tjs-lang 0.8.3 → 0.8.5

package/llms.txt

@@ -44,6 +44,8 @@ This file is a navigation index for AI agents. It does not contain the docs them
 - `tjs-lang` → `src/index.ts` — main entry: `Agent`, `AgentVM`, `ajs`, `tjs`.
 - `tjs-lang/lang` → `src/lang/transpiler.ts` — language tools only: `tjs`, `transpile`.
 - `tjs-lang/lang/from-ts` → `src/lang/emitters/from-ts.ts` — TypeScript → TJS/JS transpilation.
+- `tjs-lang/browser` → `src/lang/browser.ts` (dist `tjs-browser.js`) — **self-contained** TJS/AJS transpiler (acorn + tosijs-schema inlined); `import()` from any CDN, zero config.
+- `tjs-lang/browser/from-ts` → `src/lang/browser-from-ts.ts` (dist `tjs-browser-from-ts.js`) — browser TS→TJS; lazy-loads the `typescript` compiler from a CDN (default `https://esm.sh/typescript@5` — the only CDN that serves it reliably; jsDelivr `+esm`/esm.run time out). Override with `fromTS(src, { typescriptUrl })` or preload `globalThis.__TJS_TS__`.
 - `tjs-lang/vm` → `src/vm/index.ts` — VM and atoms.
 - `tjs-lang/eval` → `src/lang/eval.ts` — `Eval`, `SafeFunction`.
 - `tjs-lang/batteries` → `src/batteries/index.ts` — LM Studio integration (lazy, local-only).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tjs-lang",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Type-safe JavaScript dialect with runtime validation, sandboxed VM execution, and AI agent orchestration. Transpiles TypeScript to validated JS with fuel-metered execution for untrusted code.",
   "keywords": [
     "typescript",
@@ -33,6 +33,12 @@
       "lang/from-ts": [
         "./dist/src/lang/emitters/from-ts.d.ts"
       ],
+      "browser": [
+        "./dist/src/lang/browser.d.ts"
+      ],
+      "browser/from-ts": [
+        "./dist/src/lang/browser-from-ts.d.ts"
+      ],
       "vm": [
         "./dist/src/vm/index.d.ts"
       ],
@@ -62,6 +68,14 @@
       "types": "./dist/src/lang/emitters/from-ts.d.ts",
       "default": "./dist/tjs-from-ts.js"
     },
+    "./browser": {
+      "types": "./dist/src/lang/browser.d.ts",
+      "default": "./dist/tjs-browser.js"
+    },
+    "./browser/from-ts": {
+      "types": "./dist/src/lang/browser-from-ts.d.ts",
+      "default": "./dist/tjs-browser-from-ts.js"
+    },
     "./vm": {
       "bun": "./src/vm/index.ts",
       "types": "./dist/src/vm/index.d.ts",

