Changelog

All notable changes to tjs-lang are documented here.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

[0.14.0-rc.10] — 2026-10-31

On the rc dist-tag. Mostly what tosijs-native found building natively in .tjs from the first line: typed parameters with defaults, class methods that validate, .d.ts that compiles across files, a Bun.build plugin and an optional shared runtime per bundle. Pin 0.14.0-rc.10 exactly to test it.

Read this first: what changes since rc.9

• Class methods and constructors validate their parameters (BREAKING, toward correctness). Box('s') for constructor(v: 0) returns a MonadicError. A platform callback whose return value is discarded silently skips its body on a refused call: attributeChangedCallback(name = '', old = '', value = '') refuses the platform's old = null. Spell old = null.
• name: Type = default works in TJS (#3596), and is REFUSED on the AJS path with a remedy, until the type can reach the agent's input schema.
• A bare null default accepts any value (#3609), as a null dictionary member did.
• Emitted __tjs names a parameter's Type (typeName) and keeps a function type's signature; a consumer reading __tjs sees more fields.
• New entry points: tjs-lang/bun-build-plugin (tjsPlugin() for Bun.build) and tjs-lang/prelude (with prelude: 'import' / sharedPrelude; only for a bundle built by the same tjs-lang).
• tjs emit rewrites relative ./x.tjs imports to ./x.js (#3592), in the .js and the .d.ts.
• Doc comments: findDocCommentSpans / extractDocComments are exported (#3604), and the scan is linear (it was quadratic before fuel on the AJS path).

Added since rc.9

• A shared prelude: prelude: 'import' and tjsPlugin({ sharedPrelude: true }) (#3594, from tosijs-native). Every emitted module carries its own inline runtime, so a bundle of N modules carried N copies. Opted in, a module instead imports a factory from the new tjs-lang/prelude and builds its own instance: the code is in the bundle once, the state (the extend projection table, the call-stack ring) stays per module. The behaviour is the inline runtime's, checked by a differential corpus run both ways. A module compiled by a different tjs-lang is refused at load, by content hash. Measured on tosijs-native (seven modules): 102.6 KB → 72.3 KB raw, one prelude instead of seven; gzip is unchanged (15.4 → 15.6 KB), because compression had already been folding the copies. So the win is parse size, not transfer. Default output is unchanged and still standalone. This output is for a bundle built by the same tjs-lang, which is what the plugin does: it names an exact prelude, so do not publish prelude: 'import' files unless the package pins tjs-lang to that exact version. A consumer's tree resolving a different copy gets "compiled against prelude X" at load. Signature examples and test blocks still run under it (they run against the inline form: the rc.10 review found every one inconclusive, so a wrong example passed the build).

• name: Type = default (#3596, from tosijs-native): a type and a separate default, TypeScript's spelling. The parameter is checked against the type, optional, and defaults to the default; it is how a literal union gets a default (mode: 'grant' | 'deny' = 'grant'), which no other spelling could express. It was a bare Unexpected token. A passed object must satisfy the type whole (not merge-on-partial, which stays the untyped opts = { … }), a literal default that fails its own type is a compile error, and the .d.ts declares the parameter optional with its type. TypeScript conformance's "param with default" row passes.

• tjs-lang/bun-build-plugin: tjsPlugin() for Bun.build (#3593, from tosijs-native). tjs-lang/bun-plugin is a runtime registration (Bun's plugin()), which Bun.build ignores, so a project bundling .tjs had to write its own. Bun.build({ plugins: [tjsPlugin()] }) bundles a .tjs graph that runs in plain Node; the preload now uses the same plugin.

• Return examples can run on load, opt-in (#3599, from tosijs-native): tjsPlugin({ runTests: true }), or TJS_RUN_TESTS=1 with the preload. A wrong return example (or a failing test block) then fails the build or the import, instead of passing bun test and failing only tjs check. Off by default, since it runs a file's tests on every load.

• findDocCommentSpans and extractDocComments are exported from tjs-lang, tjs-lang/lang and tjs-lang/browser (#3604). They are TJS's own doc-comment grammar (/# … #/: literal-masked and nestable), so a doc system can read a .tjs file's documentation the way the language does. tosijs-ui feature-detects them, and a .tjs file documented the TJS way gets a page.

Fixed since rc.9

• Explaining a rejected value costs a bounded multiple of checking it (#3619, rc.10 review). The explainer behind "where did it fail" (#3597) asked whether each named Type's whole subtree passed before descending into it, so a rejected recursive value cost subtree × depth: 37× the accept at depth 60. It now walks the shape first and asks only where the walk found nothing (a predicate refusing a well-shaped value), at most 16 times; past that it stops explaining and the error keeps its plain message. About 3× the accept at any depth or width, counted in property reads. The messages are the old explainer's, checked against it over every leaf of a nested config broken nine ways.

• The doc-comment scan is linear (rc.10 review). findDocCommentSpans (public since #3604) and blankDocComments run before any fuel on the AJS path, and were quadratic: '/#'.repeat(k) took 28s at 128 KB, 11.6ms now. The new scan returns exactly the old one's spans, checked against the old implementation over 20,000 generated sources, and a work-counting row fails if it stops being linear. Exposure was bounded by the 8 KB default source cap (about 60ms); a host that raised maxSourceBytes, or called transpile() directly, got super-linear work before any budget.

• AJS refuses name: Type = default, with a remedy (rc.10 review). The new spelling (#3596) reached AJS through the parameter code it shares with TJS and was accepted with the type dropped, so n: number = 5 admitted 'x' into the agent: a declared input contract silently unenforced. rc.9 refused it as a syntax error; it is refused again, now saying what to write (n = 5), until the AST emitter carries the type into the input schema. The AJS construct ratchet lists it, so the next leak through the shared code fails by name.

• An emitted function's __tjs says WHICH named Type a parameter has. serializeType copied a fixed field list that left out typeName, so a declared parameter serialized as { kind: 'declared' } and wrap(fn, fn.__tjs) reported "named Type 'undefined'". A function-typed parameter lost its signature (params, returns) the same way, and a degraded any lost its unresolved text. The test meant to catch it had been passing on another row's record; CI's test order exposed it.

• The flight recorder's module-level ring mirrors into an installed instance. With globalThis.__tjs = createRuntime() (the documented setup), what the runtime module itself records, such as a wrap() notice, went to a ring nothing read. Instances already mirrored into the global; the module recorder was the one sink without. installRuntime() (the module itself on the global) is skipped, so nothing loops.

• A bare null or undefined parameter default means any value (#3609, from tosijs-native): function render(doc = null) accepted ONLY null, refusing ordinary callers, while a null dictionary member accepted anything. It now means "any value, defaulting to null", the usual JavaScript meaning. doc: null still means only null. Behaviour change for code relying on the refusal.

• A class can call itself from its own body (#3608): static of(v) { return Box(v) } threw "Cannot call a class constructor without new". TJS makes a class callable by rebinding its outer name to a wrapper; inside the body the name is the raw class. The call now goes through the wrapper (recorded on the class as a non-enumerable __tjs_callable), so overloaded constructors still dispatch. The callee is resolved by scope: a method that binds its own Box (a local, a destructured or default parameter, an inner function, catch (Box), a loop binding) calls its own (rc.10 review: those threw Box.__tjs_callable is not a function), and whether a class is wrapped is read from the wrapper's statements, not from source text a string can spell.

• A } in a string or regex inside a method no longer ends the class for the callable-class wrapper (literal blindness). The wrapper landed inside the class body, where it parsed by accident as a class field named after the class, so that class was never made callable.

• A dictionary default may have an undefined member (#3591, from tosijs-native), meaning "any value, defaulting to undefined", as a null member already did. It was refused as "not a clonable literal value", so "absent means use the global" had to be spelled null. The .d.ts declares it any.

• A declared Type's failure says where (#3597, from tosijs-native). A config type whose one bad field was deep inside reported Expected Config for '…config', got object; it now says Expected Config for '…config': products[1].kind: expected string, got number (missing members, nested shapes, the integer rule, function members and recursive Types included). The explanation runs only after the check has failed, and never throws. Size: it adds ~1.95KB (~750 bytes gzipped) to each emitted module that names a declared Type; sharing one runtime per bundle is #3594.

• Class methods validate their parameters, the constructor included (#3598, from tosijs-native). Behaviour change: a method or constructor with typed parameters now returns a MonadicError for a wrong argument (Box('s') for constructor(v: 0), which used to build a Box with v = 's'), as the same signature on a function always did. Methods were only stripped of their annotations. Static methods and destructured method parameters are covered; a derived constructor's checks run before super(), which JavaScript allows since they return only on failure. Setters are NOT checked (their return value is discarded, so a refusal would silently drop the write), nor is dialect: 'js'. BREAKING for platform callbacks whose return value the platform discards. A refused call returns a MonadicError instead of running the body, and the host never looks: attributeChangedCallback(name = '', old = '', value = '') is called with old = null the first time an attribute is set, so the body silently does not run. The refusal is recorded in the flight recorder (__tjs.records()). Spell what the platform actually passes: old = null (a null default accepts any value), or mark the method /* unsafe */.

• A function-valued member of a Type's example means "a function here" (#3595, from tosijs-native). Type Bridge { example: { call: (a) => 1 } } refused every value, one of exactly that shape included, in both checkers: the inline one compared a function example by identity, and the runtime Type's inference has no schema for a function. Both now check typeof === 'function' there (a Type, which is also callable, is still a Type).

• A package written in .tjs emits as a package TypeScript and plain Node can use (#3587, #3588, #3589, #2749; found by tosijs-native, the first project written natively in .tjs). Five defects, each a reason such a package could not be published:

  • a barrel index.tjs of export { … } from './x.tjs' emitted an EMPTY index.d.ts, so the package's entry point had no types (re-exports now pass through);
  • a Type imported from another file was declared any (it is now named, and imported with import type);
  • a Type named inside another Type's example was any[] (products: Product[]);
  • a null dictionary-default member, which admits any value at runtime, was declared null, so a TypeScript caller passing a real value failed to compile (now any);
  • tjs emit wrote ./x.tjs imports into the .js it emitted beside x.js, so the output loaded only where a .tjs loader was installed. Relative .tjs specifiers are now rewritten to .js in emitted files (JavaScript and .d.ts; found by parsing, so a mention in a string or comment is untouched), which moduleResolution: nodenext also requires. The library's tjs() keeps source specifiers, since its output runs where .tjs sources do. Pinned end to end: a multi-file package is emitted with the CLI, a consumer is compiled against it with TypeScript (nodenext, strict, skipLibCheck off), and the .js runs in plain node.

[0.14.0-rc.9] — 2026-10-28

On the rc dist-tag. A VM security fix (#3531), destructured and array-pattern parameters checked as the one argument they are at any position, wrap() working with emitted metadata, :? returns checked like parameters, tosijs proxies seen through everywhere, Type values as defaults, and sharper error messages. Pin 0.14.0-rc.9 exactly to test it.

Read this first: what changes since rc.8

• Published metadata (BREAKING, toward correctness): a destructured or array-pattern parameter beside others is ONE entry in __tjs.params, keyed by its binding pattern ({ w, h }, k, not w, h, k); a lone destructured parameter's __tjs gains destructured: true.
• A :? return with a wrong member now returns an error (#3408).
• A list element failure names the element (f.xs[1].t), not the list (#3407).
• function f(xs = [Book]) takes a list of Types, not of Books (#3411).
• dialect: 'js' no longer runs return examples (#3412).

Security since rc.8

• The VM's equality runs no host code on the values it compares (#3531). rc.7's tosijs see-through (unwrapBoxed) added a property GET of Symbol.for('xin-value'), and the VM's == used it: a GET runs a getter or a Proxy trap, which the VM's equality promises never to do. A guest cannot make such a value (guest values are membraned data), but a host object returned by an atom tagged effects: 'pure', which skips the membrane, reached the comparison and its trap ran, unmetered, inside guest evaluation. The instanceof checks it replaced also consulted a Proxy's getPrototypeOf trap. The VM now unwraps boxed primitives by slot reads only (unwrapBoxedSlots) and does not see through tosijs proxies, which no guest value is. Affected: 0.14.0-rc.7 and rc.8 for the GET; the instanceof trap reads are older. Not a sandbox escape: the code that ran is the embedder's own object. 0.14.0-rc.7 and rc.8 are deprecated on npm (2026-10-29), pointing at 0.14.0-rc.9 or later. No GitHub advisory: a guest program cannot trigger it, only a host object returned by an embedder's own effects: 'pure' atom.

Fixed since rc.8

• A Type in a default is a value: functions can take Types (#3411). In function shelf(types = [Book]) or function accepts(t = Book), the default is the Type itself, and a function may take Types and operate on them. The default was read as an EXAMPLE ("a list of Book-shaped values"), so the parameter refused its own default and every other Type passed in. A declared Type named in a default (including a dictionary default's members) is now checked as a Type (Expected Type for … when it is not one). The colon form keeps its meaning: b: [Book] is a list of Books. Behaviour change: function f(xs = [Book]) used to check its argument as a list of Books (and refuse its own default); it now takes a list of Types. For a list of Books write xs: [Book].
• The .d.ts declares a parameter with a non-literal default as optional (t = Book, x = now() were required), and parenthesizes a list of functions ((() => any)[], not () => any[]).
• Signature examples run under one condition, at build and in the test runner (#3412): native TJS. Under dialect: 'js' the build ran a return example (and failed the transpile on a wrong one) while tjs().testRunner never did. A return annotation is a worked example only in native TJS, so the js dialect now runs neither; native TJS still runs both. Behaviour change: a dialect: 'js' source with an inconsistent return example now transpiles.
• tosijs proxies are seen through everywhere a value is checked (#3406). rc.7 listed three places that still refused one: a proxy held inside a plain object or list ({ a: calculator.x }, [calculator.x]), an overloaded function's dispatch (adding an overload made f(calculator.x) "no matching overload"), and a :? return check. Each is now checked as the value the proxy wraps, while the body, the chosen overload and the caller still receive the proxy itself. Member and element checks pay nothing on the happy path (the unwrap runs only after the raw check has failed); dispatch unwraps each argument it tests, measured at a few percent on a dispatch-only micro-benchmark. A message names the wrapped value's type, not "object".
• A type error names the contract and the place (#3407). A member of a named Type said Expected declared; it says Expected Book. A list whose ELEMENT failed said Expected array of object …, got array of object; it now names the element and, for a shape, the member: Expected string for 'f.xs[1].t', got number (found on the failure path only, carrying the whole list as received). A dictionary-default member says array of string, not array. Message change: code that matched the old list-level wording for an element failure will see the element-level one.
• A checked return (:?) is checked like a parameter (#3408). Behaviour change, toward correctness: a :? function returning an object with a wrong member now gets an error back. Named Types were resolved only for parameters, so :? Book, :? [Book] and :? { top: Book } checked nothing; and the return check tested only the outer kind, so even :? { top: 0 } returned { top: 'x' } unrefused. Both are fixed; a key written key = value (a return default) may still be absent, :! is still the opt-out, and a union with a member that cannot be resolved stays unchecked, as for parameters.
• An array-pattern parameter is one parameter, checked as one (#3497). g([a, b], k) had no metadata entry for its array parameter (it listed only k), so position-based readers misaligned; a TS-style annotation ([a, b]: [0, 0]) was erased unchecked, and null THREW. It is now named, checked as an array (against its annotation when there is one), then destructured, like an object pattern (#3443); the .d.ts declares it.
• A Type with an object or list example is aliased to its shape in the .d.ts (#3482). export Type R { example: { x: 0, y: 0 } } was declared type R = Record<string, any>, and a list example any[], so TypeScript consumers got no member types for any parameter of such a Type. The declaration finder's patterns stopped at the first , or }, and the alias was guessed from the example's first character. The example is now read as an expression (acorn decides where it ends) and inferred as a parameter's example is: type R = { x: number; y: number }. Class methods with a list example now agree with functions (string[], not any[]).
• Pushing a release tag no longer re-runs the full suite it was attested on (#3445). release:ready attests every lane on the tagged tree; the pre-push hook re-ran ~8 minutes of suite anyway, git's connection to the remote sat idle until GitHub dropped it, and a green hook ended in exit 141 with the tag not pushed. The hook now accepts a valid attestation (scripts/attested.ts), and says what a 141 means if a long run still ends in one.
• wrap(fn, fn.__tjs) works (#3496). wrap is documented to take a function's __tjs metadata and refused every call given it, wrap((a, b) => a + b, add.__tjs)(1, 2) included: its checkType understood kind names ('number') and Type objects, and emitted metadata carries transpiler descriptors ({ kind: 'integer' }). checkType now checks a descriptor strictly, every kind handled. A named Type cannot be resolved from metadata alone, so it passes and the flight recorder says so once per path. And wrap treats a single object argument as named parameters only when the metadata says the function destructures it: emitted __tjs now carries destructured: true for a lone destructured parameter. It used to GUESS from the call, which read area(r: { w, h }) called with { w, h } as r: undefined.
• The .d.ts declares a destructured parameter as one parameter (#3444). export function area({ w: 0, h: 0 }) was declared area(w: number, h: number), so a TypeScript consumer was told to call area(2, 3), which the runtime refuses, and the correct area({ w: 2, h: 3 }) did not type-check. It is now area({ w, h }: { w: number; h: number }): a member with a default is optional, a default for the whole argument makes the parameter optional, and the TypeScript spelling keeps its declared type (({ x }: R)).
• A destructured parameter beside others is one parameter, checked as one (#3443). BREAKING (toward correctness), metadata: function area3({ w: 0, h = 2 }, k: 0) listed its parameters as w, h, k, flattening the pattern's members in among the positional ones, so everything reading __tjs.params by position misread it (the .d.ts declared three parameters; callback-shape checks compared the wrong positions). It is now { w, h }, k: one entry, keyed by its binding pattern and typed as the object it destructures. A lone destructured parameter's metadata is unchanged (its members, with isDestructuredParam). The parameter itself now behaves like a lone one: named, checked as an object (a monadic error passes through; null is a returned error, no longer a throw; a failing member carries the object as received), then destructured, and the TypeScript spelling (x, { b }: { b: 0 }) is checked in any position instead of erased. An ARRAY pattern is now one parameter too (#3497).

[0.14.0-rc.8] — 2026-10-20

On the rc dist-tag. A type error now carries what you passed (err.received), destructured parameters are checked as the one argument they are (in both the TJS and the TypeScript spelling), converted TypeScript gets native TJS for them, and runtime errors name the right line again after a declaration block. Pin 0.14.0-rc.8 exactly to test it.

Read this first: what changes since rc.7

• A destructured parameter returns an error instead of throwing for null or a missing argument, and passes a monadic error through. Code that caught the throw gets a value.
• ({ w, h }: Shape) is now checked. Converted TypeScript under TjsStrict that passed ill-typed objects to a destructured parameter now gets errors back.
• AJS refuses ({ a }: T = d), as it already refused ({ a } = d). It used to accept it and silently drop the default.

Added since rc.7

• A type error carries the argument it refused, as err.received. It said only "got object", so the receiver could not see what it got: in particular an Error the caller made, which a typed function refuses (only TJS's own errors pass along) and which was then lost. When a member fails, received is the whole argument ({ width: 3 } for a missing r.height), not the member's undefined: the error is that the thing passed was not a rectangle. A destructured parameter (({ w: 0, h: 0 })) is the same: see below. received is non-enumerable, so logging or JSON.stringify of the error never walks a large or cyclic value. Set at every site: the inline runtime in emitted code, the global and per-instance typeError, and the callback-shape checks. The refused value is held by the error, so the flight recorder's ring (the last 64 errors) keeps it reachable until the ring wraps or __tjs.clearRecords(); mind that for large or sensitive payloads.

Fixed since rc.7

• ({ w, h }: Shape) is checked, and fromTS writes native TJS for it where it can (#3434). The TypeScript spelling of a typed destructured parameter had its annotation erased, behind a comment claiming it was "captured for metadata"; nothing captured it, so d({ w: 'x' }) returned NaN. It is the shape fromTS emitted for every typed destructured TypeScript parameter, so converted code checked none of them, even under TjsStrict. Now the argument is checked against Shape (an object shape, a named Type, a union) and then destructured, renames included, and a default written after the type (({ a }: T = {})) is kept, where it used to be erased along with the type. fromTS now emits ({ w: 0.0, h: '' | undefined }) for an inline type whose members native syntax can hold, and keeps : Shape for a named type, a rename or a pattern default (in a pattern, { w: R } is a RENAME, so a pattern cannot name a type).
• A destructured parameter is checked as the argument it destructures (#3432). It is one parameter expecting an object, and now behaves like every other: a monadic error passes through unchanged, and anything else that is not an object (null, nothing, a string, an Error you made) is a returned type error carrying it as received. Before, the destructuring happened in the parameter list, before any check could run: null or a missing argument THREW ("Cannot destructure"), an error passed in became a new "got undefined" error, and a member's failure could not name the object. BREAKING, toward correctness: code that caught that throw now gets an error value. The emitted function takes __tjs_arg and destructures it in the body after the checks; .length, defaults, extra arguments, this and arguments are unchanged (dialect: 'js' is untouched).
• A runtime type error names the right line after a declaration block (#3404). A Type, Generic, FunctionPredicate, Union or Enum declaration became one line of output, so every line below it moved up: a function on line 5 under a four-line Type reported <source>:2:…. The rewrites now keep the source's line count (lineKeeper).

[0.14.0-rc.7] — 2026-10-19

On the rc dist-tag. TJS now works with tosijs models (typed functions, ==, truthiness and given see through tosijs proxies), live pages check signature examples, list parameters check their elements, and the TJS book's Part I, "Learn to Program", is complete. Pin 0.14.0-rc.7 exactly to test it.

Read this first: what changes since rc.6

• A list parameter checks every element against a named Type or an object shape ([Book], [{ title: '', pages: 0 }]). Code that passed a malformed element to one now gets an error value back.
• Checks accept a tosijs proxy as the value it wraps. Additive for code that never meets tosijs; nothing else is unwrapped.

Fixed since rc.6

• A list parameter checks its elements against a named Type or an object shape (#3403). books: [Book] was "array of any" and accepted [5]: a declared Type was resolved for a lone parameter and for union members, but not inside a list or an object member. And [{ title: '', pages: 0 }] checked only that each element was an object. Both are now checked element by element (members, nested shapes and nested lists), the same order of work as [0.0], which was always checked. Code that passed malformed elements to such a parameter now gets an error value instead.
• Book | null admits null again wherever a declared Type is promoted (rc.7 review): as a parameter, a list item ([Book | null]) and an object member ({ top: Book | null }). Promotion replaced the type with a bare declared one and dropped the | null; the top-level case had done so since before rc.6.

Added since rc.6

• TJS works with tosijs models. tosijs hands back proxies (calculator.x wraps a number). JavaScript uses them dynamically; TJS did not, which is exactly the friction it exists to remove: a typed press(state: { x: 0 }) said "expected integer, got object" for a model whose x was a good number, calculator.op == '+' was false, and if (calculator.op) was true for an empty op. Now parameter checks, Type.check (and Generic/Enum/Union), ==, truthiness, given and the test harness's expect all see the value a tosijs proxy wraps, while a function still RECEIVES the proxy, so writing to it updates the model and the page. Recognised by tosijs's Symbol.for('xin-value') (no dependency on tosijs); a Date, a valueOf object or a boxed primitive is checked as before. Checked with real tosijs proxies on the doc site. Not yet: a proxy held INSIDE a plain object or list ({ a: calculator.x }, [calculator.x]), an overloaded function's dispatch, and a :? return check still see the proxy and refuse it. Pass the model or the member directly, as the book does.

• tjs().testRunner checks signature examples (#3375). A return example (greet(name: 'Ada'): 'Hello, Ada!') is a test the build runs, but the runner tjs() returns, which hosts such as tosijs-ui run for live examples, carried only test blocks, so a wrong example was never reported on a live page. It now carries them too, compared with the shared expect().toEqual. An example whose call throws is inconclusive (PRINCIPLES.md): it goes to a new inconclusive list in the runner's result, never to results, which hosts count. Async examples are not checked, as at build time. A differential test requires the page and the build to agree on every signature example in the docs.

Documentation since rc.6

• The TJS Programming Language, Part I, "Learn to Program", is complete (chapters 0 to 11): values and names, functions, checking your work (tests, taught right after functions), decisions, repetition, lists, things with parts, responding to the reader, a calculator (XY registers, a tested brain driving a tosijs model) and when things go wrong. Every example runs on tjs.tosijs.net and ends in tests the reader can see pass, and doc-snippets.test.ts runs them with stand-ins for the page.

[0.14.0-rc.6] — 2026-10-17

On the rc dist-tag. One breaking change: || in a type is a compile error (a union is spelled |). Plus a fix for annotations on nested functions, and documentation whose every example now runs its tests. Pin 0.14.0-rc.6 exactly to test it.

Read this first: what breaks since rc.5

• || in a type is a compile error, in TJS and AJS alike. x: '' || null never meant "string or null" (it rejected null); write '' | null. The error names the corrected spelling. A default (x = a || b) is still JavaScript, but its type is still read from the left side, so x = '' || null is a string parameter that defaults to null and then rejects it: write x = '' | null for a nullable string with a default.

Changed since rc.5

• BREAKING: || in a type is a compile error; a union is spelled | (#3148). x: '' || null and ): T || null were taught by three docs as "string or null" and never meant it: an example's || is JavaScript's OR, so the type was only the left side and null was REJECTED. Every type position (an annotation, an object member, an array element, a union member, a return annotation) now fails with the corrected spelling: `'' || null` reads as JavaScript OR … Write `'' | null` (one bar). This covers optional annotations (x?:) and AJS too, and the error points at the annotation's own line. A default (x = a || b) is still JavaScript (see "what breaks" above). The docs now use |, and a docs-tombstones row keeps it.

Fixed since rc.5

• An annotation on a function inside an expression is no longer a default value (#3147). items.map((x: 0) => x * 2), a || ((x: '' | null) => x), { f: (x: 0) => x } and every other arrow or function expression that is an operand, argument, array element, property or return value emitted (x = 0) => …: the example became a runtime default, so a missing argument was silently 0 (or, for '' | null, the number 0). The annotation is now stripped, as it already was for declarations, named arrows, methods and class fields. These functions are not validated yet; that is a larger change.

Documentation since rc.5

• Every book snippet runs its own tests. Twelve snippets across TJS-SYNTAX, TJS-FOR-JS, TJS-FOR-TS and the TJS guide wrote a return example as a type (greet(name: 'World'): '', which TJS checks as a worked example: greet('World') must return ''), or used the || union that never worked. Each now has a real worked result or :! (type only), and doc-snippets.test.ts runs every doc's tests: its opt-in list is gone.
• TJS-FOR-JS described the return test wrongly. It said TJS checks the result "is a number"; it checks the result equals the example (deep equality). It now says so, and shows :! for a type-only return.
• The TJS Programming Language opens with "Learn to Program", chapters 0 to 2 (How This Book Works, Hello Screen, Values and Names): programming from scratch, in the page, each example ending in a test the reader can see pass. A draft; more chapters follow.

[0.14.0-rc.5] — 2026-10-09

On the rc dist-tag. == and != now group their operands as JavaScript does (the rewrite is an AST pass), tjs() returns its runtime prelude separately for REPL hosts, and npm links to the documentation site. Pin 0.14.0-rc.5 exactly to test it. This section is what changed since rc.4; the notes for 0.14.0 as a whole, rc.1 to rc.4, are under the 0.14.0 heading below.

Read this first: what changes since rc.4

• == and != group their operands as JavaScript does. Expressions the old rewrite grouped wrongly now compute what JavaScript would: await f() == 3 compares the awaited value, a & b == c is a & (b == c), and nested or chained == work. Code that relied on the old grouping gets a different, correct, answer. Everything else is additive.

Added since rc.4

• tjs() returns its runtime prelude separately: prelude (the inline-runtime setup at the head of code, or '') and body (code without it). code is unchanged. A REPL host evaluating one line needs them apart: with the setup in front, a declaration evaluated to the setup's last assignment, and a line needing await had no value (tosijs-ui's console, #3134). Evaluate prelude, then body, in one scope.

Fixed since rc.4

• npm, the README and llms.txt name the documentation site (tjs.tosijs.net) as the project's home. package.json had no homepage, so npm linked nowhere, and the README and llms.txt sent readers only to the older playground. A test keeps the three in agreement.

• == and != group their operands as JavaScript does. The rewrite to Eq/NotEq was a text scanner that re-derived operator precedence by hand, and got it wrong in several shapes, all in released versions:

  • await f() == 3 compared the Promise: false when f() resolved to 3. Reported by tosijs-ui's review of its dialect-aware console.
  • (a == b) == (b == c) emitted garbage that threw at run time, and a == b == c did not parse.
  • a & b == c (and |, ^) grouped as Eq(a & b, c); JavaScript reads a & (b == c).
  • void a == b became void Eq(a, b).

