte short of complete. A signature is only ever
+    // recognized on its *last* byte, so each of these must still be null — an
+    // off-by-one in the eliminator's terminal-position test would report the
+    // format here, and would fire the "GIF8"-prefix trap `gif8NotGif` guards.
+    truncated: {
+        png: () =>
+            assertEq(detect(bytes(0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a)), null),
+
+        jpeg: () =>
+            assertEq(detect(bytes(0xff, 0xd8)), null),
+
+        gif87a: () =>
+            assertEq(detect(bytes(0x47, 0x49, 0x46, 0x38, 0x37)), null),
+
+        gif89a: () =>
+            assertEq(detect(bytes(0x47, 0x49, 0x46, 0x38, 0x39)), null),
+
+        pdf: () =>
+            assertEq(detect(bytes(0x25, 0x50, 0x44, 0x46)), null),
+
+        zip: () =>
+            assertEq(detect(bytes(0x50, 0x4b, 0x03)), null),
+
+        // 11 bytes: "RIFF", the size wildcards, and all but the last byte of
+        // "WEBP" — the wildcard run must not shorten the pattern either.
+        webp: () =>
+            assertEq(
+                detect(bytes(
+                    0x52, 0x49, 0x46, 0x46, 0x1a, 0x00, 0x00, 0x00, 0x57, 0x45, 0x42)),
+                null),
+    },
+
     // ── Streaming detector (detectStream) ───────────────────────────────────────
 
     stream: {
@@ -230,11 +291,10 @@ export const proof = {
             assertEq(m.length, 8n)
         },
 
-        // A read `error` item short-circuits into the IoResult error.
+        // A stream that fails carries its failure out as the detector's own.
         readErrorSurfaces: () => {
-            /** @type {List<never, Result<Vec, unknown>>} */
-            const errStream =
-                nonEmpty(/** @type {const} */ (['error', 'boom']), emptyList())
+            /** @type {List<never, Vec, IoChannel>} */
+            const errStream = pureError(ioError({ message: 'boom' }))
             const o = runPure(detectStream(errStream))
             assert(o.length === 1, 'effect is not pure')
             assert(o[0][0] === 'error')

package/fjs/module.d.mts

@@ -1,2 +1,7 @@
 #!/usr/bin/env node
+/**
+ * The `fjs` CLI executable entry point.
+ *
+ * @module
+ */
 export {};

package/fjs/module.f.d.mts

@@ -1,3 +1,11 @@
+/**
+ * FunctionalScript compiler entry points and command handlers.
+ *
+ * @module
+ *
+ * @import { NodeOp, NodeProgram } from './effects/node/types.ts'
+ * @import { Commands } from './cli/types.ts'
+ */
 import type { NodeProgram } from './effects/node/types.ts';
 /** @type {NodeProgram} */
 export declare const main: NodeProgram;

package/fjs/module.f.mjs

@@ -2,18 +2,19 @@
  * FunctionalScript compiler entry points and command handlers.
  *
  * @module
+ *
+ * @import { NodeOp, NodeProgram } from './effects/node/types.ts'
+ * @import { Commands } from './cli/types.ts'
  */
+
 import { compile } from './djs/module.f.mjs'
 import { main as testMain } from './emergent_testing/module.f.mjs'
 import { commands as casCommands } from './cas/cli/module.f.mjs'
 import { main as ciMain } from './ci/module.f.mjs'
-import { import_ } from './effects/node/module.f.mjs'
-/** @import { NodeOp, NodeProgram } from './effects/node/types.ts' */
+import { errorExit, errorMessage, exitStep, import_ } from './effects/node/module.f.mjs'
 import { dispatch } from './cli/module.f.mjs'
-/** @import { Commands } from './cli/types.ts' */
 import { casMcpServer } from './mcp/module.f.mjs'
-import { pure, step } from './effects/module.f.mjs'
-import { unwrap } from './types/result/module.f.mjs'
+import { resultStep } from './effects/module.f.mjs'
 
