sendscript 1.1.0 → 2.0.1

package/.github/workflows/publish.yml

@@ -3,7 +3,7 @@ name: Publish Package
 on:
   push:
     tags:
-      - 'v*'
+      - '*'
 
 permissions:
   id-token: write  # Required for OIDC
@@ -22,4 +22,4 @@ jobs:
       - run: npm ci
       - run: npm run build --if-present
       - run: npm test
-      - run: npm publish
+      - run: npm publish

package/.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Release on tag
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ['lts/*', 'latest']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+      - run: npm test
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 'latest'
+          cache: npm
+
+      - run: npm ci
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

package/CHANGELOG.md

@@ -4,8 +4,22 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v2.0.1](https://github.com/bas080/sendscript/compare/v2.0.0...v2.0.1)
+
+- Publish to npm on tag push [`357ac0e`](https://github.com/bas080/sendscript/commit/357ac0ef3384f294e4f9bb179d5a675afda5fd19)
+
+### [v2.0.0](https://github.com/bas080/sendscript/compare/v1.1.0...v2.0.0)
+
+> 8 April 2026
+
+- Rewrite to have parse take schema to prevent accessing refs [`df16f85`](https://github.com/bas080/sendscript/commit/df16f85c79299aa8bcd3e44b6cc127bd7198eace)
+- Run tests before release and publish on release [`10442d6`](https://github.com/bas080/sendscript/commit/10442d6766a098926ee98daee08dba23eea0fb14)
+- Create release on tag with github workflows [`4ec222b`](https://github.com/bas080/sendscript/commit/4ec222bf51fc1d3cce9fc54fdd1e9639b5d259cd)
+
 #### [v1.1.0](https://github.com/bas080/sendscript/compare/v1.0.6...v1.1.0)
 
+> 7 April 2026
+
 - Support custom serialization of leaf nodes [`d56f1b7`](https://github.com/bas080/sendscript/commit/d56f1b750e2d7faf72d69f9ba8e9bb62ef5ebce7)
 - Support nested modules [`88e69e5`](https://github.com/bas080/sendscript/commit/88e69e5c05ddb85aac1797a020e92519c986e89f)
 - Document new nesting and leaf serialization feature [`b3ee9f6`](https://github.com/bas080/sendscript/commit/b3ee9f693dc6137b01c9f0072aa2dd1e940f07c9)

package/README.md

@@ -53,10 +53,11 @@ using more advanced (de)serialization libraries.
 SendScript produces an intermediate JSON representation of the program. Let's see what that looks like.
 
 ```js
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const { add } = module(['add'])
+const { add } = references(['add'])
+const stringify = Stringify()
 
 console.log(stringify(add(1,2)))
 ```
@@ -75,7 +76,7 @@ const module = {
   }
 }
 
-const parse = Parse(module)
+const parse = Parse(['add'], module)
 
 const program = '["call",["ref","add"],[1,2]]'
 
@@ -131,7 +132,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 
@@ -158,11 +160,13 @@ Now for a client that sends a program to the server.
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -176,8 +180,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 
@@ -253,52 +255,31 @@ export const add = (a: number, b: number) => a + b
 export const square = (a: number) => a * a
 ```
 
-We want to use this module on the client. We create a client version of that module and coerce the types to match those of the server.
-
-```bash
-cat ./example/typescript/math.client.ts
-```
-```ts
-import module from 'sendscript/module.mjs'
-import type * as mathTypes from './math.ts'
-
-const math = module([
-  'add',
-  'square'
-]) as typeof mathTypes
-
-export default math
-```
-
-We now use the client version of this module.
+We can then coerce the types of the instrumented stubs.
 
 ```bash
 cat ./example/typescript/client.ts
 ```
 ```ts
-import stringify from 'sendscript/stringify.mjs'
+import math  from './math.client.ts'
+import Stringify from 'sendscript/stringify.mjs'
+
+const stringify = Stringify()
 
-async function send<T>(program: T): Promise<T>{
+// The return type of this function matches the type passed as the return of the program.
+async function send<T>(program: T): Promise<T> {
   return (await fetch('/api', {
     method: 'POST',
     body: stringify(program)
   })).json()
 }
 
-import math from './math.client.ts'
-
-const { add, square } = math
-
 send(square(add(1, 2)))
 ```
 
 We'll also generate the docs for this module.
 