  The rewrite is now an AST pass in the emitter, beside the truthiness rewrite (bool-coercion.ts), so acorn decides the grouping. A differential test generates 928 expressions across the precedence table and requires TJS to agree with JavaScript (equality-precedence.test.ts). Test and mock bodies that use await now get the truthiness rewrite too: their wrapper did not parse await, so such a body was skipped.

  Inside a wasm {} body, == and != stay JavaScript's, which is what the compiled WASM does (x != x is the NaN test), so the body and its implicit JavaScript fallback agree. An explicit fallback {} is the author's own code and has TJS semantics, as before.

0.14.0 — unreleased

Release candidate: 0.14.0-rc.4 (2026-10-07), on the rc dist-tag. WASM blocks mean what they say (a block that cannot compile is a compile error, and the WASM path and the fallback give the same answer), predicate => is removed, and the deprecated unsafe prefix no longer escapes var or eval. Read "what breaks since rc.3" first. Pin 0.14.0-rc.4 exactly to test it.

Read this first: what breaks since rc.3

Each of these breaks toward correctness; none has a compatibility switch.

• A wasm {} block that cannot compile stops the transpile (it used to ship its fallback {} with a warning). Fix the block, or drop the wasm wrapper. The error names the construct, the function and the line.
• % and bitwise operators on f64 operands in WASM are refused; / is now JavaScript's division even for two i32 operands (Math.trunc(a / b) for integer division).
• predicate => expr is a compile error: write predicate(x) { return expr }.
• unsafe var and unsafe eval(…) are refused, as the docs already said: there is no escape for either. unsafe itself is deprecated; LegacyDate(x) replaces unsafe new Date(x), and new X(…) on a class declared in the file needs no escape (drop new).
• Emitted JavaScript has a different shape. Test blocks, doc comments and the hashbang are blank lines in the output rather than removed, so line N of the output's body is line N of the source. Anything matching exact emitted text will see different line numbers.

Changed since rc.3 — a wasm {} block means what its fallback {} means

Found by reviewing the WASM QuickStart, whose first example printed undefined (it promised 7). Each is pinned by src/lang/wasm-semantics.test.ts, which runs functions through WASM and through the fallback and requires the same answer.

• A statement that computes a value and throws it away is a compile error that names the fix (write \return a + b`). A block returns only with return, as in JavaScript; a bare final a + bcompiled to a function with NO result. ASSUMPTIONS L6 decided this in 2026-08 and it was never built. It found the same bug inexamples/wasm-demo.tjs(three functions returningundefined) and in the prose of the wasm-basics` example.
• / is JavaScript's division in a wasm block, even with two integer operands (7 / 2 is 3.5, not 3). The old integer-division warning is retired: there is nothing left to warn about.
• let is block-scoped: two sibling for (let i …) loops compile, instead of colliding ("Duplicate local declaration") and silently running the fallback.
• The WAT comment says (result f64) only when the function returns a value.
• An unsafe (!) function no longer warns that a typed-array parameter "could not be resolved to a runtime type": it asked for no checks.
• A wasm block that cannot compile is a compile error (BREAKING for code that relied on the quiet fallback). wasm { } is a request for WASM; an unsupported construct used to ship the block's JavaScript fallback {} with a warning. The error names the construct. fallback {} remains for a RUNTIME that cannot run WASM. Turning this on found four test fixtures and a DOCS-TJS example that had never compiled (each passed by running its fallback), the DOCS-TJS page teaching a wasm (…) form that was never implemented, and the bugs below.
• One bad block could take WASM away from a whole file. % (or a bitwise operator) on f64 operands emitted an i32 instruction on f64 values; the module was invalid, so every block in the file ran its fallback while each reported success. It is now refused, naming the operator, and every emitted module is validated, so a future codegen bug of that kind is a compile error rather than a module that fails to load.
• f32x4_load/f32x4_store need a typed-array parameter, as arr[i] did: on a plain array they compiled and then threw a WebAssembly RuntimeError on the first call.
• A file with WASM loads where WebAssembly is unavailable (iOS Lockdown Mode): its memory was created unguarded at load, so a file whose blocks use typed arrays threw before any fallback could run. Its blocks now run their fallbacks and wasmBuffer hands out ordinary typed arrays.
• DOCS-WASM documents i32 (in wasm function declarations) with its measured semantics: truncating and wrapping at the call, wrapping + - *, a throwing % 0.

Fixed since rc.3

• Compile errors name the right line. extractTests cut test blocks out, collapsed blank lines and trimmed, so every error below a test block or a few comment lines pointed at the wrong line (src/lang/diagnostic-lines.test.ts).
• The WASM QuickStart is rewritten: every example asserts its result and compiles to WASM (checked), and it states the supported subset and that anything else is a compile error. DOCS-WASM no longer lists Math.sin/cos/log/exp/pow as supported; a block using one does not compile.
• The TJS-vs-TypeScript page shows what each compiler actually did: what the program printed, or its compile error quoted verbatim (checked by differences.test.ts), instead of a one-row table where rejected sat where a printed value would go.
• Diagnostics no longer recommend the deprecated unsafe marker: var and eval have no escape, a raw Date is LegacyDate(x), and new P simply says to drop the keyword. The docs no longer teach it either (a docs-tombstones row keeps it that way), and the CodeMirror integration no longer offers it as a completion; it offers LegacyDate.
• unsafe var and unsafe eval(…) compiled although every diagnostic said there was no escape: the checks ran on source with the unsafe spans masked. They now run on the raw source. dialect: 'js' still accepts both (TJS ⊇ JS).
• wasm is TJS syntax only. Under dialect: 'js', return wasm followed by a block on the next line (legal JavaScript, by ASI) was rewritten and then refused.
• The wasm compile error wins over a failing signature example: the block is compiled before the transpile-time tests run, so % on f64 operands no longer reports "signature example is inconsistent… got undefined".
• Each failing wasm block is reported at its own line, and a wasm function by name. Two blocks sharing a first line both pointed at the first, and a repeated body pointed at the previous block's fallback {}.
• wasm function f(x: 0.0): 0.0 parses. The return annotation accepted only an identifier (: f64), so the idiomatic numeric example was passed through as JavaScript and failed with "Unexpected token".
• A WASM module that is invalid with no single block responsible fails every block (a compile error) rather than being returned as success.
• stripModuleSyntax parses instead of using line regexes: a template literal with a line starting export survives, and top-level await and imports are handled. It now shares its implementation with stripExports.
• Blanked regions cost lines, not bytes. The padding that keeps offsets during the rewrite is dropped from the output (trailing whitespace only, never inside a string or template), so 100 lines of doc comment no longer triple a module's size.

Added since rc.3

• stripExports from tjs-lang/lang and tjs-lang/browser (#3109): turns a module into a script body by dropping export and removing imports, literal-safely. tosijs-ui's live examples need it to run a module's code inline.

Removed since rc.3

• predicate => expr is gone. It saved only { return } over predicate { return expr } and was a third predicate spelling to learn. It is now a compile error that names the replacement, in Type and Generic alike (so it can never be silently ignored and accept every value). It never worked in a release: in 0.13.x it was accepted-and-ignored, then refused; only the 0.14 release candidates ran it.

Release candidate: 0.14.0-rc.3 (2026-10-06), on the rc dist-tag. It adds the doc-site work below: every playground example runs on tjs.tosijs.net, and four library fixes it found. 0.14.0 final follows once the books (the site's four volumes) are reviewed as self-hosted tutorials. Pin 0.14.0-rc.3 exactly to test it.

Found by sweeping every page of the doc site (tjs.tosijs.net) with a headless checker; the full account is docs/reviews/0.14.0-site-readiness.md.

Fixed since rc.2

• tjs(source).testRunner runs tests with TJS semantics. It was built from the raw test bodies, before the == / boxed-primitive / extend rewrites tjs test applies, so a caller running it (tosijs-ui's live examples) reported passing tests as failing. A module whose only == was in its tests also left Eq out of its inline runtime.
• extractTests ignores /# … #/ doc comments itself. It is public, and on raw source an apostrophe in a doc block's prose opened a string in its scanner, so every test after the block vanished (37 playground examples open with one); a test quoted inside a doc block was extracted, which TJS-SYNTAX.md says is inert.
• The import resolver loads packages that have dependencies. jsDelivr's +esm bundles import their dependencies by root-relative path ("/npm/acorn@…/+esm"), which resolved to OUR origin and 404ed. rewriteCdnBody (new, exported) points every CDN body's root-relative imports back at that CDN, literal-safely; rewriteEsmShBody delegates to it and now also handles minified output.

Added since rc.2

• generateDocs / generateDocsMarkdown in tjs-lang/browser, which tosijs-ui's built-in tjs dialect feature-detects to show an example's Docs tab.
• bun run preview:site (the deploy build, served locally, not published), scripts/check-site-examples.ts (does every live example run and show something), and scripts/build.ts --only <targets>.

Release candidate: 0.14.0-rc.2 (2026-10-05), on the rc dist-tag (npm i tjs-lang@rc). It carries everything since rc.1 below: the membrane rebuilt to construct its own copy (JSON data plus Date, no structuredClone), capability-boundary refusals that end the run, IO atoms that must declare an input schema, the method table, the linear regex engine, and the per-atom timer changes. Pin 0.14.0-rc.2 exactly to test it.

Release candidate: 0.14.0-rc.1 (2026-09-26), on the rc dist-tag (npm i tjs-lang@rc); latest stays on 0.13 until 0.14.0 is final. It carries everything below, including the admission work from the final re-reviews (the 8KB source cap, the deprecation of vm.run(source), and every run option read once and checked). ^0.14.0 does NOT admit a prerelease, so pin 0.14.0-rc.1 exactly to test it. Published through the OIDC workflow, vouched for by release-attestation.json.

Since rc.1 — tosijs-schema floor raised to ^1.12.0 (#58). tjs-lang unwrapped schema builders by duck-typing (x?.schema ?? x, 'schema' in x) in eight places, so a value that merely HAD a schema key was read as a builder: a Type example such as { label: '', schema: { version: 0 } } had its schema field used as the type, and a JSON Schema with a stray schema: true became accept-all. The same check sat in the VM's guest-facing Schema.isValid / Schema.response. tosijs-schema 1.12 brands builders (isBuilder); every site now asks it. The old ^1.5.1 range was also floating fresh installs onto 1.12 (four breaking validation releases later) while the code assumed 1.5, so the range now names the version the code is written against. The LLM batteries' output schema is back to named fields ({ role?, content?, tool_calls? }) via .open, still admitting provider additions such as reasoning_content, where s.record(s.any) rejected nothing at all.

Since rc.1 — AJS AST format v2: a bare string is always a literal (board #1860). v1 stored a literal string and a variable reference the same way, and the VM read it as a reference when a variable by that name was in scope: let x = 5; const s = 'x' made s 5, ['x', 'z'] became [5, 'z'], and input that chose variable names could redirect a literal. The transpiler now writes $ajs: 2, where every reference is an explicit node and a bare string is data; an object literal shaped like a VM node ({ $expr: … }) stays data too. A while body is now a block, so a const in it no longer fails on the second iteration (#2343). Compatibility: v1 ASTs — every stored procedure, everything the fluent builder writes (it still writes v1; its strings mean references) — keep v1 meaning, read by the same VM; an older VM refuses a v2 AST by version, by name. Frozen by golden fixtures for both versions.

Since rc.1 — custom atoms receive VALUES. An atom defined with defineAtom and written like the documented example (async ({ url }) => fetch(url)) received the variable's NAME when a program passed one — echo({ v: local }) got "local" — in every earlier release. The VM now resolves inputs before calling it, and runs it under a context where resolveValue is the identity: an atom written the old way, calling resolveValue on its own inputs, keeps working and cannot re-evaluate guest data shaped like { $expr: … } as code. Dynamic cost and timeoutMs functions see the same resolved input — so a cost function written against raw nodes (testing for $expr, or for a variable name) now receives values and must be updated. Steps an atom builds and runs itself — on the context it received, or on a scope from createChildScope(ctx) — run normally under either setting: the VM never runs a step under the resolved-inputs context. Running them on a COPY of that context, or after replacing its state, is refused by name rather than silently writing the caller's scope. An atom that takes steps AS INPUT must pass { resolveInputs: false }, or its steps arrive evaluated as values.

Since rc.1 — the VM's budgets are invariants, not patches (docs/vm-budgets.md). Five rc.2 review rounds in a row found one more place where guest code could allocate or hold memory that neither fuel nor maxHeapBytes saw — each fix closed one place and the next review found another. They are now three rules, each checked by a test that probes behaviour:

• Nothing allocates before it is charged. Every operation whose allocation depends on runtime data bounds it from its INPUTS and charges fuel and heap first. 'x'.repeat(5e8) built 1GB and then charged; Array.from({ length: 3e8 }) charged nothing — any guest could take the host's memory for under one unit of fuel, no capability needed.
• Every byte that outlives its step is charged where it lands — a bind, an in-place insertion (push, fill, a Set's add), a memoize store, a loop's results.
• Everything holding guest values while guest steps run is measured — scopes, memo caches, arguments, and the arrays a loop holds. Before a run fails, the VM measures the live heap from those (each object once, every slot a pointer) plus the in-flight allocations of the steps still running, and fails only if THAT is over; the error reports it.

The guest method allowlist is now a table, and a method without a declared allocation bound is not callable. Gone (breaking, though none of them could be used well): the legacy HTML string methods (bold, link, …), callback methods that guest code has no functions to pass to (forEach, every, flatMap, … — use for…of or map/filter/find/reduce), matchAll and the array keys/values/entries (they returned host iterators), the __lookupGetter__ family (it returned a host function), and toString on a builtin function — Date.toString() returned the host's SOURCE CODE. A long string held under several names still counts once per name (fails closed). With everything since rc.1 below, the VM grew ~30%: tjs-lang/vm-ast is 37 KB gzipped, tjs-lang/vm 88 KB (68 KB at rc.1); the regex engine is about 7 KB of it, the closed schema dialect and data-only Schema about 2 KB.

Since rc.1 — $predicate runs only source the host trusts (breaking). A predicate compiles to native JavaScript, and a syntactic verifier cannot make hostile JavaScript safe: one review round found five more routes from a "verified" predicate to the host's regex engine (['(a+)+$',''].reduce(RegExp), a method passed as a callback, a tagged template, a class shadowing a name, overwriting a field). So the $predicate paths — createPredicateEvaluator (what tjs-lang/schema installs), compilePredicateSchema, validatePredicateSchema — run a source only if the host registered it with trustPredicate(source) (tjs-lang/css's schema builders register theirs), or passed trustAllPredicates: true. Anything else fails closed, saying why. Migration: wrap your own $predicate sources in trustPredicate(…); never trust a source that arrived as data. Running untrusted predicates on the AJS VM, whose surface is a closed table, is planned and will lift this. A source trusted after a first refusal runs at once (the evaluator checks trust on every call); its cache is bounded. In predicates, a string-literal pattern (s.search('@')) runs on the metered engine rather than being refused.

Since rc.1 — a Set, a Date and a regex are DATA (breaking). A guest Set is an array of its items (s.size is its length, by every route; Array.isArray(s) is true), and a Date is a frozen object of its fields — value (ISO), timestamp, year, month (1–12), day, hours, minutes, seconds, dayOfWeek — all in UTC, so a program's output does not depend on the host's time zone (fields, add and format used local time). A Date has ONE form: guest JSON.stringify, a capability's input and the run result all see the object, where rc.1 wrote the ISO string — write d.value for that. Date(x) takes every form a date takes: a guest Date, a stored one (an object with a numeric timestamp, which is what a Date becomes after JSON, a store or a capability), a number of ms within the Date range, or a string that parses; Date.parse is the same door. format's keywords ('ISO', 'date', 'time') are case-insensitive. A regex is an object of its source and flags. Their methods are the VM's, dispatched by kind, so a value never carries a function: the sealed wrappers and the run-result conversion that kept their methods away from guest code are gone, with the four defects the seventeenth re-review found in them (a recursive conversion that a deep or self-containing Set crashed, a __proto__ key, an uncharged walk of an Object.assign target, conversion only at the result). push and Object.assign into a Set are refused (use its methods), and reading a method as a value (const f = s.add) is refused as it is on a string. An in-place insertion is now checked and charged BEFORE it happens, so a refused value is never left behind for a catch to reach. agentRun hands a sub-agent exactly what it was passed: it resolved the input twice (a string that named a caller variable became that variable's value) and evaluated an inline sub-agent's expressions in the CALLER's scope. Sub-agent and runCode arguments are null-prototype, like vm.run's. pick again copies any own data property (pick(arr, ['length'])), never a function. An AST's inputSchema is validated before the run's timer exists, so it is now capped on the product — 1M argument paths and 1e8 schema-node × path steps (about 0.6s) — and refused past either: validate in the host, or pass smaller arguments. A guest-program fuzzer (src/vm/guest-fuzz.test.ts) now checks the invariants over random programs.

Since rc.1 — httpFetch follows no redirects and admits only known headers; the VM never writes to your capabilities (security, breaking). In allowlist mode httpFetch compared only the hostname, so on Bun or Deno file://<allowed-host>/etc/hosts read a host file. Every request is now admitted by one rule: the scheme must be http: or https: in both modes, then the allowlist, and without an allowlist nothing is fetched.

• No redirects are followed. A redirect (301, 302, 303, 307 or 308 with a Location) comes back to the agent as data, { redirect: true, status, location }, with location resolved to an absolute URL, and fetching it is a new request, admitted like any other with its headers and body chosen afresh. A 304 Not Modified, or any other 3xx, is an ordinary response. In a browser location is null, because the browser hides it. Four review rounds each found another redirect rule the VM had re-implemented wrong (credentials re-sent, then the body re-sent on 307/308, then on 301/302 for PUT, PATCH and DELETE), so the built-in client stopped following redirects. A host that wants them followed supplies a fetch capability.
• Guest request headers are a closed list: Accept, Accept-Language, Authorization, Cache-Control, Content-Language, Content-Type, the If-* validators, Range, User-Agent, X-API-Key, X-Request-Id, X-Correlation-Id and X-Requested-With. A host adds names for a run with context.allowedRequestHeaders, as it does with allowedFetchDomains. Anything else is refused by name, never dropped, and X-Agent-Depth is refused even if a host lists it. A guest Host was sent as given, and on Bun behind a Host-routing proxy it reached virtual hosts outside the allowlist. A denylist kept growing, and so did an "X- except the routing ones" rule (X-Envoy-Original-Dst-Host, X-Originating-IP, …), so neither survived.
• A host's own fetch capability receives the agent's request after the same admission. The request's SHAPE is admitted on every path, always: http:/https: only (file:// read a host file through the documented safeFetch on Bun), the method and the headers. Its DESTINATION (allowedFetchDomains, with ports) is enforced on every path when set; without it, a host fetch owns the destination. Redirects and credentials are then the host's; the documented safeFetch refuses redirects and omits credentials.
• Eval and SafeFunction take a host-only fetchPolicy ({ domains, methods, headers }), forwarded to the run and never visible to guest code. Their context option is guest variables, so before this they could not allow a POST at all.
• Migration, hosts with their own fetch: an agent's POST, PUT or DELETE now needs context.allowedFetchMethods (or fetchPolicy.methods), and headers outside the closed list need context.allowedRequestHeaders (or fetchPolicy.headers).
• The built-in httpFetch is a demonstration capability, highly constrained by default (Tonio). A real deployment supplies its own fetch. Methods: GET and HEAD by default; a host enables more for a run with context.allowedFetchMethods. CONNECT, TRACE and TRACK are never admitted. Ports: an allowedFetchDomains entry admits the scheme's default port only, unless it names one (api.example.com:8443); matching the hostname alone admitted every port of an allowed host. One admission, every path: the agent's method and headers are admitted the same way when a host's own fetch sends the request, so a host that needs Cookie or PROPFIND declares it.
• No browser credentials: cookies and HTTP auth are not sent (credentials: 'omit'); a custom fetch can opt in.
• Bounded body: the body is read under membraneMaxBytes (a larger declared Content-Length is refused before reading) and aborted once the cap is exceeded, not buffered whole first.

Separately, vm.run used to write its default in-memory store INTO the capabilities object you passed, so two runs sharing that object shared the store, and a frozen object made the run throw. The VM now uses your capabilities object exactly as passed: it is never copied, wrapped or written, so a class instance with private fields or getters works as it always did.

• The default store belongs to the run and is used only when your object has no store.
• Custom atoms: read the store through storeOf(ctx), not ctx.capabilities.store, which is now the host's own object and undefined when the host gave none.
• Each run, nested runs included, has its own default store.
• A non-object capabilities is refused.

In AJS, an atom input named op, result, resultConst or resultAssign is refused at transpile time: it was silently read as a step control field.

Image URLs follow the same rule as a fetch, in llmVision and in llmPredictBattery message arrays: the model server may fetch an http(s) image_url itself. Inline base64 image data passes (data:image/… or data:application/octet-stream, parameters allowed, which is what httpFetch's dataUrl returns). http(s) passes only against the run's allowedFetchDomains, and is refused without one. What reaches the model server is the ADMITTED, normalised URL: a backslash-userinfo URL that one parser reads as an allowed host and another as 169.254.169.254 is never forwarded as written. llmPredictBattery takes a string or a message array, which the VM REBUILDS from a closed shape ({ role, content }, content a string or text/image_url parts; any other part type, such as video_url, is refused) and forwards with the admitted image URLs; the shipped battery sends it as the conversation itself. The { text, images } vision form is refused there (use llmVision). With an allowlist set, a fetch URL that is not absolute is refused, because it names no host to check. A NETWORK-PATH reference (//host/x and its backslash forms) is refused on every path, since it borrows the page's scheme. A host's fetch always receives the ADMITTED, normalised URL, never the raw input. A policy list that is not an array of strings is refused (a string was read one character at a time). Rebinding a value already in scope (a per-iteration let p = o) costs one pointer again: in rc.2's heap accounting it re-measured the whole value, so a loop was quadratic in fuel where rc.1 was linear.

Since rc.1 — an outbound membrane on capability calls (security, breaking for some custom atoms). What an IO atom hands a capability is now a budgeted deep COPY of its resolved input, checked against the input schema the atom declares (Tonio). The inbound membrane already did this for what a capability returns. The outbound direction kept being found one site at a time:

• a system or prompt that was really an array of video_url parts;
• tools and responseFormat forwarded live, so a guest that caught a timeout changed them before a slow host serialised them;
• raw URLs.

It applies to every core, battery and custom IO atom whose inputs the VM resolves, and fails by refusing ('<op>': its input does not have the shape the atom declares). Embedders: a custom IO atom now receives plain-data copies, and is called only with inputs matching its declared schema; a storeGet key must be the string it declares. An IO atom with resolveInputs: false should pass what it hands a capability through the newly exported egressValue. agentRun's capability route and cache now do (both handed the host live guest objects), and a cache key must be a string.

The copy is paid for. Its walk is budgeted by the run's remaining fuel and by membraneMaxBytes, which now caps both directions (it was documented for returns only). The copy is charged as an allocation before it is made, and a call that is refused is charged for the walk it caused. The first version of this membrane charged nothing, so a loop over a large value used about 100× the CPU for the same fuel (cumulative review 5).

cache and memoize require a key (breaking). A key-less block derived its key by calling the hash atom's step wrapper, which returns nothing, so every key-less block was stored under undefined and returned ANOTHER block's result; a cache entry is shared across runs for 24 hours by default. Keying by a digest of the steps is no better: the steps are the same when the data they read is not. Only the author knows what a result depends on, so the builder's key is now required and the VM refuses a block without one. A store written by an earlier version may hold a stale cache:undefined entry; it is safe to delete. A key larger than membraneMaxBytes is refused like any other capability input, and a result too large to cross fails the step rather than being returned uncached.

IO atoms declare their inputs (breaking for embedders). defineAtom refuses an IO atom (effects: 'io', the default) with no input schema (use s.object({}) for none), or whose input schema contains pattern/patternProperties: the outbound membrane validates every call against that schema, so a pattern there ran on the host's regex engine over guest-chosen strings, outside fuel. Check patterns in the atom's body. (The JSON Schema direction is Pattern: docs/pattern.md.) The schema is admitted as a frozen plain-JSON COPY when the atom is defined, and every call is validated against that copy: a pattern is refused whatever its value (a RegExp included), any other non-JSON value is refused rather than converted, and changing atom.inputSchema afterwards changes nothing. An atom tagged io after definition is admitted at its first call. Migration:

defineAtom('ping', undefined, s.any, fn)               // refused
defineAtom('ping', s.object({}), s.any, fn)            // takes nothing
defineAtom('lookup', s.object({ id: s.string.pattern('^[a-z]+$') }), …) // refused:
defineAtom('lookup', s.object({ id: s.string }), …)    // check the id in the body

A refused outbound copy is billed for the work its walk did, whatever refused it, never more than the fuel present, and keeps its own error unless fuel genuinely ran out. Round 31 billed only a refusal for size (a depth refusal after a megabyte was free); round 32 billed the whole budget on top of what the copy had already been charged (cumulative reviews 6 and 7).

A refusal at the capability boundary that is a bug ends the run (breaking). An atom call whose input does not match the atom's declared schema, a value refused on its way out to a capability (too large, too deep, not plain data, over the heap ceiling or the fuel), and a capability's RETURN that JSON could not express (a function, a getter, a class instance: the host's contract broken) can no longer be caught by try/catch. A return that is merely too large or too deep (things JSON can do), or does not match the atom's declared output, is the world's doing and stays catchable (Tonio), and every inbound copy is billed in fuel so a retry loop pays. A value an atom THROWS reaches a guest catch as a capped string: its message (read once, so a DOMException's works), or String(value) for a thrown primitive; never an object (a thrown { message: obj } used to hand over a live host object). A typed array over a SharedArrayBuffer, or any subclass of a typed array, DataView or Date, is refused at the boundary: structuredClone would SHARE that memory with the guest, not copy it. Refusals that end the run: no catch block, later step or parent-agent step runs, and the run reports the refusal. This includes a cache entry or key that cannot cross, and persisted ASTs or builder programs that wrapped such a call in try. Ordinary failures (a fetch that fails, a store that throws) are caught as before. Four review rounds in a row (cumulative reviews 5 to 8) each found a refusal path billed short of the work it did, and each mattered only because a guest could catch the refusal and retry it in a loop. A refusal that ends the run costs at most one bounded walk (Tonio).

The membrane builds its copy: JSON plus Date (breaking). Every value crossing the capability boundary (capability returns, IO-atom inputs, run arguments) is now a copy the membrane builds from exactly what it read, instead of a structuredClone of the original. structuredClone copies internal slots the check never saw, so a typed array over a SharedArrayBuffer with a shadowed buffer, a prototype-swapped buffer, or a 1-byte view over 50MB was checked as one thing and forwarded as another (cumulative review 13). What crosses is plain objects, arrays, strings, numbers, booleans, null/undefined, and Date (by its internal time). Map, Set, typed arrays, ArrayBuffer, RegExp and Error no longer cross: a capability returning one, or a run argument containing one, is refused. Convert them to JSON first (a Map to an object or an array of pairs). Shared references and cycles are preserved, as before. A Date crosses only when it is exactly an intrinsic Date (a subclass, or one with own fields, would arrive thinned). Cost, measured: a 300-document RAG return copies in ~1.9ms (3.5ms before); a 400k-number array in ~143ms (~127ms before), where the per-element descriptor read that keeps getters from running dominates, as it did.

The membrane's copy is built safely, and the VM loads in any page. Copies are built with a null prototype and given their real one when complete, so a polluted Object.prototype setter never runs on capability data and frozen intrinsics (SES) do not refuse ordinary JSON. A crossing is bounded by membraneMaxBytes and (outbound) the remaining fuel; the heap ceiling applies where the value lands. A refusal for size names the limit that set it. Fixed in the same rounds: rc.2 builds briefly read SharedArrayBuffer at module scope, which threw on import in any browser page that is not cross-origin isolated (every bundle is now load-tested without optional globals). An array's length is read from its own descriptor and validated: a Proxy whose length trap returned an object could put an unwalked host object into the copy (cumulative review 17). Object copies are built on their real prototype with each key defined, so they stay in V8's fast mode. An Array subclass, like any class instance, is refused rather than thinned to a plain array (its prototype getters would read as undefined), and so is an array or object from another realm (an iframe, a node:vm context): pass plain data, e.g. through a JSON round-trip.

Faster hot loops: a per-atom timer is armed only for a call still pending. Every atom step used to arm a setTimeout and a Promise.race, though a call whose body completes synchronously can never be overtaken by its timer. A 20,000-iteration loop went from 54ms to 32ms, and from 40,004 timers to 1 (the run's deadline), at the same fuel. An atom that awaits real work is timed as before, with its deadline counted from the call on a monotonic clock (performance.now()), so a wall-clock step cannot time it out early.

Persisted ASTs: a stored AST (procedureStore, a saved builder program) containing a key-less memoize or cache now fails when it runs, with "a key is required". Add a key.

