sendscript 1.1.0 → 2.1.0

package/.github/workflows/publish.yml

@@ -1,25 +1,62 @@
-name: Publish Package
+name: Release and Publish
 
 on:
   push:
     tags:
-      - 'v*'
+      - '*'
 
 permissions:
+  contents: write
   id-token: write  # Required for OIDC
-  contents: read
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ['lts/*', 'latest']
+      fail-fast: true
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+      - run: npm test
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 'latest'
+          cache: npm
+
+      - run: npm ci
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+
   publish:
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24'
+          node-version: 'latest'
+          cache: npm
           registry-url: 'https://registry.npmjs.org'
+
       - run: npm ci
-      - run: npm run build --if-present
       - run: npm test
       - run: npm publish

package/CHANGELOG.md

@@ -4,8 +4,30 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v2.1.0](https://github.com/bas080/sendscript/compare/v2.0.1...v2.1.0)
+
+- Make eval order when using await inline with JS [`00db8aa`](https://github.com/bas080/sendscript/commit/00db8aaa563378db814035e3e550269593ed82e2)
+- Merge release workflow into publish [`6a5db12`](https://github.com/bas080/sendscript/commit/6a5db128b659dd295390505b2e470c5913617abf)
+- Fix the cli repl [`3cf8b0d`](https://github.com/bas080/sendscript/commit/3cf8b0d9b4531989fb01a53fa9ab4cb6a011c183)
+
+#### [v2.0.1](https://github.com/bas080/sendscript/compare/v2.0.0...v2.0.1)
+
+> 8 April 2026
+
+- Publish to npm on tag push [`357ac0e`](https://github.com/bas080/sendscript/commit/357ac0ef3384f294e4f9bb179d5a675afda5fd19)
+
+### [v2.0.0](https://github.com/bas080/sendscript/compare/v1.1.0...v2.0.0)
+
+> 8 April 2026
+
+- Rewrite to have parse take schema to prevent accessing refs [`df16f85`](https://github.com/bas080/sendscript/commit/df16f85c79299aa8bcd3e44b6cc127bd7198eace)
+- Run tests before release and publish on release [`10442d6`](https://github.com/bas080/sendscript/commit/10442d6766a098926ee98daee08dba23eea0fb14)
+- Create release on tag with github workflows [`4ec222b`](https://github.com/bas080/sendscript/commit/4ec222bf51fc1d3cce9fc54fdd1e9639b5d259cd)
+
 #### [v1.1.0](https://github.com/bas080/sendscript/compare/v1.0.6...v1.1.0)
 
+> 7 April 2026
+
 - Support custom serialization of leaf nodes [`d56f1b7`](https://github.com/bas080/sendscript/commit/d56f1b750e2d7faf72d69f9ba8e9bb62ef5ebce7)
 - Support nested modules [`88e69e5`](https://github.com/bas080/sendscript/commit/88e69e5c05ddb85aac1797a020e92519c986e89f)
 - Document new nesting and leaf serialization feature [`b3ee9f6`](https://github.com/bas080/sendscript/commit/b3ee9f693dc6137b01c9f0072aa2dd1e940f07c9)

package/README.md

@@ -53,10 +53,11 @@ using more advanced (de)serialization libraries.
 SendScript produces an intermediate JSON representation of the program. Let's see what that looks like.
 
 ```js
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const { add } = module(['add'])
+const { add } = references(['add'])
+const stringify = Stringify()
 
 console.log(stringify(add(1,2)))
 ```
@@ -75,7 +76,7 @@ const module = {
   }
 }
 
-const parse = Parse(module)
+const parse = Parse(['add'], module)
 
 const program = '["call",["ref","add"],[1,2]]'
 
@@ -91,7 +92,7 @@ composition and even await.
 This package is nothing more than the absolute core of sendscript. It
 includes:
 
-- The `module` function to create stubs to write the programs.
+- The `references` function to create stubs to write the programs.
 - `stringify` which takes the program and returns a JSON string.
 - `parse` which takes the `stringify` JSON string and a real module and returns the result.
 
@@ -131,7 +132,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 
@@ -158,11 +160,13 @@ Now for a client that sends a program to the server.
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -176,8 +180,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 
@@ -253,52 +255,31 @@ export const add = (a: number, b: number) => a + b
 export const square = (a: number) => a * a
 ```
 
-We want to use this module on the client. We create a client version of that module and coerce the types to match those of the server.
-
-```bash
-cat ./example/typescript/math.client.ts
-```
-```ts
-import module from 'sendscript/module.mjs'
-import type * as mathTypes from './math.ts'
-
-const math = module([
-  'add',
-  'square'
-]) as typeof mathTypes
-
-export default math
-```
-
-We now use the client version of this module.
+We can then coerce the types of the instrumented stubs.
 