 ```bash
-npm install --no-save \
-  typedoc \
-  typedoc-plugin-markdown
-
 npx typedoc --plugin typedoc-plugin-markdown --out ./example/typescript/docs ./example/typescript/math.ts
 ```
 
@@ -316,32 +297,33 @@ Sendscript allows you to define your API as a **nested object of functions**, ma
 
 ### Defining a Nested Module
 
-You can define a schema as either:
-
-1. **An object with nested objects** – submodules.
-2. **An array of function names** – automatically instrumented.
+You can define a schema as **an array of function names**
 
 ```js
-import module from 'sendscript/module.mjs'
-
-const myModule = module({
-  math: ['add', 'sub'],
-
-  // Use an object with keys and true value
-  vector: {
-    add: true,
-    multiply: true
-  },
 
-  // or use an array.
-  utils: ['identity', 'always'],
+const schema = [
+  'help',
+  'version',
+
+  ['math', [
+    'add',
+    'sub'
+  ]],
+  ['vector', [
+    'add',
+    'multiply'
+  ]],
+  ['utils', [
+    'identity',
+    'always'
+  ]],
 })
 ```
 
 Functions are referenced via their **path in the module tree**:
 
 ```js
-const { math, vector } = myModule
+const { math, vector } = references(schema)
 
 math.add(
   1,
@@ -389,9 +371,9 @@ Here's how to use [superjson](https://github.com/blitz-js/superjson) to support
 
 ```js
 import SuperJSON from 'superjson'
-import stringify from 'sendscript/stringify.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import Parse from 'sendscript/parse.mjs'
-import module from 'sendscript/module.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __undefined__: true })
@@ -404,7 +386,10 @@ const leafDeserializer = (text) => {
   return SuperJSON.deserialize(parsed)
 }
 
-const { processData } = module(['processData'])
+const schema = ['processData']
+
+const { processData } = references(schema)
+const stringify = Stringify(leafSerializer)
 
 // Program with Date, RegExp, and other types
 const program = {
@@ -416,17 +401,20 @@ const program = {
 }
 
 // Serialize with custom leaf serializer
-const json = stringify(processData(program), leafSerializer)
+const json = stringify(processData(program))
 
-// Parse with custom leaf deserializer
-const parse = Parse({
+// The environment
+const env = {
   processData: (data) => ({
     success: true,
     received: data
   })
-})
+}
+
+// Parse with custom leaf deserializer
+const parse = Parse(schema, env, leadDeserializer)
 
-const result = parse(json, leafDeserializer)
+const result = parse(json)
 ```
 
 The leaf wrapper format is `['leaf', serializedPayload]`, making it unambiguous and safe from colliding with SendScript operators.
@@ -441,19 +429,19 @@ npm t -- report text-summary
 ```
 ```
 
-> sendscript@1.1.0 test
+> sendscript@2.0.1 test
 > tap -R silent
 
 
-> sendscript@1.1.0 test
+> sendscript@2.0.1 test
 > tap report text-summary
 
 
 =============================== Coverage summary ===============================
-Statements   : 100% ( 328/328 )
-Branches     : 100% ( 138/138 )
-Functions    : 100% ( 23/23 )
-Lines        : 100% ( 328/328 )
+Statements   : 100% ( 348/348 )
+Branches     : 100% ( 145/145 )
+Functions    : 100% ( 24/24 )
+Lines        : 100% ( 348/348 )
 ================================================================================
 ```
 

package/README.mz

@@ -30,10 +30,11 @@ using more advanced (de)serialization libraries.
 SendScript produces an intermediate JSON representation of the program. Let's see what that looks like.
 
 ```js|json node --input-type=module | tee /tmp/sendscript.json
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const { add } = module(['add'])
+const { add } = references(['add'])
+const stringify = Stringify()
 
 console.log(stringify(add(1,2)))
 ```
@@ -49,7 +50,7 @@ const module = {
   }
 }
 
-const parse = Parse(module)
+const parse = Parse(['add'], module)
 
 const program = '["call",["ref","add"],[1,2]]'
 
@@ -102,7 +103,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 
@@ -129,11 +131,13 @@ Now for a client that sends a program to the server.
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -147,8 +151,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 
@@ -217,13 +219,7 @@ Let's say we have this module which we use on the server.
 cat ./example/typescript/math.ts
 ```
 
-We want to use this module on the client. We create a client version of that module and coerce the types to match those of the server.
-
-```bash|ts bash
-cat ./example/typescript/math.client.ts
-```
-
-We now use the client version of this module.
+We can then coerce the types of the instrumented stubs.
 
 ```bash|ts bash
 cat ./example/typescript/client.ts
@@ -232,10 +228,6 @@ cat ./example/typescript/client.ts
 We'll also generate the docs for this module.
 