A fetch URL that is relative is decided by the URL parser itself (resolved against an http and a file: sentinel). It passes only as a plain path naming no host, and contains no tab/LF/CR/backslash a parser would rewrite. A hand-written "two leading slashes" check missed /\t/evil.com/x.

Since rc.1 — AsyncJS checks every atom call against the atom's declared inputs (breaking). A call to an atom is a single object literal, storeSet({ key, value }), or no arguments, random(). The transpiler now refuses, with a message naming what the atom takes:

• a positional call (storeSet('k', v), foo(opts));
• a spread (foo({ ...opts }), which was silently dropped);
• an input the atom does not declare (httpFetch({ url, cache }); four playground examples asked for a cache that httpFetch never had);
• a missing required input.

These all used to compile and run the atom with inputs undefined, reporting success. Core atoms are checked from a table generated from their schemas (src/vm/core-atom-inputs.ts). Pass your own atoms to check calls to them too: transpile(src, { atoms: vm.atoms }). Every entry point that holds a VM does this itself (vm.run(source), createAgent, Eval, SafeFunction), so a host atom that overrides a core name is checked against its own inputs. Without atoms, a refusal on a core name says to pass them. An open schema (no additionalProperties: false) still requires what it lists. An AST persisted under rc.1 with a positional atom call (e.g. in procedureStore) never delivered its inputs; re-transpile it. Local functions and Error('message') keep positional arguments. The VM does not check parameters; it runs an AST as written. Its job is to be correct and safe; preventing bad code is the transpiler's job (Tonio). An AST built by hand or by another front end is that producer's responsibility. Four review rounds tried to make the VM decide what a call meant from each atom's schema, and each broke a call that worked. Embedders: an atom you called positionally (an args input) is now called foo({ args: [a, b] }).

Since rc.1 — the AsyncJS value domain is closed (breaking). A guest value is data — JSON values, with the VM's own Set, Date and regex as data (above) — and never a host function or a builtin namespace. It is checked where values ENTER guest state: the walk that charges every bind, insertion and reconcile now refuses a function or namespace anywhere in the value, so no producer (an expression, an argument read, an atom result such as pick) can bypass it. Arguments are a null-prototype object read by own key (args.constructor was the host's Object, and varsImport could hand a capability Object.prototype). A Set or Date in the run's RESULT is plain data, so a structuredClone at a worker or process boundary keeps it (wrapper methods had reduced a Set to { size }); a host that read wrapper methods off the result reads the data instead. Validation costs about 0.002 fuel per schema-node × data-node step (some 0.11 fuel per 6-field row): raise fuel, or validate at your own edge, for large payloads. Earlier holes closed in this round of review: const g = parseInt, Object.values(Math), { toJSON: encodeURIComponent }, [Set].join('') (which printed VM source) and a dot-path 's.add' all handed out host functions, and a stolen Set.add called through a guest object's own hasOwnProperty property grew a Set past maxHeapBytes. Method calls now dispatch to the receiver kind's INTRINSIC, never to a property the guest owns; a namespace can no longer reach the host's result (where JSON.stringify threw). llmPredict options are allowlisted (model, temperature, maxTokens, topP, stop, seed, responseFormat, tools) and tools must be { type: 'function', function: { name, description?, parameters?, strict? } }. Validation is charged at the VM's own rate (it bought ~38× more host time per fuel), and an AST's inputSchema counts its arguments per path, as validation walks them.

Since rc.1 — in AsyncJS, Schema is data, and a method is not a value (breaking). Guest code held live tosijs-schema builders, whose methods are host closures: a validate read as a value and spliced next to a harmless schema validated against a pattern smuggled in through meta (51s on Node, at fuel 50). Now Schema.string, Schema.email, … are frozen plain JSON schemas, and Schema.object, array, record, union, tuple, enum, const, fromExample, response and isValid are VM-implemented, returning plain JSON built only from admitted parts. Migration: builder chaining is gone — write the keyword: .int → type: 'integer'; .min/.max → minimum/maximum (or minLength/maxLength, minItems/maxItems); .step → multipleOf; .title/.describe → title/description; .default → default; .open → additionalProperties: true; Schema.pattern → refused (use regexMatch). .optional → a nullable type, { type: ['string', 'null'] }, which Schema.object leaves out of required — note that a nullable key may be absent; a present key must be the type or null. And reading a method as a value (const f = s.trim, 'a'.toUpperCase) is refused: call it. Validation is charged as schema size × data size, before it runs, at every door (an anyOf of 3,300 branches over a 97×97 array ran 630ms for 63 fuel when charged as a sum), including the AST's inputSchema, paid at admission. Every LLM door — the core llmPredict too — admits its responseFormat (shape allowlisted: json_schema, json_object, text) and every tool's parameters schema.

Since rc.1 — guest schemas are a closed dialect (breaking). Every schema that comes from guest code or the guest AST — Schema.* and filter arguments (after an example is converted), an AST's inputSchema, a return step's schema, an LLM responseFormat — must be a plain JSON tree using only the keywords the VM admits, each with exactly its value type: type, properties, items, additionalProperties, anyOf, oneOf, required, enum, const, the numeric bounds, format (only the formats tosijs-schema enforces, all linear), title, description, default, examples. Anything else is refused, naming its path — including pattern (except the library's own, e.g. Schema.emoji), patternProperties and $predicate. A denylist failed: tosijs-schema compiles pattern with new RegExp(value), so an ARRAY or a regex object walked past a string-only check and ran on the host's backtracking engine, at the inputSchema door before fuel or the timeout existed. Migration: a builder or persisted AST whose .take()/.return() schema uses .pattern(), patternProperties or $predicate (the tjs-lang/css schemas included) is now refused by the VM; validate those on the host after vm.run, or match inside the program with regexMatch. Also refused, and failing at vm.run for a persisted AST: $schema, $id, $ref, definitions, uniqueItems, prefixItems, nullable, additionalItems, any other keyword, an accessor, a non-plain object, a non-finite number, more than 10,000 nodes or 64 levels. An object with a string type field (or an array of type names) is read as a schema, not an example. The predicate trust registry moved from a string global to a Symbol.for slot, so bundles of different 0.14 prereleases in one realm do not share trust.

Since rc.1 — every resource a regex uses is charged. Everything a regex costs is now a function of its program size and its input. A compiled regex is charged its program's size against maxHeapBytes as the program is built, and counted while it is held (it used to keep its matching table for as long as it lived: 1000 held regexes kept ~690MB under an 8MB ceiling). Regex literals in one source share a compile budget of max(250k, 200 × source bytes) steps, every byte compiling allocates counted as work, with each distinct literal compiled once; an over-budget source is refused with "The regexes in this source are too large to compile". That holds in AJS helper functions too, and for $predicate sources. In predicates, __fuel and __rx are reserved identifiers, and the pattern passed to match/search/matchAll must be a regex or string literal (or a const bound to one): JavaScript compiles a string passed there as a regex on its own engine, which no fuel can see inside. A string LITERAL is compiled by the metered engine instead; any other non-regex argument is refused (replace/split take a string literally and are unaffected).

Since rc.1 — the regex engine is metered by construction, and predicates use it too. A linear algorithm is not a bounded one unless its work is CHARGED: the first version charged one step per thread per position, and the work it did not see (following zero-width instructions, copying capture arrays, testing a 400k-character class, expanding (?:){1e12} at compile time) ran for seconds on a few fuel. Every unit of engine work is now charged — each instruction visited, each capture copy in proportion to its width, each class probe, compilation itself — and every pattern-sized quantity is capped (counts over {10000}, nesting, program size, capture slots). Classes are merged range tables, binary-searched. Case-insensitive matching uses equivalence classes DERIVED from the host engine (generated, freshness-tested), so i and iu agree with JavaScript on every code point (Dž ~ DŽ, ſ ~ s under u, dotless ı). A long-standing divergence on nested quantifiers over empty-matchable bodies is fixed: dedup on the program counter alone let a path whose empty check would fail block one whose check would pass. replace charges each substitution at its exact length BEFORE building it. Unsupported regex literals are a transpile error at their source location. Predicates (compilePredicate, $predicate, tjs-lang/css) run regex literals on the same engine, charged to the predicate's fuel — /a*a*c/, which the old star-height screen certified, took 13s on 6k characters inside a $predicate that travels as data. A Type predicate with a regex is no longer emitted as a verified guard (standalone output cannot carry the engine; it still runs, unverified). That means a warning from tjs check, so a --max-warnings 0 gate fails on such a file. Write the check with string methods (includes, indexOf, startsWith, split) to keep it verified — the Email example in the declarations guide now does. Cost: tjs-lang/css validates a theme in 7.3ms (0.20ms on the host's engine, measured — ~36× slower; ~15× per value), still inside a frame. Making this fast is card #2767, and Pattern (docs/pattern.md) is the longer-term answer. Also: the ASI guard recognises a control header from its parenthesis structure, so a header spanning lines, label: for (…) and for await (…) keep their brace-less bodies.

Since rc.1 — native TJS accepts a brace-less control body that starts with [ or (. The ASI guard put a ; in front of such a line — which, after if (…) / while (…) / for (…) / else, BECAME the statement's body: if (c)\n [a, b] = …\nelse … orphaned the else, so valid JavaScript was refused (a TJS ⊇ JS violation, found when the VM's regex parser entered the dogfood corpus). A bare header now keeps its body; a complete one-line if (a) foo(b) still separates the next line, as before.

Since rc.1 — guest regexes run on the VM's own engine; methods take exactly-typed arguments (breaking). Guest regexes (literals, regexMatch, match/search/replace/replaceAll/ split) no longer run on the host's backtracking engine: a linear-time Pike VM, fuel per step, makes ReDoS ordinary work instead of screening for it (the screen missed polynomial shapes — /a*a*c/ over 6k characters ran 12.9s for 2.7 fuel). Unsupported, and refused when the regex is compiled (a literal, at transpile time): backreferences, lookahead/lookbehind, \p{…}, the d/v flags. A schema pattern supplied by guest code is refused (it would validate on the host's engine) — use regexMatch. Methods now take arguments of exactly the type they read: a count is a number ('x'.repeat('1e8') is refused; it built 191MB under a 1MB cap), positions are typed (arr.indexOf(v, obj) converted obj), and extra arguments are refused. The regex input cap (100k characters) is gone — input is charged, not capped. Also: a Set's remove(NaN) removed the last element; JSON.stringify is bounded by its escaped size; printers charge their walk as they walk.

Since rc.1 — AJS refuses implicit coercion of objects and arrays (breaking). Operators (+ - * / % ** < > <= >=, unary +/-), computed keys, and methods that take primitives now refuse an object/array operand instead of converting it to its string form, recursively and for free: arr < 5, 'x' + arr, `${arr}`, obj[arr], 's'.includes(arr), Math.max(arr), parseInt(arr), [[2],[1]].sort(). Write the conversion: arr.join(','), JSON.stringify(obj). Equality still compares objects, by identity. Printers (join, JSON.stringify, flat, toString) are now bounded by the TREE they print — a shared-reference DAG of a few KB joined to 400M characters for 2.5 fuel. Regex literals are now data in the AST ({ $expr: 'regex' }), built by the VM after the ReDoS screen; they were host RegExp objects the transpiler built from guest source, never screened, and serialized as {}. match/search with a string pattern are screened too (one was 634ms past a 50ms timeout), and a RegExp runs only over inputs up to the existing 100k-character cap. Also: a Set's has/intersection/diff are O(1)/O(n+m) (they were linear/quadratic for a linear charge); slice/substring/split are charged for what they select; a helper's extra arguments are dropped, not held unbound.

Since rc.1 — one implementation per operation (v2). Method calls compile to the VM's gated method call and template literals to its gated +, instead of push/split/join/ template atoms with their own budgets and their own semantics: let n = arr.push(x) is now the new length (it was the array), `${null}` is 'null' (it was ''), and an unknown method is a transpile error (it became a call to an atom named after the method). An expression statement compiles to a new evaluate step — it bound _, clobbering a guest's own _, and refused a program with const _. v1 ASTs keep the data atoms, now thin wrappers over the same gate; the template atom reads only its own vars ({{constructor}} printed Object's source). costOverrides/quotas keyed on a data op apply to v1 ASTs only. Hosts running untrusted code at scale should still give each run a hard engine-enforced floor (a Node Worker with resourceLimits) — see "Why not just ask the runtime?" in the budgets doc.

Since rc.1 — every v2 block is a scope. if/else, try and catch blocks now scope their declarations, as while bodies already did and as JavaScript does: sibling blocks may each declare const t, a block let x may shadow an outer const x, and catch (e) shadows an outer e (with errorOp, bound in the catch block). v1 ASTs keep unscoped blocks. A raw atom ({ op, exec }) that writes ctx.state[step.result] itself now declares in the innermost block — use defineAtom, which honours assignment (resultAssign). A default parameter is now filled by assignment, not a declaration in the if that tests it. var is function-scoped, as in JavaScript: it is declared once at function entry and var x = v assigns it, in any block (lowering it like let lost if (c) { var q = 5 } silently); a callback's vars are the callback's own. for (var x of …) and for (x of …) are refused with a pointer to const/let: the loop variable is bound in the loop's scope, so they cannot mean what JavaScript means (assign an outer x), and they silently did not. errorOp, like the catch parameter, is bound in the catch block and is not visible after it.

Since rc.1 — const follows the scope a write lands in. One rule, enforced where every scope write passes: a write may not land on a const of the scope it writes. A block let x beside an outer const x was refused as a reassignment — legal JavaScript rejected — while varsImport, varsLet and catch checked nothing and could overwrite a const.

Since rc.1 — guest code cannot set an object's prototype. __proto__ is refused as an object key — at transpile time, in object literals, in resolved values, in atom inputs, and in the guest Object.assign (which used the native one, and so the __proto__ setter), and in every atom that builds an object from guest keys (pick, omit, varsExport, agentRun's input, the return projection). Set as a key, it replaced the object's prototype, hiding whatever hung off it from maxHeapBytes (~19MB held under an 8MB cap). Every computed-key write in the VM now goes through one guarded function, and a source scan (guest-key-writes.test.ts) fails on any new one. pick also reads own properties only: pick(o, ['constructor']) returned the inherited Object function, a live host function in guest hands.

Since rc.1 — AJS assignment means what it means in JavaScript (#59). Found by tosijs-platform; every one of these was a SILENT wrong answer:

• Every compound assignment stored only its right-hand side: n -= 2 gave 2, s += 'b' gave 'b', n *= 3 gave 3. They now lower to x = x op y.
• i++ / i-- / ++i as a statement were dropped (a warning, then nothing). They now assign. Used as a VALUE (j = i++) they are refused, as is any expression AJS does not support — the transpiler used to turn an unrecognised expression into null and carry on.
• Assigning an outer variable inside a for…of body was lost (s = s + w left s empty): assignment and declaration compiled to the same step, which wrote the loop body's own scope. Assignment now compiles to a new varAssign step that writes the scope that OWNS the variable, as JavaScript does, charged to that scope's heap ledger. Declarations are unchanged, and ASTs already stored keep their meaning. An AST from this transpiler is format v2 (below), so an older VM refuses it by version, never silently.

Since rc.1 — runCode is its own program. Breaking. Code run by runCode sees only the args it is given; it no longer sees the caller's variables or local helpers. It ran in a child of the caller's scope, so model-written source could read every caller binding (keys, tokens), reassign them (stopped at a scope boundary in the first rc.2 fix), and — what that boundary could not stop — mutate them in place (allowed.push('evil')). A fresh scope has nothing on the other side to reach. Symptom: a caller variable that runCode source used to read now reads as undefined. Pass what the code needs in args; what it is given it holds by reference, as a function holds its arguments. Likewise agentRun now runs a sub-agent's OWN local helpers — it was handed the caller's, so a call by name ran the wrong body.

Since rc.1 — two exports removed. Technically breaking; neither had a real use.

• setTranspiler is no longer exported from any entry. It lived in vm.ts, which every entry re-exports, so it was public everywhere — including tjs-lang/vm-ast, whose whole promise is that it contains no parser, while setTranspiler let any importer arm one in the sandbox's process. It is now internal; tjs-lang/vm, the main entry and tjs-lang/eval still wire the transpiler in exactly as before. If you called it to give vm-ast a parser, import AgentVM from tjs-lang/vm instead — that is what it is for.
• The tjs-lang/src export is gone. It pointed at src/index.ts under every condition, so in Node (with type stripping) it loaded TypeScript whose relative imports have no extension and failed; every other src/ path is behind the bun condition. Nothing we could find imported it. Use tjs-lang (the bun condition already resolves it to source).

The syntax reference is now TJS-SYNTAX.md (was CLAUDE-TJS-SYNTAX.md), so its page on the doc site is /TJS-SYNTAX/. The old file stays as a one-line pointer.

Since rc.1 — httpFetch no longer breaks cross-origin requests in a browser. The default fetch added X-Agent-Depth to every request; in a browser that is a non-simple header, so any cross-origin API that does not allow it failed preflight with "Failed to fetch" (found running the AJS weather example live on the doc site). In a browser the header now goes only to the page's own origin, where agent endpoints live; servers send it everywhere as before, and a custom fetch capability still receives the depth.

Packaging (rc.1): typescript is now a declared OPTIONAL peer (^5) — tjs-lang/lang/from-ts imports it, and it was only a devDependency, so a Node consumer of that entry without it installed failed at import. Dev-only scripts (bin/*.ts, editors/build-*.ts, the CodeMirror demo component) and unreachable editor .ts sources are no longer shipped; every exported path is unchanged. Found by the new publish workflow's release-doctor, not by a user.

Published first as 0.14.0-rc.0 on the rc dist-tag, so tosijs-ui could verify against it before its peer range admitted 0.14 (tosijs-ui#182). It did: tosijs-ui 1.15.2 declares tjs-lang: ^0.13.1 || ^0.14.0, so npm consumers of both resolve cleanly. That rc verified PEER RESOLUTION; the Type-example and TjsStrict changes below came after it, through several review rounds (docs/reviews/0.14.0-*).

Untrusted AJS source is capped at 8KB by default (was 64KB) — and the real answer is to not accept source at all. maxSourceBytes for Eval, SafeFunction, vm.run(source), runCode and transpileCode now defaults to 8KB. Nine review rounds in this release each found another input shape that the AJS preprocessor or acorn parses super-linearly — nested destructuring took 19s at 60KB, a function head followed by whitespace 2.9s — and patching them did not converge. A quadratic cost shrinks with the square of the cap: at 8KB the worst known shape is ~455ms (densely nested destructuring, measured 2026-09-26). Raise it per call for trusted source, and transpile(source, { maxSourceBytes }) (new, opt-in) caps an in-process transpile. For source the GUEST builds (runCode/transpileCode), vm.run's maxSourceBytes can only lower the 8KB cap, never raise or disable it: that text can come from llmPredict output, and one option cannot speak for two trust domains. If you run agents from untrusted callers, take an AST instead: transpile on the caller's side (tjs-lang/browser or tjs-lang/lang) or in a worker or process you can afford to lose, send the AST, and run it with tjs-lang/vm-ast, which has no parser in it at all — the parse cost then lands on whoever sent the source, and what remains on the host is linear. (This project's own hosted endpoints still accept source; they get the 8KB cap when functions/ is bumped to 0.14 and redeployed — a 0.x minor is outside ^0.13.x — and moving them to ASTs is next.) ajs, createAgent, tjs and the exported parser functions are for TRUSTED source and take no cap.

Deprecated: vm.run(source) — the VM parsing AJS. It still works (capped at 8KB) and notes itself once in the flight recorder. The VM should never be the thing that parses: transpile separately (transpile from tjs-lang/lang, in a worker, another process, or on the caller's machine) and run the AST with tjs-lang/vm-ast, which contains no parser — so a bad payload can only take down the step that parsed it, never the endpoint. Eval and SafeFunction keep taking source: they are for source you trust, or a process you can afford to lose.

A language release. The tosijs-ui-hosted site was what 0.14.0 was originally reserved for; that work is real but lands separately, as a non-breaking change to build tooling that does not touch the published surface. The version number follows the narrative rather than a name reserved in advance.

If you only read one line: a runtime type now reports typeof === 'function' instead of 'object'. .check(), isRuntimeType(), Object.keys() and spread are unchanged, and serialisation improved from throwing to working — so unless you branch on typeof, that one moves nothing under you.

What may newly RUN — error propagation is decided at the type check (native .tjs and converted code). A MonadicError passed where it does not fit a parameter's type is still returned unchanged without running the body — including through overloads, arrays and options bags. But every validated function used to begin with a pre-check that returned ANY Error from ANY parameter, whatever its declared type:

• A function whose parameter admits errors now RUNS with one. describe(e: Error), isErr(x: unknown), log(msg: '', detail: any), unsafe ! functions, and every catch-handler helper used to hand their argument straight back; their bodies now run.
• A plain Error (from new Error() or a catch) where something else is expected is a new TYPE ERROR — it used to be passed through as if it were a TJS error, identity intact.
• A MonadicError is never an object shape, so o: {} or an all-optional shape propagates it instead of running on it; an error inside an options bag ({ x: err }) propagates the same way in every parameter form.
• vm.run arguments cross the capability membrane, like capability returns (so do Eval context values and SafeFunction arguments, which become them). They arrived LIVE, and methodCall's allowlist filters method NAMES, not owners: a class instance whose class defines slice had it invoked by guest code (svc.slice(0) ran host code). Migration — what is now refused, loudly, with an AgentError naming the argument:
  • A CLASS INSTANCE (any prototype but a plain object's, null, Array, Date, Map, Set, RegExp, Error or a typed array). Copying only its own data would thin it silently: a Firestore Timestamp's seconds getter read as undefined, and a negated rule over it flipped deny to allow. Convert it to plain data first (ts.toMillis()). The same rule now applies to what a capability RETURNS.
  • An own function or getter, a Proxy (including a raw tosijs state proxy — pass .value), a URL, and anything else structuredClone cannot copy. Arguments are metered and capped. Admission walks the data before any atom runs, so it is budgeted by the run's own fuel — about 8,000 bytes per unit, the rate binding the same data costs — and capped by the new argsMaxBytes run option, default 4MB, the same as the capability direction. The cap bounds that pre-budget work absolutely (about 180ms at the walk's worst, whatever the fuel). What crosses is charged to fuel, and so is a refusal. A host passing large arguments must pass fuel in proportion (a 1MB string needs about 250) and, above 4MB, raise argsMaxBytes.
• vm.run refuses invalid budget options. A fuel, timeoutMs, argsMaxBytes, membraneMaxBytes or maxHeapBytes that is not a non-negative number is an AgentError ("Invalid run option fuel: …"). fuel: 'abc' made the argument budget NaN, which no size ever exceeds, so the walk it bounds ran unbounded.
• Admission is one module (src/vm/admission.ts), and every entry path goes through it. The release cycle blocked five times on one class — work proportional to caller input, done before any budget could stop it — because each fix guarded one door. Now: vm.run(source) is capped like Eval (new maxSourceBytes run option, default 8KB), and its options are checked before the source is even resolved; cost, timeout and quota overrides are validated too (a negative cost override MINTED fuel; a NaN quota read as unlimited; a NaN timeout disabled the timeout; timeoutMs: Infinity fired after 1ms and now means no timer; a run-level timeoutMs: 0 still means the deadline has passed). src/admission.test.ts runs every hostile shape through every entry path and asserts each is cheap — a new entry path belongs in that table.
• The AJS preprocessor is linear on hostile input. Every quadratic pass the release reviews measured is fixed at its cause, not bounded: two look-backs that ran per character over blanked comments (64KB of //: 54s → ~12ms); an unmatched ( rescanned to EOF from every later ( (60-90s; now each partner — or "never closes" — is recorded as it is proven, held equal to a fresh scan at every ( of a real-file corpus); the method-head regex tried at every character; trimEnd() of all output on every /; a class-heritage scan to EOF per header; and the ternary-colon test, which walked back over the whole expression for every : and is now one forward pass (held equal to the old walk at every : of the corpus). AJS paren nesting is bounded at 64 by the recursion itself (the deepest in 3,372 real files is 19); the TJS compiler, which takes the author's own source, has no limit. After five consecutive review blocks each found another such scan, the AJS transform also carries a deterministic work budget (64× the source length, shared by every recursion level; real code uses a median of 2×, at most 8.8×) — fuel for the parser, so a super-linear scan anywhere in it is refused at a bounded cost instead of trusted to be linear. The lexical layer's regex scan remembers which (position, state) pairs it has proven fail, so a line of /[/[… or /\/\… no longer rescans per /. src/admission.test.ts pushes every hostile shape it knows, a GENERATED grid of 41 tokens and a grid of 289 token PAIRS, each repeated to the cap, through the source entries; the worst measured at the old 64KB cap was ~114ms for the gridded shapes (see the 8KB cap above for the shapes that were not).
• An aborted run takes no further step. Every atom now checks the run's abort signal before it runs, so after a deadline or a caller's abort no capability is called and no guest code continues — vm.run used to stop WAITING while straight-line steps carried on unobserved. A run-level timeoutMs: 0 fails before the first step (0.13.x let a compute-only agent complete), and a caller signal that is ALREADY aborted stops the run (it was ignored: an abort listener never fires for a signal already aborted). A caller's abort is reported as "Execution aborted by the caller", no longer as a timeout.
• Eval and SafeFunction take argsMaxBytes, so a host can raise the new 4MB argument ceiling through the safe-eval API (strings count two bytes per character).
• Every budget option is validated, including outside a run. compilePredicate and emitVerifiedPredicate read fuel raw, so fuel: NaN removed the runaway guard (--fuel < 0 is never true for NaN — an exponentially recursive predicate ran unbounded) and emitVerifiedPredicate spliced the unvalidated value into emitted source. Both now refuse a fuel that is not a non-negative number (Infinity means no limit), and compilePredicate splices only verified names into its generated function. defineAtom refuses an invalid static timeoutMs where it is written, and an atom with timeoutMs: Infinity no longer makes every run on its VM unbounded. Refusals name the bad value (NaN, not null). Quota tables are checked over exactly what the VM reads. A NaN, negative or string quotaUsed counter switched the quota off (NaN >= 3 is false; -100 granted a hundred extra calls), and so did a quotas or quotaUsed table whose bad value was inherited, non-enumerable or behind a getter — validation walked own enumerable keys while table[op] reads through the prototype. quotas, costOverrides, timeoutOverrides and quotaUsed must now be plain objects of data properties (a Map or class instance is refused; a Map never worked — map[op] is undefined, so it silently meant "no quota"). vm.run reads its options exactly once: each option is read a single time (an accessor on the options object is refused — a getter could answer the check one way and the run another), checked, and frozen, and the run reads only that record. The three static tables are built from the entries the check saw, so changing them after vm.run starts has no effect. quotaUsed is shared by design, so it is the caller's own object, checked at every read: a corrupted value refuses the next step, a frozen or read-only counter is refused up front, and a run never counts BELOW its own tally — a shared counter can raise a run's count (that is how a quota holds across nested runs) but not lower it. Across nested runs the shared counter is trusted: it is host code. A quota slot is spent before the fuel check, so a call can never happen uncounted. A custom atom named like an Object.prototype member (toString) is no longer charged by that member's function. Every vm.run option is classified in a table keyed by the options type, so an option added without saying whether it is a budget fails to compile — the class blocked this release five review rounds running. src/budget-funnel.test.ts is a second line for budgets read outside a run, and names its blind spots. new AgentVM now throws on a hand-built atom (one not made with defineAtom) whose timeoutMs is not a number or a function — in 0.13 a null quietly took the 1000ms default and NaN disabled the atom's timeout; build the VM inside a try if its atoms come from configuration. compilePredicate throws on an export name the verifier did not certify; emitVerifiedPredicate refuses fuel: Infinity, because emitted code runs in someone else's program.
• runCode and transpileCode refuse guest-built source over the source cap (8KB) before the host's transpiler sees it, and charge per character. Transpilation is super-linear and runs before fuel or timeout can stop it: 160KB of generated comments took 284 seconds.
• Emitted code uses an installed globalThis.__tjs only if it speaks the same runtime ABI (abi, now 2); otherwise it uses its own inline runtime. A 0.13 runtime's typeError ignores the propagation argument, so 0.14 code running under one replaced the caller's error with a fresh "got object" error. versionsCompatible now follows semver below 1.0, so 0.13 and 0.14 count as incompatible. Embedders that pin tjs-lang in more than one place (tosijs-ui pins it twice) should bump every pin together.