package/src/lang/browser-bundle.test.ts

@@ -0,0 +1,69 @@
+/**
+ * Guards the browser bundles' defining property: they must be **self-contained**
+ * (no bare/node imports) so a single `import('https://cdn/.../tjs-browser.js')`
+ * works on any CDN with zero import-map/config. Builds in-test with esbuild, so
+ * it doesn't depend on `dist/` existing.
+ *
+ * CDN reality (verified in a real headless browser, 2026-06): the self-contained
+ * TJS/AJS bundle loads from ANY CDN; for the TypeScript path, the compiler is
+ * lazy-loaded and **esm.sh is the only CDN that reliably serves `typescript`**
+ * (jsDelivr `+esm` / esm.run time out on its ~10MB CJS; skypack is dead).
+ */
+import { describe, it, expect } from 'bun:test'
+import { buildSync } from 'esbuild'
+import { DEFAULT_TYPESCRIPT_URL } from './browser-from-ts'
+
+const HERE = import.meta.dir
+
+function bundle(entry: string, alias?: Record<string, string>): string {
+  const r = buildSync({
+    entryPoints: [`${HERE}/${entry}`],
+    bundle: true,
+    format: 'esm',
+    platform: 'neutral',
+    write: false,
+    external: [],
+    alias,
+  })
+  return r.outputFiles[0].text
+}
+
+/** Bare (non-relative, non-URL) static + dynamic import specifiers. */
+function bareImports(src: string): string[] {
+  const found: string[] = []
+  for (const m of src.matchAll(
+    /(?:^|[;\n}])import\s*(?:[^"';]*?from)?\s*["']([^"']+)["']/g
+  ))
+    found.push(m[1])
+  for (const m of src.matchAll(/import\(\s*["']([^"']+)["']\s*\)/g))
+    found.push(m[1])
+  return [...new Set(found)].filter(
+    (s) => !s.startsWith('.') && !s.startsWith('http')
+  )
+}
+
+describe('browser bundles are self-contained (CDN drop-in)', () => {
+  it('tjs-browser inlines all deps — no bare/node imports', () => {
+    const out = bundle('browser.ts')
+    // bareImports([]) already implies no `node:` imports (they'd be bare too);
+    // a raw `out.includes('node:')` would false-positive on `{node: ...}` props.
+    expect(bareImports(out)).toEqual([])
+    // sanity: acorn really got inlined (parser internals present)
+    expect(out.length).toBeGreaterThan(100_000)
+  })
+
+  it('tjs-browser-from-ts: no bare imports, TS lazy (not inlined)', () => {
+    const out = bundle('browser-from-ts.ts', {
+      typescript: `${HERE}/ts-cdn-shim.ts`,
+    })
+    expect(bareImports(out)).toEqual([])
+    // typescript must NOT be bundled in (it's ~10MB) — the shim swaps it out
+    expect(out.length).toBeLessThan(300_000)
+    // the only runtime dependency is the configurable compiler URL
+    expect(out).toContain('esm.sh/typescript')
+  })
+
+  it('default TypeScript CDN is esm.sh (the only one that serves it reliably)', () => {
+    expect(DEFAULT_TYPESCRIPT_URL).toBe('https://esm.sh/typescript@5')
+  })
+})