 ```bash
 cat ./example/typescript/client.ts
 ```
 ```ts
-import stringify from 'sendscript/stringify.mjs'
+import math  from './math.client.ts'
+import Stringify from 'sendscript/stringify.mjs'
+
+const stringify = Stringify()
 
-async function send<T>(program: T): Promise<T>{
+// The return type of this function matches the type passed as the return of the program.
+async function send<T>(program: T): Promise<T> {
   return (await fetch('/api', {
     method: 'POST',
     body: stringify(program)
   })).json()
 }
 
-import math from './math.client.ts'
-
-const { add, square } = math
-
 send(square(add(1, 2)))
 ```
 
 We'll also generate the docs for this module.
 
 ```bash
-npm install --no-save \
-  typedoc \
-  typedoc-plugin-markdown
-
 npx typedoc --plugin typedoc-plugin-markdown --out ./example/typescript/docs ./example/typescript/math.ts
 ```
 
@@ -316,32 +297,33 @@ Sendscript allows you to define your API as a **nested object of functions**, ma
 
 ### Defining a Nested Module
 
-You can define a schema as either:
-
-1. **An object with nested objects** – submodules.
-2. **An array of function names** – automatically instrumented.
+You can define a schema as **an array of function names**
 
 ```js
-import module from 'sendscript/module.mjs'
-
-const myModule = module({
-  math: ['add', 'sub'],
-
-  // Use an object with keys and true value
-  vector: {
-    add: true,
-    multiply: true
-  },
 
-  // or use an array.
-  utils: ['identity', 'always'],
+const schema = [
+  'help',
+  'version',
+
+  ['math', [
+    'add',
+    'sub'
+  ]],
+  ['vector', [
+    'add',
+    'multiply'
+  ]],
+  ['utils', [
+    'identity',
+    'always'
+  ]],
 })
 ```
 
 Functions are referenced via their **path in the module tree**:
 
 ```js
-const { math, vector } = myModule
+const { math, vector } = references(schema)
 
 math.add(
   1,
@@ -389,9 +371,9 @@ Here's how to use [superjson](https://github.com/blitz-js/superjson) to support
 
 ```js
 import SuperJSON from 'superjson'
-import stringify from 'sendscript/stringify.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import Parse from 'sendscript/parse.mjs'
-import module from 'sendscript/module.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __undefined__: true })
@@ -404,7 +386,10 @@ const leafDeserializer = (text) => {
   return SuperJSON.deserialize(parsed)
 }
 
-const { processData } = module(['processData'])
+const schema = ['processData']
+
+const { processData } = references(schema)
+const stringify = Stringify(leafSerializer)
 
 // Program with Date, RegExp, and other types
 const program = {
@@ -416,17 +401,20 @@ const program = {
 }
 
 // Serialize with custom leaf serializer
-const json = stringify(processData(program), leafSerializer)
+const json = stringify(processData(program))
 
-// Parse with custom leaf deserializer
-const parse = Parse({
+// The environment
+const env = {
   processData: (data) => ({
     success: true,
     received: data
   })
-})
+}
+
+// Parse with custom leaf deserializer
+const parse = Parse(schema, env, leadDeserializer)
 
-const result = parse(json, leafDeserializer)
+const result = parse(json)
 ```
 
 The leaf wrapper format is `['leaf', serializedPayload]`, making it unambiguous and safe from colliding with SendScript operators.
@@ -441,19 +429,19 @@ npm t -- report text-summary
 ```
 ```
 
-> sendscript@1.1.0 test
+> sendscript@2.1.0 test
 > tap -R silent
 
 
-> sendscript@1.1.0 test
+> sendscript@2.1.0 test
 > tap report text-summary
 
 
 =============================== Coverage summary ===============================
-Statements   : 100% ( 328/328 )
-Branches     : 100% ( 138/138 )
-Functions    : 100% ( 23/23 )
-Lines        : 100% ( 328/328 )
+Statements   : 100% ( 326/326 )
+Branches     : 100% ( 118/118 )
+Functions    : 100% ( 21/21 )
+Lines        : 100% ( 326/326 )
 ================================================================================
 ```
 

package/README.mz

@@ -30,10 +30,11 @@ using more advanced (de)serialization libraries.
 SendScript produces an intermediate JSON representation of the program. Let's see what that looks like.
 