What may newly REJECT something — each is a fix, and each can turn a value that used to pass into a returned MonadicError:

• Type examples mean what they say. A float example (0.0) no longer means integer, a +N is non-negative, '' | undefined is a union (it was bitwise OR, 0), type names and references to other types are checked, and a recursive type is checked all the way down. A value your example only matched by accident may now be rejected; one it wrongly rejected (9.99 against 0.0) now passes. A recursive type is checked to any depth (a 50,000-deep list, on Node as on Bun) in time linear in the data; cyclic data is accepted when every node satisfies its type.
• default: inside a Type block is a transpile error. It was never read. Write Type T = 0 (or Type T = 0 { … }).
• An example: that cannot be read, and a type defined only in terms of itself (Type T = T, A = B with B = A), are transpile errors. The first used to become a type that accepted everything; the second accepts every object under coinduction.
• A Type with a predicate enforces its example with no runtime installed. Standalone emitted code used to skip the example and run only the predicate, so a predicate wider than its example now rejects what the example rejects.
• TjsStrict on converted TypeScript now validates arguments. A TS object parameter is checked only loosely (anything is accepted): TJS has no "non-primitive" type yet, and under-checking is the safe direction.
• Type X = … reads the whole default expression. Type Opt = '' | undefined used to emit Type(…, '') | undefined — bitwise OR, so Opt was the number 0 — and an object default stopped at its first }.
• A .tjs template literal is no longer rewritten. The first-assignment auto-const ran over raw source, so a template line like Red = 'red' got const written into the STRING.
• An anonymous export default function is reported as default in result.types (it was anonymous, attached to a binding that did not exist), with its return type in result.types and the .d.ts, and default in its error paths.
• Size, measured against the published v0.13.13 (KiB, zlib default — the README's method): tjs-lang/lang grew 6.2 KB gzipped (98.2 → 104.4), the full tjs-lang entry 7.5 KB, tjs-lang/browser 6.2 KB, tjs-lang/lang/from-ts 1.7 KB, tjs-lang/eval 1.0 KB and tjs-lang/vm 0.9 KB. (An earlier draft of this entry said +2.1 KB, measured against a build that already had some of the growth.) In EMITTED code: a file whose Type examples carry a marker (0.0, a union, +0) carries ~1.7 KB (0.7 KB gzipped) more inline runtime, and only a file with a recursive reference also carries the solver, ~5.8 KB (2.1 KB gzipped) in all; a file with no marker carries nothing. Per call, a marked non-recursive Type measured ~15% slower than an unmarked one (0.039 vs 0.034 µs), and a recursive Type ~5× an unmarked one — the price of checking a value that can recurse.

Changed

• The documentation is organised as a book-shaped site. Every doc now carries its place in a navigation hierarchy and in one or more books, for the tosijs-ui doc site that will replace the playground:

  section	contents
  TJS	the language guide, TJS for JS developers, and the examples, grouped
  AJS	the AJS guide, Safe Eval, the LLM prompt, and the examples
  TypeScript	TJS for TypeScript developers, and 14 TypeScript examples as pages
  The TJS Language	why TJS exists, its principles, Declarations, the syntax reference, and the design notes from docs/
  TypeScript: the Good, the Bad, and the Ugly	the measured comparison with TypeScript, plus two design notes; being written

  Four books build from the same source: the whole site, The TJS Programming Language, TypeScript: the Good, the Bad, and the Ugly, and AJS and Safe Eval.

  Two chapters are new. Declarations grows the old "Type Declarations" example into a chapter: what each of Type, Enum, Union, Generic and FunctionPredicate declares, why each is a callable predicate, and why a FunctionPredicate is a function's type rather than a value predicate. Safe Eval gathers what was spread across the README and two guides behind one argument: eval is too powerful to allow, so the goal was the most powerful eval that is still safe, and it ended up the one part of a program guaranteed to halt.

  Renamed files (the doc site identifies pages by bare filename, and these collided): guides/benchmarks.md → guides/performance.md, guides/examples/ajs/error-handling.md → ajs-error-handling.md, guides/examples/tjs/dictionary-defaults.md → dictionary-defaults-example.md, and guides/examples/tjs/type-declarations.md → declarations.md. Agent instructions, TODO lists and working notes are marked hidden and will not be published on the site.

• tosijs-ui 1.14.1 → 1.15.0, tosijs 1.6.1 → 1.10.3 (devDependencies; no effect on your install). 1.15.0 fixes two of the three defects that were blocking the doc-system migration: SiteConfig gained ignoreDocPaths, and extractDocs's frontmatter match is anchored to line start — so CLAUDE.md, which documents the format, is no longer classified as a playground example by its own illustration. The third (docsJson defaulting outside outputDir) is documented rather than fixed, which is workable since we set it explicitly.

  The tosijs upgrade tightened Component's typing and caught two long-standing misuses in our demo: reading contentVisible (a static initAttribute) instead of the intended navVisible, and assigning a raw boolean to a BoxedScalar. Both had "worked" only because the old types permitted arbitrary property access.

• Runtime types are now FUNCTIONS with properties, not objects with a callable check. Type, Enum, Union and FunctionPredicate all return callables:

  const Age = Type('Age', 0)
  Age(5)                    // true      — callable, the natural JS idiom
  Age.check(5)              // true      — the SAME function; one implementation
  Age instanceof Predicate  // true      — a real prototype chain, no Symbol.hasInstance
  Age.name                  // 'Age'     — introspection, for autocomplete and messages
  Age.example               // 0         — a Type is a Predicate carrying a witness
  

  That block is library code (import { Type, Predicate } from 'tjs-lang'). Types declared in a .tjs file are callable, check-is-the-function and named the same way — but they come from the file's inline runtime, which does not share the library's class, so an emitted type is not instanceof Predicate, and has no .example (the stub calls it __ex). Both are recorded in docs/type-identity.md under "Surface, not decisions" and pinned by tests; joining emitted types to the brand is tracked in TODO.md.

  Additive in practice. .check() still works, isRuntimeType() still recognises them, and object-shaped types from older emitted output still match — the two typeof === 'object' guards were widened rather than replaced. Emitted types are file-local consts that never cross a module boundary, so there is no old-stub/new-shape skew to migrate.

  The point is not ergonomics. A verified plain function becomes a predicate by attaching properties — no wrapping, no lifting, no two populations to reconcile — and check being the function means one implementation that cannot drift from itself. name is set deliberately because it is real introspection; length is inherited from Function and says nothing.

  Runtime types now serialise, which they never did. JSON.stringify(Type('Age', 0)) previously threw — "Maximum call stack size exceeded", because a Type carries a schema object with internal cycles. Making types callable turned that throw into a silent undefined (JSON drops functions), which is how the gap was noticed; a toJSON now emits the type's FACTS:

  JSON.stringify(Type('Age', 0))
  // {"description":"Age","example":0,"default":0,"__runtimeType":true}
  

  In emitted code too — and that is not a footnote. The toJSON first landed only in the real runtime, while emitted files call the inline __pred stub through their own __tjs_rt, so the stub always wins and is the shipped semantics (docs/type-identity.md). For a release cycle the claim above was true of the library and false of every emitted .tjs, where JSON.stringify(Age) returned undefined and JSON.stringify({field: Age}) returned {} — the key vanishing with no error, which is exactly the silent data loss the toJSON exists to prevent. The stub now serialises to byte-identically what a pre-0.14.0 plain-object type produced, so this is a restoration rather than a new format, and the emitted and real Enum serialise to the same facts.

  One measured divergence remains and is pinned rather than glossed: the stub names a Type's witness __ex where the real runtime says example. Same information, two names, so Age.example is undefined in emitted code. Unifying them changes the serialised shape, so it is tracked in TODO.md as a deliberate change rather than made in passing.

  New capability rather than restored behaviour — worth stating precisely, because it looks like a regression fix and is not.

  The one genuine break is typeof: a runtime type reports 'function' where it used to report 'object'. Everything else a consumer is likely to touch is unchanged — .check(), isRuntimeType(), Object.keys(), spread — and serialisation improved from throwing.

  The inline stub emits callables too — all five constructors, not just Type — so emitted code and the real runtime agree on shape as well as on decisions. Pinned by src/lang/predicate-callable.test.ts, whose library and emitted assertions are driven from one shared table, so a form covered on one side must pass on the other.

  Predicate is exported from tjs-lang and tjs-lang/css, and is claimed through a shape-versioned global slot (the MonadicError treatment, docs/runtime-fusion.md) so it is the same class across bundles — without that, isColor instanceof Predicate would be false for a consumer importing the brand from one entry and the predicate from another.

• Verified predicates are Predicates too — isColor instanceof Predicate is true, and tjs-lang/css's nineteen unary validators all carry the brand.

  This is the payoff of predicates being functions rather than objects: isColor was already an ordinary function, so becoming a Predicate meant attaching facts, not lifting it into a different shape. isColor and Type('age', 0) are now the same kind of thing, which is what lets one concept cover both in $predicate, in the documentation, and in editor introspection.

  A bare predicate takes the defaults and claims no structure — toJSONSchema() returns { $predicate: … }, and it carries neither example nor values, because it has neither. That is the progressive-enhancement story exactly: a naive validator sees "anything", an aware one runs the predicate.

  isStyleValueFor(prop, val) is deliberately not branded: it is a binary relation, and a predicate's contract is check(v) over one value. Branding it would degrade instanceof Predicate to "callable and boolean-ish".

  That rule is now enforced in brandPredicate, which declines any function declaring more than one parameter and hands it back untouched. It previously existed only as a hand-written carve-out in src/css/index.ts, while compilePredicate — the public API that produces functions of exactly that shape — branded every cluster export unconditionally. One rule, two addresses, drifted at birth.

  It was not cosmetic. checkType dispatches on the presence of check, and branding sets check to the function itself, so a branded relation took the runtime-type branch and was invoked with one argument, its second parameter silently undefined. Measured: compilePredicate('function differsFrom(a, b) { return a !== b }', …) then checkType(v, differsFrom) returned null for every v — a validator that always says yes, with no diagnostic. Rearranged, the same bug fails closed instead, or throws.

  The brand also erased the evidence: compilePredicate wraps each export in a rest-args fuel closure, so fn.length read 0, removing the one defence a careful consumer had and leaving the rule nothing to act on. The wrapper now carries the underlying function's arity and name, so a declined relation is still properly introspectable. Arity 0 is branded — (...args) => … and () => … both report it, so zero means unknown, not not a predicate. Pinned by src/lang/predicate-arity.test.ts, which includes a sweep asserting no binary export anywhere in tjs-lang/css carries the brand.

Added

• The AJS AST carries a format version — {"$ajs": 1, "op": "seq", …} — and the VM acts on it: an AST declaring a version this build does not understand is refused, not executed.

  An AST is a persisted artifact — procedureStore maps proc_… tokens to stored ASTs, and consumers serialise agents — so data written today is read by code written later.

  To be precise about the deadline, since an earlier draft of this entry overstated it: "absent means 1" is a total, unambiguous rule, so adding the field late would have been perfectly sound provided the format had not changed first. The real hazard is shipping a v2 format without the field, at which point absent becomes genuinely ambiguous and permanently so. The window is "before the format first changes", and this is comfortably inside it — cheap insurance bought early, not a catastrophe averted. The standing obligation: never change the AST format without bumping the version.

  It does not eliminate unversioned ASTs — already-persisted ones have no field and keep working. What it does is stop the population growing, turning an unbounded set into a finite, shrinking one.

  That claim holds only if every producer stamps the field, and one did not: the transpiler stamped it while TypedBuilder.toJSON() did not, so Agent.take(…)…toJSON() minted an unversioned AST on every call. The builder is not a lesser path — its output goes to vm.run and storeProcedure on identical terms, so it is persisted on identical terms, and a single unstamped producer falsifies the claim outright rather than partially. Now stamped, at the root only: nested branches splice .steps rather than re-serialising, so an inner seq never carries a field that would describe nothing there. Guarded the same way the boundaries are, by src/vm/ast-version-producers.test.ts — both producers asserted behaviourally, plus a scan that fails on any file constructing a seq root without the stamp, so a third producer lands there by name. The assertion is '$ajs' in ast, never astVersionOf(ast) === 1: the latter passes for exactly the unversioned ASTs it is meant to catch, since absent reads back as the legacy default, which is 1.

  The refusal is the part that makes the field real rather than decorative: running an AST whose format we cannot read means guessing at the meaning of untrusted code. The version is checked before the root shape, so a newer AST reports its version rather than "Root AST must be 'seq'" — a diagnosis that would send the reader to entirely the wrong problem.

  The gate applies at every boundary an AST enters through, not just AgentVM.run(): resolveProcedureToken (which is how agentRun receives one) and storeProcedure are gated too. storeProcedure matters most — it validates at storage, because persisting an AST this build cannot run defers the failure to whoever resolves the token later, who did not write it and has no context for the error.

  The general defect was that nothing made the boundary set enumerable, so the next entry point would have been missed the same way while every existing test stayed green. src/vm/ast-version-boundaries.test.ts closes that: it drives a future-version AST through each boundary, asserts the gate is present in each function body, and flags any other reader of procedureStore that is ungated — so a fourth boundary nobody listed fails there. Mutation-tested: removing any one gate turns it red.

  Groundwork for docs/ajs-native-vm.md (a Rust → wasm VM), where a second implementation reading the same ASTs makes versioning load-bearing rather than merely prudent.

Fixed

• Converted TypeScript that opts into validation now accepts valid data. Found by running the TypeScript examples, which had only ever been compiled: three promised "invalid calls return error objects" and printed Hello, 42!, and "The Full Picture" threw on its own bad-input demo. Three defects stacked, each hiding the next:

  • TjsStrict did not turn on input validation. Documented as "opts TS-originated code into full TJS; .tjs has this already", it set every mode and left converted code's safety none in place — so the one opt-in a TypeScript author can write validated nothing. It now restores the native default; an explicit safety directive still wins.
  • A Type example lost everything the source said that its value cannot. Examples are evaluated and matched by value, so 0.0 === 0 made Type Price = 0.0 reject 9.99 (narrowed to integer), { count: +0 } accepted -1, '' | undefined evaluated as bitwise OR (to 0), and string or a later-declared type was a ReferenceError. Parameter types never had the problem — they read the AST. Type examples now do too, with the same rules: floats, +N, unions (an all-literal union is still a closed set), sound type names, optional members (T | undefined may be absent), and references to other types, read lazily so forward and recursive references work. Native TJS is affected as well — Type Price = 0.0 was wrong in every file. An example with none of these emits exactly the code it did before.
  • fromTS wrote interface examples that rejected valid data. any, and every reference to another interface, became null ("must be null"), so Product[] accepted only arrays of nulls; optional members were required. Interface and type-alias examples now say any, name the referenced type, and mark optional members — which also makes converted code read like the TypeScript it came from.

  The TypeScript examples now run in CI, and the four that demonstrate a rejection must show it while accepting their valid input. A default: member inside a Type block — never read, so Type T { default: 0 } accepted every value — is now an error naming the real spelling, Type T = 0.

• A Generic's parameter defaults are types, too. A default like <T = number | bigint> became 0.0 | 0n — bitwise OR, which throws Cannot mix BigInt and other types at load. It now gets the same reading as a Type example. (A Generic instantiation, Box(0.0), is still ordinary call code, so a float argument there still narrows to integer — deciding that a call argument is a type needs scope analysis; see TODO. Use Box(1.5).)

• An anonymous export default function (…) could not be imported. Its metadata was attached to a binding named anonymous that does not exist. It now gets a local binding, exports the same hoisted function, and keeps the .name JavaScript gives it, 'default'.

• Four fromTS defects that kept zod from loading at all, found by running zod's own suite for the first time (it had been skipped on every run for want of pnpm):

  • export enum lost its export;
  • an interface whose name the file uses as a value — zod's interface File beside instanceof File, the global — was promoted to a runtime Type that shadowed it;
  • a default import beside named ones was dropped (import config, { A } → import { A }), and import def, { type T } vanished whole;
  • plus the Generic default and anonymous default export above.

  Zod now runs 1959 of its tests, all passing; before, 105 of its suites failed to load. That was invisible because the compat harnesses counted only failed TESTS: a suite that cannot load contributes none, so zod reported "551/552 passed". All five vitest harnesses now fail on a failed suite.

• Eval context values were invisible to atoms. Eval wrapped code in a function with no parameters, so context reached plain expressions but not atoms: items.filter(…) failed with "items is not an array". Context keys are now declared parameters. Found by running the README's own example, which the rewritten Safe Eval chapter now executes along with every example in it. The keys are imported as variables at the AST level (a varsImport step), never spliced into source: declaring them as parameters put caller-controlled text into the transpiled source, where maxSourceBytes never measured it, and 80k keys took over a minute to transpile before fuel or timeout applied (the hosted endpoints pass request arguments as context). Only keys the code uses as IDENTIFIERS are imported — read from the parse, after the size gate, so a name inside a template interpolation counts and a string literal does not. A key never rebinds a builtin or a global value (Math, JSON, NaN, undefined…), and code may declare a local (let or const) that shares a key's name, which shadows it. A non-string code is an error result, not a throw, and an expression containing a callback with return (xs.map(v => { return v * k })) is treated as an expression.

• AJS: a block-bodied callback works. [1, 2].map(v => { return v * 3 }) failed the whole run with "Agent must return an object" — the callback's return was held to the AGENT's rule — and a returned object was dropped ([null, null]), because map and reduce read only the result an expression body binds. Only expression-bodied arrows worked. A callback body now runs as a function: its return, early or not, is its value.

• AJS: const is per binding, per scope. A block-level const could not shadow ANY outer binding (redeclaration was checked up the whole scope chain), and an inner const x made an unrelated outer x unassignable for the rest of the run (const-ness was one set of names). Redeclaration is now refused in the same scope only, and reassignment only when the binding a write resolves to is a const. Still open: a const inside a while body fails on the second iteration, because the body does not get a scope of its own — part of the AJS AST v2 work (TODO), with assignment to an outer variable from inside a block or loop.

• AJS: a for...of body is a loop, not a callback. A return inside it now ends the agent, as in JavaScript: an object return (return { allowed: false }) was silently swallowed and the agent carried on to the code after the loop. The transpiler marks the node loop: true; map without it keeps callback semantics.

• AJS: memoize and cache bodies are callbacks too — a scalar return is the value, not an agent-rule violation — and a sub-agent or runCode started inside a callback is held to the agent rule again (the callback's exemption leaked into it).

• fromTS class metadata keeps what the code erases: OVERLOAD signatures — of methods, static methods AND constructors — and abstract. Both are rightly erased from the emitted code — neither exists at runtime — but metadata is where TJS keeps types, and both were being lost there too. Members were recorded by name, so the implementation silently overwrote each signature: m(string): string and m(number): number collapsed to the implementation's m(a: any). Methods and abstract classes now carry abstract: true. Read from fromTS(…).classes.

  One rule for the shape, documented on FunctionTypeInfo.overloads: overloads is the full list of CALLABLE signatures, present only when there is more than one; the entry is a summary — the implementation, or the FIRST signature when there is none (ambient or abstract). Render overloads when present. Note for consumers of a group WITHOUT an implementation: the entry used to be the LAST signature and is now the first, matching declaration order.

  Scope, stated plainly: this is fromTS's metadata. TJS's OWN introspection — runtime __tjs metadata, the playground's autocomplete — comes from TJS source, which has no way yet to express an abstract member or an overload signature, so those facts do not survive TS → TJS → JS. Carrying them through needs TJS syntax for a signature-only member; tracked in TODO.md.

• fromTS no longer fabricates runtime values from ambient declarations. declare function f(…) became function f(…) { } and declare enum E a real Enum — values TypeScript never emits, which shadow the real one that lives elsewhere. Two export declare function f signatures became two export function f: a duplicate declaration that an ES module refuses to load. Ambient VALUE declarations (function, enum, const/let/var, namespace) now contribute metadata and no code, matching declare class. Ambient TYPE declarations (declare interface, declare type) are unaffected — in TJS a type IS a runtime Type, and declare adds nothing to one.

• fromTS now THROWS on constructs it refuses, where it used to return (lossy) output: decorators anywhere in the file, accessor, and any modifier or class member kind it has no rule for. If you convert a whole tree, catch per file. A refusal is a FromTSRefusal with code: 'FROMTS_REFUSED', so it can be told apart from a converter bug; the message names the file, line and a remedy. The tjs convert CLI already reports per file.

• fromTS no longer silently drops class constructs it does not understand. It rebuilds a class from parts, from a closed whitelist, and anything off the list simply did not come out — no error, no warning. Measured, every one converting "successfully":

  TypeScript	was	now
  decorators — class, method, property, param	dropped, behaviour deleted	refused, with the line and a remedy
  static { … }	dropped — the code never ran	converted
  export default class F	export class F — default imports break	export default class F
  abstract m(): T	an empty method m() { }	erased, as TypeScript erases it
  method overload signatures	one extra empty method each	erased — one method
  declare class X { … } (ambient)	a fabricated runtime class	erased — it describes a class that exists elsewhere
  accessor x	dropped	refused
  constructor(override a: number)	this.a = a dropped	converted — override makes a parameter property

  Decorators are refused rather than converted because they cannot be converted faithfully: fromTS reads no tsconfig, so it cannot tell legacy experimentalDecorators semantics from TC39's (the TypeScript 5 default) — which call them differently — and TJS cannot carry @ syntax. The class transform now classifies every member kind and modifier — on the class, its members, and constructor parameters — and refuses anything it cannot classify, so new syntax fails loudly instead of vanishing. Found through a permanently skipped test whose reason ("does not parse") had quietly become false, and whose assertion would have gone GREEN on the lossy output had anyone simply unskipped it. The ambient-class case was found by the compat corpus (kysely) the moment the modifier table existed.

• agentRun with an inline AST, and runCode, now apply the AST version gate. Both executed an AST of a format this build cannot read — {op:'agentRun', agentId: <a $ajs:99 AST>} ran its body, with no capability required, and runCode ran whatever a host transpiler returned. Harmless today (AST_VERSION is 1) and wrong-semantics execution of untrusted code the day a v2 format ships. Every execution of an AST that arrived from outside is now gated, and ast-version-boundaries.test.ts sweeps every such site, so a new one fails there by name.

• Emitted Generic instances are callable, like every other runtime type. Box(0) was a plain object in emitted code — Box(0)(v) threw is not a function — while the library's is a callable Predicate. The factory itself is still not a predicate, in both.

• Object.keys() and spread really are unchanged from 0.13.13. Serialisation support added toJSON as an ordinary enumerable property, which added a key and made a spread copy carry a toJSON bound to the ORIGINAL — so {...Age, description: 'X'} serialised as Age. It is now non-enumerable; JSON.stringify still finds it. Pinned against the key list the published 0.13.13 produces.

• A non-constructor in Predicate's global slot is no longer adopted. If something other than a class sits under globalThis.__tjs_Predicate_1, this bundle uses its own class and records a warning, instead of breaking every predicate at once. Any constructor found there is still adopted, unchecked — the same trust model as MonadicError (docs/runtime-fusion.md §7).

• A present-but-unreadable $ajs field is refused, not read as version 1. {"$ajs":"2"} — a v2 AST whose number a JSON codec stringified in transit — was read as legacy and executed, the exact misreading the field exists to prevent. Reading a field as legacy is not distrusting it; legacy means "run it as v1". Absence proves an AST predates versioning, but a present-and-malformed field proves the opposite: something that stamps versions wrote it. Now: absent → legacy, a positive integer → itself, anything else → refused, with a message naming the likely codec cause.

• package.json sideEffects named one module; five have module-scope effects. Everything an allowlist omits is asserted pure, so a bundler honouring it could skip src/index.ts, src/vm/index.ts or src/lang/eval.ts — each wires the transpiler at load — and hand a consumer a VM that refuses source, visible only in a production bundle. Worse, tjs-lang/bun-plugin, whose documented usage is a bare import, which is the exact import an allowlist lets a bundler drop. The list is now derived: src/side-effects-allowlist.test.ts scans every module for module-scope calls over a literal-masked view and fails on any that is neither listed nor exempt with a reason. Deriving is what found the plugin; the review that prompted this named only the other three.

• Emitted Union and Exactly named themselves f. Their inline stubs called __pred without the name argument that Type and Enum pass, so .name was the stub's closure name, in stack traces and autocomplete alike. The real runtime names both from the description; the emitted code now does too.

• expect(str).toContain(nonString) reported a comparison that never happened — Expected "12345" to contain 234 for a needle refused on type. It now says so: toContain on a string needs a string needle, got number (234).

• expect(…).toContain(…) now does substring on strings. It was array-only — the guard read !Array.isArray(actual) || …, so a string could never pass however plainly it contained the argument, and the failure was reported as Expected "a.tjs:17:sized.opts.x" to contain "opts.x": a content message for what was really a type refusal. Every comparable harness (bun:test, jest) does substring, so the spelling that works everywhere else failed here and misdescribed why.

  A non-string, non-array haystack now says toContain expects a string or an array, rather than describing a comparison that never happened.

  Found by writing a documentation example, not by a test — which is the argument for examples being executed rather than illustrative.

Added

• tjs-lang/vm-ast — the VM with no parser in the bundle. The same AgentVM, built without the transpiler wiring: 56 KB against 221 KB (measured at the time; ~65 KB raw / ~21 KB gzipped at 0.14.0 rc), and no acorn. It takes an AST; transpile on the caller's side with tjs-lang/lang and send the AST.

  import { transpile } from 'tjs-lang/lang' // where the source is YOURS
  import { AgentVM } from 'tjs-lang/vm-ast' // where the guest code runs
  
  const { ast } = transpile(source)
  await new AgentVM().run(ast, args)
  

  The size is the smaller half of the argument. AgentVM.run() accepts source, and resolving it meant a static import of the transpiler — so a sandbox shipped a parser, reachable from untrusted input, upstream of fuel, timeouts, capabilities and the membrane. That is the position the test-block leak occupied in 0.13.10; the leak was closed, but the shape that permitted it survived. This removes the shape, by not shipping the code.

  It also makes good on what "code travels to data" already claimed: if the AST is the wire format, the string never crosses the boundary and the far side has no reason to read one.

  Purely additive — tjs-lang/vm is untouched and still accepts source. The transpiler is now injected (setTranspiler), and every batteries-included entry supplies it explicitly.

  The guarantee, stated precisely: no parser is present in this bundle — not "this object refuses source even when a parser is loaded". The binding is module-level, so an app importing both entries shares it. That is the guarantee worth having (anyone importing tjs-lang/vm already has the parser), but it is not the stronger one, and the difference is load-bearing: the test asserting refusal has to run in its own process, because it passed alone and failed under bun test once another file imported the main entry.

0.13.13 — 2026-09-13

Read this first if you use unsafe

A patch release normally cannot take anything away. This one can, so it is named here rather than left for you to discover. var and eval were reachable in a .tjs file behind the unsafe marker; they are now refused outright, so source that compiled under 0.13.12 can fail under 0.13.13:

unsafe var x = 1      // 0.13.12: compiled     0.13.13: refused
unsafe eval(src)      // 0.13.12: compiled     0.13.13: refused

The full reasoning is under Changed below; briefly, eval could not be given a named replacement even in principle, because direct eval reads the CALLER's scope and any wrapper would silently be a different operation. unsafe itself is only deprecated — it warns and keeps working.

It is a patch deliberately: the version line stays on 0.13.x until the tosijs-ui migration and tjs doc land, and 0.14.0 is reserved for that release. Pinning ~0.13.12 will not protect you from this; pin exactly if you rely on either escape.

Added

• /# … #/ — a doc comment TJS actually owns. Multi-line, nestable, and able to quote any syntax without escaping.

  /*# … */ is an ordinary JavaScript block comment, so it inherits the rule that block comments do not nest and ends at the first */ inside it. A doc comment that cannot contain */ cannot document comment syntax — which is exactly what a language's own documentation must do. Escaping works and is what this repo did; an escape you must remember is a trap that fails as a parse error some distance from the cause.

  Claiming this syntax takes nothing away from anyone, and that is measured rather than estimated:

  const re = /# comment #/       parses — a regex matching #comment#
  const re = /# one
               two #/            SyntaxError: Unterminated regular expression
  

  A regex literal cannot contain a raw newline, so the multi-line form is already illegal JavaScript. The newline requirement is not a style rule — it is the whole subset-preservation argument (PRINCIPLES.md invariant 1), and single-line /#…#/ stays a regex forever. Under dialect: 'js' the syntax is left entirely alone.

  Doc comments are blanked at the first point any pass touches the source, which is the structural payoff: a doc comment exists to QUOTE syntax, so it is the place in a file most likely to contain the constructs every scanner is hunting for. Blanking it up front means the ~30 downstream passes cannot see into it at all — a structural fix for this project's dominant defect class rather than one more scanner that has to remember. A test '…' { … }, a wasm function, an unsafe marker or a Type declaration written inside one is inert.

  /*# … */ is retired as a doc comment but remains a perfectly good block comment, and stays the convention in .ts sources, where /# … #/ cannot parse.

  AJS has them too. The bar for adding a step to AJS's parser is "does AJS have this construct", never "is it harmless" — that distinction exists because seven TJS constructs once leaked onto the AJS path and one executed submitted source. A doc comment clears it: AJS source deserves to carry its own documentation exactly as TJS source does, and blanking a comment is lexical rather than semantic. Withholding it would have broken the subset in the awkward direction — a documented .ajs file would be legal TJS and illegal AJS.

  All 34 TJS examples are migrated (47 doc comments), and src/rbac/rules.tjs / src/linalg/index.tjs are the first real sources to use it. .tjs files now publish their own doc comments into the corpus, so a .tjs file is a literate program on its own terms — the documentation is in the language, and rendering it does not depend on anyone's build system.

