tjs-lang 0.8.7 → 0.9.0

package/src/lang/redos-lint.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Regex ReDoS linting in the predicate verifier. A regex match is opaque to the
+ * fuel counter (a single `.test`/`.match` can't be interrupted mid-backtrack),
+ * so a catastrophic-backtracking pattern can't be certified predicate-safe. The
+ * verifier flags the exponential star-height≥2 class (`(a+)+`, `(a*)*`, …) and
+ * fails closed: over-flagging only costs the "verified" badge (the predicate
+ * still runs), whereas certifying a dangerous one would be a broken promise.
+ */
+import { describe, it, expect } from 'bun:test'
+import { verifyPredicate, emitVerifiedPredicate } from './predicate'
+import { preprocess } from './parser'
+
+/** Verify a single predicate whose body uses the given regex literal. */
+const verifyRe = (re: string) =>
+  verifyPredicate(`function p(s) { return ${re}.test(s) }`)
+
+describe('ReDoS linting: dangerous patterns are not predicate-safe', () => {
+  const dangerous: Array<[string, string]> = [
+    ['nested +', '/(a+)+$/'],
+    ['nested *', '/(a*)*/'],
+    ['plus-in-star', '/([a-z]+)*/'],
+    ['dot-star star', '/(.*)*/'],
+    ['digit nest', '/(\\d+)+/'],
+    ['unbounded brace nest', '/(a{2,})+/'],
+    ['doubly nested group', '/((a+))+/'],
+  ]
+  for (const [label, re] of dangerous) {
+    it(`flags ${label}: ${re}`, () => {
+      const r = verifyRe(re)
+      expect(r.safe).toBe(false)
+      expect(
+        r.diagnostics.some((d) => /redos|backtrack/i.test(d.message))
+      ).toBe(true)
+    })
+  }
+})
+
+describe('ReDoS linting: safe patterns still verify', () => {
+  const safe: Array<[string, string]> = [
+    ['char class +', '/[a-z]+/'],
+    ['bounded braces', '/\\d{3}-\\d{4}/'],
+    ['group repeated, no inner quantifier', '/(abc)+/'],
+    ['alternation repeated', '/(foo|bar)+/'],
+    ['anchored hex', '/^#[0-9a-f]{6}$/'],
+    ['single star', '/foo.*bar/'],
+    ['optional group', '/(ab)?c+/'],
+  ]
+  for (const [label, re] of safe) {
+    it(`accepts ${label}: ${re}`, () => {
+      const r = verifyRe(re)
+      expect(r.safe).toBe(true)
+      expect(r.diagnostics).toEqual([])
+    })
+  }
+})
+
+describe('ReDoS linting: end-to-end', () => {
+  it('emitVerifiedPredicate refuses a ReDoS regex (no code)', () => {
+    const r = emitVerifiedPredicate(
+      'function p(s) { return /(a+)+$/.test(s) }',
+      'p'
+    )
+    expect(r.safe).toBe(false)
+    expect(r.code).toBeUndefined()
+  })
+
+  it('a Type predicate with a ReDoS regex falls back (no verified guard)', () => {
+    const out = preprocess(
+      `Type Bad 'bad' { predicate(s) { return /(a+)+$/.test(s) } }`
+    ).source
+    expect(out).not.toContain('__fuel') // not certified → raw fallback
+    expect(out).toContain('(a+)+') // raw body preserved
+  })
+
+  it('a Type predicate with a safe regex compiles to a verified guard', () => {
+    const out = preprocess(
+      `Type Hex 'hex' { predicate(s) { return /^#[0-9a-f]{6}$/.test(s) } }`
+    ).source
+    expect(out).toContain('__fuel') // certified safe → fuel-bounded guard
+  })
+})

package/src/lang/transpiler.ts

@@ -28,6 +28,8 @@ export {
 export {
   verifyPredicate,
   compilePredicate,
+  emitVerifiedPredicate,
+  createPredicateEvaluator,
   suggest,
   effectfulFromAtoms,
   formatPredicateDiagnostics,
@@ -36,6 +38,8 @@ export {
   type PredicateVerifyResult,
   type VerifyPredicateOptions,
   type CompilePredicateOptions,
+  type EmitPredicateResult,
+  type PredicateEvaluatorOptions,
   type Suggestion,
   type SuggestOptions,
 } from './predicate'
@@ -53,6 +57,14 @@ export {
 // AST emitter
 export { transformFunction } from './emitters/ast'
 