 ```js|json node --input-type=module | tee /tmp/sendscript.json
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const { add } = module(['add'])
+const { add } = references(['add'])
+const stringify = Stringify()
 
 console.log(stringify(add(1,2)))
 ```
@@ -49,7 +50,7 @@ const module = {
   }
 }
 
-const parse = Parse(module)
+const parse = Parse(['add'], module)
 
 const program = '["call",["ref","add"],[1,2]]'
 
@@ -62,7 +63,7 @@ composition and even await.
 This package is nothing more than the absolute core of sendscript. It
 includes:
 
-- The `module` function to create stubs to write the programs.
+- The `references` function to create stubs to write the programs.
 - `stringify` which takes the program and returns a JSON string.
 - `parse` which takes the `stringify` JSON string and a real module and returns the result.
 
@@ -102,7 +103,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 
@@ -129,11 +131,13 @@ Now for a client that sends a program to the server.
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -147,8 +151,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 
@@ -217,13 +219,7 @@ Let's say we have this module which we use on the server.
 cat ./example/typescript/math.ts
 ```
 
-We want to use this module on the client. We create a client version of that module and coerce the types to match those of the server.
-
-```bash|ts bash
-cat ./example/typescript/math.client.ts
-```
-
-We now use the client version of this module.
+We can then coerce the types of the instrumented stubs.
 
 ```bash|ts bash
 cat ./example/typescript/client.ts
@@ -232,10 +228,6 @@ cat ./example/typescript/client.ts
 We'll also generate the docs for this module.
 
 ```bash bash 1>&2
-npm install --no-save \
-  typedoc \
-  typedoc-plugin-markdown
-
 npx typedoc --plugin typedoc-plugin-markdown --out ./example/typescript/docs ./example/typescript/math.ts
 ```
 
@@ -253,32 +245,33 @@ Sendscript allows you to define your API as a **nested object of functions**, ma
 
 ### Defining a Nested Module
 
-You can define a schema as either:
-
-1. **An object with nested objects** – submodules.
-2. **An array of function names** – automatically instrumented.
+You can define a schema as **an array of function names**
 
 ```js
-import module from 'sendscript/module.mjs'
 
-const myModule = module({
-  math: ['add', 'sub'],
-
-  // Use an object with keys and true value
-  vector: {
-    add: true,
-    multiply: true
-  },
-
-  // or use an array.
-  utils: ['identity', 'always'],
+const schema = [
+  'help',
+  'version',
+
+  ['math', [
+    'add',
+    'sub'
+  ]],
+  ['vector', [
+    'add',
+    'multiply'
+  ]],
+  ['utils', [
+    'identity',
+    'always'
+  ]],
 })
 ```
 
 Functions are referenced via their **path in the module tree**:
 
 ```js
-const { math, vector } = myModule
+const { math, vector } = references(schema)
 
 math.add(
   1,
@@ -326,9 +319,9 @@ Here's how to use [superjson](https://github.com/blitz-js/superjson) to support
 
 ```js
 import SuperJSON from 'superjson'
-import stringify from 'sendscript/stringify.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import Parse from 'sendscript/parse.mjs'
-import module from 'sendscript/module.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __undefined__: true })
@@ -341,7 +334,10 @@ const leafDeserializer = (text) => {
   return SuperJSON.deserialize(parsed)
 }
 
-const { processData } = module(['processData'])
+const schema = ['processData']
+
+const { processData } = references(schema)
+const stringify = Stringify(leafSerializer)
 
 // Program with Date, RegExp, and other types
 const program = {
@@ -353,17 +349,20 @@ const program = {
 }
 
 // Serialize with custom leaf serializer
-const json = stringify(processData(program), leafSerializer)
+const json = stringify(processData(program))
 
-// Parse with custom leaf deserializer
-const parse = Parse({
+// The environment
+const env = {
   processData: (data) => ({
     success: true,
     received: data
   })
-})
+}
+
+// Parse with custom leaf deserializer
+const parse = Parse(schema, env, leadDeserializer)
 
-const result = parse(json, leafDeserializer)
+const result = parse(json)
 ```
 
 The leaf wrapper format is `['leaf', serializedPayload]`, making it unambiguous and safe from colliding with SendScript operators.

package/cli.mjs

@@ -2,13 +2,14 @@
 
 import path from 'path'
 import { pathToFileURL } from 'url'
-import stringify from './stringify.mjs'
+import Stringify from './stringify.mjs'
 import repl from './repl.mjs'
 import Parse from './parse.mjs'
 