 /** @type {Commands<NodeOp>} */
 const commands = [
@@ -35,9 +36,17 @@ const commands = [
     {
         names: ['mcp', 'm'],
         description: 'Run an MCP server over stdio exposing the CAS and Evo (subjects/heads) as tools',
-        handler: ({ home }) => step(
-            casMcpServer(home),
-            () => pure(0)),
+        // `exitStep`, not `resultStep(…, () => pureOk(0))`: the server's
+        // bootstrap can fail, and a continuation that ignores its result would
+        // report a server that never started as a clean exit.
+        //
+        // The types do *not* rule that out. `Program`'s exit code being a
+        // `Result` catches the old spelling — `() => pure(0)` hands back a bare
+        // number, which no longer fits — but `() => pureOk(0)` still compiles,
+        // because discarding a result you were handed is exactly what a
+        // continuation is allowed to do. This comment guards a mistake that is
+        // still available.
+        handler: ({ home }) => exitStep(casMcpServer(home)),
     },
     {
         names: ['ci', 'i'],
@@ -47,11 +56,25 @@ const commands = [
     {
         names: ['run', 'r'],
         description: 'Run a FunctionalScript module as a NodeProgram',
+        // Both ways this can fail are the command line, not a defect: the
+        // named file may not import, and a module that does import may export
+        // no `main`. Neither deserves a stack trace, so both are reported on
+        // `stderr` and exit `1` — the same answer an unknown command gets a
+        // few lines up, and the same one every other command now gives.
         handler: options => {
             const [file, ...args] = options.args
-            return step(
+            return resultStep(
                 import_(file),
-                x => (/** @type {NodeProgram} */ (unwrap(x).main))({ ...options, args }))
+                r => {
+                    if (r[0] === 'error') {
+                        return errorExit(`${file}: ${errorMessage(r[1])}`)
+                    }
+                    const { main } = r[1]
+                    if (typeof main !== 'function') {
+                        return errorExit(`${file}: not a NodeProgram — no exported \`main\` function`)
+                    }
+                    return /** @type {NodeProgram} */ (main)({ ...options, args })
+                })
         },
     },
 ]

package/fjs/module.mjs

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 
+/**
+ * The `fjs` CLI executable entry point.
+ *
+ * @module
+ */
+
 import { main } from './module.f.mjs'
 import { run } from './effects/node/module.mjs'
 

package/fjs/nanvm/proof.f.mjs

@@ -121,8 +121,8 @@ const eqProof = (() => {
     })
     /** @type {(c: EqCase) => readonly[string, () => void]} */
     const leaf = c => [c.name, () => {
-        const a = /** @type {any} */(operand(c.a))
-        const b = /** @type {any} */(operand(c.b))
+        const a = operand(c.a)
+        const b = operand(c.b)
         assertEq(a === b, c.eq, [a, c.eq ? '===' : '!==', b])
         assertEq(b === a, c.eq)
     }]
@@ -157,7 +157,7 @@ const jsOnly = {
     },
     throw: {
         toStringThrows: () => String({ toString: () => { throw 'Custom error' } }),
-        toStringNotAFunction: () => String(/** @type {any} */({ toString: 'hello' })),
+        toStringNotAFunction: () => String({ toString: 'hello' }),
         toStringNotPrimitive: () => String({ toString: () => [] }),
         /** `throws` describes a case's outcome; it is not a value to build. */
         throwsIsNotAValue: () => value(() => ['throw']),

package/fjs/nanvm/rust/module.f.mjs

@@ -78,7 +78,7 @@ export const valueExpr = v => {
         case 'bigint': { return `bigint_any(${i64Literal(v)})` }
     }
     if (Array.isArray(v)) {
-        const items = /** @type {readonly Value[]} */(v)
+        const items = v
         return items.length === 0
             ? 'Array::default().to_any()'
             : `[${items.map(valueExpr).join(', ')}].to_array().to_any()`

package/fjs/nanvm/update/module.f.d.mts

@@ -8,16 +8,16 @@
  *
  * @module
  *
+ * @import { IoChannel, Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts'
  * @import { Effect } from '../../effects/types.ts'
- * @import { Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts'
  */
+import type { IoChannel, Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts';
 import type { Effect } from '../../effects/types.ts';
-import type { Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts';
 /**
  * Regenerates `nanvm-lib/tests/test/generated.rs` from the shared test data.
  *
- * @type {() => Effect<Mkdir | WriteFile, void>}
+ * @type {() => Effect<Mkdir | WriteFile, void, IoChannel>}
  */
-export declare const generateRustTests: () => Effect<Mkdir | WriteFile, void>;
+export declare const generateRustTests: () => Effect<Mkdir | WriteFile, void, IoChannel>;
 /** @type {NodeProgram} */
 export declare const main: NodeProgram;

package/fjs/nanvm/update/module.f.mjs

@@ -8,26 +8,25 @@
  *
  * @module
  *
+ * @import { IoChannel, Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts'
  * @import { Effect } from '../../effects/types.ts'
- * @import { Mkdir, NodeProgram, WriteFile } from '../../effects/node/types.ts'
  */
 