+// .d.ts emitter — the express-controlled migration bridge for a TS importer
+// graph (see ../tosijs/TJS-PORT-DX.md). Needs to be reachable from `tjs-lang/lang`.
+export {
+  generateDTS,
+  typeDescriptorToTS,
+  type GenerateDTSOptions,
+} from './emitters/dts'
+
 // JS emitter (TJS -> JS)
 export { transpileToJS } from './emitters/js'
 export type {
@@ -107,4 +119,5 @@ export type {
   TranspileOptions,
   TranspileResult,
   TranspileWarning,
+  PredicateVerification,
 } from './types'

package/src/lang/type-verified-predicate.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Integration: `Type … { predicate(x){…} }` bodies that verify as predicate-safe
+ * compile to a self-contained, fuel-bounded native guard (the `emitVerifiedPredicate`
+ * path); unverifiable ones fall back to the raw arrow (never rejected — TJS ⊇ JS).
+ *
+ * We assert against the preprocessed source: `__fuel` present ⇔ the verified
+ * guard was emitted. Runtime guard behavior is covered by
+ * `emit-verified-predicate.test.ts`.
+ */
+import { describe, it, expect } from 'bun:test'
+import { preprocess } from './parser'
+import { tjs } from './index'
+
+const src = (s: string) => preprocess(s).source
+
+describe('multiple verified predicates in one module (no name collision)', () => {
+  // Regression: each verified guard used a fixed `function __pred`, so two in
+  // one module collided — the polymorphic-merge transform saw duplicate names
+  // and either errored ("ambiguous signatures") or renamed to `__pred$1`,
+  // breaking the guard IIFE at runtime. Names are now per-declaration.
+  it('transpiles two Type predicates without a `__pred` clash', () => {
+    const out = tjs(
+      `Type A 'a' { predicate(x) { return x > 0 } }\n` +
+        `Type B 'b' { predicate(x) { return x < 0 } }`
+    )
+    expect(out.code).not.toContain('__pred$')
+    expect(out.code).toContain('__pred_A')
+    expect(out.code).toContain('__pred_B')
+  })
+
+  it('transpiles a Type + Generic predicate together', () => {
+    const out = tjs(
+      `Type Pos 'positive' { predicate(x) { return x > 0 } }\n` +
+        `Generic Box<T> { description: 'b', predicate(x, T) { return T(x.value) } }`
+    )
+    expect(out.code).not.toContain('__pred$')
+    expect(out.code).toContain('__pred_Pos')
+    expect(out.code).toContain('__pred_Box')
+  })
+})
+
+describe('Type predicate → verified fuel-bounded guard', () => {
+  it('compiles a safe predicate-only Type to a fuel-bounded guard', () => {
+    const out = src(`Type Pos 'positive' { predicate(x) { return x > 0 } }`)
+    expect(out).toContain(`const Pos = Type('positive'`)
+    expect(out).toContain('__fuel') // verified + fuel-injected
+    expect(out).toContain('x > 0') // original body preserved inside the guard
+  })
+
+  it('compiles a safe predicate+example Type, keeping the example schema gate', () => {
+    const out = src(
+      `Type EvenNum 'even' { example: 2, predicate(x) { return x % 2 === 0 } }`
+    )
+    expect(out).toContain(`const EvenNum = Type('even'`)
+    expect(out).toContain('__fuel') // verified
+    expect(out).toContain('__tjs?.validate') // example schema still gates
+    expect(out).toContain('x % 2 === 0')
+  })
+
+  it('verifies a native-TJS predicate using == (rewritten to Eq)', () => {
+    // `==` → `Eq(...)`; Eq is whitelisted pure, so the predicate still verifies.
+    const out = src(`Type Five 'five' { predicate(x) { return x == 5 } }`)
+    expect(out).toContain('Eq(') // proves the equality rewrite ran
+    expect(out).toContain('__fuel') // ...and it still verified as safe
+  })
+
+  it('falls back to the raw arrow for an unverifiable predicate (loop)', () => {
+    const out = src(
+      `Type AllPos 'all positive' { example: [1], predicate(xs) { for (const x of xs) { if (x <= 0) return false } return true } }`
+    )
+    expect(out).not.toContain('__fuel') // NOT verified → no fuel guard
+    expect(out).toContain('for (const x of xs)') // raw body preserved
+    expect(out).toContain('__tjs?.validate') // example gate still present
+  })
+
+  it('falls back for an impure predicate (effectful call)', () => {
+    const out = src(
+      `Type Reachable 'reachable' { predicate(url) { return fetch(url) } }`
+    )
+    expect(out).not.toContain('__fuel')
+    expect(out).toContain('fetch(url)') // raw body preserved
+  })
+})

