rip-lang 3.15.4 → 3.16.1

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/shreeve/rip-lang/commits/main"><img src="https://img.shields.io/badge/version-3.15.4-blue.svg" alt="Version"></a>
+  <a href="https://github.com/shreeve/rip-lang/commits/main"><img src="https://img.shields.io/badge/version-3.16.1-blue.svg" alt="Version"></a>
   <a href="#zero-dependencies"><img src="https://img.shields.io/badge/dependencies-ZERO-brightgreen.svg" alt="Dependencies"></a>
   <a href="#"><img src="https://img.shields.io/badge/tests-1%2C436%2F1%2C436-brightgreen.svg" alt="Tests"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License"></a>
@@ -414,13 +414,13 @@ That's it. All `<script type="text/rip">` tags share scope — `export` makes na
 <script type="text/rip" src="app.rip"></script>
 
 <!-- Bundle — fetch all components from a server endpoint -->
-<script defer src="/rip/rip.min.js" data-src="bundle" data-mount="App"></script>
+<script defer src="/rip/rip.min.js" data-src="app" data-mount="App"></script>
 
 <!-- Bundle with stash persistence (sessionStorage) -->
-<script defer src="/rip/rip.min.js" data-src="bundle" data-mount="App" data-persist></script>
+<script defer src="/rip/rip.min.js" data-src="app" data-mount="App" data-persist></script>
 
 <!-- Mix bundles and individual files -->
-<script defer src="/rip/rip.min.js" data-src="/rip/ui bundle header.rip" data-mount="App"></script>
+<script defer src="/rip/rip.min.js" data-src="/rip/ui app header.rip" data-mount="App"></script>
 ```
 
 Every component has a static `mount(target)` method — `App.mount '#app'` is shorthand for `App.new().mount('#app')`. Target defaults to `'body'`.
@@ -561,6 +561,8 @@ bun run bump major
 | [docs/RIP-LANG.md](docs/RIP-LANG.md) | Full language reference (syntax, operators, reactivity, types, components) |
 | [docs/RIP-TYPES.md](docs/RIP-TYPES.md) | Type system specification |
 | [docs/RIP-SCHEMA.md](docs/RIP-SCHEMA.md) | Schema keyword — validators, models, ORM, DDL, algebra |
+| [docs/RIP-DUCKDB.md](docs/RIP-DUCKDB.md) | DuckDB foreign-key constraints — what works, what doesn't, how the ORM keeps you safe |
+| [docs/RIP-APP.md](docs/RIP-APP.md) | Rip App — browser framework architecture, subsystems, lifecycle invariants, gotchas |
 | [AGENTS.md](AGENTS.md) | AI agents — compiler architecture, subsystems, conventions |
 
 ---

package/bin/rip

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { readFileSync, readdirSync, writeFileSync, existsSync, statSync, unlinkSync } from 'fs';
+import { readFileSync, readdirSync, writeFileSync, existsSync, statSync, unlinkSync, lstatSync, readlinkSync, rmSync, mkdirSync, symlinkSync, realpathSync } from 'fs';
 import { execSync, spawnSync, spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, basename, join } from 'path';
@@ -8,7 +8,7 @@ import { Compiler, formatError } from '../src/compiler.js';
 // Side-effect imports — register CLI-side runtime providers. The browser
 // bundle imports a different schema loader so server-only fragments
 // (db-naming/orm/ddl) tree-shake out of docs/dist/rip.min.js.
-import '../src/types-emit.js';        // registers emitTypes for .d.ts output
+import '../src/dts.js';               // registers emitTypes for .d.ts output
 import '../src/schema/loader-server.js'; // registers full schema runtime
 import packageJson from '../package.json' with { type: 'json' };
 
@@ -60,7 +60,12 @@ Options:
 
 Subcommands:
   rip check [dir]               Type-check all .rip files in directory
-  rip check --strict [dir]      Require type annotations in all .rip files
+  rip check --audit [pkgDir]    Audit a typed package's public API surface for 'any' leaks
+  rip check --sourcemap [dir]   Verify source-map round-trip for every identifier
+                                (hover/go-to-def integrity). Useful for compiler work.
+  rip link [--quiet]            After 'bun install', symlink @rip-lang/* deps to
+                                local source (opt-in, for framework devs;
+                                undo with 'bun install --force')
   rip <name> [args]             Run rip-<name> (repo bin/, node_modules, or PATH)
 
   Configure via rip.json or package.json:
@@ -95,6 +100,121 @@ Shebang support:
 `);
 }
 
+// `rip link` — opt-in override for framework maintainers, layered on top of a
+// normal install. The canonical setup for any rip project is `bun install`
+// (published packages, lockfile, transitive deps); `rip link` then redirects
+// the @rip-lang/* deps to this CLI's own source checkout, by symlinking them
+// into ./node_modules/@rip-lang/* (plus matching .bin shims). The `rip-lang`
+// compiler/toolchain is pointed at source too, so the loader and VS Code LSP
+// load the matching toolchain instead of a shadowing published tarball. Lets
+// you edit framework source live without publishing.