 ```bash bash 1>&2
-npm install --no-save \
-  typedoc \
-  typedoc-plugin-markdown
-
 npx typedoc --plugin typedoc-plugin-markdown --out ./example/typescript/docs ./example/typescript/math.ts
 ```
 
@@ -253,32 +245,33 @@ Sendscript allows you to define your API as a **nested object of functions**, ma
 
 ### Defining a Nested Module
 
-You can define a schema as either:
-
-1. **An object with nested objects** – submodules.
-2. **An array of function names** – automatically instrumented.
+You can define a schema as **an array of function names**
 
 ```js
-import module from 'sendscript/module.mjs'
 
-const myModule = module({
-  math: ['add', 'sub'],
-
-  // Use an object with keys and true value
-  vector: {
-    add: true,
-    multiply: true
-  },
-
-  // or use an array.
-  utils: ['identity', 'always'],
+const schema = [
+  'help',
+  'version',
+
+  ['math', [
+    'add',
+    'sub'
+  ]],
+  ['vector', [
+    'add',
+    'multiply'
+  ]],
+  ['utils', [
+    'identity',
+    'always'
+  ]],
 })
 ```
 
 Functions are referenced via their **path in the module tree**:
 
 ```js
-const { math, vector } = myModule
+const { math, vector } = references(schema)
 
 math.add(
   1,
@@ -326,9 +319,9 @@ Here's how to use [superjson](https://github.com/blitz-js/superjson) to support
 
 ```js
 import SuperJSON from 'superjson'
-import stringify from 'sendscript/stringify.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import Parse from 'sendscript/parse.mjs'
-import module from 'sendscript/module.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __undefined__: true })
@@ -341,7 +334,10 @@ const leafDeserializer = (text) => {
   return SuperJSON.deserialize(parsed)
 }
 
-const { processData } = module(['processData'])
+const schema = ['processData']
+
+const { processData } = references(schema)
+const stringify = Stringify(leafSerializer)
 
 // Program with Date, RegExp, and other types
 const program = {
@@ -353,17 +349,20 @@ const program = {
 }
 
 // Serialize with custom leaf serializer
-const json = stringify(processData(program), leafSerializer)
+const json = stringify(processData(program))
 
-// Parse with custom leaf deserializer
-const parse = Parse({
+// The environment
+const env = {
   processData: (data) => ({
     success: true,
     received: data
   })
-})
+}
+
+// Parse with custom leaf deserializer
+const parse = Parse(schema, env, leadDeserializer)
 
-const result = parse(json, leafDeserializer)
+const result = parse(json)
 ```
 
 The leaf wrapper format is `['leaf', serializedPayload]`, making it unambiguous and safe from colliding with SendScript operators.

package/example/client.socket.io.mjs

@@ -1,11 +1,13 @@
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -19,8 +21,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 

package/example/server.socket.io.mjs

@@ -4,7 +4,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 

package/example/typescript/client.ts

@@ -1,14 +1,14 @@
-import stringify from 'sendscript/stringify.mjs'
+import math  from './math.client.ts'
+import Stringify from 'sendscript/stringify.mjs'
 
-async function send<T>(program: T): Promise<T>{
+const stringify = Stringify()
+
+// The return type of this function matches the type passed as the return of the program.
+async function send<T>(program: T): Promise<T> {
   return (await fetch('/api', {
     method: 'POST',
     body: stringify(program)
   })).json()
 }
 
-import math from './math.client.ts'
-
-const { add, square } = math
-
 send(square(add(1, 2)))

package/example/typescript/docs/functions/add.md

@@ -8,7 +8,7 @@
 
 > **add**(`a`, `b`): `number`
 
-Defined in: [math.ts:1](https://github.com/bas080/sendscript/blob/68bfab27a561a994381cdcf5a7cf367e29a2d07d/example/typescript/math.ts#L1)
+Defined in: [math.ts:1](https://github.com/bas080/sendscript/blob/357ac0ef3384f294e4f9bb179d5a675afda5fd19/example/typescript/math.ts#L1)
 