  One thing the migration exposed: /*# … */ doc comments were shipping into emitted JavaScript, because they are valid JS. js-footgun-fixes emitted 265 characters, all of them comment and none of them code — and a test asserting code.length > 0 had been passing on that padding. It now emits nothing, correctly, and the assertion tests what it meant to.

• unsafe is deprecated. Every remaining use now warns, naming its replacement. The marker is the only escape in this language that does not say WHICH rule it suspends, and it is what drags /* @tjs-unsafe */ along as a comment channel.

  var and eval are now refused outright rather than offered an escape, and their diagnostics say so and say why. eval in particular could not have been given a named replacement: direct eval is a syntactic form that sees the CALLER's scope, so any wrapper would silently be a different operation — reaching the caller's scope is precisely the part that is dangerous.

  The reasoning is now a principle (PRINCIPLES.md, "An on-ramp and an off-ramp. No craters."): TJS provides a total file-level on-ramp and a total off-ramp, and a per-construct hole in an otherwise-native file is a third kind of thing that relieves the pressure to graduate properly. Strict mode and ESM set the precedent — measured, they still permit var and eval, so the lesson is not which constructs went but that where something was removed it was removed outright.

• LegacyDate(x) — a named confession replacing unsafe new Date(x). Raw Date is banned in native TJS (mutable, timezone-dependent) and Timestamp is the remedy, but a deliberate exception has to be expressible. Until now the only way to say it was the generic marker unsafe, which is the odd one out in this language: every other escape — DangerousLegacyEquals, LegacyExactly, LegacyDefault — is a named, greppable, deliberately-ugly callable that announces what debt it is taking on. unsafe says only "some rule does not apply here" without saying which.

  The diagnostic teaches the new form and still points at Timestamp first — the escape is not the advice, and there is a test pinning that ordering, because the diagnostic is the teaching moment.

• Prism language definitions for TJS and AJS — tjs-lang/editors/prism/tjs and /prism/ajs, generated by bun run build:grammars from the same editors/tjs-syntax.ts that already feeds VSCode, Monaco, CodeMirror and Ace. A fifth emitter, not a new grammar, so a keyword added to the source reaches all five.

  A colon example is highlighted as a VALUE, not a type, and that is the point rather than a detail. In function greet(name: 'Alice') the 'Alice' is a real string that survives to runtime, and reading it as a type annotation is the single most common mistake people make with TJS. Prism renders non-executable fences in doc systems and is being baked into printed and ePub output — where a wrong token colour is permanent and highlighting is the main thing a reader uses to decode unfamiliar syntax. So it gets its own example-value token, aliased to string so existing themes already render it correctly.

  Also distinguished: safety-marked returns (:! / :?), block constructs (test, mock, wasm, given, extend), /*# … */ doc comments, the declaration forms, forbidden keywords, and the deliberately-ugly escapes (unsafe, DangerousLegacyEquals, LegacyDefault) — which are marked important because looking alarming is their job.

  Guarded by editors/prism.test.ts, which asserts TOKEN TYPES rather than rendered HTML (the class names are what a theme styles against), and pins that every keyword in the source of truth reaches the generated definition.

• tjs-lang/rbac — the RBAC rule primitives are now importable. interpretRuleResult and the role/shortcut helpers had no built output at all (dist/src/rbac/ carried a lone .d.ts), so they were reachable only by reading rules.tjs out of the tarball. That is how #54 arrived: as a fail-open in a reference implementation nobody could import — which also meant nobody could receive the fix by upgrading. They now ship as dist/tjs-rbac.js, verified from a Node consumer.

  Scope is the RULE layer only. src/rbac/index.ts imports tosijs/rbac and tosijs/store, and tosijs is a devDependency here, so exporting that entry would ship a subpath that cannot resolve in a consumer's install. rules.tjs is self-contained, which is what makes it publishable.

• ./package.json is exported. Node refuses require('tjs-lang/package.json') without it, and several tools read the manifest (bundler plugins, version probes). Found while verifying the 0.13.12 tarball, when my own check hit it.

Changed

• The build compiles .tjs entry points in-process. esbuild has no .tjs loader and buildSync refuses plugins, so a .tjs entry is transpiled and written to a scratch file the bundler then reads. Deliberately NOT the shell form functions/ uses (tjs emit "$f" > "${f%.tjs}.js"), because > truncates the target before the command runs — a failed transpile there once left an EMPTY module that bundled and shipped. Writing only after a successful transpile means this cannot half-succeed.

  Incidentally now dogfooding: the build of tjs-lang compiles .tjs with tjs-lang.

• marked moved 9 → 18 (a devDependency; it does not affect your install). tosijs-ui peer-requires ^16 || ^17 || ^18 and we had 9.1.6, so the renderer behind our doc system was a version tosijs-ui does not claim to support — and the doc system is what the next release migrates onto.

  Nine majors is a big jump, so it was measured rather than assumed: all 109 docs were rendered through both versions. 31 byte-identical, 75 differing only in whitespace between block elements, and 3 substantive — two of which were marked 9 getting our prose wrong. It treated a pair of single tildes on one line as strikethrough, so ~0.13 ms (~8K themes/s) rendered as <del>0.13 ms (</del>8K themes/s). Our performance docs use ~ for "approximately" throughout. Real ~~strikethrough~~ is unaffected in both.

Fixed

• tjs-lang/rbac promised TypeScript declarations that no build step produced. The new export's types condition pointed at dist/src/rbac/rules.tjs.d.ts, and nothing generated it: tsc -p tsconfig.build.json only sees .ts, and rules.tjs is not a TypeScript file. A TS consumer of a brand-new export got no types at all, while the build reported success.

  Caught by scripts/prepublish-check.ts, which resolves every path exports names — but only at publish time. The reason no test caught it is worth recording: the guard in package-exports.test.ts excluded types conditions and excluded ./dist/ paths, so a types path pointing into dist/ was invisible twice over. Both exclusions are now covered by tests that were mutation-checked (delete the file, watch them go red).

  The build now generates declarations for any .tjs entry point whose types condition names one, driven off the exports map rather than a list, so the next .tjs subpath is handled without anyone remembering.

• demo/docs.json was ordered by the filesystem, not by its inputs. The .tjs doc walk used bare readdirSync, which returns APFS order locally and ext4 order in CI, so two entries could trade places with no content change. That made the committed-artifact check fail for anyone whose filesystem enumerated differently, reporting a stale artifact that was perfectly current. Sorted at both levels; verified by generating twice and comparing.

• The AJS grokkability lane could never run cold, and was scoring repaired output. Two problems in the one harness:

  Its beforeAll probes every downloaded model against bun's default 5s hook timeout, so a cold run died before measuring anything — and presented as "pin model not loaded", the harness blaming the environment for a question it never got to ask.

  It also ran fixCommonMistakes over model output before scoring, making every published rate a post-repair rate wearing a raw rate's label. Two of its three repairs were rewriting : string → : '' and : number → : 0 — spellings the language has accepted for some time via TYPE_NAMES. So the harness had been repairing something already fixed, which is exactly why the fix could never appear in the number meant to measure it. The rate is now the RAW rate; repairs are named and report separately what they would have recovered. First honest run against the pin: 20/20.

  Bare type names are now pinned deterministically by src/lang/ajs-type-annotations.test.ts, asserting the validator REJECTS the wrong type — accepting the annotation and inferring any would pass a parses-without-throwing test while validating nothing.

Security

• All 11 dependency advisories cleared; both trees report clean. In the DEPLOYED Cloud Functions tree, qs (6.15.3 → 6.16.0) and uuid (9.0.1 → 11.1.1) were runtime scope, so "dev-only, not shipped" was never a mitigation for them. At the root: flatted → 3.4.4, form-data → 2.5.6, protobufjs → 7.6.6, esbuild → 0.28.2. None of these reach a consumer's install — the published runtime dependencies (acorn, acorn-loose, acorn-walk, tosijs-schema) carry no advisories and are unchanged.

• bun audit now runs in CI, because Dependabot structurally cannot cover this repo's main tree. Measured, not assumed: Dependabot had produced alerts for exactly one manifest ever (functions/package-lock.json), and GitHub's dependency graph held 307 packages with none of the root's own devDependencies — the root has bun.lock and no package-lock.json, so it is invisible to the graph. At that moment bun audit found 9 root advisories (3 high) that Dependabot reported as 0. The gate was previously reachable only from the pre-tag lane, since test:fast sets SKIP_AUDIT=1, so between tags nothing checked.

• AUDIT_EXEMPTIONS is now empty, and the reason is worth recording: all seven entries were dated 2026-10-27 and every one was already fixable, six with a published fix available for months. A dated exemption reads as "handled" — the gate stays green, and green is indistinguishable from fixed. The file had already recorded this exact lesson about brace-expansion and it repeated verbatim; both times the trigger was accidental. The guidance now prefers an overrides entry, which fixes an advisory, over an exemption, which only agrees to ignore it.

0.13.12 — 2026-09-06

Two security-relevant fixes against published 0.13.11, and the end of a defect class.

Eval/SafeFunction returned plausible wrong values (#52) — spread was silently dropped and a dotted read came back as its own source text — and in the reference RBAC layer that inverted into a grant (#54). Both were reported by a consumer running against a known-good oracle, which is the only way either could have been seen: every wrong value had the right shape, so structural checks, typeof and length checks all passed. Separately, verifyPredicate was certifying impure functions as pure, so "verified" meant less than the badge claimed.

The rest is one class of defect, finally closed. Eight scanners that misread code merely MENTIONING the syntax they scan for — a test block quoted as data being executed and deleted, a comment containing export consuming the real one, a template's ${…} desynchronising the shared literal scanner, a quoted wasm function being compiled, a quoted Is operator being transformed. Each was found somewhere other than where it did its damage.

The dogfood behaviour gate went from 108 broken tests to zero. Every test suite we ship now converts to TJS, runs, and preserves every assertion — all three 1.0 self-hosting gates at zero, both ratchets pinned at 1.0. Roughly two thirds of that distance was defects in the gate rather than in the language, which is recorded at the baseline so the next bad number there is read as a question about the apparatus first.

Fixed — silent wrong values in Eval/SafeFunction

• Eval/SafeFunction returned plausible wrong values (#52). Two defects, both silent, both shipped in 0.13.11. Neither was a runtime bug — the AST emitter built an AST that did not represent the source:

  return data.a      ->  {"op":"return","value":"data.a"}                <- a bare STRING
  return data["a"]   ->  {"op":"return","value":{"$expr":"member",...}}  <- correct
  return { ...d }    ->  {"op":"return","value":{}}                      <- spread DROPPED
  

  Spread is now compiled instead of skipped. Both object/array literal handlers matched Property only, so a SpreadElement fell off with no error: { ...doc, rev: 1 } returned { rev: 1 } and lost every original field, and [...a] returned [null] — length 1, the hole presenting as a value. It now desugars to the call it means (Object.assign({}, …), [].concat(…)) and recurses, so the whole path is the one already tested and there is no second implementation to drift. Source order is preserved, which is the semantics: { a: 1, ...d } lets d win and { ...d, a: 1 } does not. DOCS-AJS.md documents spread under "What's Allowed", so refusing it would have made the doc wrong — the doc was right and the emitter was not.

  A dotted read returns the value, not its source text. Non-computed member access in value position emitted a dot-path string; the computed branch a few lines above already emitted a proper node and said why — "so the runtime evaluates the index rather than treating it as a string path" — the same reasoning simply had not been applied. The string reached resolveValue, failed to resolve (the root came from context, i.e. args, and the traversal only checks state), and fell through to "return the literal string". So the caller got back the characters they had written, as data.

  That one line explains every asymmetry in the report: typeof data.a, data.a * 2 and data.a.valueOf() were all correct because they build real nodes; only the bare return substituted. Pure boolean predicates were unaffected, which is why a permissions layer looked fine.

  The string-path optimisation survives where it is provably safe. It is deliberate and has a test to its name, and it is correct whenever the root is a local or a parameter — those land in state, where the traversal looks. The emitter now asks (TransformContext carries locals/parameters up a scope chain) instead of assuming.

  resolveValue's literal fallback is recorded, not changed. It cannot simply become an error: a hand-built AST legitimately says value: 'obj.prop' (the builder API, 35+ call sites) and a program just as legitimately says 'not.a.path' meaning a string — once both are strings they are indistinguishable. So the semantics stand and the near-miss is now reported to the flight recorder, which is what it is for.

  Guarded by src/lang/eval-value-fidelity.test.ts. Found by tosijs-platform against a known-good oracle — worth recording, because both bugs returned values of the right SHAPE, so every structural check passed and only a differential comparison could see them.

Security

• A rule returning a non-boolean granted access (#54). interpretRuleResult in the reference RBAC layer ended with allowed: !!result, so every truthy non-boolean was coerced to a grant. Combined with #52 — a dotted read returning its own source text — the most obvious rule anyone would write inverted:

  return doc.published        // doc.published === false
  ->  'doc.published'         // a non-empty string (#52)
  ->  !!'doc.published'       // true
  ->  ACCESS GRANTED          // no error, no warning
  

  Bracket access, !doc.published, doc.published === true and if (doc.published) were all unaffected, which is exactly why a test suite can miss it — every case in the reporter's own baseline happened to use a surviving shape.

  A non-boolean result now denies, and the object form requires allow to be a boolean rather than coercing it. The reason string distinguishes "the rule said no" from "the rule did not answer", because a denial that reads like an ordinary policy decision hides a broken rule.

  Fixed separately from #52 and on its own terms, even though #52's fix means that particular input can no longer arrive: "the input cannot be corrupted any more" is not the same as "the interpretation is correct". A security property must not depend on the language never having a bug — a nullish-coalescing chain, an accidental object or a forgotten await must all fail closed. This also restores a claim the surrounding design already made, and which this function was the one place not to honour: fuel exhaustion, a thrown error, or a non-boolean return all evaluate as false.

  No known exposure: reported by tosijs-platform with no ajs-backed endpoint exported yet. Guarded by src/rbac/fail-closed.test.ts and by inline test blocks in rules.tjs, so the guarantee travels with the code.

• verifyPredicate certified impure functions as pure. The verifier checked calls — effectful globals, unknown methods, ReDoS — and never looked at assignments or at references to bindings outside the function. All of these were reported safe: true:

  function f(a) { globalThis.hit = a; return true }   // writes a global
  function f(a) { window.hit = a; return true }       // writes a global
  let count = 0
  function f(a) { count += 1; return count > 0 }      // mutates outer scope
  const seen = []
  function f(a) { seen[0] = a; return true }          // mutates outer scope
  

  So "verified pure" actually meant "calls nothing effectful" — a far weaker claim than the badge makes. redos-lint.test.ts states this file's doctrine and it applies unchanged: over-flagging only costs the badge; certifying a dangerous pattern is a broken promise. This was that, in a dimension nobody had checked.

  Purity is the entire contract behind the badge: a verified predicate compiles to native JS and is trusted without further checking, and docs/type-system-north-star.md has predicates travelling to other runtimes as serialized ASTs, where being pure is precisely what makes them portable. An impure predicate does not port, and nothing said so.

  Not rated a vulnerability, because predicates come from source the developer wrote rather than from untrusted input — but it is a promise this project makes and did not keep.

  The check is scope-correct, not name-based, because the cheap version fails both ways: a parameter named count shadowing a module-level count is local and must keep the badge, while a nested arrow's own binding must not make an outer one writable.

  Mutability is keyed on whether a module-level binding is ever written, not on its declaration keyword. The first implementation used kind !== 'const' and rejected 115 tests in src/css/ — the library that is the main consumer of the badge — because its keyword tables ship as var CSS_NAMED_COLORS = [...] and are never touched again. The keyword is wrong in both directions: that var is constant in every sense that matters, while const rows = [] followed by rows.push(…) is a const that mutates.

  Found while sizing the purity gate for the :! promotion (TODO.md A4c), which needs the same analysis — and which cannot use this verifier for a second reason recorded there: it is also too STRICT, rejecting for loops and .push() on a local array.

  Guarded by src/lang/predicate-purity.test.ts, which pins both directions — the seven impure shapes above, and eleven ordinary pure ones that must keep the badge.

Fixed — the emitted runtime and the TypeScript bridge

• The emitted runtime no longer declares its helpers in your namespace (#39). The preamble declared Eq, Is, IsNot, NotEq, TypeOf, Type, Generic, Enum, Union, FunctionPredicate, MonadicError, tjsEquals and the Legacy* family at module scope. Those are ordinary JavaScript bindings in the author's own module, so a file that imported one and also used the syntax that generates it declared the name twice:

  import { Eq } from 'tjs-lang/runtime'
  export function same(a: 0, b: 0): true { return a == b }
  -> SyntaxError: Identifier 'Eq' has already been declared
  

  Node refuses to LOAD such a module, so nothing in it runs — no error from your code, because your code never started. #39 named five of these; the dogfood gate found thirteen.

  The inline runtime now lives inside one __tjs_rt IIFE and generated code calls __tjs_rt.Eq(…). The bodies are untouched: they still call each other by bare name inside the IIFE, so this is a scoping change, not a rewrite of the semantics.

  The rename has to happen at generation time, which is the whole reason this was not a one-line fix. Once the preamble and your code are one string, a compiler-generated Eq( and a hand-written one are the same five characters — no later pass can separate them.

  The ambient surface is preserved. Is(a, b), DangerousLegacyEquals(a, b), LegacyDefault({…}), Exactly('a') and the type constructors are documented as simply available, and they were available because of those module-scope declarations. Emitted files still bind them — but only when you have not bound the name yourself, which is a question about your AST and therefore decidable, unlike the one above.

  Measured on the dogfood behaviour gate: 1076 assertions lost → 313, and 38 broken tests → 30. The disparity between those two numbers is the interesting part: ten suites were failing at LOAD time, so the gate had been reporting six "broken tests" for what was really ~760 lost assertions. A load-time failure is under-reported by any metric denominated in tests, by roughly the size of the file.

  Guarded by src/lang/rt-namespace.test.ts, which pins all three properties — no collision, ambient names still work, and nothing inside the IIFE is unreachable.

• A quoted wasm function declaration was COMPILED. extractWasmFunctions detected on raw source, so a wasm function written inside a string was compiled to WebAssembly and the fixture replaced by the JS wrapper it was supposed to produce:

  const SRC = `wasm function total(a: Float32Array, n: i32): f64 { … }`
  ->  const SRC = `function total(a, n) { return globalThis.__tjs_wasm_total(a, n) }`
  

  Four suites were being corrupted this way, and only ONE of them showed up as a conversion failure. That is the part worth keeping: a scanner that mangles a fixture is visible only when the mangling breaks the parse. When it produces valid code — as it did here, four times — the file converts cleanly and lies at runtime instead, asserting against a fixture that is no longer the fixture. One had a real compiled WebAssembly module emitted into the test file itself.

  Its regex also opened with ^\b against a SLICED string, where \b is satisfied by the first character being a word character — so it never looked at what preceded the match, and the comment claiming it stopped mywasm was wrong. Same pair of defects, in the same order, as extractAndRunTests.

• A quoted Is / IsNot operator was transformed. transformIsOperators was two plain source.replace(…) calls, so a Is b inside a string became __tjs_rt.Is(a, b). It was the last failure standing on the dogfood behaviour gate — in eval-no-transpile-execution.test.ts, whose entire job is to hold TJS constructs as data and check which ones reach the AJS path. A scanner that edits its own fixtures makes that suite measure itself.

  Masking is safe for the operands even though the pattern accepts string literals: maskLiterals blanks a literal's interior and keeps its quotes, so c Is 'lit' still matches while 'x Is y' no longer does.

• A quoted /* @tjs-unsafe */ annotation was applied as a real one. applyUnsafeAnnotations was a code.replace(…) over raw source, so it rewrote the annotation wherever it appeared — including inside a string that merely quotes it. The damage is delayed and lands nowhere near the cause: unsafe is TJS-only syntax, so once it is inside a TypeScript fixture that a test feeds back to tsc, the parser reads it as a bare expression statement and ASI splits it from the expression it was meant to mark.

  `const d = /* @tjs-unsafe */ new Date(x)`   ->   `const d = unsafe new Date(x)`
                                             ->   const d = unsafe; new Date(x);
  

  The annotation's own test suite carries exactly that fixture, so the file documenting the feature was the file it broke. Matched over maskLiteralsKeepComments now — comments intact (the annotation IS a comment), literals blanked. Rows added to literal-blindness.test.ts.

Self-hosting

• The dogfood behaviour gate reached zero on all three of its 1.0 gates.

  original : 4251 pass, 0 fail, 9703 assertions
  converted: 4251 pass, 0 fail, 9703 assertions
  

  Every test suite we ship converts to TJS, runs, and preserves every assertion. KNOWN_CONVERSION_FAILURES is empty. Both ratchet rates are now pinned at exactly 1.0 — there is no slack left to give back, so any regression fails immediately.

  It read 108 broken tests two days ago. The honest accounting of that distance: roughly two thirds of it was defects in the GATE, not the language — a test block quoted as data being executed and deleted, relocate() rewriting import paths inside template literals, relocate() not rewriting require at all. The language defects were real (the __tjs_rt namespace collision, and three scanners reading fixtures as code) but the measurement was the bigger liar. Recorded at the baseline so the next person reads a bad number here as a question about the apparatus first.

Changed — the dogfood gate stopped discarding its own evidence

• The dogfood behaviour gate stopped throwing away its own work list. Three things, all of which had cost real time every session the gate was worked:

  • relocate() did not rewrite require('./x'), only import. All 15 failures in lang/features.test.ts — the largest remaining cluster by a factor of seven — were Cannot find module './parser' from test bodies reaching for un-exported helpers. 313 assertions lost → 16, and 30 broken tests → 5.
  • testsBroken was printed as a bare integer, which is the defect the block above it had already fixed for the baseline ("a number with no name attached"). It now prints the failures clustered by suite, which is the axis that has carried the signal every time.
  • DOGFOOD_KEEP=1 leaves the converted tree in place, and the temp directory is created inside the test rather than in the describe body — a describe body runs at collection time, so merely loading the file made a directory that any filtered run then left behind. Twenty-two empty .dogfood-* directories had accumulated in the repo.

  That relocate() gap is the third time this gate's own defects dominated its output, and they are now the majority of every movement it has ever recorded. A bad number here is a question about the apparatus first.

Fixed — the literal-blindness class

• A comment mentioning export consumed the real one (#51, reported by tosijs). fromTS decided whether an arrow-function const was already exported with tjsFunc.includes('export ') — a substring test over the whole rendered function, leading comments included. So a body comment quoting `export interface Sub extends …` satisfied the guard and the declaration's own export was never added:

  export const withAttributes = <A …>(…) => { … }   ->   function withAttributes(…) { … }
  

  No error, no warning; the failure surfaces at LINK time in a consumer's bundler, and only if something imports that name. Rewording the comment brought the export back, which is what "comment text changes the emitted code" looks like from outside. Now decided from the declaration.

  The report says it could not be reduced to a small file. It reduces fine — the reduction was measured by looking for the FUNCTION, which is still emitted. Only the export is lost.

• A test '…' { … } quoted as DATA was executed and deleted. extractAndRunTests detected on RAW source, so a test block written inside a template literal or a double-quoted string was taken for a real one: its body ran at transpile time via new Function, and the text was removed from the emitted output. Both silent.

  tjs(`test 'uses toBe' {\n  expect(1).toBe(1)\n}`)   ->   tjs(``)
  

  Any .tjs file that quotes a test block — every fixture in this repo's language tests, and any documentation example — lost the quoted text. Detection now runs over maskLiteralsKeepComments: literals blanked, comments INTACT, because /*test … */ is a deliberate TS-compat spelling. Body extents come from matchingBrace, retiring the fifth hand-rolled literal scanner in this codebase.

  Measured effect on the dogfood behaviour gate: 108 broken tests to 59. Three of the four worst-affected suites are language tests whose fixtures are TJS source held in strings, so the gate had been reporting their deleted fixtures as "conversion loses assertions" — 52 of 99 failures were this defect and nothing to do with conversion. Assertion preservation 87.2% → 88.0%, tests 88.9% → 90.2%; baseline ratcheted down.

• test was not actually required to be a whole word. The check was source.slice(i).match(/^\btest\s+/), where \b sits at the start of the sliced string and is therefore always satisfied, so mytest 'x' { } matched.

• tjs-playground --port N --force could have signalled a developer's test run. OUR_SERVERS matched cli/playground as a bare substring, so it also matched src/cli/playground.test.ts — and since the second identity rule only additionally requires the argv to reference this checkout, any process whose command line merely NAMED that file was identified as our server. Test runs genuinely hold ports (several suites call Bun.serve). The generic entry markers now have to end at a token boundary, so a path that merely contains one no longer qualifies. Same defect as the OUR_ROOT anchor one level in: a marker identifying a file that exists rather than a process that is running.

  Found sitting in the dogfood gate's baseline, which spawns bun test <every suite path> and so is the only invocation that builds that argv. The gate printed 1 fail on the unconverted corpus and neither named it nor failed on it; it now does both, and the conversion-damage figures are no longer measured against a baseline that is allowed to be red.

• A template literal's first ${ … } desynchronised the bang-access transform for the rest of the file. transformBangAccess hand-rolled its own literal tracking, and its ${ arm switched to code and never switched back. From the first substitution onward the remainder of that template was scanned as code, so its closing backtick was read as an opening one and every literal after it carried inverted parity — a !. quoted as data was then rewritten in place:

  ['bang access', 'function f(o) { return o!.a }']
  ->  ['bang access', 'function f(o) { return __tjs.bang(o,'a') }']
  

  which injects bare quotes into a single-quoted string and fails the parse tens of lines from the cause. The scanner now keeps one frame per template, so ${ … } returns to the template body at its matching } (correct through nesting), and it skips regex literals, which could open a phantom string the same way. Bang access inside a substitution — `${o!.a}` — still transforms, now including nested templates, where previously only the first substitution behaved.

  This is the literal-blindness class (docs: src/lang/literal-blindness.test.ts), and it is the last entry but one on the dogfood conversion ratchet: lang/eval-no-transpile-execution.test.ts now converts, taking KNOWN_CONVERSION_FAILURES from two back to one.

• The shared literal scanner had the same defect, with twelve consumers. scanLiterals ended a template at the next bare backtick, so `${ x === "`" ? a : b }` ended at the quoted one — and from there the mask inverted: code masked, later literals exposed. Template ends are now found past their own ${ … } substitutions, through nesting, strings and comments. What consumers see masked is unchanged: a substitution's interior stays blanked, which is a separate and much wider decision. Regex literals inside a substitution remain untracked, and the limitation is now stated at the function rather than left implicit.

Added

• The dogfood converter gate now checks that every exported value survives conversion, as the #51 report suggested. A dropped export passes conversion, compilation and graduation, so none of the three existing stages could see it. Validated across the compat corpus first (2,085 real files, zero violations once ambient export declare const is excluded), so the bar is not one this codebase happens to clear. Pinned at 100%, not ratcheted — unlike graduation, there is no legitimate reason for it to be below.

Fixed — the dogfood gate itself (not shipped code)

• The dogfood behaviour gate's own relocation step was literal-blind. relocate() rewrote import specifiers with a regex over raw text, so it also rewrote the ones inside TEMPLATE LITERALS that suites write out as fixture modules at runtime — repointing them at a source directory where no such file exists. Those suites then failed and were scored as conversion losing tests. It now asks acorn which string literals are import sources, because masking cannot help here: an import specifier IS a string literal, so blanking literals blanks the very text to rewrite.

  59 broken tests → 38. Combined with the test-block fix above, the gate went from 108 to 38 in one day, and two of those three movements were defects in the gate rather than in conversion.

Changed — cleanups

• extractAndRunTests no longer calls source.slice(i) once per character, and no longer carries its own literal scanner. Both are cleanups, not a speed-up: measured against the previous implementation on a 459KB file the two are indistinguishable (2926ms vs 2940ms), because JS engines represent str.slice(i) as an O(1) view rather than a copy. Recorded because the opposite was the obvious guess, and the compat scan's four preprocess is quadratic skips still stand — whatever makes preprocess blow up past ~1MB is somewhere else and is still unidentified.

0.13.11 — 2026-09-04

Three findings from the 0.13.10 pre-release review, all pre-existing, none introduced by 0.13.10. Each was reproduced before being fixed and is pinned by a test.

Security

• The VM resolved inherited names to host values. Every lookup keyed by a guest-controlled name used in / bare bracket access on a plain object, and in walks the prototype chain — so constructor, toString, valueOf, hasOwnProperty and seven other Object.prototype members resolved to real host functions, past an allowlist that only ever enumerated own keys. With no capabilities and 400 fuel:

  return { v: constructor('abc') }   ->  { "v": "abc" }   // the host Object, CALLED
  return { v: toString() }           ->  "[object Undefined]"
  

  No escalation to Function (assertSafeProperty and SAFE_METHOD_NAMES hold) and no prototype pollution, so this was not an escape — but host functions crossing into guest scope is the wrong side of the boundary. Fixed at all three lookup sites; builtins and unsupportedBuiltins are Object.create(null) as well.