package/src/lang/browser-from-ts.ts

@@ -0,0 +1,81 @@
+/**
+ * Browser TypeScript→TJS — lazy-loads the TypeScript compiler from a CDN on
+ * demand, so the bundle stays small and only pays the (~MB) compiler download
+ * when you actually transpile TS. `acorn` + `tosijs-schema` are bundled in; the
+ * `typescript` import in `from-ts.ts` is aliased (at build time) to a Proxy that
+ * forwards to the lazily-loaded compiler (see `ts-cdn-shim.ts`).
+ *
+ *   const { fromTS } = await import('https://cdn.jsdelivr.net/npm/tjs-lang/dist/tjs-browser-from-ts.js')
+ *   const { code } = await fromTS('const x: number = 1', { emitTJS: true })
+ *
+ * Zero config by default. Override the compiler source with `typescriptUrl` (or
+ * preload it yourself onto `globalThis.__TJS_TS__`).
+ */
+import type { FromTSOptions, FromTSResult } from './emitters/from-ts'
+
+/**
+ * Default CDN for the TypeScript compiler. **esm.sh** — verified the only CDN
+ * that reliably serves `typescript` as ESM (default export = the compiler
+ * namespace), in ~700ms. The on-the-fly bundlers choke on typescript's ~10MB
+ * CommonJS size: jsDelivr `+esm`, esm.run → timeout; skypack → dead. So esm.sh
+ * it is. Override via `BrowserFromTSOptions.typescriptUrl` (e.g. a self-hosted
+ * copy) or preload your own compiler onto `globalThis.__TJS_TS__`.
+ *
+ * NOTE: only the *TypeScript* path depends on this. The TJS/AJS transpiler
+ * (`tjs-lang/browser`) is fully self-contained and loads from ANY CDN.
+ */
+export const DEFAULT_TYPESCRIPT_URL = 'https://esm.sh/typescript@5'
+
+const TS_GLOBAL = '__TJS_TS__'
+
+export interface BrowserFromTSOptions extends FromTSOptions {
+  /** Override the CDN URL the TypeScript compiler is lazy-loaded from. */
+  typescriptUrl?: string
+}
+
+let loading: Promise<void> | null = null
+
+/** Lazy-load the TypeScript compiler (once) onto `globalThis.__TJS_TS__`. */
+export function loadTypeScript(
+  url: string = DEFAULT_TYPESCRIPT_URL
+): Promise<void> {
+  if ((globalThis as any)[TS_GLOBAL]) return Promise.resolve()
+  if (!loading) {
+    loading = import(/* @vite-ignore */ /* webpackIgnore: true */ url).then(
+      (mod) => {
+        const ts = mod?.default ?? mod
+        if (!ts || typeof ts.createSourceFile !== 'function') {
+          loading = null
+          throw new Error(
+            `Loaded ${url} but it is not a usable TypeScript compiler ` +
+              `(no createSourceFile). Try a different typescriptUrl.`
+          )
+        }
+        ;(globalThis as any)[TS_GLOBAL] = ts
+      },
+      (e) => {
+        loading = null
+        throw e
+      }
+    )
+  }
+  return loading
+}
+
+/**
+ * Transpile TypeScript → TJS (or JS) in the browser. Lazy-loads the TypeScript
+ * compiler on first call, then runs the same `fromTS` logic as Node.
+ */
+export async function fromTS(
+  source: string,
+  options: BrowserFromTSOptions = {}
+): Promise<FromTSResult> {
+  const { typescriptUrl, ...rest } = options
+  await loadTypeScript(typescriptUrl)
+  // Imported after the compiler is set; from-ts's `typescript` import is aliased
+  // to the Proxy shim, which now forwards to the loaded compiler.
+  const { fromTS: nodeFromTS } = await import('./emitters/from-ts')
+  return nodeFromTS(source, rest)
+}
+
+export type { FromTSOptions, FromTSResult } from './emitters/from-ts'

package/src/lang/browser.ts

@@ -0,0 +1,13 @@
+/**
+ * Self-contained browser entry — the TJS/AJS transpiler with `acorn` and
+ * `tosijs-schema` bundled in (no external/bare imports). Build target
+ * `tjs-browser` (see `scripts/build.ts`) emits a single ESM file you can
+ * `import()` from any CDN with zero import-map / config:
+ *
+ *   const { tjs } = await import('https://cdn.jsdelivr.net/npm/tjs-lang/dist/tjs-browser.js')
+ *   const { code } = tjs("function greet(name: 'x'): '' { return 'hi' }")
+ *
+ * For TypeScript→TJS in the browser, use `tjs-lang/browser/from-ts` (which
+ * lazy-loads the TypeScript compiler from a CDN on demand).
+ */
+export * from './transpiler'