+const stringify = Stringify()
 const modulePath = pathToFileURL(path.resolve(process.cwd(), process.argv[2])).href
 const mod = await import(modulePath)
-const parse = Parse(mod)
+const parse = Parse(Object.keys(mod), mod)
 
 const send = program => parse(stringify(program))
 

package/example/client.socket.io.mjs

@@ -1,11 +1,13 @@
 // ./example/client.socket.io.mjs
 
 import socketClient from 'socket.io-client'
-import stringify from 'sendscript/stringify.mjs'
-import module from 'sendscript/module.mjs'
-import * as math from './math.mjs'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 import assert from 'node:assert'
 
+const { add, square } = references(['add', 'square'])
+const stringify = Stringify()
+
 const port = process.env.PORT || 3000
 const client = socketClient(`http://localhost:${port}`)
 
@@ -19,8 +21,6 @@ const send = program => {
   })
 }
 
-const { add, square } = module(math)
-
 // The program to be sent over the wire
 const program = square(add(1, add(add(2, 3), 4)))
 

package/example/server.socket.io.mjs

@@ -4,7 +4,8 @@ import { Server } from 'socket.io'
 import Parse from 'sendscript/parse.mjs'
 import * as math from './math.mjs'
 
-const parse = Parse(math)
+const schema = Object.keys(math)
+const parse = Parse(schema, math)
 const server = new Server()
 const port = process.env.PORT || 3000
 

package/example/typescript/client.ts

@@ -1,14 +1,14 @@
-import stringify from 'sendscript/stringify.mjs'
+import math  from './math.client.ts'
+import Stringify from 'sendscript/stringify.mjs'
 
-async function send<T>(program: T): Promise<T>{
+const stringify = Stringify()
+
+// The return type of this function matches the type passed as the return of the program.
+async function send<T>(program: T): Promise<T> {
   return (await fetch('/api', {
     method: 'POST',
     body: stringify(program)
   })).json()
 }
 
-import math from './math.client.ts'
-
-const { add, square } = math
-
 send(square(add(1, 2)))

package/example/typescript/docs/functions/add.md

@@ -8,7 +8,7 @@
 
 > **add**(`a`, `b`): `number`
 
-Defined in: [math.ts:1](https://github.com/bas080/sendscript/blob/68bfab27a561a994381cdcf5a7cf367e29a2d07d/example/typescript/math.ts#L1)
+Defined in: [math.ts:1](https://github.com/bas080/sendscript/blob/3d843187a56e23f0e70f11e904832efb1abd9cf1/example/typescript/math.ts#L1)
 
 ## Parameters
 

package/example/typescript/docs/functions/square.md

@@ -8,7 +8,7 @@
 
 > **square**(`a`): `number`
 
-Defined in: [math.ts:2](https://github.com/bas080/sendscript/blob/68bfab27a561a994381cdcf5a7cf367e29a2d07d/example/typescript/math.ts#L2)
+Defined in: [math.ts:2](https://github.com/bas080/sendscript/blob/3d843187a56e23f0e70f11e904832efb1abd9cf1/example/typescript/math.ts#L2)
 
 ## Parameters
 

package/example/typescript/math.client.ts

@@ -1,9 +1,5 @@
-import module from 'sendscript/module.mjs'
 import type * as mathTypes from './math.ts'
+import Stringify from 'sendscript/stringify.mjs'
+import references from 'sendscript/references.mjs'
 
-const math = module([
-  'add',
-  'square'
-]) as typeof mathTypes
-
-export default math
+export default references(['add', 'square']) as typeof mathTypes

package/index.test.mjs

@@ -1,7 +1,9 @@
 import { test } from 'tap'
-import stringify from './stringify.mjs'
-import ssparse from './parse.mjs'
-import module from './module.mjs'
+import Stringify from './stringify.mjs'
+import references from './references.mjs'
+import Parse from './parse.mjs'
+
+const order = []
 
 const myModule = {
   nested: {
@@ -12,6 +14,16 @@ const myModule = {
   add: (a, b) => a + b,
   identity: (x) => x,
   concat: (a, b) => a.concat(b),
+  delay: (value, ms) => {
+    return new Promise(resolve => {
+      order.push(`${value} start`)
+      setTimeout(() => {
+        order.push(`${value} end`)
+
+        resolve(value)
+      }, ms)
+    })
+  },
   toArray: (...array) => array,
   always: (x) => () => x,
   multiply3: (a) => (b) => (c) => a * b * c,
@@ -30,27 +42,19 @@ const myModule = {
     obj.b = 'c'
     return obj
   },
-  Function,
   Promise
 }
 