  Guest scopes are prototype-linked on purpose (Object.create(parentState), so a child write shadows), so the fix walks the scope chain and stops at Object.prototype rather than demanding own properties — a plain own-property check severs lexical scoping, which is how the first attempt at this failed.

• Eval/SafeFunction now cap source length (maxSourceBytes, default 64 KB), refused before transpiling. fuel and timeoutMs are properties of vm.run, and transpilation happens first, so neither bounded it: with { fuel: 10, timeoutMs: 1 }, 500 KB took 3.9s and 1.8 MB took ~145s, charging 0.2 fuel throughout. Measured in bytes, not string length. Set 0 to opt out for trusted source. The hosted endpoints name the limit explicitly.

Fixed

• The two transpile() entry points gave OPPOSITE input contracts for the documented AJS entry shape. For function agent({ apiKey: 'sk-example' }), tjs-lang produced required: ['apiKey'] and rejected a missing input, while tjs-lang/lang produced no required and vm.run(ast, {}) returned { apiKey: 'sk-example' } — the example value, credential-shaped for a parameter called apiKey, silently substituted for an input the caller never supplied.

  The emitter's required-parameter scan inspected only top-level AssignmentPattern params, so a destructured ObjectPattern — the documented AJS entry shape — matched nothing; and because that branch was an else if, the name-based fallback was skipped too. It now descends into destructured members, and falls back whenever the scan yields nothing, since an empty result means "could not index this shape", not "nothing is required".

0.13.10 — 2026-09-03

Changed — AJS parses through its own core, not parse() with a flag

The structural fix behind 0.13.7's test-block RCE. That vulnerability was one missing !options.vmTarget among ~30 source transforms of which exactly two checked the flag, so ~28 TJS transforms ran when compiling AJS. A gate fails open, and this one had for months.

AJS now parses through parseAgentSource() in the new src/lang/parser-agent.ts — four steps (hashbang, line comments, colon shorthand, param markers), because that is what AJS is: a JavaScript subset plus typed signatures. Adding a TJS transform means editing parser.ts, which AJS does not call, so there is nothing left to remember.

All seven previously-leaking TJS constructs — bang access, Is, inline wasm function, Type, Generic, extend, FunctionPredicate — are rejected on the AJS path now, closed as a group rather than one at a time. They were inert, but accepting syntax the language does not have is how the last one arrived.

vmTarget is removed from ParseOptions and PreprocessOptions. It was internal (both AJS entry points set it themselves) and is not part of the documented API, so no supported usage changes. parse() is TJS's parser and says so.

One visible behaviour change: two same-name top-level functions in AJS source are now rejected by acorn (Identifier 'x' has already been declared) rather than by TJS's polymorphic-merge pass (ambiguous signatures). Same rejection, from the JavaScript rule that actually governs a JavaScript subset.

Guarded two ways in src/lang/eval-no-transpile-execution.test.ts: an acorn-parsed pin on the AJS pipeline's import set, so a new transform fails at the import rather than waiting for someone to think of a construct that exercises it; and the existing behavioural ratchet, whose known-leak list is empty.

Scope of that claim, stated honestly. parser-params.ts is shared with TJS's parser, so "absent by construction" is true of the transform list, not of every behaviour reachable through it: TJS safety markers (!/? on params, :!/:? on returns) are still accepted and silently discarded on the AJS path. No execution, no capability, no fuel bypass — but an author writing function main(!apiKey: '') gets the opposite of what the marker documents. Tracked in TODO.md.

Shipped as a patch, with the breakage named. Three things could bite:

• If you passed vmTarget to parse() or preprocess(), it now throws, naming parseAgentSource() as the replacement. It is not ignored: the flag used to suppress transpile-time new Function(), so silently dropping it would have re-enabled execution for a caller who had explicitly asked for the protection. TypeScript only ever caught the inline object-literal case, so a JS consumer or an as any needed a runtime refusal.
• If AJS source you ship contains one of the seven constructs, it now fails at transpile instead of parsing. They failed later and less clearly before; a transpile error is louder.
• Two further acceptance narrowings, found by the pre-release review and not by the seven- construct list: a typed let (let x: 0 = n) and a leading safety none directive now fail with an acorn Unexpected token on the AJS path. Neither is documented AJS.

Neither the flag nor the constructs are a documented API, which is why this is a patch rather than a minor.

Fixed

• tjs-lang/vm is 23% smaller and tjs-lang/eval is 40% smaller (283→218 KB and 164→99 KB raw; 88→66 KB and 54→32 KB gzipped). Not an optimisation — the VM had been bundling ~26 TJS-only source transforms it never legitimately ran, and giving AJS its own parser dropped them. Less code on the path that compiles untrusted input is a security property before it is a size one. The README table is updated and re-measured.

[0.13.9] — 2026-09-03

SECURITY — a TJS example value is parsed, never executed

Second transpile-time escape, and a different path from 0.13.7's. A return-type annotation containing = was evaluated rather than parsed:

function f(a: 0): { x = (globalThis.PWNED = 1) } { return { x: a } }

tjs check on that file ran it. So did tjs emit, the bun .tjs plugin, the module loader and the playground — anything that transpiles source it did not write. Eight emitter sites used new Function(\return ${text}`)()` to turn an example into a value.

This is the ordinary tjs() path, so 0.13.7's vmTarget gate did not touch it. The AJS path rejects the carrier, so the VM and the hosted endpoints were not affected — the blast radius is developer and CI machines transpiling untrusted .tjs.

Fix: src/lang/literal-value.ts parses examples with acorn and accepts only literals — strings, numbers, booleans, null, regex, arrays, plain objects, signed numbers, and non-interpolated templates. No allowlist of dangerous names and no sanitising of source text: anything that can compute is not an example, and that is decidable from the AST. Ordinary return defaults are unaffected.

Found by the post-remediation review (reviews/0.13.8-post-remediation-review.md).

Fixed

• Two self-hosting canaries had been red on main for five CI runs. They transpile ~275KB of parser modules at ~79% of bun's 5s default and carried no explicit budget. A known-red baseline hides every real failure behind it.

Changed

• The structural guard in eval-no-transpile-execution.test.ts now scans the emitters and predicate.ts, not only the four parser files. It had asserted that test extraction was "the only dynamic-execution site in the entire parse path" — a claim broader than what it checked, which is the failure that test exists to prevent. Widening it surfaced the eight emitter sites above plus two legitimate ones, each now named with its justification.

Known

tjs-lang <= 0.13.8 all carry at least one transpile-time execution path. No GitHub advisory has been filed and prior versions are not deprecated: this project has no known consumers, so the automated-notification machinery would be ceremony rather than protection. Revisit if that changes.

[0.13.8] — 2026-09-03

SECURITY — 0.13.7 shipped the fix in src/ but not in dist/

If you installed 0.13.7 from npm and use it under Node, upgrade. 0.13.7's security fix (a VM-target transpile no longer executes the code it is transpiling) was real in source and absent from the published bundles: dist/ had been built 35 minutes before the fix landed.

Bun resolves this package to src/, so every local check passed. Node resolves it to dist/, so every Node consumer of 0.13.7 got the vulnerable build — including anyone importing tjs-lang/eval. Verified by fresh-installing the published tarball and running the exploit against it, which is the only check that would have caught it.

No source change from 0.13.7. This release is the same code, correctly built.

Added

• src/dist-freshness.test.ts — the committed dist/ bundles must not be older than the source they are built from. editors/** has had this guard for months; dist/ is larger, is published, and had none. The mechanical release check had already reported artifact freshness — no build script as a SKIP, on a tool whose summary says "skips are NOT passes"; it was read as a pass anyway.

[0.13.7] — 2026-09-02

SECURITY — a VM-target transpile no longer executes the code it is transpiling

If you call Eval, SafeFunction, or expose either over a network, upgrade.

parse() ran every test '…' { … } block with new Function(body)(). Eval and SafeFunction transpile the submitted string before vm.run, so the payload executed with full ambient authority before fuel, timeout, capabilities and the membrane existed:

Eval({ code: "test 'x' { globalThis.__PWNED__ = true } return 1", fuel: 10, timeoutMs: 1 })
// -> { result: 1, fuelUsed: 0.2 }     and __PWNED__ === true

timeoutMs: 1 was irrelevant and 0.2 fuel was charged, because the whole sandbox is downstream of transpilation.

It was a category error before it was a vulnerability. AJS has never had test blocks — they are a TJS feature, and the AJS path inherited them only by sharing parse(), where every other TJS-only transform is gated on vmTarget and this one was not. An agent language whose premise is that code travels as data and runs with no ambient authority was calling new Function on submitted source.

What changed: a VM-target transpile rejects test blocks as the syntax error they are. TJS inline tests are unaffected — no .tjs behaviour changed, and the global runTests default was deliberately not touched, because that would have altered documented TJS behaviour to fix a bug that only ever existed on the other path.

Verified two ways: every TJS construct a VM-target transpile still accepts was probed for transpile-time execution (none executes), and a source-level test asserts that test extraction is the only dynamic-execution site in the entire parse path.

Still open and tracked: a VM-target transpile accepts seven TJS constructs AJS does not have (inert, ratcheted). The structural fix — an AJS core that TJS wraps, rather than one shared function with flags — is planned. A gate fails open; layering fails closed.

Fixed

• An annotated arrow after a keyword failed to parse. return (x: 0) => x, export default (x: 0) => x, throw (x: 0) => x and curried (a: 0) => { return (b: 0) => a + b } all raised Unexpected token. A guard read the single preceding character, so the n of return read as a callee. Introduced in this cycle; not present in 0.13.6.
• A TypeScript optional parameter no longer acquires a runtime default. fromTS emitted name?: T, and TJS's ?: is documented as "same as name = value" — so every optional gained its type example as a default. For a predicate type that meant a truthy object where TypeScript gives undefined, and radash's unique threw TypeError: toKey is not a function. Optionals convert to T | undefined again, and required: false is reported correctly.
• Converted TypeScript overloads no longer change behaviour for unmatched input. TypeScript erases overload signatures, so the implementation receives every call. We emitted runtime dispatch variants that rejected input matching no signature — inRange(null, 0, 20) returned an error where TypeScript returns false. Conversion now emits the implementation and suggests the upgrade instead of performing it. The variants could never have earned their cost: with one body, every variant was a pass-through, so dispatch routed nothing and only gated. It also leaked ...__args into the generated .d.ts, producing a declaration you could not legally call.
• Same-named functions in different scopes are no longer merged. The polymorphic merge grouped by name across the whole file, so two ordinary local helpers were rejected as "ambiguous variants" — legal JavaScript that TJS refused, a subset violation.
• A type-only class field no longer absorbs the next member. readonly get: T above modify(f) {…} emitted a bare get, producing a getter named modify. Private (#x) fields are still emitted — they are load-bearing, not type-level.
• $ is a legal identifier character. function $constructor(…) and Array$ were not recognised as declarations at all, so their parameters were never transformed. Also fixed in type-name position (: Record$).
• A ternary's : is no longer read as an arrow's return type. flag ? ((r) => f(r)) : (r) => {…} had its alternative deleted.
• A generic type-parameter list is split depth-aware. <Config = { a: X, b: Y }> was cut inside its own braces, emitting a brace closed by a bracket. A default containing => was silently dropped.
• A generated diagnostic can no longer be terminated by the code it quotes. TypeScript type text often contains */, which closed the comment early and turned the remainder into stray code.
• convert --emit-tjs no longer reports success for output it cannot read. It now validates its own result, exits non-zero, names the file, and does not write the artifact.
• given no longer warns you to use given. It lowers to a switch before parsing, so the advice fired on it — quoting the internal lowering back at the author, and failing --max-warnings 0.
• A reasoning model's answer is read from whichever channel holds it. Asking for structured output can leave content empty with the answer in reasoning_content; six call sites read content directly.

Changed

• MonadicError is shared across modules via a shape-versioned global slot, so instanceof now works across a module boundary. isMonadicError remains the contract for anything crossing one. See docs/runtime-fusion.md for the rule this establishes: code fuses, data unions.
• README bundle sizes remeasured — they had drifted 17–23%.

Added

• tjs-lang/lang exports isTernaryColon (src/lang/expression-context.ts), the first syntactic primitive above the lexical layer. See docs/parser-primitives.md.
• docs/parser-primitives.md, docs/runtime-fusion.md.
• bun run test:compat-scan — a ratchet over the whole compatibility corpus.

Compatibility

Every file in zod, effect, kysely, radash, superstruct and ts-pattern now converts and parses — 1973/1973, up from 1951. All six projects' own test suites pass against our output.

[0.13.6] — 2026-08-26

BREAKING — defineAtom now defaults to effects: 'io'

If you define custom atoms, read this. It ships as a patch, deliberately, and the reasoning is worth stating because the obvious call is the wrong one.

Gating a security correctness fix behind a version bump means every adopter on ^0.13.x keeps the hole until they choose to move. Here the failure mode is the silent absence of protection, so the person who never upgrades is the one who stays exposed — while the person who does gets, at worst, a loud error telling them their atom was handing live host references to guest code. There are no bad surprises in that trade, only good ones, and they should arrive automatically. Breaking toward correctness, loudly, is a bugfix.

So: no bad surprises, but not silent ones either — hence this entry, the BREAKING marker, and the migration notes below.

effects defaulted to 'pure', and 'pure' skips the capability membrane. Not a lighter check — membraneValue has exactly one call site, inside if (atom.effects === 'io'), so an atom that didn't opt in bypassed the boundary entirely: host objects reached guest scope by reference, getters intact, with methodCall standing right there.

One default was serving two populations with opposite needs. Core atoms (len, jsonStringify, map) work on data already inside the VM, so 'pure' is right for them. Atoms defined through the public defineAtom exist to bring host data in — Firestore snapshots, Elasticsearch hits, SDK responses — which is precisely the data the membrane exists to sanitise, and precisely the shape that carries accessors. The default served the first and silently disabled the boundary for the second, whose authors are outside our audit surface.

It failed quietly, which is what settles it: nothing warned, nothing broke, the atom worked and the hardening was absent. snowfox-app upgraded specifically for the 0.12.0 prototype-strip and later found all four of its custom atoms untagged (#38). When the people who read the release note and acted on it still don't get the protection, documentation is not a control.

What changes for you. An atom you define without effects now has its return deep-copied through structuredClone before it reaches guest state. Three consequences:

• Identity is not preserved. The guest gets a copy. If you relied on handing through a live reference, that stops working — deliberately.
• Non-cloneable returns are now rejected with a MonadicError (Capability boundary rejected the return of '<op>') instead of silently succeeding. Functions and accessor properties are refused; build the object literally, naming each field. { ...someResponse } is not the fix and fails silently — a Response keeps ok/status on its prototype, so the spread is {}.
• The atom is no longer callable from a verified predicate, since predicates may only call pure atoms.

If your atom really is pure, say so and nothing changes:

defineAtom('slugify', inSchema, outSchema, fn, { effects: 'pure' })

That is the honest fix, not a workaround — and it is now an explicit claim rather than something you get by forgetting. Core atoms are classified the same way, by an explicit sweep in both directions, so their class no longer depends on which default is in force.

Fixed

• convert stripped new from locally-declared classes (#37). Converted modules threw Class constructor X cannot be invoked without 'new' and could not be imported at all — a static zero = new Thing(0) field fails at module evaluation time, before any of the module's own code runs. Regressed in 0.13.0; 0.12.x and earlier are correct.

  Dropping new is only safe where a class is callable, and in native .tjs it is (the emitter Proxy-wraps it). But every fromTS output carries the /* tjs <- … */ annotation, and that annotation means JS semantics — no Proxy wrap — so the new being removed was load-bearing. The transform now runs at graduation (where the annotation is stripped and the class becomes callable), which is the step whose job it is.

  This was also corrupting converted test suites: preserved assertions 0.88 → 0.898, preserved tests 0.89 → 0.912. Both dogfood ratchets raised to lock it in.

Added

• A type can declare asCompared() on itself (#33), beneath the extend/global registries in the projection chain. A registered projection still wins — the registries are keyed by constructor.name, which is a third party describing a type it does not own, whereas a method is the type answering for itself.

  This is the layer a Proxy can reach, and nothing above it can be. A proxy over new Number(0) has no internal slot (and slots are not forwarded to the target), so the slot read throws while instanceof Number says yes; and it reports its target's constructor.name, so the only registerable key is 'Number' — which would claim that key for every boxed Number in the process. A get trap can serve a method.

  class Money { constructor(c) { this.cents = c }  asCompared() { return this.cents } }
  new Money(500) == new Money(500)   // true
  if (new Money(0))                  // falsy
  

  Containment is unchanged: the probe and the call are both fail-soft, and a projection that is not a primitive is ignored rather than honoured.

Fixed (same change)

• A literal union disagreed with == about the same value. __oneOf (the check emitted for mode: 'a' | 'b') walked unwrapBoxed alone while every comparator walked the projection chain first — so a value could satisfy v == 'b' and fail the check 'a' | 'b'. The emitter had listed unions as a reason to emit the projection table since 0.13.4; the union check just never read it.

[0.13.5] — 2026-08-25

Fixes two defects in 0.13.4's asCompared, both found by a nine-lens review run after that release was published. If you use asCompared, upgrade. If you do not, the second one still affects you — the projection table is emitted into every file that uses ==, Is or truthiness, whether or not it declares a projection.

0.13.4 also went out without its tag being pushed, so the full-suite pre-push gate never ran for it. That is how it shipped.

Fixed

• A projection declared in one module silently changed another module's if. The projection table was at MODULE scope rather than per-runtime, and extend fed it unconditionally — so a module with no extend at all had its control flow change when an unrelated module loaded:

  B before A loads: truthy
  B after  A loads: FALSY     ← B has no `extend`
  

  Four shipped documents asserted the opposite, including this changelog's own 0.13.4 entry ("one module's projection cannot reach another's comparators"). The global write is gone.

  The structural half, which is why the first attempt got it wrong: == and Is are emitted bare and read the file-local table, but truthiness went through __tjs.toBool — the SHARED implementation, which cannot see it. So a value could be falsy without being equal to false, inside one module. The emitted runtime binding now overrides its own toBool to consult the file-local table, so all three comparators read one table and it is this file's.

• An attacker-controlled constructor.name reached Object.prototype. The emitted table was a bare {} and the lookup was __ac[k], so a key from JSON.parse — which creates a real own constructor property — walked the prototype chain. __ac['toString'] resolved to Object.prototype.toString, which returns a conforming primitive for any object, so two distinct objects with different contents compared equal under emitted ==:

  eq(JSON.parse('{"constructor":{"name":"toString"},"x":1}'),
     JSON.parse('{"constructor":{"name":"toString"},"x":2}'))   // was true
  

  The table is now Object.create(null) with an own-property check, and the resolved value must be a function. Verified against toString, valueOf, hasOwnProperty, isPrototypeOf and toLocaleString.

• wasm { } fallback { } threw instead of falling back when the engine has no wasm compiler (#36). The async retry lived inside the catch of the sync attempt with nothing around it — WebAssembly.instantiate normally rejects, so a .catch was assumed sufficient, but under memory pressure SpiderMonkey throws no WebAssembly compiler available SYNCHRONOUSLY and that escaped, taking down the whole module. So fallback covered "this module failed to validate" but not "this engine has no wasm compiler right now" — the broader case, and the one an author cannot code around: intermittent, resource-dependent, ~1 run in 6 on a loaded Firefox. Reported from tosijs-ui's Playwright lane.

• The dependency-audit gate did not cover functions/. It ran bun audit with no cwd override and there is no workspaces field, so the deployed Cloud Functions tree was outside it — which is how an ecosystem sweep found 3 criticals there while the gate reported green. Both trees are audited now.

Changed

• Dev-tree advisories cleared (#31): firebase devDep ^10 → ^12 removes all eleven undici advisories; root firebase-admin/firebase-functions aligned with the versions functions/ already moved to. Root audit 23 → 7, all dev-only.

Documentation

• The optional-peer re-export trap (#28) is documented in the README. import type is erased from emitted JS but not from emitted .d.ts, so a package re-exporting a tjs-lang type makes tjs-lang a hard typecheck dependency for its consumers — and declaring the optional peer does not help, because optionality governs installation, not type resolution.

[0.13.4] — 2026-08-25

Added

• asCompared — a type can say what it IS, for comparison. Declared with extend, so you can attach one to a type you do not own without touching its prototype:

  extend Timestamp { asCompared() { return this.seconds * 1000 + this.nanos / 1e6 } }
  
  ts1 == ts2          // true when they project equally
  Is({ when: ts1 }, { when: ts2 })   // composes into the deep walk
  if (failedResult)   // false, when the type projects to false
  

  Consumed by Eq, Is AND toBool — that last one is the point as much as the first. An errored service result is an object, objects are truthy, and until now the type had no way to say otherwise: if (result) took the success branch on a failure.

  A projection, not an equals(other) predicate, deliberately. A projection composes — the deep walk normalises each node, so a projected value nested three levels inside an object just works — and it generalises to ordering, neither of which a comparison predicate gives you.

  Must project to a primitive, or to nothing: number, string, boolean, null, undefined. An object projection defers the question rather than answering it. bigint is excluded on purpose — 1n === 1 is false, so two projections disagreeing on number-vs-bigint would compare unequal for values that are equal, and nobody needs nanosecond-exact ==. A non-conforming or throwing projection is IGNORED rather than thrown: a hook that breaks == for every value is worse than one that does not apply.

  It works in standalone emitted code, not only under a shared runtime. Emitted files declare their own comparators and call them bare, so the projection table is emitted per-file — which also makes it file-local by construction. One module's projection cannot reach another's comparators; a single shared mutable type→behaviour table would be prototype pollution by another name, which is what extend exists to avoid. ⚠️ This claim was FALSE as shipped in 0.13.4 — the table was process-global and projections did leak across modules. Fixed in 0.13.5; the note is left here rather than rewritten, because a changelog that quietly corrects itself is worse than one that says what happened.

  This is not a new mechanism so much as an opened one: unwrapBoxed was already a comparison-projection table with three hardcoded entries (a String instance compares as a string, Number as a number, Boolean as a boolean). Those are the root of the chain; asCompared is the layer above them. Design and rationale in docs/type-system-north-star.md.

Fixed

• functions/: 3 critical advisories cleared (#30). firebase-admin 13→14, firebase-functions →7.3.2, and tjs-lang off ^0.2.8 — a range we deprecated ourselves. 3 critical / 5 high / 21 moderate → 0 / 1 / 16. The remaining undici high is pinned transitively by @firebase/auth.

• An abolished mode directive emitted a bare identifier instead of erroring. The guard scanned the file preamble and stopped at the first line that was not itself a directive, skipping only line comments and block-comment openers — so a markdown line inside a doc comment ended the scan at the top of the file. tjs emit then exited 0 and wrote a module that threw ReferenceError: TjsSafeEval is not defined on load. Our own Cloud Functions shipped that way; the committed bundle worked only because it predated the abolition.

[0.13.3] — 2026-08-24

Found by an ecosystem security sweep and by playing with the deployed playground — neither by a test here. Both defects were in published 0.13.2.

Fixed

• typeof obj[key] compiled to (typeof obj)[key], so every guard of that shape was silently always true (#29). typeof lowered to TypeOf(…) consuming only .name / ?.name chains, so a COMPUTED access fell outside the call:

  typeof obj[k] !== 'function'   //  ->  TypeOf(obj)[k] !== 'function'
  

  TypeOf(obj) is the string 'object', 'object'[k] is undefined, and undefined !== 'function' is always true. No parse error, no type error, no warning, and the source reads correctly — the reporter's filter returned every key instead of dropping the function.

  The report named one form; six were broken. x[k], x[0], x['lit'], x[k].foo, x.foo[k] and x[k][j] were all silently wrong, and typeof f() became TypeOf(f)() — calling a string, which at least failed loudly. The operand now consumes balanced […] and (…) by depth over a masked view, so nesting is safe and a bracket inside a string is not structure.

  This also restores something that never worked: typeof o[k] where the value is null now returns 'null' rather than 'object'. TypeOf exists to fix exactly that footgun and the value was never reaching it through a computed access.

  Reproduces back to 0.8.1 — not a regression, always wrong.

• The Schema Validation playground example shipped a wrong worked example. Its return annotation described a SHAPE ({ name: '', … }) where TJS reads a worked example and compares by deep equality — the single most common mistake with this syntax, in a teaching example on the public playground. The guard that should have caught it exists, but the example sat on a skip list whose stated reason is "examples that use imports"; it has no imports, nor did three other entries. A test now derives that justification instead of trusting it.

Changed

• demo/ is no longer published. It shipped 30 files and ~1.9 MB of playground source that no consumer of the package needs, including the Firebase web key in three of them (#31 — a public project identifier by design, not a secret, but noise that trips secret scanners). Unpacked size 15.2 MB → 13.3 MB. The playground is deployed from .demo/ and is unaffected.

[0.13.2] — 2026-08-21

A ninth pass then blocked this one on three more (report), two of them sibling-site misses in the fixes above: the symlink guard protected only the LEAF, so a symlinked output DIRECTORY still escaped and destroyed a file outside the named tree; and moving the #! line to the file-write seam fixed -o while silently regressing tjs emit bin.tjs > bin.js, which is the first example in --help. Both fixed here, with containment (a symlinked -o ROOT stays legal — that is a normal setup) and with stdout treated as the artifact sink it is. A fourth finding — that port.test.ts is red — was checked and refuted: isOurServer rejects the test runner under both relative and absolute argv.

An eighth review pass, run after 0.13.1 shipped (report), found that 0.13.1's hashbang fix had been applied at the wrong seam — breaking tjsx, a published bin. Six of eight rounds have now found a defect introduced by the previous round's fixes. That is the argument for the round, not against it.

⚠️ Upgrade from 0.13.1

• If you use tjsx, the playground, or new Function(result.code) on a file with a #! line, 0.13.1 threw Invalid character: '#'. Fixed. result.code is now always a clean fragment and the shebang is carried separately as result.hashbang.
• tjs emit now exits non-zero when it fails. If a build script relied on it exiting 0, it was relying on a bug: 0.13.1 reported 2 emitted, 0 failed with output missing.

Fixed

• The #! line was baked into result.code, breaking every embedder. code is a FRAGMENT — tjsx wraps it in new Function, CLAUDE.md documents that idiom, and the playground evaluates it — and a hashbang is legal only at offset 0 of a whole script. All three died with Invalid character: '#', an error naming neither the shebang nor the file. The line now travels beside the code as result.hashbang and is re-attached only where a FILE is written.

• tjs convert silently stripped the #! line. It never had any hashbang handling; the TS→TJS→JS chain loses it at the first step, so the restore added in 0.13.1 never saw it. convert is the command the migration docs point TypeScript users at — the one most likely to meet a real bin script.

• tjs emit reported success and exited 0 with output missing. emitFile swallowed its own error whenever -o was given, so the directory walk's failure branch was unreachable: a directory with one broken file printed 2 emitted, 0 failed, exit 0, with that file's output absent. Nested tallies were also dropped at the recursion boundary. tjs emit is the documented production build path, so a CI step went green having produced a missing module. convert fixed exactly this in #24; its structural twin never got the same fix.

• A symlinked output DIRECTORY still escaped the named tree. The first guard unlinked a symlinked LEAF, but with out/sub a link elsewhere, lstat on out/sub/b.js resolves sub through the link and sees an ordinary file — so the write went through and destroyed the target while reporting 1 emitted, 0 failed, exit 0. Writes are now CONTAINED: the resolved destination must sit under the resolved -o root. A symlinked root itself stays legal (-o dist where dist -> /build/dist is a normal setup).

• tjs emit/convert to STDOUT dropped the #! line. Moving the hashbang to the file-write seam fixed -o and regressed the pipe — and tjs emit bin.tjs > bin.js is the first example in --help, appears in two guides, and is what functions/'s own build script runs. A file and a pipe are two consumers of one decision.

• tjs emit -o out/a.mjs overwrote the module with its own generated docs. The sibling paths were derived with replace(/\.js$/, …), which does not match .mjs — the normal ask for a "type": "module" package — so the docs path equalled the artifact path. Now derived from the stem, and a derived path equal to the output is refused as the bug it is.

• emit --dts and emit --docs wrote THROUGH symlinks too. The first fix for this routed emit's JS output through a safe boundary and left its two sibling writes on raw writeFileSync, twenty lines below — so emit --dts still destroyed a symlink's target and reported success. Every file the CLI writes now goes through one writeEmitted, and src/cli/write-boundary.test.ts enumerates the command files and fails on any raw writeFileSync rather than relying on anyone to remember the sweep. A companion check enumerates the result.code contract (never starts with #!, always embeddable in new Function), because that fragment has twelve consumer sites and the previous round tested four.