 ## Parameters
 

package/example/typescript/docs/functions/square.md

@@ -8,7 +8,7 @@
 
 > **square**(`a`): `number`
 
-Defined in: [math.ts:2](https://github.com/bas080/sendscript/blob/68bfab27a561a994381cdcf5a7cf367e29a2d07d/example/typescript/math.ts#L2)
+Defined in: [math.ts:2](https://github.com/bas080/sendscript/blob/357ac0ef3384f294e4f9bb179d5a675afda5fd19/example/typescript/math.ts#L2)
 
 ## Parameters
 

package/example/typescript/math.client.ts

@@ -1,9 +1,5 @@
-import module from 'sendscript/module.mjs'
 import type * as mathTypes from './math.ts'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const math = module([
-  'add',
-  'square'
-]) as typeof mathTypes
-
-export default math
+export default references(['add', 'square']) as typeof mathTypes

package/index.test.mjs

@@ -1,7 +1,7 @@
 import { test } from 'tap'
-import stringify from './stringify.mjs'
-import ssparse from './parse.mjs'
-import module from './module.mjs'
+import Stringify from './stringify.mjs'
+import references from './references.mjs'
+import Parse from './parse.mjs'
 
 const myModule = {
   nested: {
@@ -30,27 +30,19 @@ const myModule = {
     obj.b = 'c'
     return obj
   },
-  Function,
   Promise
 }
 
-const schema = Object.keys(myModule).reduce((acc, key) => {
-  acc[key] = true
+const schema = Object.keys(myModule)
+schema.push(['nested', [
+  ['again', ['T']]
+]])
 
-  return acc
-}, {})
+const api = references(schema)
+const stringify = Stringify()
+const parse = Parse(schema, myModule)
 
-schema.nested = { again: ['T'] }
-
-const sendscript = {
-  stringify,
-  parse: ssparse(myModule),
-  module: module(schema)
-}
-
-const { parse } = sendscript
-
-const run = (program) => sendscript.parse(sendscript.stringify(program))
+const run = (program) => parse(stringify(program))
 
 const RealPromise = Promise
 
@@ -61,7 +53,6 @@ test('should evaluate basic expressions correctly', async (t) => {
     resolve,
     delayedIdentity,
     noop,
-    Function,
     Promise,
     instanceOf,
     asyncFn,
@@ -74,7 +65,16 @@ test('should evaluate basic expressions correctly', async (t) => {
     always,
     multiply3,
     nested
-  } = sendscript.module
+  } = api
+
+  t.test('mix await without await', async t => {
+    const [one, two] = await run([await resolve(1), resolve(2)])
+
+    t.equal(one, 1)
+    t.ok(two instanceof RealPromise)
+
+    t.end()
+  })
 
   t.test('calling nested function works', t => {
     t.equal(run(nested.again.T()), true)
@@ -143,9 +143,6 @@ test('should evaluate basic expressions correctly', async (t) => {
     t.strictSame(await run(asyncFn()), 'my-async-function')
     t.strictSame(await run(await resolve('my-promise')), 'my-promise')
     t.strictSame(run(instanceOf(resolve(asyncFn), Promise)), true)
-    t.strictSame(
-      await run(instanceOf(await resolve(asyncFn), Function)), true
-    )
     t.strictSame(
       await run({ a: await resolve('b') }),
       { a: 'b' }
@@ -218,7 +215,7 @@ test('should evaluate basic expressions correctly', async (t) => {
   })
 