-import { mapStep, step } from '../../effects/module.f.mjs'
-import { mkdir, writeUtf8File } from '../../effects/node/module.f.mjs'
-import { unwrap } from '../../types/result/module.f.mjs'
+
+import { exitStep, mkdir, writeUtf8File } from '../../effects/node/module.f.mjs'
+import { step } from '../../effects/module.f.mjs'
 import { data } from '../module.f.mjs'
 import { directory, generate, path } from '../rust/module.f.mjs'
 
 /**
  * Regenerates `nanvm-lib/tests/test/generated.rs` from the shared test data.
  *
- * @type {() => Effect<Mkdir | WriteFile, void>}
+ * @type {() => Effect<Mkdir | WriteFile, void, IoChannel>}
  */
 export const generateRustTests = () => {
-    const directoryReady = mapStep(mkdir(directory, { recursive: true }), unwrap)
-    const written = step(directoryReady, () => writeUtf8File(path, generate(data)))
-    return mapStep(written, unwrap)
+    const directoryReady = mkdir(directory, { recursive: true })
+    return step(directoryReady, () => writeUtf8File(path, generate(data)))
 }
 
 /** @type {NodeProgram} */
-export const main = () => mapStep(generateRustTests(), () => 0)
+export const main = () => exitStep(generateRustTests())

package/fjs/nanvm/update/proof.f.mjs

@@ -4,8 +4,9 @@
  * @module
  */
 
+import { exitCode } from '../../effects/node/module.f.mjs'
 import { assert, assertEq } from '../../asserts/module.f.mjs'
-import { step } from '../../effects/module.f.mjs'
+import { step as ioStep } from '../../effects/module.f.mjs'
 import { readUtf8File } from '../../effects/node/module.f.mjs'
 import {
     defaultNodeProgramOptions,
@@ -20,13 +21,13 @@ export const proof = {
     generateRustTests: () => {
         // The target directory does not exist in `emptyState`, so this also
         // covers the `mkdir` the writer does before the file write.
-        const written = step(generateRustTests(), () => readUtf8File(path))
+        const written = ioStep(generateRustTests(), () => readUtf8File(path))
         const [, [tag, result]] = virtual(emptyState)(written)
         assert(tag === 'ok', result)
         assertEq(result, generate(data))
     },
     main: () => {
         const [, result] = virtual(emptyState)(main(defaultNodeProgramOptions))
-        assertEq(result, 0)
+        assertEq(exitCode(result), 0)
     },
 }

package/fjs/path/module.f.d.mts

@@ -1,3 +1,11 @@
+/**
+ * Path parsing and normalization helpers for portable module paths.
+ *
+ * @module
+ *
+ * @import { Fold, Reduce, Unary } from '../types/function/operator/types.ts'
+ * @import { List } from '../types/list/types.ts'
+ */
 import type { Reduce, Unary } from '../types/function/operator/types.ts';
 /**
  * Converts Windows separators (`\`) to POSIX separators (`/`).

package/fjs/path/module.f.mjs

@@ -2,9 +2,11 @@
  * Path parsing and normalization helpers for portable module paths.
  *
  * @module
+ *
+ * @import { Fold, Reduce, Unary } from '../types/function/operator/types.ts'
+ * @import { List } from '../types/list/types.ts'
  */
-/** @import { Fold, Reduce, Unary } from '../types/function/operator/types.ts' */
-/** @import { List } from '../types/list/types.ts' */
+
 import { fold, last, take, length, concat as listConcat, toArray } from '../types/list/module.f.mjs'
 import { join as listJoin, concat as stringConcat } from '../types/string/module.f.mjs'
 