-const schema = Object.keys(myModule).reduce((acc, key) => {
-  acc[key] = true
-
-  return acc
-}, {})
-
-schema.nested = { again: ['T'] }
-
-const sendscript = {
-  stringify,
-  parse: ssparse(myModule),
-  module: module(schema)
-}
+const schema = Object.keys(myModule)
+schema.push(['nested', [
+  ['again', ['T']]
+]])
 
-const { parse } = sendscript
+const api = references(schema)
+const stringify = Stringify()
+const parse = Parse(schema, myModule)
 
-const run = (program) => sendscript.parse(sendscript.stringify(program))
+const run = (program) => parse(stringify(program))
 
 const RealPromise = Promise
 
@@ -59,9 +63,9 @@ test('should evaluate basic expressions correctly', async (t) => {
     aPromise,
     asyncAdd,
     resolve,
+    delay,
     delayedIdentity,
     noop,
-    Function,
     Promise,
     instanceOf,
     asyncFn,
@@ -74,7 +78,58 @@ test('should evaluate basic expressions correctly', async (t) => {
     always,
     multiply3,
     nested
-  } = sendscript.module
+  } = api
+
+  t.test('await evaluation order matches JS semantics', async (t) => {
+    const lorder = []
+
+    const ldelay = (label, ms) => new RealPromise((resolve) => {
+      lorder.push(label + ' start')
+      setTimeout(() => {
+        lorder.push(label + ' end')
+        resolve(label)
+      }, ms)
+    })
+
+    const lresult = [
+      await ldelay('a', 30),
+      await ldelay('b', 10)
+    ]
+
+    t.same(lresult, ['a', 'b'])
+    t.same(lorder, [
+      'a start',
+      'a end',
+      'b start',
+      'b end'
+    ])
+
+    // TODO: Write it what ss touches
+
+    const result = await run([
+      await delay('a', 30),
+      await delay('b', 10)
+    ])
+
+    t.same(result, ['a', 'b'])
+    t.same(order, [
+      'a start',
+      'a end',
+      'b start',
+      'b end'
+    ])
+
+    t.end()
+  })
+
+  t.test('mix await without await', async t => {
+    const [one, two] = await run([await resolve(1), resolve(2)])
+
+    t.equal(one, 1)
+    t.ok(two instanceof RealPromise)
+
+    t.end()
+  })
 
   t.test('calling nested function works', t => {
     t.equal(run(nested.again.T()), true)
@@ -143,9 +198,6 @@ test('should evaluate basic expressions correctly', async (t) => {
     t.strictSame(await run(asyncFn()), 'my-async-function')
     t.strictSame(await run(await resolve('my-promise')), 'my-promise')
     t.strictSame(run(instanceOf(resolve(asyncFn), Promise)), true)
-    t.strictSame(
-      await run(instanceOf(await resolve(asyncFn), Function)), true
-    )
     t.strictSame(
       await run({ a: await resolve('b') }),
       { a: 'b' }
@@ -218,8 +270,9 @@ test('should evaluate basic expressions correctly', async (t) => {
   })
 
   t.test('null-prototype object traversal', (t) => {
-    const { nullProto } = sendscript.module
-    t.strictSame(run({ a: nullProto() }), { a: { b: 'c' } })
+    const { nullProto } = api
+    const other = myModule.nullProto()
+    t.strictSame(run({ a: nullProto() }), { a: other })
     t.end()
   })
 