+//
+// Requires `bun install` first — it overrides an existing install, it is not a
+// substitute for one. Reversible: the symlinks live in node_modules (gitignored)
+// and package.json stays clean semver, so `bun install --force` restores the
+// published packages (a plain `bun install` sees the lockfile as satisfied and
+// leaves the symlinks in place). No-op when no source tree is found (e.g. `rip`
+// installed from npm without a dev checkout) — projects then just use installed
+// packages.
+//
+// Source is this CLI's repo root (so it Just Works after `link-global`),
+// overridable via RIP_SRC.
+function ripLink(args) {
+  const quiet = args.includes('--quiet');
+  const log = (msg) => { if (!quiet) console.log(`[rip] link: ${msg}`); };
+
+  const rawSrc = process.env.RIP_SRC || join(__dirname, '..');
+  if (!existsSync(join(rawSrc, 'packages'))) {
+    log(`no rip-lang source at ${rawSrc} — using installed packages (set RIP_SRC to override)`);
+    return;
+  }
+  const src = realpathSync(rawSrc);
+
+  const cwd = process.cwd();
+  const pkgPath = join(cwd, 'package.json');
+  if (!existsSync(pkgPath)) {
+    console.error('[rip] link: no package.json in current directory');
+    process.exit(1);
+  }
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+  const deps = Object.keys(pkg.dependencies || {}).filter((d) => d.startsWith('@rip-lang/'));
+  if (deps.length === 0) {
+    log('no @rip-lang/* dependencies declared — nothing to link');
+    return;
+  }
+
+  const nodeModules = join(cwd, 'node_modules');
+  if (!existsSync(nodeModules)) {
+    console.error('[rip] link: no node_modules found — run `bun install` first, then `rip link`.');
+    process.exit(1);
+  }
+  const binDir = join(nodeModules, '.bin');
+
+  const linkTo = (path, target, type = 'dir') => {
+    try {
+      if (lstatSync(path).isSymbolicLink() && readlinkSync(path) === target) return false;
+      rmSync(path, { recursive: true, force: true });
+    } catch {}
+    mkdirSync(dirname(path), { recursive: true });
+    symlinkSync(target, path, type);
+    return true;
+  };
+
+  const linked = [];   // { dep, bins: [names] } for each resolved package
+  let changed = false;
+
+  for (const dep of deps) {
+    const short = dep.slice('@rip-lang/'.length);
+    const target = join(src, 'packages', short);
+    if (!existsSync(target)) { log(`skip ${dep} — not found at ${target}`); continue; }
+    if (linkTo(join(nodeModules, '@rip-lang', short), target)) changed = true;
+
+    // Re-create .bin shims from the package's own `bin` field so `rip server`
+    // and friends resolve source binaries from this project's node_modules.
+    let meta = {};
+    try { meta = JSON.parse(readFileSync(join(target, 'package.json'), 'utf-8')); } catch {}
+    const binMap = typeof meta.bin === 'string' ? { [short]: meta.bin } : (meta.bin || {});
+    const bins = [];
+    for (const [name, rel] of Object.entries(binMap)) {
+      const binTarget = join(target, rel);
+      if (!existsSync(binTarget)) continue;
+      if (linkTo(join(binDir, name), binTarget, 'file')) changed = true;
+      bins.push(name);
+    }
+    linked.push({ dep, bins });
+  }
+
+  // The compiler/toolchain itself. Every @rip-lang/* package depends on it,
+  // and the loader + VS Code LSP resolve it from the project's node_modules —
+  // so it must point at source too, otherwise a published `rip-lang` tarball
+  // shadows it (e.g. the LSP loading a typecheck.js without the latest API).