package/fjs/proof.f.d.mts

@@ -1,9 +1,13 @@
+/**
+ * @import { NodeProgram, NodeProgramOptions } from './effects/node/types.ts'
+ * @import { Dir } from './effects/node/virtual/types.ts'
+ */
 export declare const proof: {
     help: () => void;
     compileRequiresArgs: () => void;
     runModule: () => void;
     mcp: () => void;
-    throw: {
-        runImportError: () => void;
-    };
+    mcpCorruptStore: () => void;
+    runImportError: () => void;
+    runNotANodeProgram: () => void;
 };

package/fjs/proof.f.mjs

@@ -1,9 +1,14 @@
+/**
+ * @import { NodeProgram, NodeProgramOptions } from './effects/node/types.ts'
+ * @import { Dir } from './effects/node/virtual/types.ts'
+ */
+
+import { exitCode } from './effects/node/module.f.mjs'
 import { assert, assertEq } from './asserts/module.f.mjs'
-import { pure } from './effects/module.f.mjs'
-/** @import { NodeProgram, NodeProgramOptions } from './effects/node/types.ts' */
+import { pureError, pureOk } from './effects/module.f.mjs'
 import { defaultNodeProgramOptions, emptyState, virtual } from './effects/node/virtual/module.f.mjs'
-/** @import { Dir } from './effects/node/virtual/types.ts' */
 import { main } from './module.f.mjs'
+import { vec8 } from './types/bit_vec/module.f.mjs'
 
 /** @type {(args: readonly string[]) => NodeProgramOptions} */
 const makeOptions = args => ({ ...defaultNodeProgramOptions, args })
@@ -11,18 +16,20 @@ const makeOptions = args => ({ ...defaultNodeProgramOptions, args })
 const run = (/** @type {Dir} */ root) => (/** @type {readonly string[]} */ args) =>
     virtual({ ...emptyState, root })(main(makeOptions(args)))
 
+// A program whose exit code is its argument count — non-zero, so it leaves
+// through the error branch like any other failing program.
 /** @type {NodeProgram} */
-const appMain = ({ args }) => pure(args.length)
+const appMain = ({ args }) => args.length === 0 ? pureOk(0) : pureError(args.length)
 
 export const proof = {
     help: () => {
         const [state, code] = run({})(['help'])
-        assertEq(code, 0)
+        assertEq(exitCode(code), 0)
         assert(state.stdout.includes('compile'), 'expected command list in stdout')
     },
     compileRequiresArgs: () => {
         const [state, code] = run({})(['compile'])
-        assertEq(code, 1)
+        assertEq(exitCode(code), 1)
         assert(state.stderr.length !== 0, 'expected error in stderr')
     },
     runModule: () => {
@@ -30,7 +37,7 @@ export const proof = {
         const root = { 'app.f.ts': () => ({ main: appMain }) }
         const [, code] = run(root)(['run', 'app.f.ts', 'x', 'y'])
         // `run` strips the command and file name, so `main` sees two arguments
-        assertEq(code, 2)
+        assertEq(exitCode(code), 2)
     },
     mcp: () => {
         // stdin is empty in the virtual environment, so the server sees EOF
@@ -38,11 +45,33 @@ export const proof = {
         // The store is empty too, so `casMcpServer`'s Evo cache scan
         // (`initEvo`) also runs and finds nothing.
         const [, code] = run({})(['mcp'])
-        assertEq(code, 0)
+        assertEq(exitCode(code), 0)
+    },
+    mcpCorruptStore: () => {
+        // The headline new error path, end to end: `.cas` exists but is a
+        // file, so `initEvo`'s scan cannot list it. The server never starts,
+        // and the failure travels out of the bootstrap to the command's
+        // `exitStep` — a message on stderr and exit 1, where it used to be a
+        // panic from inside `buildCache`.
+        const [state, code] = run({ '.cas': [vec8(0x2An)] })(['mcp'])
+        assertEq(exitCode(code), 1)
+        assert(state.stderr !== '', ['expected the storage error on stderr', state.stderr])
     },
-    throw: {
-        runImportError: () => {
-            run({})(['run', 'missing.f.ts'])
-        },
+    // A file that will not import is the user's command line, not a defect:
+    // it is reported with the name they typed and exits 1, where it used to
+    // panic out of the effect runner.
+    runImportError: () => {
+        const [state, code] = run({})(['run', 'missing.f.ts'])
+        assertEq(exitCode(code), 1)
+        assert(state.stderr.startsWith('missing.f.ts: '), state.stderr)
+    },
+    // The file imports but is not a program. Same answer, different reason —
+    // and the reason is the half of it worth saying.
+    runNotANodeProgram: () => {
+        /** @type {Dir} */
+        const root = { 'app.f.ts': () => ({ notMain: 1 }) }
+        const [state, code] = run(root)(['run', 'app.f.ts'])
+        assertEq(exitCode(code), 1)
+        assert(state.stderr.includes('not a NodeProgram'), state.stderr)
     },
 }