@@ -238,3 +291,78 @@ test('should evaluate basic expressions correctly', async (t) => {
     t.end()
   })
 })
+
+test('stringify: invalid children throws', t => {
+  const invalidSchema = [
+    ['math', 'add']
+  ]
+
+  t.throws(() => Parse(invalidSchema, {}))
+  t.throws(() => Parse([Symbol('no-allowed')], {}))
+  t.end()
+})
+
+test('forbidden/reflection access should be blocked', async (t) => {
+  function run (program) {
+    return parse(JSON.stringify(program))
+  }
+
+  t.test('cannot access constructor via ref', (t) => {
+    // try to reach the constructor of nested.again.T
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'constructor']))
+    t.end()
+  })
+
+  t.test('cannot access prototype property', (t) => {
+    // direct prototype traversal attempt
+    t.throws(() => run(['ref', 'nested', '__proto__']))
+    t.throws(() => run(['ref', 'nested', 'again', '__proto__']))
+    t.end()
+  })
+
+  t.test('cannot reach Function constructor', (t) => {
+    // many modules may accidentally expose Function; this should not be available via ref
+    t.throws(() => run(['ref', 'Function']))
+    t.end()
+  })
+
+  t.test('cannot call Function to execute code', (t) => {
+    // If Function were reachable, this would execute arbitrary code
+    const program = ['call', ['ref', 'Function'], [['leaf', '"return 1 + 2"']]]
+    t.throws(() => run(program))
+    t.end()
+  })
+
+  t.test('cannot access global Promise constructor via ref', (t) => {
+    t.throws(() => run(['ref', 'Promise', 'prototype', 'then']))
+    t.end()
+  })
+
+  t.test('cannot access Object.prototype methods', (t) => {
+    // toString is a common vector for prototype access
+    t.throws(() => run(['ref', 'toString']))
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'toString']))
+    t.end()
+  })
+
+  t.test('cannot reach process or global (if accidentally exposed)', (t) => {
+    // attempt common global names; parser should not resolve them
+    t.throws(() => run(['ref', 'process']))
+    t.throws(() => run(['ref', 'global']))
+    t.end()
+  })
+
+  t.test('cannot use constructor.constructor to reach Function', (t) => {
+    // attempt: nested.again.T.constructor.constructor
+    t.throws(() => run(['ref', 'nested', 'again', 'T', 'constructor', 'constructor']))
+    t.end()
+  })
+
+  t.test('throws when trying to get something that does not exist', (t) => {
+    // Ensure array that contains a ref-like array stays as data if not a SendScript ref wrapper:
+    t.throws(() => run(['ref', 'doesNotExist']))
+    t.end()
+  })
+
+  t.end()
+})

package/leaf-serializer.test.mjs

@@ -1,6 +1,7 @@
 import { test } from 'tap'
 import SuperJSON from 'superjson'
-import Sendscript from './index.mjs'
+import Parse from './parse.mjs'
+import Stringify from './stringify.mjs'
 
 const leafSerializer = (value) => {
   if (value === undefined) return JSON.stringify({ __sendscript_undefined__: true })
@@ -17,10 +18,14 @@ const module = {
   identity: (x) => x
 }
 
-const sendscript = Sendscript(Object.keys(module))
-const { parse, stringify } = sendscript
-const run = (program, serializer, deserializer) =>
-  parse(stringify(program, serializer), deserializer)
+const schema = Object.keys(module)
+
+const run = (program, serializer, deserializer) => {
+  const parse = Parse(schema, module, deserializer)
+  const stringify = Stringify(serializer)
+
+  return parse(stringify(program))
+}
 
 test('custom leaf serializer/deserializer using superjson', async (t) => {
   const value = {
@@ -64,13 +69,3 @@ test('default leaf deserializer when not provided', async (t) => {
   t.strictSame(result, value)
   t.end()
 })
-
-test('default leaf deserializer handles undefined parameter', (t) => {
-  const parse = Sendscript({}).parse
-  // Create a simple JSON with a leaf then parse using default deserializer
-  // The reviver will never pass undefined to deserializer, but we test it defensively
-  const json = '["leaf","{\\"test\\":1}"]'
-  const result = parse(json)
-  t.strictSame(result, { test: 1 })
-  t.end()
-})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sendscript",
-  "version": "1.1.0",
+  "version": "2.1.0",
   "description": "Blur the line between server and client code.",
   "module": true,
   "main": "index.mjs",
@@ -29,6 +29,8 @@
     "tape-check": "^1.0.0-rc.0"
   },
   "dependencies": {
-    "debug": "^4.4.3"
+    "debug": "^4.4.3",
+    "typedoc": "^0.28.18",
+    "typedoc-plugin-markdown": "^4.11.0"
   }
 }

package/parse.mjs

@@ -1,13 +1,29 @@
 import Debug from './debug.mjs'
 import { SendScriptReferenceError } from './error.mjs'
 
-const debug = Debug.extend('parse')
+function flattenSchema (schema) {
+  const obj = {}
+
+  for (const item of schema) {
+    if (typeof item === 'string') {
+      // leaf function
+      obj[item] = true
+    } else if (Array.isArray(item)) {
+      const [name, children] = item
+      if (!Array.isArray(children)) {
+        throw new Error(`Expected children array for namespace "${name}"`)
+      }
+      obj[name] = flattenSchema(children)
+    } else {
+      throw new Error('Schema items must be strings or [name, children] arrays')
+    }
+  }
+
+  return obj
+}
 
-const isThenable = (value) => (
-  value != null && typeof value.then === 'function'
-)
+const debug = Debug.extend('parse')
 