package/src/lang/runtime.test.ts

@@ -27,6 +27,8 @@ import {
   isNativeType,
   Is,
   IsNot,
+  Eq,
+  NotEq,
   tjsEquals,
   checkType,
   MonadicError,
@@ -1178,3 +1180,47 @@ describe('predicate reason strings', () => {
     expect(err!.reason).toBeUndefined()
   })
 })
+
+// `==`/`!=` (which transpile to Eq/NotEq under TjsEquals) are **footgun-free
+// `===`**, NOT structural. They unwrap boxed primitives and treat null/undefined
+// as equal — but distinct objects/arrays are genuinely distinct (a real
+// distinction, and structural `==` would be a silent O(n) perf hit). Deep
+// structural comparison is the separate `Is`/`IsNot` function. This block pins
+// that design so docs/behavior can't drift back to "== is structural".
+describe('equality semantics — == (Eq) is footgun-free, NOT structural', () => {
+  it('fixes the boxed-primitive footgun (unlike ===)', () => {
+    expect(Eq(new Boolean(false), false)).toBe(true)
+    expect(Eq(new Number(5), 5)).toBe(true)
+    expect(Eq(new String('x'), 'x')).toBe(true)
+  })
+
+  it('does NOT coerce across types (unlike JS ==)', () => {
+    expect(Eq('5', 5)).toBe(false)
+    expect(Eq('', false)).toBe(false)
+    expect(Eq(0, false)).toBe(false)
+    expect(Eq(1, true)).toBe(false)
+    expect(Eq(null, 0)).toBe(false)
+  })
+
+  it('treats null and undefined as equal; NaN as equal to itself', () => {
+    expect(Eq(null, undefined)).toBe(true)
+    expect(Eq(NaN, NaN)).toBe(true)
+  })
+
+  it('is NOT structural — distinct objects/arrays are distinct', () => {
+    expect(Eq({ a: 1 }, { a: 1 })).toBe(false)
+    expect(Eq([1, 2], [1, 2])).toBe(false)
+    const shared = { a: 1 }
+    expect(Eq(shared, shared)).toBe(true) // identity still holds
+    expect(NotEq([1, 2], [1, 2])).toBe(true)
+  })
+
+  it('Is/IsNot ARE structural — that is the deep-comparison path', () => {
+    expect(Is({ a: 1 }, { a: 1 })).toBe(true)
+    expect(Is([1, 2], [1, 2])).toBe(true)
+    expect(Is({ a: { b: [1] } }, { a: { b: [1] } })).toBe(true)
+    expect(IsNot([1, 2], [1, 3])).toBe(true)
+    // and Is is not fooled into structural-comparing unequal shapes
+    expect(Is({ a: 1 }, { a: 2 })).toBe(false)
+  })
+})

package/src/lang/ts-cdn-shim.ts

@@ -0,0 +1,35 @@
+/**
+ * Build-time stand-in for the `typescript` module, used ONLY by the
+ * `tjs-browser-from-ts` bundle (via an esbuild `alias`). `from-ts.ts` does
+ * `import ts from 'typescript'` and accesses `ts.<x>` at call time; this Proxy
+ * forwards every access to the compiler that `browser-from-ts.ts` lazy-loads
+ * from a CDN and stashes on `globalThis.__TJS_TS__`.
+ *
+ * Because all of from-ts's `ts.<x>` uses are inside functions (run when `fromTS`
+ * is called, never at module load), the access is always deferred to after the
+ * compiler is loaded — so the swap needs no changes to `from-ts.ts`. tsc still
+ * typechecks `from-ts.ts` against the real `typescript` types; only the browser
+ * BUILD aliases the runtime to this shim.
+ */
+const TS_GLOBAL = '__TJS_TS__'
+
+function compiler(): any {
+  const ts = (globalThis as any)[TS_GLOBAL]
+  if (!ts) {
+    throw new Error(
+      'TypeScript not loaded. Use fromTS() from tjs-lang/browser/from-ts, ' +
+        'which lazy-loads the compiler before transpiling.'
+    )
+  }
+  return ts
+}
+
+const shim: any = new Proxy(
+  {},
+  {
+    get: (_t, prop) => compiler()[prop],
+    has: (_t, prop) => prop in compiler(),
+  }
+)
+
+export default shim

package/src/runtime.test.ts

@@ -596,8 +596,8 @@ describe('Edge Cases', () => {
     expect(result.result.res).toEqual({ value: 42 })
   })
 
-  describe('structural equality in expressions', () => {
-    it('== compares arrays structurally', async () => {
+  describe('footgun-free equality in expressions (== is NOT structural)', () => {
+    it('distinct arrays are NOT equal (== matches TJS, not structural)', async () => {
       const ast = {
         op: 'seq',
         steps: [
@@ -621,10 +621,10 @@ describe('Edge Cases', () => {
         ],
       } as any
       const result = await vm.run(ast, {})
-      expect(result.result.res).toBe(true)
+      expect(result.result.res).toBe(false) // distinct arrays — NOT structural
     })
 