   t.test('null-prototype object traversal', (t) => {
-    const { nullProto } = sendscript.module
+    const { nullProto } = api
     t.strictSame(run({ a: nullProto() }), { a: { b: 'c' } })
     t.end()
   })
@@ -238,3 +235,78 @@ test('should evaluate basic expressions correctly', async (t) => {
     t.end()
   })
 })
+
+test('stringify: invalid children throws', t => {
+  const invalidSchema = [
+    ['math', 'add']
+  ]
+
+  t.throws(() => Parse(invalidSchema, {}))
+  t.throws(() => Parse([Symbol('no-allowed')], {}))
+  t.end()
+})
+
+test('forbidden/reflection access should be blocked', async (t) => {
+  function run (program) {
+    return parse(JSON.stringify(program))
+  }
+
+  t.test('cannot access constructor via ref', (t) => {
+    // try to reach the constructor of nested.again.T
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'constructor']))
+    t.end()
+  })
+
+  t.test('cannot access prototype property', (t) => {
+    // direct prototype traversal attempt
+    t.throws(() => run(['ref', 'nested', '__proto__']))
+    t.throws(() => run(['ref', 'nested', 'again', '__proto__']))
+    t.end()
+  })
+
+  t.test('cannot reach Function constructor', (t) => {
+    // many modules may accidentally expose Function; this should not be available via ref
+    t.throws(() => run(['ref', 'Function']))
+    t.end()
+  })
+
+  t.test('cannot call Function to execute code', (t) => {
+    // If Function were reachable, this would execute arbitrary code
+    const program = ['call', ['ref', 'Function'], [['leaf', '"return 1 + 2"']]]
+    t.throws(() => run(program))
+    t.end()
+  })
+
+  t.test('cannot access global Promise constructor via ref', (t) => {
+    t.throws(() => run(['ref', 'Promise', 'prototype', 'then']))
+    t.end()
+  })
+
+  t.test('cannot access Object.prototype methods', (t) => {
+    // toString is a common vector for prototype access
+    t.throws(() => run(['ref', 'toString']))
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'toString']))
+    t.end()
+  })
+
+  t.test('cannot reach process or global (if accidentally exposed)', (t) => {
+    // attempt common global names; parser should not resolve them
+    t.throws(() => run(['ref', 'process']))
+    t.throws(() => run(['ref', 'global']))
+    t.end()
+  })
+
+  t.test('cannot use constructor.constructor to reach Function', (t) => {
+    // attempt: nested.again.T.constructor.constructor
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'constructor', 'constructor']))
+    t.end()
+  })
+
+  t.test('throws when trying to get something that does not exist', (t) => {
+    // Ensure array that contains a ref-like array stays as data if not a SendScript ref wrapper:
+    t.throws(() => run(['ref', 'doesNotExist']))
+    t.end()
+  })
+
+  t.end()
+})

package/leaf-serializer.test.mjs

@@ -1,6 +1,7 @@
 import { test } from 'tap'
 import SuperJSON from 'superjson'
-import Sendscript from './index.mjs'
+import Parse from './parse.mjs'
+import Stringify from './stringify.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __sendscript_undefined__: true })
@@ -17,10 +18,14 @@ const module = {
   identity: (x) => x
 }
 
-const sendscript = Sendscript(Object.keys(module))
-const { parse, stringify } = sendscript
-const run = (program, serializer, deserializer) =>
-  parse(stringify(program, serializer), deserializer)
+const schema = Object.keys(module)
+
+const run = (program, serializer, deserializer) => {
+  const parse = Parse(schema, module, deserializer)
+  const stringify = Stringify(serializer)
+
+  return parse(stringify(program))
+}
 
 test('custom leaf serializer/deserializer using superjson', async (t) => {
   const value = {
@@ -64,13 +69,3 @@ test('default leaf deserializer when not provided', async (t) => {
   t.strictSame(result, value)
   t.end()
 })
-
-test('default leaf deserializer handles undefined parameter', (t) => {
-  const parse = Sendscript({}).parse
-  // Create a simple JSON with a leaf then parse using default deserializer
-  // The reviver will never pass undefined to deserializer, but we test it defensively
-  const json = '["leaf","{\\"test\\":1}"]'
-  const result = parse(json)
-  t.strictSame(result, { test: 1 })
-  t.end()
-})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sendscript",
-  "version": "1.1.0",
+  "version": "2.0.1",
   "description": "Blur the line between server and client code.",
   "module": true,
   "main": "index.mjs",
@@ -29,6 +29,8 @@
     "tape-check": "^1.0.0-rc.0"
   },
   "dependencies": {
-    "debug": "^4.4.3"
+    "debug": "^4.4.3",
+    "typedoc": "^0.28.18",
+    "typedoc-plugin-markdown": "^4.11.0"
   }
 }

package/parse.mjs

@@ -1,6 +1,29 @@
 import Debug from './debug.mjs'
 import { SendScriptReferenceError } from './error.mjs'
 