package/src/lang/types.ts

@@ -97,6 +97,23 @@ export interface TranspileWarning {
   source?: string
 }
 
+/**
+ * Per-declaration report of whether a `Type`/`Generic` predicate body verified
+ * as predicate-safe (→ compiled to a fuel-bounded, DoS-safe native guard) or
+ * fell back to a plain unverified function (still valid — TJS ⊇ JS — but not
+ * fuel-bounded or safe to run on untrusted data). Surfaced on the transpile
+ * result so tools can flag unverifiable predicates.
+ */
+export interface PredicateVerification {
+  /** The `Type` / `Generic` declaration name. */
+  name: string
+  kind: 'Type' | 'Generic'
+  /** True → verified + compiled to a native guard; false → raw-function fallback. */
+  verified: boolean
+  /** When `!verified`, the verifier's reason(s). */
+  reason?: string
+}
+
 /** Source map for debugging */
 export interface SourceMap {
   version: 3

package/src/lang/typescript-syntax.test.ts

@@ -13,7 +13,8 @@
  */
 
 import { describe, test, expect } from 'bun:test'
-import { transpileToJS, fromTS, tjs } from './index'
+import { transpileToJS, tjs } from './index'
+import { fromTS } from './emitters/from-ts'
 
 // Helper to get the first function's metadata from the Record
 function getFirstFunc(metadata: Record<string, any>) {

package/src/schema/index.ts

@@ -0,0 +1,62 @@
+/**
+ * `tjs-lang/schema` — tosijs-schema, pre-wired with predicate support.
+ *
+ * A drop-in for `tosijs-schema` that additionally evaluates the `$predicate`
+ * keyword: importing this module registers tjs-lang's verified predicate engine
+ * as the evaluator, so JSON-Schema validation is predicate-aware **out of the
+ * box** — no manual `setPredicateEvaluator` call. Everything tosijs-schema
+ * exports is re-exported here, so this is the only import a consumer needs:
+ *
+ * ```ts
+ * import { s, validate } from 'tjs-lang/schema'
+ * // a schema whose node carries `$predicate` now validates computationally
+ * ```
+ *
+ * Why it lives here and not in tosijs-schema: tjs-lang depends on tosijs-schema,
+ * so the reverse would be a circular dependency. This entry sits on the side of
+ * the graph that may know about both — it's the "batteries-included" packaging
+ * of the two.
+ *
+ * Registration is a global (tosijs-schema keeps one evaluator), so importing
+ * this module makes `$predicate` work for tosijs-schema usage app-wide, even in
+ * code that imports `tosijs-schema` directly. Call `setPredicateEvaluator(null)`
+ * to opt back out, or `installPredicateSupport(opts)` to re-install with custom
+ * options (fuel budget, atom-aware effects, etc.).
+ */
+import { setPredicateEvaluator, getPredicateEvaluator } from 'tosijs-schema'
+import {
+  createPredicateEvaluator,
+  type PredicateEvaluatorOptions,
+} from '../lang/predicate'
+
+// The full tosijs-schema surface (s, validate, filter, diff, types,
+// setPredicateEvaluator, getPredicateEvaluator, PredicateEvaluator, …).
+export * from 'tosijs-schema'
+// The evaluator factory, for advanced/custom wiring.
+export {
+  createPredicateEvaluator,
+  type PredicateEvaluatorOptions,
+} from '../lang/predicate'
+
+let installed = false
+
+/**
+ * Register tjs-lang's predicate engine as tosijs-schema's `$predicate` evaluator.
+ * Called automatically when this module is imported; exposed so callers can
+ * re-install with custom {@link PredicateEvaluatorOptions} (e.g. a smaller fuel
+ * budget, or an atom-aware effectful set) after opting out.
+ */
+export function installPredicateSupport(
+  opts?: PredicateEvaluatorOptions
+): void {
+  setPredicateEvaluator(createPredicateEvaluator(opts))
+  installed = true
+}
+
+/** True once predicate support has been installed (and not since cleared). */
+export function predicateSupportInstalled(): boolean {
+  return installed && getPredicateEvaluator() !== null
+}
+
+// Batteries included: wire the engine up on import.
+installPredicateSupport()