-    it('== compares objects structurally', async () => {
+    it('distinct objects are NOT equal (== matches TJS, not structural)', async () => {
       const ast = {
         op: 'seq',
         steps: [
@@ -648,7 +648,7 @@ describe('Edge Cases', () => {
         ],
       } as any
       const result = await vm.run(ast, {})
-      expect(result.result.res).toBe(true)
+      expect(result.result.res).toBe(false) // distinct objects — NOT structural
     })
 
     it('== does not coerce types', async () => {
@@ -678,7 +678,7 @@ describe('Edge Cases', () => {
       expect(result.result.res).toBe(false) // no coercion
     })
 
-    it('!= returns true for structurally different objects', async () => {
+    it('!= returns true for distinct objects', async () => {
       const ast = {
         op: 'seq',
         steps: [

package/src/vm/equality.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'bun:test'
+import { evaluateExpr } from './runtime'
+
+/**
+ * AJS `==`/`!=` must match TJS `==` (Eq): footgun-free `===`, NOT structural.
+ * This used to do deep structural comparison in the VM — an early, unconsidered
+ * divergence from TJS `==` (so `[1,2] == [1,2]` was `true` in AJS but `false` in
+ * TJS). Now consistent: distinct objects/arrays are distinct; structural
+ * equality is an explicit operation, never `==`.
+ */
+const lit = (value: unknown) => ({ $expr: 'literal' as const, value })
+const evalEq = (op: '==' | '!=', a: unknown, b: unknown) =>
+  evaluateExpr(
+    { $expr: 'binary', op, left: lit(a), right: lit(b) } as any,
+    { state: {}, args: {} } as any
+  )
+
+describe('AJS == / != — footgun-free, NOT structural (consistent with TJS)', () => {
+  it('distinct arrays/objects are NOT equal (the divergence fix)', () => {
+    expect(evalEq('==', [1, 2], [1, 2])).toBe(false)
+    expect(evalEq('==', { a: 1 }, { a: 1 })).toBe(false)
+    expect(evalEq('!=', [1, 2], [1, 2])).toBe(true)
+  })
+
+  it('identity still holds for the same reference', () => {
+    const shared = { a: 1 }
+    expect(evalEq('==', shared, shared)).toBe(true)
+    const arr = [1, 2]
+    expect(evalEq('==', arr, arr)).toBe(true)
+  })
+
+  it('no type coercion', () => {
+    expect(evalEq('==', '5', 5)).toBe(false)
+    expect(evalEq('==', '', false)).toBe(false)
+    expect(evalEq('==', 0, false)).toBe(false)
+  })
+
+  it('unwraps boxed primitives', () => {
+    expect(evalEq('==', new Boolean(false) as any, false)).toBe(true)
+    expect(evalEq('==', new Number(5) as any, 5)).toBe(true)
+  })
+
+  it('null/undefined equal; NaN equal to itself', () => {
+    expect(evalEq('==', null, undefined)).toBe(true)
+    expect(evalEq('==', NaN, NaN)).toBe(true)
+    expect(evalEq('==', null, 0)).toBe(false)
+  })
+
+  it('scalars compare as expected', () => {
+    expect(evalEq('==', 1, 1)).toBe(true)
+    expect(evalEq('==', 'x', 'x')).toBe(true)
+    expect(evalEq('!=', 1, 2)).toBe(true)
+  })
+
+  it('=== / !== remain strict identity (unchanged)', () => {
+    expect(evalEq('===' as any, [1], [1])).toBe(false)
+    expect(evalEq('===' as any, 5, 5)).toBe(true)
+  })
+})

package/src/vm/runtime.ts

@@ -1,69 +1,36 @@
 import { s, validate, filter as schemaFilter } from 'tosijs-schema'
 