+function flattenSchema (schema) {
+  const obj = {}
+
+  for (const item of schema) {
+    if (typeof item === 'string') {
+      // leaf function
+      obj[item] = true
+    } else if (Array.isArray(item)) {
+      const [name, children] = item
+      // TODO: Test this
+      if (!Array.isArray(children)) {
+        throw new Error(`Expected children array for namespace "${name}"`)
+      }
+      obj[name] = flattenSchema(children)
+      // TODO: Test this also
+    } else {
+      throw new Error('Schema items must be strings or [name, children] arrays')
+    }
+  }
+
+  return obj
+}
+
 const debug = Debug.extend('parse')
 
 const isThenable = (value) => (
@@ -89,8 +112,10 @@ const spy = (fn) => (...args) => {
 
 const defaultLeafDeserializer = (text) => JSON.parse(text)
 
-export default (env) =>
-  function parse (program, deserialize = defaultLeafDeserializer) {
+export default (schemaArg, env, deserialize = defaultLeafDeserializer) => {
+  const schema = flattenSchema(schemaArg)
+
+  return function parse (program) {
     debug('program', program)
 
     const reviver = spy((key, value) => {
@@ -140,10 +165,12 @@ export default (env) =>
       if (operator === 'ref') {
         const path = rest // e.g., ["math","add"]
         let current = env
+        let schemaCurrent = schema
 
         for (const segment of path) {
-          if (current && Object.hasOwn(current, segment)) {
+          if (schemaCurrent && Object.hasOwn(schemaCurrent, segment)) {
             current = current[segment]
+            schemaCurrent = schemaCurrent[segment]
           } else {
             throw new SendScriptReferenceError({ key, value })
           }
@@ -160,3 +187,4 @@ export default (env) =>
 
     return result
   }
+}

package/{module.mjs → references.mjs}

@@ -37,22 +37,21 @@ function instrument (path) {
 }
 
 export default function module (schema, parentPath = []) {
-  if (Array.isArray(schema)) {
-    return schema.reduce((acc, name) => {
-      acc[name] = instrument([...parentPath, name])
-      return acc
-    }, {})
-  }
-
-  return Object.keys(schema).reduce((acc, key) => {
-    const value = schema[key]
-
-    if (Array.isArray(value)) {
-      acc[key] = module(value, [...parentPath, key])
-    } else if (typeof value === 'object' && value !== null) {
-      acc[key] = module(value, [...parentPath, key])
+  return schema.reduce((acc, item) => {
+    if (typeof item === 'string') {
+      // leaf function
+      acc[item] = instrument([...parentPath, item])
+    } else if (Array.isArray(item)) {
+      const [name, children] = item
+
+      if (Array.isArray(children)) {
+        // recurse: children can be strings or [name, children] arrays
+        acc[name] = module(children, [...parentPath, name])
+      } else {
+        throw new Error(`Expected children array for namespace "${name}"`)
+      }
     } else {
-      acc[key] = instrument([...parentPath, key])
+      throw new Error('Schema items must be strings or [name, children] arrays')
     }
 
     return acc

package/references.test.mjs

@@ -0,0 +1,8 @@
+import { test } from 'tap'
+import references from './references.mjs'
+
+test('invalid uses of references', t => {
+  t.throws(() => references([['a']]))
+  t.throws(() => references([{}]))
+  t.end()
+})

package/stringify.mjs

@@ -69,6 +69,10 @@ function transformValue (value, leafSerializer) {
   return ['leaf', leafSerializer(value)]
 }
 
-export default function stringify (program, leafSerializer = JSON.stringify) {
-  return JSON.stringify(transformValue(program, leafSerializer))
+export default function stringify (leafSerializer = JSON.stringify) {
+  function stringify (program) {
+    return JSON.stringify(transformValue(program, leafSerializer))
+  }
+
+  return stringify
 }

package/index.mjs

@@ -1,11 +0,0 @@
-import stringify from './stringify.mjs'
-import makeModule from './module.mjs'
-import parse from './parse.mjs'
-
-export default function sendscript (module) {
-  return {
-    stringify,
-    parse: parse(module),
-    module: makeModule(module)
-  }
-}