-const isAwaitPromise = Symbol('sendscript-await')
 const undefinedSentinel = Symbol('sendscript-undefined')
 
 const isPlainObject = (value) => {
@@ -16,66 +32,57 @@ const isPlainObject = (value) => {
   return proto === Object.prototype || proto === null
 }
 
-const markAwait = (promise) => {
-  promise[isAwaitPromise] = true
-  return promise
-}
-
-const isExplicitAwait = (value) => (
-  isThenable(value) && value[isAwaitPromise] === true
-)
-
 // Recursively resolve awaited values in a parsed tree
-const resolveAwaitedValues = (value) => {
+const evaluate = (value, awaits = []) => {
   if (value === undefinedSentinel) return undefined
 
-  if (isThenable(value)) {
-    return isExplicitAwait(value)
-      ? markAwait(value.then(resolveAwaitedValues))
-      : value
-  }
-
   if (Array.isArray(value)) {
-    let hasAwait = false
-    const result = value.map((item) => {
-      const resolved = resolveAwaitedValues(item)
-      if (isExplicitAwait(resolved)) hasAwait = true
-      return resolved
-    })
+    const [operator, ...rest] = value
+
+    if (operator === 'await') {
+      const [index] = rest
+      // No need to check index. It is closely tied to the program.
+      // if (typeof index !== 'number' || index < 0 || index >= awaitsResolved.length) {
+      //   throw new Error(`Invalid await index: ${index}`);
+      // }
+      return awaits[index]
+    }
+
+    if (operator === 'call') {
+      // Step 1: evaluate the function itself
+      let [fn, args] = rest
+      fn = evaluate(fn, awaits)
+
+      // Step 2: evaluate each argument AFTER fn is ready
+      for (let i = 0; i < args.length; i++) {
+        args[i] = evaluate(args[i], awaits)
+      }
+
+      // Step 3: call the function
+      return fn(...args)
+    }
 
-    if (!hasAwait) return result
+    if (operator === 'quote') {
+      const [quoted] = rest
+      return quoted // return as-is without evaluating
+    }
 
-    const awaited = result.map((item, index) =>
-      isExplicitAwait(item)
-        ? Promise.resolve(item).then((resolved) => {
-          result[index] = resolved
-          return resolved
-        })
-        : item
-    )
+    // fallback: evaluate each element
+    // re-uses the array again.
 
-    return markAwait(Promise.all(awaited).then(() => result))
+    for (let index = 0; index < value.length; index++) {
+      const item = value[index]
+      value[index] = evaluate(item, awaits)
+    }
+    return value
   }
 
   if (isPlainObject(value)) {
-    const result = {}
-    const promises = []
-
+    // We muatate the object itself. No need to make a new one.
     for (const key of Object.keys(value)) {
-      const resolved = resolveAwaitedValues(value[key])
-      if (isExplicitAwait(resolved)) {
-        promises.push(
-          Promise.resolve(resolved).then((resolvedValue) => {
-            result[key] = resolvedValue
-          })
-        )
-      } else {
-        result[key] = resolved
-      }
+      value[key] = evaluate(value[key], awaits)
     }
-
-    if (!promises.length) return result
-    return markAwait(Promise.all(promises).then(() => result))
+    return value
   }
 
   return value
@@ -89,10 +96,15 @@ const spy = (fn) => (...args) => {
 
 const defaultLeafDeserializer = (text) => JSON.parse(text)
 
-export default (env) =>
-  function parse (program, deserialize = defaultLeafDeserializer) {
+export default (schemaArg, env, deserialize = defaultLeafDeserializer) => {
+  const schema = flattenSchema(schemaArg)
+
+  return function parse (program) {
     debug('program', program)
+    const awaits = []
 
+    // Creates the list of awaits that will resolve in order
+    // and also deserializes the leaves.
     const reviver = spy((key, value) => {
       if (value === null) return value
 
@@ -109,41 +121,19 @@ export default (env) =>
 
       if (operator === 'await') {
         const [program] = rest
-        return markAwait(Promise.resolve(program))
-      }
 