package/fjs/protocol/json_rpc/module.f.d.mts

@@ -2,7 +2,7 @@
  * JSON-RPC 2.0 envelopes and a pure dispatcher.
  *
  * The envelopes are rtti schemas, so one declaration yields both a runtime
- * decoder (`validate(request)`) and the static type (`Ts<typeof request>`) — no
+ * decoder (`parse(request)`) and the static type (`Ts<typeof request>`) — no
  * drift between them. The dispatcher is pure: it maps an already-parsed request
  * value to a response value (or `null` for a notification) and performs no I/O.
  *
@@ -15,7 +15,7 @@
  * @module
  *
  * @import { Unknown } from '../../media/json/types.ts'
- * @import { Id, RpcError, Handler, Handlers, Response } from './types.ts'
+ * @import { Id, RpcError, Handlers, Response } from './types.ts'
  */
 import type { Unknown } from '../../media/json/types.ts';
 import type { RpcError, Handlers, Response } from './types.ts';
@@ -77,7 +77,7 @@ export declare const response: import("../../types/rtti/types.ts").Or<[{
     readonly id: import("../../types/rtti/types.ts").Or<[import("../../types/rtti/types.ts")._Type0<"string">, import("../../types/rtti/types.ts")._Type0<"number">, null]>;
 }]>;
 /** Decodes an untrusted value as a JSON-RPC request / notification. */
-export declare const decodeRequest: import("../../types/rtti/common/types.ts").Validate<{
+export declare const decodeRequest: import("../../types/rtti/parse/types.ts").Parse<{
     readonly jsonrpc: "2.0";
     readonly method: import("../../types/rtti/types.ts")._Type0<"string">;
     readonly params: import("../../types/rtti/types.ts").Or<readonly [() => readonly ['or', typeof import("../../media/json/rtti/module.f.mjs").primitive, typeof import("../../media/json/rtti/module.f.mjs").object, typeof import("../../media/json/rtti/module.f.mjs").array], undefined]>;

package/fjs/protocol/json_rpc/module.f.mjs

@@ -2,7 +2,7 @@
  * JSON-RPC 2.0 envelopes and a pure dispatcher.
  *
  * The envelopes are rtti schemas, so one declaration yields both a runtime
- * decoder (`validate(request)`) and the static type (`Ts<typeof request>`) — no
+ * decoder (`parse(request)`) and the static type (`Ts<typeof request>`) — no
  * drift between them. The dispatcher is pure: it maps an already-parsed request
  * value to a response value (or `null` for a notification) and performs no I/O.
  *
@@ -15,11 +15,12 @@
  * @module
  *
  * @import { Unknown } from '../../media/json/types.ts'
- * @import { Id, RpcError, Handler, Handlers, Response } from './types.ts'
+ * @import { Id, RpcError, Handlers, Response } from './types.ts'
  */
 
+import { at } from '../../types/object/module.f.mjs'
 import { number, string, or, option } from '../../types/rtti/module.f.mjs'
-import { validate } from '../../types/rtti/validate/module.f.mjs'
+import { parse } from '../../types/rtti/parse/module.f.mjs'
 import { unknown } from '../../media/json/rtti/module.f.mjs'
 
 export const jsonrpc = /** @type {const} */ ('2.0')
@@ -62,7 +63,7 @@ export const errorResponse = /** @type {const} */ ({ jsonrpc, error, id: _id })
 export const response = or(successResponse, errorResponse)
 