+  if (existsSync(join(nodeModules, 'rip-lang'))) {
+    if (linkTo(join(nodeModules, 'rip-lang'), src)) changed = true;
+    linked.push({ dep: 'rip-lang', bins: [], label: 'compiler' });
+  }
+
+  if (quiet || linked.length === 0) {
+    if (linked.length === 0) log('no @rip-lang/* packages resolved to source');
+    return;
+  }
+
+  const home = process.env.HOME || process.env.USERPROFILE || '';
+  const tilde = (p) => home && p.startsWith(home) ? '~' + p.slice(home.length) : p;
+  const tty = process.stdout.isTTY;
+  const dim = (s) => tty ? `\x1b[2m${s}\x1b[0m` : s;
+  const bold = (s) => tty ? `\x1b[1m${s}\x1b[0m` : s;
+
+  const n = linked.length;
+  const verb = changed ? 'linked' : 'already linked';
+  console.log(`${bold('rip link')} ${dim('·')} ${verb} ${n} package${n === 1 ? '' : 's'} ${dim('→ ' + tilde(src))}`);
+  const width = Math.max(...linked.map((l) => l.dep.length));
+  for (const { dep, bins, label } of linked) {
+    const tag = label || (bins.length ? `bin: ${bins.join(', ')}` : '');
+    const line = tag ? `${dep.padEnd(width)}${dim(`  ${tag}`)}` : dep;
+    console.log(`  ${dim('•')} ${line}`);
+  }
+}
+
 async function main() {
   const args = process.argv.slice(2);
 
@@ -140,14 +260,27 @@ async function main() {
   // --- Built-in subcommands ---
 
   if (args[0] === 'check') {
-    const { runCheck } = await import('../src/typecheck.js');
     const checkArgs = args.slice(1);
+    const VALID_FLAGS = new Set(['--audit', '--sourcemap']);
+    const unknown = checkArgs.filter(a => a.startsWith('-') && !VALID_FLAGS.has(a));
+    if (unknown.length > 0) {
+      console.error(`rip check: unknown flag${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}`);
+      console.error(`Valid flags: ${[...VALID_FLAGS].join(', ')}`);
+      process.exit(2);
+    }
     const dir = checkArgs.find(a => !a.startsWith('-')) || '.';
-    const exitCode = await runCheck(dir, {
-      quiet: checkArgs.includes('-q') || checkArgs.includes('--quiet'),
-      strict: checkArgs.includes('--strict'),
-    });
-    process.exit(exitCode);
+    const wantAudit     = checkArgs.includes('--audit');
+    const wantSourcemap = checkArgs.includes('--sourcemap');
+    const { runCheck, runAudit } = await import('../src/typecheck.js');
+    const checkCode = await runCheck(dir, { sourceMapAudit: wantSourcemap });
+    if (!wantAudit) process.exit(checkCode);
+    const auditCode = await runAudit(dir);
+    process.exit(checkCode || auditCode);
+  }
+
+  if (args[0] === 'link') {
+    ripLink(args.slice(1));
+    process.exit(0);
   }
 
   // --- Subcommand dispatch: rip <name> → rip-<name> ---
@@ -197,13 +330,32 @@ async function main() {
         }
       }
 
-      // 5. Global PATH: rip-<name>
+      // 5. Nearest node_modules/.bin walking up from the cwd. `getRepoRoot`
+      // uses `git rev-parse --show-toplevel`, which returns the OUTERMOST git
+      // repo — wrong when a project lives in a subdirectory of a larger git
+      // repo: step 4 then probes the outer repo's node_modules and misses the
+      // project's own declared bins. Resolve the bin the way Node resolves a
+      // dependency — nearest node_modules up the tree from the cwd — which is
+      // correct for nested projects and standalone consumers alike.
+      let nmDir = process.cwd();
+      while (true) {
+        const nmBin = join(nmDir, 'node_modules', '.bin', `rip-${name}`);
+        if (existsSync(nmBin)) {
+          const r = spawnSync(nmBin, subArgs, { stdio: 'inherit', env: process.env });
+          process.exit(r.status ?? 1);
+        }
+        const parent = dirname(nmDir);
+        if (parent === nmDir) break;
+        nmDir = parent;
+      }
+
+      // 6. Global PATH: rip-<name>
       const pathResult = spawnSync(`rip-${name}`, subArgs, { stdio: 'inherit', env: process.env });
       if (pathResult.error?.code !== 'ENOENT') {
         process.exit(pathResult.status ?? 1);
       }
 
-      // 6. Not found
+      // 7. Not found
       console.error(`rip: unknown command '${name}'\n\nRun 'rip --help' for usage.`);
       process.exit(1);
     }
@@ -213,7 +365,10 @@ async function main() {
 
   if ((args.length === 0 && process.stdin.isTTY) || ripOptions.includes('-r') || ripOptions.includes('--repl')) {
     const replModule = join(__dirname, '../src/repl.js');
-    const replProcess = spawn('bun', ['--experimental-vm-modules', '-e', `import('${replModule}').then(m => m.startREPL())`], {
+    // --preload installs the rip-loader plugin so `import '@rip-lang/foo'`
+    // (and any other .rip dependency) compiles when the REPL is run from a
+    // directory without a bunfig.toml.
+    const replProcess = spawn('bun', ['--experimental-vm-modules', '--preload', loaderPath, '-e', `import('${replModule}').then(m => m.startREPL())`], {
       stdio: 'inherit',
       env: process.env
     });

package/docs/AGENTS.md

@@ -38,6 +38,6 @@ App.mount()
 - `demo.html` and `charts.html` — dashboard demos
 - `sierpinski.html` — CDN demo
 - `example/index.html` and `results/index.html` — app launchers / examples. `example/index.json` is generated from `docs/demo/` via `bun run bundle:demo` (the source-of-truth lives in `docs/demo/`, the JSON is the deployable artifact).
-- `ui/index.html` — widget gallery
+- `ui/index.html` — widget gallery. `ui/bundle.json` is generated from `packages/ui/browser/components/` via `bun run bundle:ui` (auto-runs as part of `bun run build`). The source-of-truth is the workspace package; the JSON is the deployable artifact. The gallery loads the bundle at boot via `data-src="bundle.json"` and reads view-source text synchronously from the in-memory components store (`window.__RIP__.components.read("_pkg/ui/<id>.rip")`) — no per-component fetches.
 
 Static demos can be opened via `file://`. The playground and example app require `bun run serve`.