• emit/convert wrote THROUGH symlinks in the output directory. With out/a.js a link to precious/keep.txt, tjs emit src -o out -r overwrote the target and reported 1 emitted, 0 failed, exit 0 — data loss reported as success, in the same command whose READ half refuses that exact escape by construction. Writes now go through one writeEmitted boundary that unlinks a symlink rather than following it.

[0.13.1] — 2026-08-21

0.13.0 was published by mistake. It was meant to be a release candidate and the version was labelled 0.13.0; the publish also ran from the working tree rather than a pushed tag, so the full-suite gate in .githooks/pre-push never fired for it. v0.13.0 has since been tagged retroactively at the commit the registry actually has, and 0.13.0 will be deprecated on npm in favour of this release.

A seventh pass then reviewed this patch before it shipped and blocked it on three more, all introduced by the fixes below (report): tjs check had started silently SKIPPING symlinked source files (green because it did not look), emit/convert still followed symlinks and could write output derived from outside the tree they were given, and tjs emit silently stripped the #! line this release advertises as newly supported. All three are fixed here. Five of seven rounds have now found a defect introduced by the previous round's fixes — which is the argument for the round, not against it.

A sixth review pass, run AFTER publication (report), found the blocker below plus every major fixed here. Reviewing after shipping is not the plan; it is what caught this.

⚠️ Upgrade from 0.13.0

• { mode: 'a' | 'b', other: 1 } did not compile in 0.13.0. If you pinned it and hit a signature example is inconsistent error on an options object, this is why — and the workaround (reordering members) is no longer needed.

Fixed

• A nested literal union discarded every sibling after it. collapseUnions handed the whole bracket body back to itself, found the first depth-0 | inside the container, and returned only what was left of it. Whether a file compiled depended on the ORDER of its members: function cfg(o: { mode: 'a' | 'b', other: 1 }) threw, while the same members reversed passed. The array form was worse because it was SILENT — ['a' | 'b', 'c'] collapsed to a one-element array, so the signature test ran against a shorter argument and passed while checking less than it claimed. Every nested case in the test file put the union in a container by itself, which is why the whole multi-member class — the ordinary shape — shipped untested and green.

• IsNot without Is emitted a module that threw on first call. needsIs = code.includes('Is(') is false for IsNot(, and IsNot is implemented as !Is(a,b), so emitted code raised ReferenceError: Is is not defined in Node and Bun, for both the call form and the a IsNot b infix form. NotEq escaped only by luck: 'NotEq(' does contain 'Eq('.

• A #! line was rejected everywhere except tjs check. Hashbang is standard ECMAScript (ES2023) and acorn already parses it, so rejecting it made tjs(src, { dialect: 'js' }) refuse legal JavaScript — a PRINCIPLES.md TJS ⊇ JS subset violation. It was handled in the check command alone, so check green-lit bin scripts that emit, run, types and test all died on. Now handled in preprocess, which every path goes through.

• The shared directory walk mishandled symlinks — in three ways, across three commands. A link to a real FILE is now collected (skipping it made tjs check <dir> print a tick and exit 0 without reading a source file that was there); a link to a DIRECTORY is not descended (descending escaped the tree the user named — emit -r wrote output derived from a file outside it while reporting success — and a cycle recursed 33 levels before ELOOP); a DANGLING link is skipped rather than fatal (it aborted the run and emitted zero files, losing valid siblings). emit and convert had been left on the old statSync walk when check moved, so the three disagreed; they now share one readEntries.

• tjs emit silently stripped the #! line. preprocess blanks it for offset stability and nothing put it back, so an emitted bin script opened with 19 spaces and died with a shell syntax error — exit 0, no warning. Worse than the bug it replaced: 0.13.0 rejected such a file loudly, which at least names the problem.

• tjs convert <dir> mirrored node_modules and dot-directories into its output — 913 real .ts files in this repo alone. It applied neither exclusion while emit applied both. Hoisted as shouldDescend, now shared by all three walks.

• --max-warnings silently suppressed narration for a single file, while --help asserted "a single file always narrates". A warning-budget flag doubling as a hidden verbosity switch; --verbose is the narration control.

• The array diagnostic's … marker was missing on the four-kinds path, so [1,'a',true,null,{},Symbol()] reported an exhaustive-looking list after scanning 4 of 6 elements — contradicting the invariant the marker was added to establish.

• chargeHeapWalk could refuse a heap write without setting ctx.error, breaking the contract its callers document: the caller stopped and the run reported success with no explanation.

• tjs check on an all-TypeScript directory said "No source files found", which is true and reads like the path is wrong. It now names the extensions it wants and points at tjs convert.

• tjs-playground ignored TJS_CACHE_DIR — defaultOutDir was an independent copy of the cache-path policy resolveCacheDir was extracted in 0.13.0 to own, and it was the copy that writes tens of megabytes under $HOME.

Performance

• rejectAt was O(violations × filesize) — locAt scans from offset 0, so 3200 violations in a 343KB file took 540ms to build a 44,498-character message it was about to throw. One forward pass now, with the location list capped at 20 plus a total count.

Internal

• One balanced-bracket matcher instead of four: matchingBrace takes its closer from its opener and handles {/[/(. The fourth private copy had been added in the same window that hoisted splitTopLevelTrimmed to prevent exactly that — and the untested copy was the one the nested-literal-unions feature ran on.
• src/cli/walk.ts and tjs check's three 0.13.0 behaviours gained the tests they shipped without; emitted-module-scope.test.ts now parses, RUNS and loads emitted output in a real node subprocess, having previously only parsed — which is how it held IsNot in its corpus and passed.
• perf.test.ts's intensive-loop test no longer prints a ratio: measured in-process it varied 54× for identical code depending on JIT history (2.18× alone, 116.75× in a full run), because the baseline folds away. The file's other ratios are unchanged and carry the same caveat, stated in its header; bun run bench is the authority for any number you plan to quote.

Compatibility

• Bun 1.4: full suite green. Bun.build()'s native memory leak (oven-sh/bun#34053) is fixed upstream — 300 builds now cost ~15MB total rather than growing without bound. The fetch error-shape and shared-reference-recursion issues we filed remain open; our workarounds stay.

[0.13.0] — 2026-08-19

Reviewed FIVE times before tagging, each pass over the full diff since v0.13.0-beta.1. The first (report) returned BLOCK on five blockers; the second (report) BLOCKed on two more that the first round of fixes had introduced; the third (report) BLOCKed on a parenthesised-arrow emit bug; the fourth (report) BLOCKed on four, two of them regressions introduced by the third round's own fixes — a maxHeapBytes bypass and a build failure that would have shipped a stale bundle; the fifth (report) BLOCKed on two — a let arrow with :? that crashed at module load (a regression from the fourth round's own fixes) and the shipped tjs binary hard-failing for anyone without the TypeScript compiler. All are fixed, along with every major and most minors each pass confirmed.

That pattern — a fix round introducing the next blocker — happened in FOUR of the five rounds, and is the honest argument for reviewing again after fixing rather than treating the last green run as the answer.

Links are absolute because docs/reviews/ is deliberately excluded from the npm package ("!docs/reviews" in files): relative links would be dead on npm and unpkg.

⚠️ Upgrading — read this first

11 changes alter behaviour. Most produce no type error, so recompiling does not catch them; one of them — a Type block that declares no example, predicate or default — is a hard compile error on source that used to transpile. All but the VM-budget change affect code that ran under 0.12.0.

(The count and the "the last one" pointer were both stale: bullets were appended to this list after it was written, so the positional reference had drifted off the item it named. Positional references into a list that grows are a standing trap; the item is named now.)

• Timestamp and isValidTimestamp now mean epoch MILLISECONDS, not an ISO 8601 string. Both signatures WIDENED ((v: string) → (v: unknown)), and RuntimeType<T>.check(value: unknown) never references T, so tsc --strict reports zero diagnostics — isValidTimestamp(isoString) simply returns false where it returned true. Use isValidISOTimestamp / TimestampISO for the string form, or Date.parse(s) to convert. As of 0.13.0 the epoch form warns once per process when handed a valid ISO string, naming the replacement.

• tosijs-schema ≥ 1.5.0 enforces additionalProperties: false, which the battery atoms' output schemas did not account for. An OpenAI-shaped message carrying refusal/annotations failed with Output validation failed for 'llmPredictBattery' — a hard AgentError, not a warning. Fixed here. This affects already-released versions: 0.12.0 and 0.13.0-beta.1 both declare tosijs-schema: ^1.4.0, which resolves to 1.5.x today, so a fresh npm i on an older tjs-lang can break with no change on the consumer's side. Upgrading to 0.13.0 is the fix.

• VM budgets: loop bindings (map/filter/find/reduce) no longer re-account the loop variable, so per-iteration fuel is size-insensitive again and matches 0.12.x. If you tuned a fuel budget against a 0.13.0 beta, it buys MORE work now, not less.

• A declared Type now CHECKS when used as an annotation. Type Even { example: 0 predicate(v) { return v % 2 === 0 } } followed by function double(n: Even) — before, double(3) returned 6; now it returns a MonadicError. The annotation always looked like a contract; it now is one. Nothing to migrate if your values were already valid, but a previously-silent violation becomes a visible error at the call site.

• :? validates the return value at runtime, not only in the signature test. Two consequences worth knowing, because the wrapper REBINDS the function:

  • f.length becomes 0 (the wrapper takes ...args), so anything reflecting on arity sees a different number.
  • a declared async function becomes a plain Function object — await still works and it still returns a promise, but fn.constructor.name is no longer AsyncFunction.

• A Type block that declares no example, predicate or default is now an ERROR. The interface spelling — Type User { name: '' \n age: 0 } — used to parse, silently discard its members, and produce a type that accepted every value (User.check(42) → true), while the real runtime threw at construction. Source that transpiled now fails, with the fix shown as code. An EMPTY or comments-only block is still accepted: that is what fromTS emits for a TypeScript type it cannot express, and it discards nothing.

• tjs check --max-warnings exits 2 on a fumbled argument, where it used to exit 1. A missing or non-numeric value made Number() produce NaN, and 0 > NaN is false, so a bare --max-warnings failed a CLEAN file with "0 warnings exceeds --max-warnings NaN". Exit 2 now means "you invoked me wrong" and 1 still means "the check failed" — worth knowing if a script branches on the code.

• Excess object keys are now accepted everywhere, and dictionary defaults no longer strip them. place({ x: 5, z: 9 }) against place(args = { x: 0, y: 0 }) returns { x: 5, y: 0, z: 9 }; in 0.12.0 the z was silently deleted (WebIDL §5.4 semantics, with a once-per-site recorder notice). A declared type with a non-empty object example likewise no longer rejects an extra key.

  Three reasons, in docs/dictionary-defaults.md → "Where we diverge from WebIDL": WebIDL strips because a dictionary is a wire format, whereas a TJS = {…} parameter is an options bag inside one program; the notice was silent where it mattered (a log, once per site); and TypeScript cannot express the closed type this enforced — its excess-property check is a freshness lint on literals, not a property of the type, and there is no Exact<T>.

  Members are still validated, missing members still fill recursively, and the prototype-pollution keys are still rejected — that one is a security guard, not a normalisation policy. If you relied on a dictionary default to sanitise a payload, destructure explicitly: const clean = ({ x, y }) => ({ x, y }). The dict-default-excess-key lint still fires, now worded as the typo check it always really was.

• Destructured : members are genuinely required now, and destructured params generate signature tests. function f({ a: 2, b = 3 }) called as f({ a: 2 }) used to return 5; a call omitting a : member now returns a MonadicError. Separately, a destructured parameter used to produce NO signature test at all (the extractor fell through and threw, and the throw was swallowed), so a previously-green build can go red on a signature that was never actually being checked. Both are the same correction: the annotation always looked like a contract and now is one.

• Emitted Is and Eq no longer run a hostile valueOf, and no longer throw. A boxed-primitive subclass that overrides valueOf used to have that method CALLED by emitted comparisons (Is(new Liar(1), 999) was true), and a Proxy faking Boolean.prototype made == throw a raw TypeError — out of an operator whose whole contract is that errors are RETURNED. Both now read the internal slot and fail soft. If you relied on valueOf being consulted by ==, use Is with a [Symbol.for('tjs.equals')] method, which is the supported seam.

• MonadicError.actual now describes an array's ELEMENTS, not just 'array'. It is a public field on a public error type, and the string changed: f([1, 'bad', 3]) against xs: [0] reports array of number | string where it used to report array. That names the intruder next to the expectation, which is the pair a reader can act on — but any test asserting err.actual === 'array', or matching the full message, will need updating. Very long arrays are summarised from the first 64 elements and marked with a trailing …, so the value never claims to have looked at more than it did.

Two bodies of work. First, the language stabilised in its own direction: the guiding rule became a form that parses must mean something, and every construct that parsed while validating nothing was either built or removed. Second (below, from "Everything below came out of the full pre-release review"), the pre-release review of 0.13.0-beta.1.

The through-line is worth stating because it explains why so many entries are small: the language now claims less by accident and checks more on purpose, and everything it claims is asserted by something that runs.

Added

• predicate => expr and predicate { return expr }. The terse spellings are real. The type name binds to the value under test, so Type Even { example: 2\n predicate => Even % 2 === 0 } reads as "an Even is a value where…". Both normalise into the function form, so they inherit predicate verification, fuel bounding and the $predicate schema path rather than re-implementing them. predicate => previously parsed and accepted every value; it was then rejected outright; now it works.

• A parameterized type derives its predicate from its example. Type Box<T> { example: { value: T } } now checks its parameter — writing predicate(x, T) { return T(x.value) } alongside it was restating what the example already said. Previously a predicate-less parameterized type emitted Generic([...], () => true): it accepted everything while looking like it checked.

• Type arguments in an annotation: b: Box<int>. A parameterized type applied to arguments is a call at run time, and a primitive argument becomes a predicate — the only representation available for a type that is not a value (int compiles to an inline check, so Box(int) would reference nothing). Predicates compose, so Box<Box<int>> works. The applied type is hoisted to a module-level const named after the annotation, so it is built once rather than per call and errors read Expected Box_int.

• T[] — the most common annotation in TypeScript. function f(xs: number[]) did not parse at all. It now rewrites to the array-example spelling ([0.0]), inheriting item checking, .d.ts emit and JSON-Schema. Nests (string[][]), and int[] narrows where number[] deliberately does not.

• Literal unions narrow. function f(x: 'yes' | 'no') rejects 'maybe'. This is the one place the examples model bends, and the line is vacuity: read as examples, 'a' | 'b' widens to string | string and means what '' means, so it says nothing and must have been meant as a set — whereas 0 | '' widens to integer | string, which is a real statement, and stays a union of types. Membership is the language's ==, which is a decision with consequences: new String('yes') is a member, +0 | +1 is identical to 0 | 1, and 1 | 1.0 is a ONE-member union.

Changed

• new is not allowed on a class declared in the same file. A TJS class is called — P(1) and new P(2) produce identical objects — so new was decoration with the look of significance, and it was meanwhile a hard error for Date. unsafe new P(1) is the per-site escape. Scoped to locally-declared classes: for a built-in, new is mandatory (new Float32Array(4) throws without it).

• A rest parameter cannot have a default. ...xs: number[] = [1] compiled and did nothing — f() returned []. A rest parameter is always bound, to [] when nothing is passed, so there is no absent case for a default to fill. JS rejects ...xs = [1] already; only the annotated spelling slipped through.

Fixed

• An emitted module using both == and Is would not load in Node. Eq, Is and __oneOf each prepended their own copy of the shared boxed-primitive unwrap, so a file using two of them declared function __ub twice at module top level. Bun runs that; Node refuses (SyntaxError: Identifier '__ub' has already been declared). Emitted modules were therefore dead on arrival for Node consumers while the whole suite stayed green — the same shape as the typescript import snowfox hit in production. Emitted output is now parsed as a MODULE in the guard, where a duplicate top-level declaration is an error rather than a shrug, and the helpers are driven pairwise because the defect only existed in combination.

• A literal-union type check THREW on a hostile value instead of returning a MonadicError. __oneOf carried the fifth hand-inlined copy of the boxed-primitive unwrap and was the only one still missing the fail-soft guard, so pick(new Proxy({}, { getPrototypeOf: () => Number.prototype })) produced a raw TypeError: thisNumberValue called on incompatible object. A throw out of a type check breaks the promise that errors are returned, not thrown, and it was reachable from any untrusted input. It now calls the shared __ub.

• The shipped tjs binary hard-failed without the TypeScript compiler, including --help and --version, which touch no TypeScript at all. typescript is a devDependency; the CLI entry imported ./commands/convert statically, which reaches emitters/from-ts. src/index-tsfree.test.ts had guarded the library entry against exactly this since snowfox hit it in production; the CLI had no equivalent. convert is now loaded lazily and still fails clearly, naming the missing package, when actually invoked.

• One exempt new X\n .Y() silenced the no-new rule for an entire file. The rewriter and the checker each had their own answer to "does this new X construct X?", and the two disagreed: the rewriter tested for . with no whitespace allowed (so new Shape\n .Circle(2) became Shape()\n .Circle(2), changing what the program means, and new Reg[key]() became Reg()[key]()), while the reporter re-matched with \s*\. and so matched nothing. tjs check accepted files containing genuine violations. Both now call one shared predicate, and every violation is reported rather than only the first.

• A let arrow with a :? return annotation crashed at module load — a temporal dead-zone error introduced by the previous review round's own fix.

• tjs check <dir> walked into .ts files it cannot parse, and a shebang line broke offsets. It now takes the directory its own error text recommends.

• Exported arrow consts reach the .d.ts (GitHub #4). export const id = (x: 0) => x emitted id: any, so a consumer got no types for exactly the declaration style modern TS code is written in. Guarded by src/lang/dts-compiles.test.ts ("exported arrows reach the .d.ts (issue #4)"), which compiles the emitted declarations rather than string-matching them.

• Nested literal unions, and | null dropped from .d.ts output.

• A string containing /* unsafe */ turned validation off for the whole function. Per-function safety was decided by a raw substring search over the parameter source, and a parameter DEFAULT is part of that source — so function h(n: 0, s = '/* unsafe */') emitted unsafe: true and checked nothing, while the same function without the literal validated n. A nested arrow's default disarmed the OUTER function the same way. This is the one member of the literal-blindness class that turns checks OFF rather than garbling output, so its entire effect is the absence of something.

• Five declaration transforms rewrote TJS syntax inside string literals — Type, FunctionPredicate, Generic, Union, Enum, plus const!. A declaration written inside a template came out as the string's CONTENTS transformed; the single-quoted form injected unescaped quotes and failed to parse, rejecting legal JavaScript even under dialect: 'js'. For a language whose own docs and tests are full of illustrative declarations, "a declaration inside a string" is the normal case.

• A declaration inside a doc template became a phantom exported type in the .d.ts. Two dts.ts scanners detected on raw source while brace-matching a masked view, so a documentation template could emit export type Ghost = (x: number) => any — a type with no runtime, degraded as well, which a consumer's editor autocompletes and their build accepts.

• The expect harness differed depending on which runner ran your test. Two copies had drifted in opposite directions: one had toThrow and no toBeNaN, the other the reverse. tjs test file.tjs failed with expect(...).toThrow is not a function on a test that passed in the playground. Both documented as working. There is now one harness.

• The converter emitted .tjs that does not parse for builtin return types. Any class method returning Response, URL, AbortSignal (and others) produced make():! new Response() { — new is abolished in TJS — or make():! AbortSignal.abort() {. Three sites emitted return annotations and only one filtered anything.

• The emitted call-stack array grew without bound. The inline runtime's pushStack appended one entry per call forever — 201,000 calls left 201,000 entries — because the matching popStack() is emitted after the return. It is now the same bounded 64-entry ring the real runtime uses. Standalone emitted files are the shipping configuration, so this was a live leak in any long-running program built from them.

• tjs-playground built into its own installed package directory. Under pnpm and bun on Linux that is a hardlink into the machine-wide store. It now builds into an OS cache directory keyed by version, announces the path on stderr, and accepts --out-dir. It also no longer regenerates demo/docs.json when installed, which produced a DEGRADED file from a tarball that does not carry every markdown source.

• --force could stop a stranger's dev server. Port reclaim decided ownership from the executable name (bun/node/deno), which is an ecosystem, not an identity — so tjs-playground --port 3000 --force would SIGTERM→SIGKILL a consumer's Vite or Next dev server and report it as reclaiming its own. Identity is now the full command line, and reclaim refuses to signal its own process.

• The model-audit cache littered the consumer's project and never expired on logic changes. It was written to process.cwd()/.models.cache.json — a dotfile dropped into whatever repo you ran from — and keyed only on base URL plus a 24h TTL, so when looksLikeVisionModel was corrected this release an upgrader kept vision: false for a multimodal model for up to a day. It now lives in the OS cache directory (~/Library/Caches/tjs-lang, $XDG_CACHE_HOME/tjs-lang, %LOCALAPPDATA%), announces its path, and carries a probe version. Override it with the new TJS_CACHE_DIR if you want it somewhere specific; with no home directory at all (scratch containers, some CI images) it falls back to the OS temp dir rather than to ., which would have been the original bug wearing a different hat.

• extractTDoc re-scanned the whole file prefix for every function. Doc comments are now located once per source and binary-searched: 128.9ms → 4.5ms over 58 functions on a 176KB file, and ~12% off a full TS→TJS→JS transpile of it.

• Arrow and function-expression parameters are validated. The same annotation was enforced or ignored depending purely on spelling: function decl(n: 0) rejected 'x' while const arrow = (n: 0) => n accepted it. Only top-level function declarations ever got boundary checks. Arrows are most of real TypeScript, which made this the largest silent hole in the language. const f = function (n: 0) {} did not even parse.

• Rest parameters enforce their element type. ...xs: number[] accepted f(1, 'x'). (Not a rest-param bug: ...xs: [0] was correct all along — the failure was T[].)

• Enum and Union annotations are enforced. function f(c: Color) emitted no check and warned that Color "could not be resolved to a runtime type" — the type declared three lines above it. Color.check() worked the whole time; nothing asked it.

• Type N { example: +0 } rejects negatives. +0 means non-negative integer, and +0 === 0, so passing the example through as a value destroyed the narrowing before any runtime saw it — the idiomatic way to declare a count accepted -1 everywhere, while n: +0 (which reads the source token) was correct. The emitter now writes the check into the emitted code.

• The inline runtime and the real runtime agree. Emitted standalone .js accepted values the real runtime rejects: an integer example accepting a float, directly and through objects and arrays. Since emitted code calls Type bare, the inline stub always wins — so those were the shipped semantics, not a fallback. All disagreements are closed and the corpus is empty. (The fourth case, excess keys, was first closed by making the stub REJECT them and then resolved the other way — both checkers now ACCEPT them; see "Upgrading" above. Agreement is the invariant; the excess-key POLICY is the open one.)

• fromTS emits TypeScript parameter properties. class P { constructor(public x: number) {} } converted to an empty constructor body, so every such field was undefined at run time. Silent, and large for TS ports: a parameter property is the idiomatic dependency-injected field.

• The new Date() remedy is runnable. It advised Timestamp.now() without mentioning that Timestamp must be imported, so following it produced a second error — Timestamp is not defined — from the message meant to resolve the first. It now shows the import and both call forms.

• The editors described a language that is not TJS. The syntax lists were AJS plus a handful of JS keywords: no Type, Generic, Enum, Union, FunctionPredicate, predicate, extend, wasm, or any type name — int, unsigned, float. Meanwhile -> shipped as a valid operator, and the return-type pattern matched ) -> Type, so real return types went unhighlighted while an abandoned form was highlighted. Completions had the same shape: nothing for the declaration forms, the deprecated isError as the only error check, and the non-canonical test('x') snippet.

Performance

• extractParamMarkers was quadratic twice over. A per-character regions.some(…) literal guard made it O(n × literals), and removing that exposed a second one: out += … built a rope while out.endsWith(' ') flattened it once per marker. A 622KB file took 152ms and its per-byte cost ROSE with file size — the failure mode nobody notices until their file is big. Now 0.65ms and flat. Pinned by a differential test against the old implementation plus a growth-ratio assertion.

• Array diagnostics no longer walk the whole array. describeActual and the emitted __arrKinds stopped after four distinct element types, which bounds the message but not the work: a homogeneous number[] never reaches four, so a ten-million-element array was scanned end to end to conclude "array of number" — on the ERROR path, where a failure inside a loop pays it every iteration. Capped at 64 elements, with … marking a sampled answer so the message never overclaims.

Documentation

• TJS vs TypeScript vs JavaScript — a generated comparison where every row is executed against tsc --strict and TJS on each test run. 18 rows. It doubles as the language-design surface: a row can be marked proposed, which asserts it red until someone builds it. All four proposals raised this cycle are now shipped.

• Type identity — which mechanism answers "does value v satisfy type T", which is authoritative, and where they disagreed. The load-bearing fact: the inline stub is not a fallback, it always wins in emitted code.

• Equality invariants are pinned (src/lang/equality-invariants.test.ts): a === b implies a == b, verified exhaustively rather than argued; +1, 1 and 1.0 are one value; and == is not TypeOf(a) === TypeOf(b) && a == b — under that rule null == undefined would be false, and it is deliberately true.

Everything below came out of the full pre-release review of 0.13.0-beta.1. Seven findings were blockers; the review also caught that the beta's own changelog entry had omitted four VM security fixes entirely (now written up in their own section, below, since they shipped there).

Changed

• A required destructured member is now genuinely required. function f({a: 2, b: 3}) called as f({a: 2}) returned 5 — b had silently defaulted to its own example, so : (required) was unenforceable in the one parameter shape people destructure most. The colon value is a type and a worked example, not a default; conflating the two made "required" mean nothing. It now returns a MonadicError. = members are unaffected: f({a: 2, b = 3}) called as f({a: 17}) still gives 20.

• Destructured parameters generate signature tests. function f({a: 2, b: 3}): 5 silently produced no signature test, while the near-identical function f(o = {a: 2, b: 3}): 5 produced one — so the language's headline promise, that the annotation is the test, quietly did not hold for destructuring. The generated call supplies required (:) members and omits defaulted (=) ones, so the defaults are exercised rather than bypassed — which is what would have caught the corrupted 'hello,' default below without anyone writing a test.

Fixed

• A comma inside a string literal split the parameter list mid-literal. {what = 'hello,', who: 'alice'} was split inside the string and the pieces rejoined with ', ', putting the comma back with a space after it, inside the literal — so greeting({who: 'fred'}) returned "hello, fred!". Silent: the output parsed, ran, and returned a plausible wrong answer, and the corrupted value reached the emitted __tjs metadata, the .d.ts and the JSON Schema. Templates and regexes were hit too — a = /,/ became a = /, /, a different regex — and a lone brace in a string (a = '{') broke bracket depth and failed the transpile outright.

  Same literal-blindness family as the fifteen call sites consolidated earlier in this cycle; it survived that sweep because it splits on commas rather than scanning quotes, so it did not look like a literal scanner. Both parameter splitters now scan a maskLiterals() view and slice from the original.

• tjs test <file> ignored its argument and always exited 0. It was built around .test.tjs wrapper files, so any other path fell into a branch that discarded it and reinterpreted it as a filter pattern — printing "No .test.tjs files found" and exiting 0. A real file with a failing inline test and a path that did not exist produced identical output and the same success code, which made it useless as a CI gate and actively misleading as the first command a reader types. It now runs the file's inline tests and signature tests, reports each with a line number, and exits non-zero on failure, on a missing path, or on a directory scan that matches nothing.

Security

• The OOM guard allocated like the thing it was guarding against. Rejecting an array that exceeded a 1,024-byte membraneMaxBytes by four orders of magnitude cost 549ms and 103MB at 2,000,000 elements, linear in N — the walk called Object.keys first and checked the budget after. It now scans incrementally and abandons on the first overflow: 0ms and 0MB at every size tested. A caller who set a small budget to bound their exposure was wrong in the one case they set it for.

• An array's length was never budgeted. A capability could return an array with length = 1e9 holding three values; it passed the membrane on ~40 bytes and structuredClone then spent 6.5 seconds materialising a billion-slot array — synchronous host work invisible to fuel, atom timeouts and membraneMaxBytes alike, behind the guard whose stated job is to reject before the clone allocates.

• Two vm.run exit paths leaked the timeout timer and the caller's abort listener. The root-op throw and the input-schema rejection both happened after the timer was created and before the try, so neither cleared it — while the comment beside the finally claimed it "guarantees on every exit path". A pending timer also keeps the event loop alive, so a host that validates a batch of agents and then exits did not exit.

• The capability membrane billed array elements for the string form of their own index, cutting effective array capacity ~3.4×. readOwnData charged k.length * 2 + 8 for every own key, and an array's key list is its indices — but structuredClone copies an element as a slot and never materialises "199999", so the charge was for bytes that do not exist. It compounded with length: 500,000 floats are 3.81MB of data and were charged 13.14MB, so an ordinary RAG return (300 documents × 768 floats, ~1.84MB) came back as Capability boundary rejected the return of 'storeVectorSearch' under the documented 4MB default — and the only remedy on offer was to raise membraneMaxBytes, i.e. to weaken the OOM guard to buy back capacity that was never being used. A canonical array index now costs nothing: the element's value is already priced when the walk reaches it. Non-index own properties on an array (arr.meta) keep their name charge, since those really are serialised by name. The guard is unchanged in strength — 1M floats are 8MB and still refused.