-/** Well-known symbol for custom equality (matches src/lang/runtime.ts) */
-const tjsEquals = Symbol.for('tjs.equals')
-
 /**
- * Structural equality for AJS expressions.
- * Mirrors the TJS Is() function: symbol → .Equals → structural.
+ * AJS `==`/`!=` equality — **footgun-free `===`**, consistent with TJS `Eq`
+ * (`src/lang/runtime.ts`). NOT structural: it unwraps boxed primitives, treats
+ * `null`/`undefined` as equal and `NaN` as equal to itself, but does NOT coerce
+ * across types, and distinct objects/arrays are distinct (`[1,2] != [1,2]`).
+ *
+ * (Originally the VM did deep structural comparison here — an early, unconsidered
+ * divergence from TJS `==`. It was also a SECURITY hole: a single `==` node costs
+ * a flat EXPR_FUEL_COST, but the structural walk charged nothing per element, so
+ * `==` on an attacker-controlled large structure was an unbounded-work / fuel-
+ * bypass DoS — exactly what AJS exists to prevent. `eqValue` is O(1).
+ *
+ * Structural equality is an explicit operation: in TJS it's the `Is`/`IsNot`
+ * function; AJS can grow an `Is` atom if/when needed — but it MUST be fuel-metered
+ * per element compared, or it reintroduces the same DoS.)
  */
-function isStructurallyEqual(a: unknown, b: unknown): boolean {
-  // Symbol protocol
-  if (
-    a !== null &&
-    typeof a === 'object' &&
-    typeof (a as any)[tjsEquals] === 'function'
-  ) {
-    return (a as any)[tjsEquals](b)
-  }
-  if (
-    b !== null &&
-    typeof b === 'object' &&
-    typeof (b as any)[tjsEquals] === 'function'
-  ) {
-    return (b as any)[tjsEquals](a)
+function eqValue(a: unknown, b: unknown): boolean {
+  if (a instanceof String || a instanceof Number || a instanceof Boolean) {
+    a = a.valueOf()
   }
-
-  // .Equals method
-  if (
-    a !== null &&
-    typeof a === 'object' &&
-    typeof (a as any).Equals === 'function'
-  ) {
-    return (a as any).Equals(b)
-  }
-  if (
-    b !== null &&
-    typeof b === 'object' &&
-    typeof (b as any).Equals === 'function'
-  ) {
-    return (b as any).Equals(a)
+  if (b instanceof String || b instanceof Number || b instanceof Boolean) {
+    b = b.valueOf()
   }
-
   if (a === b) return true
-
-  // Nullish equality (null == undefined)
-  if ((a === null || a === undefined) && (b === null || b === undefined))
+  if (typeof a === 'number' && typeof b === 'number' && isNaN(a) && isNaN(b)) {
     return true
-
-  if (a === null || a === undefined || b === null || b === undefined)
-    return false
-
-  if (typeof a !== typeof b) return false
-  if (typeof a !== 'object') return false
-
-  // Arrays
-  if (Array.isArray(a) && Array.isArray(b)) {
-    if (a.length !== b.length) return false
-    return a.every((v, i) => isStructurallyEqual(v, b[i]))
   }
-  if (Array.isArray(a) !== Array.isArray(b)) return false
-
-  // Objects
-  const keysA = Object.keys(a as object)
-  const keysB = Object.keys(b as object)
-  if (keysA.length !== keysB.length) return false
-  return keysA.every((k) => isStructurallyEqual((a as any)[k], (b as any)[k]))
+  if ((a === null || a === undefined) && (b === null || b === undefined)) {
+    return true
+  }
+  return false
 }
 
 // --- Monadic Error Type ---
@@ -1204,9 +1171,9 @@ export function evaluateExpr(node: ExprNode, ctx: RuntimeContext): any {
         case '<=':
           return left <= right
         case '==':
-          return isStructurallyEqual(left, right)
+          return eqValue(left, right)
         case '!=':
-          return !isStructurallyEqual(left, right)
+          return !eqValue(left, right)
         case '===':
           return left === right
         case '!==':