 /** Decodes an untrusted value as a JSON-RPC request / notification. */
-export const decodeRequest = validate(request)
+export const decodeRequest = parse(request)
 
 /**
  * Builds an `RpcError` with the given `code` and `message` (no `data`).
@@ -100,9 +101,11 @@ export const dispatch = handlers => value => {
     if (id === undefined) {
         return null
     }
-    /** @type {Handler | undefined} */
-    const handler = handlers[method]
-    if (handler === undefined) {
+    // `at`, not `handlers[method]`: `method` is untrusted wire data, and a
+    // bracket lookup on a plain object resolves inherited `Object.prototype`
+    // names (`constructor`, `toString`, …) to callables.
+    const handler = at(method)(handlers)
+    if (handler === null) {
         return errorResponseOf(id)(methodNotFound)
     }
     const [t2, result] = handler(params)

package/fjs/protocol/json_rpc/proof.f.d.mts

@@ -1,3 +1,6 @@
+/**
+ * @import { Handlers } from './types.ts'
+ */
 export declare const proof: {
     schema: {
         request: {
@@ -29,6 +32,9 @@ export declare const proof: {
         paramsPassed: () => void;
         handlerError: () => void;
         methodNotFound: () => void;
+        inheritedToString: () => void;
+        inheritedConstructor: () => void;
+        ownPrototypeName: () => void;
         invalidRequest: () => void;
         notification: () => void;
     };

package/fjs/protocol/json_rpc/proof.f.mjs

@@ -1,7 +1,10 @@
-/** @import { Handlers } from './types.ts' */
+/**
+ * @import { Handlers } from './types.ts'
+ */
+
 import { assert, assertEq } from '../../asserts/module.f.mjs'
 import { ok, error } from '../../types/result/module.f.mjs'
-import { validate } from '../../types/rtti/validate/module.f.mjs'
+import { parse } from '../../types/rtti/parse/module.f.mjs'
 import {
     error as errorSchema,
     decodeRequest,
@@ -25,6 +28,9 @@ const handlers = {
 }
 const d = dispatch(handlers)
 
+/** A handler table that does own the `Object.prototype` name `toString`. */
+const dOwnPrototypeName = dispatch({ toString: () => ok('own') })
+
 export const proof = {
     schema: {
         request: {
@@ -38,9 +44,9 @@ export const proof = {
             notObject: () => assert(!isOk(decodeRequest(42))),
         },
         error: {
-            ok: () => assert(isOk(validate(errorSchema)({ code: -1, message: 'x' }))),
-            withData: () => assert(isOk(validate(errorSchema)({ code: -1, message: 'x', data: [1, 2] }))),
-            missingMessage: () => assert(!isOk(validate(errorSchema)({ code: -1 }))),
+            ok: () => assert(isOk(parse(errorSchema)({ code: -1, message: 'x' }))),
+            withData: () => assert(isOk(parse(errorSchema)({ code: -1, message: 'x', data: [1, 2] }))),
+            missingMessage: () => assert(!isOk(parse(errorSchema)({ code: -1 }))),
         },
     },
     errors: {
@@ -72,6 +78,21 @@ export const proof = {
             const r = d({ jsonrpc: '2.0', method: 'nope', id: 4 })
             assert(r !== null && 'error' in r && r.error.code === -32601)
         },
+        // `method` is untrusted wire data: an inherited `Object.prototype`
+        // name must not resolve to a callable.
+        inheritedToString: () => {
+            const r = d({ jsonrpc: '2.0', method: 'toString', id: 4 })
+            assert(r !== null && 'error' in r && r.error.code === -32601)
+        },
+        inheritedConstructor: () => {
+            const r = d({ jsonrpc: '2.0', method: 'constructor', id: 4 })
+            assert(r !== null && 'error' in r && r.error.code === -32601)
+        },
+        // ... while an *own* property of that name is an ordinary method.
+        ownPrototypeName: () => {
+            const r = dOwnPrototypeName({ jsonrpc: '2.0', method: 'toString', id: 4 })
+            assert(r !== null && 'result' in r && r.result === 'own')
+        },
         invalidRequest: () => {
             const r = d({ jsonrpc: '1.0', method: 'ping', id: 5 })
             assert(r !== null && 'error' in r && r.error.code === -32600 && r.id === null)