-      if (Array.isArray(operator) && operator[0] === 'quote') {
-        const [, quoted] = operator
-        return [quoted, ...rest]
-      }
-
-      if (operator === 'call') {
-        const [fn, args] = rest
-        const resolvedFn = isExplicitAwait(fn) ? Promise.resolve(fn) : fn
-        const resolvedArgs = resolveAwaitedValues(args)
-
-        if (isExplicitAwait(resolvedFn) || isExplicitAwait(resolvedArgs)) {
-          const promiseFn = isExplicitAwait(resolvedFn)
-            ? Promise.resolve(resolvedFn)
-            : resolvedFn
-          const promiseArgs = isExplicitAwait(resolvedArgs)
-            ? Promise.resolve(resolvedArgs)
-            : resolvedArgs
-
-          return Promise.all([promiseFn, promiseArgs])
-            .then(([resolvedFnValue, resolvedArgsValue]) => resolvedFnValue(...resolvedArgsValue))
-        }
-
-        return fn(...resolvedArgs)
+        return ['await', awaits.push(program) - 1]
       }
 
       if (operator === 'ref') {
-        const path = rest // e.g., ["math","add"]
+        const path = rest
         let current = env
+        let schemaCurrent = schema
 
         for (const segment of path) {
-          if (current && Object.hasOwn(current, segment)) {
+          if (schemaCurrent && Object.hasOwn(schemaCurrent, segment)) {
             current = current[segment]
+            schemaCurrent = schemaCurrent[segment]
           } else {
             throw new SendScriptReferenceError({ key, value })
           }
@@ -156,7 +146,23 @@ export default (env) =>
     })
 
     const parsed = JSON.parse(program, reviver)
-    const result = resolveAwaitedValues(parsed)
 
-    return result
+    debug('parsed', parsed)
+
+    if (awaits.length) {
+      debug('awaits', awaits)
+
+      return (async function () {
+        for (let index = 0; index < awaits.length; index++) {
+          awaits[index] = await evaluate(awaits[index], awaits)
+        }
+
+        debug('awaits(awaited)', awaits)
+
+        return evaluate(parsed, awaits)
+      })()
+    }
+
+    return evaluate(parsed)
   }
+}

package/{module.mjs → references.mjs}

@@ -37,22 +37,21 @@ function instrument (path) {
 }
 
 export default function module (schema, parentPath = []) {
-  if (Array.isArray(schema)) {
-    return schema.reduce((acc, name) => {
-      acc[name] = instrument([...parentPath, name])
-      return acc
-    }, {})
-  }
-
-  return Object.keys(schema).reduce((acc, key) => {
-    const value = schema[key]
-
-    if (Array.isArray(value)) {
-      acc[key] = module(value, [...parentPath, key])
-    } else if (typeof value === 'object' && value !== null) {
-      acc[key] = module(value, [...parentPath, key])
+  return schema.reduce((acc, item) => {
+    if (typeof item === 'string') {
+      // leaf function
+      acc[item] = instrument([...parentPath, item])
+    } else if (Array.isArray(item)) {
+      const [name, children] = item
+
+      if (Array.isArray(children)) {
+        // recurse: children can be strings or [name, children] arrays
+        acc[name] = module(children, [...parentPath, name])
+      } else {
+        throw new Error(`Expected children array for namespace "${name}"`)
+      }
     } else {
-      acc[key] = instrument([...parentPath, key])
+      throw new Error('Schema items must be strings or [name, children] arrays')
     }
 
     return acc

package/references.test.mjs

@@ -0,0 +1,8 @@
+import { test } from 'tap'
+import references from './references.mjs'
+
+test('invalid uses of references', t => {
+  t.throws(() => references([['a']]))
+  t.throws(() => references([{}]))
+  t.end()
+})

package/repl.mjs

@@ -1,8 +1,8 @@
-import instrument from './module.mjs'
+import references from './references.mjs'
 import repl from 'node:repl'
 
 export default async function sendscriptRepl (send, module) {
-  Object.assign(global, instrument(module))
+  Object.assign(global, references(Object.keys(module)))
 
   async function cb (cmd, context, filename, callback) {
     callback(null, await send(eval(cmd))) // eslint-disable-line no-eval

package/stringify.mjs

@@ -69,6 +69,10 @@ function transformValue (value, leafSerializer) {
   return ['leaf', leafSerializer(value)]
 }
 
-export default function stringify (program, leafSerializer = JSON.stringify) {
-  return JSON.stringify(transformValue(program, leafSerializer))
+export default function stringify (leafSerializer = JSON.stringify) {
+  function stringify (program) {
+    return JSON.stringify(transformValue(program, leafSerializer))
+  }
+
+  return stringify
 }

package/index.mjs

@@ -1,11 +0,0 @@
-import stringify from './stringify.mjs'
-import makeModule from './module.mjs'
-import parse from './parse.mjs'
-
-export default function sendscript (module) {
-  return {
-    stringify,
-    parse: parse(module),
-    module: makeModule(module)
-  }
-}