package/src/schema/schema.test.ts

@@ -0,0 +1,66 @@
+/**
+ * `tjs-lang/schema` — tosijs-schema pre-wired with predicate support. Importing
+ * the module should make `$predicate` validation work with no manual wiring, and
+ * re-export the whole tosijs-schema surface. Runs against the real published
+ * tosijs-schema (node_modules), so it also guards the version/API contract.
+ */
+import { describe, it, expect, afterAll } from 'bun:test'
+import {
+  validate,
+  s,
+  setPredicateEvaluator,
+  getPredicateEvaluator,
+  installPredicateSupport,
+  predicateSupportInstalled,
+  createPredicateEvaluator,
+} from './index'
+import { cssStyleSchema, cssColorSchema } from '../css'
+
+// Leave the global evaluator registered for other suites (import order is
+// nondeterministic); this module's contract is "installed after import".
+afterAll(() => installPredicateSupport())
+
+describe('tjs-lang/schema is batteries-included', () => {
+  it('registers the predicate evaluator on import', () => {
+    expect(predicateSupportInstalled()).toBe(true)
+    expect(typeof getPredicateEvaluator()).toBe('function')
+  })
+
+  it('re-exports the tosijs-schema surface', () => {
+    expect(typeof validate).toBe('function')
+    expect(typeof s).toBe('object') // the builder proxy
+    expect(typeof setPredicateEvaluator).toBe('function')
+    expect(typeof createPredicateEvaluator).toBe('function')
+  })
+
+  it('validates a $predicate node out of the box (CSS color)', () => {
+    const color = cssColorSchema()
+    expect(validate('#3a3', color)).toBe(true)
+    expect(validate('notacolor', color)).toBe(false) // predicate ran, no manual wiring
+  })
+
+  it('validates the recursive CSS style structure', () => {
+    const style = cssStyleSchema()
+    expect(
+      validate({ color: 'red', '&:hover': { color: 'var(--accent)' } }, style)
+    ).toBe(true)
+    expect(validate({ '  bad key  ': 'red' }, style)).toBe(false)
+    expect(validate('not-an-object', style)).toBe(false)
+  })
+
+  it('opting out (setPredicateEvaluator(null)) falls back to structural only', () => {
+    setPredicateEvaluator(null)
+    const color = cssColorSchema()
+    // naive: only `type: string` is checked, so a non-color string passes
+    expect(validate('notacolor', color)).toBe(true)
+    // re-install for the remaining assertions
+    installPredicateSupport()
+    expect(validate('notacolor', color)).toBe(false)
+  })
+
+  it('installPredicateSupport accepts custom options (fuel budget)', () => {
+    installPredicateSupport({ fuel: 500_000 })
+    expect(predicateSupportInstalled()).toBe(true)
+    expect(validate('#fff', cssColorSchema())).toBe(true)
+  })
+})

package/src/use-cases/bootstrap.test.ts

@@ -14,6 +14,7 @@
 import { describe, it, expect } from 'bun:test'
 import { fromTS } from '../lang/emitters/from-ts'
 import { tjs } from '../lang'
+import { emitVerifiedPredicate } from '../lang/predicate'
 import * as fs from 'fs'
 import * as path from 'path'
 
@@ -528,10 +529,16 @@ describe('Bootstrap Canary', () => {
       // Step 2: Execute the combined transpiled parser modules
       const execStart = performance.now()
 
-      const parserModule = new Function(`
+      // parser-transforms.ts calls emitVerifiedPredicate (from predicate.ts, an
+      // acorn-backed engine module not in this parser-only bundle) — inject the
+      // native one so the self-hosted preprocess can verify Type/Generic predicates.
+      const parserModule = new Function(
+        'emitVerifiedPredicate',
+        `
         ${combinedCode}
         return { preprocess };
-      `)()
+      `
+      )(emitVerifiedPredicate)
       const execTime = performance.now() - execStart
 
       expect(typeof parserModule.preprocess).toBe('function')
@@ -639,10 +646,13 @@ describe('Bootstrap Canary', () => {
         combinedCode += stripped + '\n'
       }
 
-      const bootstrappedParser = new Function(`
+      const bootstrappedParser = new Function(
+        'emitVerifiedPredicate',
+        `
         ${combinedCode}
         return { preprocess };
-      `)()
+      `
+      )(emitVerifiedPredicate)
 
       // Import native parser
       const nativeParser = require('../lang/parser')