• The capability membrane ran host code and defeated the byte budget on two of its three walk branches. The object branch was hardened, then array indices the next morning; two paths were never revisited. Affects 0.12.0 and earlier, and both branches of 0.13.0-beta.1.

  • An array's non-index own enumerable properties were never visited at all, while structuredClone serialises them. A capability returning [1,2,3] with an enumerable getter meta ran that getter and delivered 'HOST-CODE-RAN' into guest state; a throwing variant leaked host exception text into result.error.message, which malicious-actor.test.ts explicitly forbids for the object branch. It was a budget bypass too — arr.big = 'x'.repeat(5MB) crossed a 4 MB cap cleanly.
  • Map/Set were read with for…of, which dispatches to a guest-overridable Symbol.iterator, while structuredClone reads the internal slots. A class extends Map with a lying iterator presented itself as empty to the walk while 20,000 entries crossed a 1024-byte membraneMaxBytes intact (verified in both JSC and V8). Three guarantees failed at once: the documented OOM guard was simply not enforced for Map/Set, MEMBRANE_MAX_DEPTH was evadable by nesting, and host code ran.

  One readOwnData() helper now serves the array and object branches, so they cannot diverge again; collections are read through Map.prototype.entries.call(v) / Set.prototype.values.call(v), and a Map/Set whose prototype is not exactly the intrinsic is refused.

• xmlParse was tagged effects: 'pure' while calling ctx.capabilities.xml.parse. That tag is what routes a return through the membrane and what the predicate verifier reads to certify a cluster safe to compile to native JS — so a DOMParser result reached guest state as a live host Document, prototype chain and all, with methodCall standing right there. Every atom in atoms/browser.ts was untagged as well. atom-effects.test.ts could not have caught it: it iterates the same constant that assigns the tag, so it proves the list agrees with itself. New atom-effects-scan.test.ts reads each atom's body and asks whether it touches a capability, randomness, the clock, the network or the console.

• The live-heap ceiling was bypassed completely by two of the four binding atoms. varSet/constSet had both the prototype-pollution guard and heap accounting; varsLet and varsImport — the two atoms whose entire job is binding variables — had only the first, as did the loop binds and the catch binding. Verified: the identical doubling program routed through varsLet held a 1 GB string under the 64 MB default cap. Every guest-scope write now goes through one setStateVar() helper, and state-writes.test.ts fails on any bare ctx.state[…] = outside it.

• The heap-ceiling walker reintroduced the size-proportional fuel bypass — the == bug class, in the function next door to the commit that closed it. estimateBytes was called with the absolute ceiling rather than remaining headroom, per-key accounting replaced rather than accumulated (so re-binding an unchanged object re-walked it in full, forever), and the walk charged no fuel while being synchronous, so no timeout could preempt it. Measured: 500 rebinds of a 300k-element array cost 28,838 ms of pegged CPU for 50.2 fuel — 574 ms per fuel unit, against 1 ms for a benign program charged identically. Now 53 ms. Also fixes an accounting split where createChildScope copied the running total by value while sharing the per-key ledger by reference, letting the total drift negative and silently buy back budget.

• hash and omit were flat-charged regardless of operand size. hash digests every byte and returns 64 chars, so result accounting sees nothing — 1 KB and 1 MB both cost 1.20 fuel. omit must walk the whole source object to know what to keep, so 100,000 keys in and one key out cost the same as 1,000. cost-invariant.test.ts now enumerates the atom registry: every atom needs either a case demonstrating marginal fuel growth or a SIZE_INSENSITIVE entry saying why not.

• vm.run leaked an abort listener onto the caller's signal — no once, no removal. Measured 41.6 MB retained after 20,000 runs against one shared signal, versus 1.59 MB with no signal at all; a host running many short agents under a single cancellation scope is the normal case. Now 1.46 MB.

Fixed

• compareVersions ordered prereleases lexically, so 'beta.2' > 'beta.10' — the tenth beta looked older than the second. Combined with installRuntime's wholesale replacement, an older beta "upgrades" over a newer one and discards the flight recorder and any applied configure(). Now follows semver §11, pinned against the specification's own worked ordering example. (The equality case was fixed in the beta; this is the ordering case left behind.) Affects every consumer of 0.13.0-beta.1.

• unsafe stole the identifier unsafe from JavaScript — a PRINCIPLES.md TJS ⊇ JS violation shipped by the escape hatch that exists to uphold compatibility, and present under dialect: 'js' too. {unsafe: Date} + o.unsafe instanceof Function, let unsafe = Date; if (unsafe instanceof Function), and unsafe in {a:1} were all SyntaxError. A related span defect let one marker un-ban an entire nested closure: unsafe makeHandler({ onClick: () => { eval(src); var leaked = 1 } }) transpiled with zero warnings, quietly reinventing the whole-file mode that unsafe replaced.

• The literal-blindness class, consolidated onto one scanner — not ended. A source-processing pass hand-rolls its own literal tracking and silently mis-reads code that mentions the syntax it scans for. Since tjs-lang is code about code, its own source, tests and documentation hit this constantly. Every scanning call site now consumes one scanLiterals() in src/strip-comments.ts.

  This heading previously read "ended", and that was wrong — at least fourteen instances landed in this cycle, the last six found by review after the consolidation: a raw .replace rewriting the contents of user strings; all five declaration scanners detecting on unmasked source (the single-quoted form injected unescaped quotes and rejected legal JavaScript); /* unsafe */ read out of a parameter default, turning validation off for the whole function; and two .d.ts scanners emitting a phantom exported type. A further nine surfaced at once when the dogfood conversion ratchet was finally given a CI lane — six of them labelled "undiagnosed" for weeks, all nine the same defect. See #25, whose pre-registered counter this answers, and ASSUMPTIONS.md E1.

  • isInsideComment had no notion of strings, so const OPEN = '/*' — or the ordinary glob '**/*.ts' — convinced it the rest of the file was one giant comment and every test { } block after it vanished: no error, no warning, no recorder entry. For a language whose thesis is that tests live in the source, silently reporting zero tests is the worst available failure mode.
  • The naive escape lookback source[i-1] !== '\\' in fifteen scanners across five files. It is wrong for exactly the input that matters: in '\\' the character before the closing quote is a backslash, but an escaped one. sep == '\\' failed with "Unexpected token" forty characters away.
  • computeBraceDepths tracked strings but not regexes, so one const R = /}/ — or the very common /\$\{([^}]+)\}/g — drove the depth negative and generateDocs returned an empty document. tjs emit writes a sidecar .md per file, so users' docs came out blank.
  • extractEmbeddedTestComments produced both a false negative and a false positive from one blind spot: const q = /['"]/ dropped a real embedded test, and const q = /'/ above a JSDoc promoted a documentation example into a real emitted test.
  • maskWasmBodies matched wasm { inside a string and brace-counted past it, swallowing the real code that followed. No error — the output still parsed.
  • Fixing findFunctionBodyEnd exposed three latent bugs it had been accidentally compensating for: the class, polymorphic-constructor and extend scanners were all matching declarations written inside /*# … */ doc comments — the language's own documentation of those features.

  New src/lang/literal-blindness.test.ts pins the class in test:fast (41 cases): each trigger placed in a string, template, regex, comment and wasm{} body in turn.

• The Eval/SafeFunction auto-import emitted JavaScript that does not parse. Usage was detected with \bEval\s*\( over masked source, which never checked whether the name was already bound and matches after a .. import { Eval } from 'tjs-lang/eval' — the documented form in README, CLAUDE.md and TJS-FOR-TS.md — produced two imports and a SyntaxError, so the documented TS → TJS → JS chain had no correct authoring path. It also fired under dialect: 'js', making legal JavaScript containing function Eval(){} un-transpilable. Now decided from the AST: inject only for a call whose callee is a bare identifier with no binding anywhere in the module.

• bigint was inverted in both directions. TS_TYPE_NAMES mapped it to { kind: 'number' }, so f(10n) returned "Expected number … got bigint" and f(10) — a plain number — passed. In 0.12.0 the annotation degraded to any and simply worked, so this was working → 100% broken, on a type the beta's changelog advertised as checking at runtime. Two adjacent defects made it unusable end to end even once the check was right: fromTS emitted x: 0n that the return-position scanner rejected, and a single 0n anywhere in a file took down the whole transpile with "JSON.stringify cannot serialize BigInt", naming no file and no line.

• n?: number emitted JavaScript that throws on the happy path. The colon shorthand rewrites an optional parameter to n = <annotation>, right for an example (n?: 0 → n = 0) and a dangling identifier for a type name — so g() threw number is not defined. Long-standing, but this release made it far more likely: bare TS names now produce real checks, so the annotation looks like it works, and int/unsigned/float are newly encouraged.

• Predicate canonicalization alpha-renamed object-literal keys. Field names are literals, not variables, and the two node types spell them differently, so the guard's Property arm was dead: { n: 10 } canonicalized to { $0: 10 } — the canonical AST read a field the source never named. That AST is forwarded verbatim by storeQueryWhere to store.queryPredicate, making it the silent filter failure its own comment calls "an authorization bug".

• tjs check hid the release's flagship diagnostic. The command CI and coding agents run printed ✓ file for a file whose type had silently degraded, while tjs run on identical source printed the full remedy; tjs emit was silent too. That directly undercuts this release's own measured finding — a shown remedy is repaired ~80% of the time, a bare diagnostic 0%. Warnings now go to stderr from check/emit/convert (so tjs emit f.tjs > out.js still produces clean output), plus --max-warnings N.

• tjs convert reported success while dropping files (#24). convertFile caught its own error and returned normally whenever outputPath was set, so the caller's catch was unreachable: one good file and one bad file reported "2 converted, 0 failed" and exited 0, with the bad file silently missing. The failure surfaced two steps later as a bundler resolution error.

• Unconditional rejections reported no location and stopped at the first occurrence. Fixing a file with three violations took three tjs check runs, each printing an identical positionless message — in validator order, not source order. var, new Date and eval now throw a located error at the first occurrence and list the rest beneath it.

• LegacyDefault(...) erased the parameter's type to any — weaker than the plain-JS equivalent it exists to reproduce. The caller asked for atomic default semantics; they did not ask for the type to disappear.

• The shipped editor artifacts taught a language that isn't TJS.

  • The generated TextMate grammars could never match anything: \\\\b in a template literal produces the string \\b, a literal backslash — so every keyword, forbidden and builtin rule in both grammars was incapable of matching any input, for as long as they have existed. The extension's advertised red-squiggle highlighting was dead.
  • .tjs had no VS Code support at all — the grammar was regenerated on every build and referenced by nothing, in the release whose central idea is that the file extension is the language gate.
  • The TJS keyword model encoded AJS's restrictions. Measured against the real compiler, 41 of 42 painted-red tokens are legal TJS: switch/case/default are ordinary control flow, type/module/is/as/keyof/never ordinary identifiers.
  • The CodeMirror completion inserted unsafe { … }, a form the language rejects, and offered no completion for unsafe <expr> or any Legacy* bridge — so this release's entire escape vocabulary was undiscoverable in the editor.

• Two AJS playground examples shipped truncated, and the flagship wasm-functions example never compiled. extractCodeBlock was not fence-length aware, so examples opening with four backticks (precisely because their code contains three) were cut mid-expression; extractWasmBlocks compiled a wasm { } written in a doc comment, so the example whose prose necessarily says "inline wasm { … } blocks" printed "did not compile — running the fallback{} (JS)" on every run.

Changed

• Timestamp the runtime type is now a number, matching Timestamp the module. 0.13.0-beta.1 flipped the representation to epoch milliseconds and announced it, but the runtime type in Type.ts — the one re-exported into __tjs, and therefore the one a .tjs file annotating t: Timestamp is checked against — still validated an ISO string. So Timestamp.check(Timestamp.now()) was false: the type rejected the only value its own constructor produces, while the compiler's new Date() diagnostic pointed users at that constructor by name.

  Before (0.13.0-beta.1)	Now
  Timestamp — ISO 8601 string	Timestamp — epoch milliseconds
  (no equivalent)	TimestampISO — the ISO 8601 string
  isValidTimestamp(v: string) — ISO	isValidTimestamp(v) — epoch ms
  (no equivalent)	isValidISOTimestamp(v: string) — ISO

  If you were annotating an ISO string as Timestamp, use TimestampISO. Both spellings now share one predicate with src/types/Timestamp.ts, so they cannot drift apart again.

• The npm package now ships its own documentation. llms.txt is the agent-facing navigation index and it ships — but 29 of its 43 links were 404 in the tarball, including CLAUDE-TJS-SYNTAX.md, the file it names as the thing to read first. The guarding test resolved links against the repo root, certifying an artifact nobody installs. The user-facing docs (DOCS-*, TJS-FOR-*, PRINCIPLES, ASSUMPTIONS, CHANGELOG, guides/, examples/, tjs-src/) are now in files; repo-process docs (TODO/PLAN/AGENTS/UPSTREAM) are linked absolutely on GitHub instead; and docs-index.test.ts now resolves against npm pack's own file list.

[0.13.0-beta.1] — 2026-08-03

Beta. The language changed shape: all nine mode directives are gone and the file extension is the only gate. Escapes are per-construct, so an accidental use is still caught. Published as a beta because that shape change deserves real use before it is called stable.

Removed — BREAKING

• All nine mode directives are abolished. TjsEquals, TjsClass, TjsDate, TjsNoeval, TjsNoVar, TjsStandard, TjsDictDefaults, TjsSafeEval and TjsSafeAssign no longer exist. The file extension is the gate — a .tjs file gets every rule, unconditionally — the way ESM made "use strict" implicit. Writing an abolished directive is now an error that names the replacement rather than a bare identifier that fails at runtime.

  TjsCompat and TjsStrict survive, because they answer a different question — which language is this? That is dialect, not a rule. Plain JS, TS-originated code and AJS/VM code still get JS semantics by default, so TJS remains a superset of JavaScript.

  Migration is per-construct, not per-file. The old ladder ("turn the rules off, then re-enable one at a time") is replaced by marking the individual sites that need the old behaviour — which is strictly better, because a modes-off file also silenced the next, accidental use.

Security

The four items immediately below shipped in 0.13.0-beta.1 and were omitted from this entry at the time — found by the pre-release review of the beta. They are recorded here, under the version that actually contains them, rather than backdated into [Unreleased].

• The capability membrane executed host code while inspecting it. The pre-walk read every own key with v[k], which invokes a getter — so the machinery whose entire job is keeping host code out of guest state was itself running host code, before structuredClone was reached and regardless of whether the value was ultimately accepted. The rejection path ran them too, so even a refused value had already executed. A getter can throw, mutate, or stall, making this a side-effect vector on the boundary rather than only a data leak. The walk now reads Object.getOwnPropertyDescriptor and rejects accessor properties outright — not evaluated-then-checked, because there is no way to learn what a getter returns without running it. Breaking for capability authors: see the migration note under Changed. Affects 0.12.0 and earlier.

• The run's AbortController was aborted only when the timeout fired. Any other ending — fuel exhaustion, an atom error, or plain success — cleared the timer and left in-flight requests alive with nothing left to cancel them. A time box you can only rely on when it expires is not a time box. It now aborts in finally, on every exit path. Teardown signals; it does not await cleanup, because waiting is exactly how cancellation becomes a path that starts unmetered work. Affects 0.12.0 and earlier.

• Per-atom call quotas (quotas: { llmPredict: 3, httpFetch: 10 }). Fuel meters work done inside the VM and is blind to what an atom summons outside it: an llmPredict costing 50 fuel may cost real money, a httpFetch costing 10 may hammer someone else's service. Enforced in the atom exec wrapper before both fuel and execution — an exhausted quota must not have already made the call it exists to prevent, and must not also drain the budget. An unset op is unlimited, so this is purely additive.

  Scope, honestly: a quota counts calls within ONE run. A capability that starts a new vm.run gets a fresh counter, so an agent able to trigger re-entrancy can multiply its allowance. Pass the same quotaUsed object to each nested run to enforce a shared cap. Across a process or network boundary no such enforcement is possible — budget does not travel, only tokens and data do. Documented in DOCS-AJS.md and pinned by src/vm/quotas.test.ts.

• installRuntime replaced the runtime with itself and discarded the flight recorder. Identical prerelease versions did not compare equal, so a second import of the same version counted as an upgrade and wholesale-replaced the installed runtime — taking the error history and any applied configure() with it. (The ordering half of this bug survived into the beta; see [Unreleased].)

• Fuel bypass: size-proportional atoms charged a flat cost — the == bug class, found again by a cost-model audit. defineAtom's cost: is charged once per call regardless of operand width, so any atom whose work scales with input size was effectively unmetered. Measured before the fix: jsonStringify serialized a 2,000,000-element array for 1.2 fuel and completed under a 10-fuel budget. join, split, jsonParse and template were the same. (The expression path already charged proportionally in methodCall — the atom path had diverged, which is how it survived.) Those atoms now charge via a shared chargeForSize() on both operand and allocated result, using the same per-char/per-element constants as the expression path; fuel now scales linearly with N. Affects 0.12.0 and earlier — anyone relying on fuel as a DoS bound against untrusted input should upgrade.

• Live-heap ceiling (maxHeapBytes, default 64 MB) — the space budget to fuel's time budget. Fuel meters cumulative work, which bounds how much a program allocates over its lifetime but says nothing about how much it holds at once: x = x + x charges honestly, yet at ~10 KB-per-fuel a legitimate 100,000-fuel budget still buys roughly a gigabyte of live string. A run that exhausts host memory has taken the process down regardless of how honestly it paid. Guest scope writes (varSet/constSet and atom-result bindings) are now accounted against the ceiling with a bounded, cycle-safe estimator; accounting is per key, so overwriting a variable frees its budget and ordinary loops don't false-positive. Verified: 26 doublings of 1 KB (~64 GB unchecked) stops at the ceiling with unlimited fuel.

• New src/vm/cost-invariant.test.ts pins the invariant mechanically: each size-sensitive atom is driven at growing N and must show marginal fuel scaling (a flat-charged atom scores exactly 0 marginal fuel — the bug's signature). Cheap stand-in for a mechanized proof of the cost model; it catches the next flat-charged O(n) atom rather than relying on someone noticing. Adding a size-sensitive atom means adding a case there.

Security / Chore

• bun audit gate with time-gated exemptions. A new pre-tag lane (src/dependency-audit.test.ts) fails the suite on any high or critical advisory that isn't covered by a live entry in audit-exemptions.ts. Exemptions are deliberate and dated: each carries a reason and an until date, and lapses on that date (the advisory then fails the gate again, forcing a re-fix or a renewed justification) — not a permanent silence. A dead exemption (advisory no longer reported) warns to be removed. The gate runs in the full bun test (pre-tag) run, is skipped by test:fast (SKIP_AUDIT=1 — it needs the network), and self-skips offline so a network blip can't red the suite. The current exemptions are all dev/deploy-only transitive advisories (eslint→brace-expansion/flatted, firebase→undici/form-data) with no upstream fix yet.
• Dropped vitest and valibot from devDependencies — removing a whole vulnerable dependency chain (incl. a critical vitest UI-server advisory) that was dev-only and unused: the repo's framework is bun:test. Six files that imported { describe, it, expect } from vitest (and thereby errored out under bun test — a silent coverage hole across the timeout/cost-override/request-context/store tests) were migrated to bun:test and now run. valibot was used only by a compile-only type-inference file, switched to the shipped tosijs-schema. @happy-dom/global-registrator bumped to a fixed happy-dom (≥20.8.9). (The published package's runtime deps — acorn/acorn-loose/acorn-walk/tosijs-schema — carry no advisories; consumers were never exposed.)

Added

• unsafe <expression> — the per-construct escape. Marks one construct as deliberate at the site: unsafe new Date(x), unsafe var x = 1, unsafe eval(s). Zero runtime cost. Recognised only in expression position and only on the same line as its expression, so a variable named unsafe remains legal JavaScript.

• /* @tjs-unsafe */ — the same marker for TypeScript source, which cannot contain TJS-only syntax because tsc rejects it.

• Legacy equality bridges — DangerousLegacyEquals, DangerousLegacyNot, LegacyExactly, LegacyNotExactly. A fixed operator has no construct to mark, so the escape is a name. The coercing pair is named "Dangerous" because == invokes valueOf()/toString() on any object and can therefore throw or run arbitrary code; the strict pair is not, because === cannot.

• LegacyDefault(value) — per-parameter escape from dictionary defaults, restoring JavaScript's atomic semantics for one parameter rather than disabling a whole function's validation.

• ASI guidance. Statement boundaries are the one place TJS and JavaScript disagree (const x = g / (a) calls g(a) in JS, two statements in TJS). That case now warns at the site with a line number instead of changing meaning silently.

• int and unsigned — the numeric types TypeScript never had. TS has a single numeric type, so "this is a count / index / id" is inexpressible and ends up policed by comments or hand-written asserts. n: int rejects a float, n: unsigned (alias uint) rejects a negative, and float is an explicit spelling of number. These extend TypeScript rather than narrowing it — number still means number, so pasted TS is unaffected.

  • The example forms are shorthand for exactly these, and carry a worked value too: n: int ≡ n: 5, n: unsigned ≡ n: +5, n: number ≡ n: 5.0. That equivalence is pinned by a test: two spellings of one type that disagree would mean one of them is lying to the reader.

• Canonical form for verified predicates (canonicalizePredicate / predicateKey, exported from tjs-lang/lang). A verified predicate is pure, total, serializable and composable; giving it a canonical form makes it an identity, which is what lets one object serve as cache key, pushdown payload (send the predicate to store.query instead of dragging rows to the code), auth object (a permission is a predicate), and the substrate for safe macro splicing. Predicates differing only in formatting, comments or local variable names now share a key; differences in operator, literal value, field name, or any helper in the cluster do not.

  • Verification is a precondition, not an option — identity implies "same input ⇒ same result", which an impure predicate doesn't satisfy however identical its syntax, so canonicalizing an unverified cluster throws PredicateNotVerifiedError.
  • Deliberately not an optimizer: commutative operands are not reordered. That would be a claim about totality and cost, not just purity — and a canonicalizer you can't trust isn't usable as an auth object.
  • The convenience key is FNV-1a and documented as non-cryptographic: fine for cache bucketing (a collision costs a miss), insufficient where an adversary picks the input (cache poisoning, auth) — hash the canonical string with SHA-256 for those.

• Predicate pushdown (storeQueryWhere + store.queryPredicate) — send the predicate to the data instead of dragging rows to the code. The atom takes a canonical verified predicate and forwards it as data; the store evaluates it and can cache on its stable key, so two spellings of the same rule hit the same cache entry. The VM never parses it — that's what keeps the acorn-dependent canonicalizer out of the lean tjs-lang/vm bundle and lets the same payload travel to a remote store. queryPredicate is optional (progressive enhancement, like $predicate in JSON Schema); a store without it makes storeQueryWhere fail loudly rather than degrade to an unfiltered read — silently returning rows the caller meant to exclude is a data-exposure bug, not a fallback.

  • Known, deliberate limitation: canonicalization is structural, so refactoring a predicate (hoisting a subexpression into a local) mints a new identity. Collapsing those would mean inlining, i.e. optimizing — and a canonicalizer that rewrites more than spelling isn't one you can trust as an auth object.

Changed

• BREAKING for capability authors: the boundary takes plain data only — no accessor properties. A getter is host code, so a membrane that ran one while inspecting a payload would be executing the thing it exists to keep out. This bites the obvious shape, which is exactly what a host wrapping a Response tends to write:

  // Rejected: `status` is a getter — code wearing a data costume.
  return { ok: res.ok, get status() { return res.status }, body }
  
  // Fix: read it once, hand over the value.
  return { ok: res.ok, status: res.status, body }
  

  Spreading is not the fix and fails silently: a Response keeps ok/status/ headers on its prototype, so { ...res } is {} — it crosses cleanly and delivers nothing. Build the object literally, naming each field. Rejection is a MonadicError (Capability boundary rejected the return of '<op>': … accessor property '<name>'), not a throw.

• Timestamp is a number (epoch milliseconds), not an ISO string. diff is a - b, isBefore is a < b, sorting is the default comparator — and Timestamp.now() is a genuine drop-in for Date.now(), which it was not before. iso() renders the readable form; isValidISO validates it.

• Diagnostics for constructs AJS deliberately lacks now SHOW the fix. Unsupported statement type: ForStatement was accurate and useless: an A/B over diagnostic text (experiments/agent-legibility/error-message-ab.ts) measured the repair rate each message actually produces — worked example 80%, prose remedy 50%, our shipped message 0%, saying nothing at all 0%. On the for-loop case, prose advice scored 0/5 while the same remedy shown as code scored 5/5. for, for...in, switch and do...while errors now carry a worked correction. Pure message text; no compiler change.

  • Guarded by src/lang/diagnostic-remedy.test.ts — deterministic, no model needed: every remedy must contain real code, name a supported alternative, reach the thrown message, and correspond to a construct the transpiler actually rejects. That last check caught a first draft claiming for...of was unsupported (it isn't) — a diagnostic for a restriction that doesn't exist teaches a false limit and is worse than none.

Fixed

• Eq can no longer be made to run user code. It unwrapped boxed primitives with a.valueOf(), which a subclass can override — so a comparison could throw, mutate, or lie about the value. It now reads the internal slot via the prototype method.

• Optional chaining broke the ==/!= rewrite. o?.b != null did not compile: the operand scanner treated ?. as a ternary boundary. Every form was affected.

• Regex literals were read as comments. A regex containing */ or // desynced the scanner, and an escaped backslash ('\\') desynced the string scanner — between them these broke conversion of several of our own files.

• Sound TypeScript type names now produce real runtime checks — restoring a stated design goal that had quietly gone missing: implement the parts of TypeScript that aren't Turing-complete damage, and best-effort only the rest. In native TJS, function f(s: string) inferred any, so it transpiled cleanly, looked typed, and validated nothing — the worst possible outcome in a language whose pitch is that types survive to runtime, and it hit the annotation newcomers and models reach for first (ASSUMPTIONS.md A7). string, number, boolean, bigint, object, null, undefined and unions of them now check at runtime, agreeing exactly with the equivalent example type (s: string ≡ s: ''). any/unknown/void/never remain unconstrained because that is what they mean; an unresolvable user type still degrades to best-effort rather than erroring, which preserves TJS ⊇ JS.

  • Deliberately still best-effort: conditional types, mapped types, recursive templates, infer — the undecidable type-level metaprogramming TJS answers with a predicate function you can read, test and run.
  • Known gap: string[] doesn't parse (use ['']). It fails loudly, which is the acceptable interim state — a parse error tells you to fix something; the old silent any removed your type checking and said nothing.

• Best-effort type degradation now teaches instead of happening silently. When an annotation can't be resolved to a runtime type it still degrades to any (by design — TJS ⊇ JS), but the transpiler now emits a warning naming what was dropped and showing the ladder back to safety: an example (foo: 3), a sound type (foo: number), or a Type … { predicate(v) { … } }. The suggestion is shown as code, per the measured finding that a remedy shown repairs 80% where the same advice as prose repairs 50% and a bare diagnostic 0%. No warning when any/unknown was asked for explicitly — honouring any isn't a degradation, and warning there would train people to ignore the channel.

• Bare-assignment auto-const no longer captures an all-caps alias (#22). In native tjs, B = BABYLON was rewritten to const B = …; when B was declared in an enclosing/host scope the source-level transform can't see (e.g. a /*# */ example inside a module that already let Bs), the injected const shadowed the outer binding — it bit tosijs-3d demos. A bare-identifier RHS is now treated as an alias/reassignment and left alone; the feature still fires for definition RHSs (Foo = Type(…), Foo = { … }, Bar = mk()).

• configure() after a converted module loaded now warns instead of silently doing nothing (#23). A converted module snapshots its config when it captures the runtime (globalThis.__tjs.createRuntime()) at import, so configure() called after the module graph evaluated reached nothing — which made tosijs's debug/safe bundles inert. It now emits a loud one-time console.warn (+ a recorder warning) pointing at the import-order requirement, reliably distinguishing the install (bare module-level createRuntime()) from a module's capture (the instance's createRuntime()), so configuring before any module loads never warns. (Making config a live post-eval read is a deeper change to the intentional per-instance isolation — deferred to 0.13.0; a silent no-op was the worst outcome and is now gone.)

• == inside an inline wasm { } block is no longer rewritten to Eq(...) (L807). In native tjs the ==→Eq() (and Is/IsNot→call) transforms ran before inline wasm-block extraction, so a wasm { if (a == b) … } body became Eq(a, b) — which the wasm compiler can't compile, silently falling back to JS. Wasm bodies are now masked across just those two operator transforms and restored before extraction, so the wasm compiles; a following fallback { } (real JS) still gets the normal rewrite. wasm function declarations were already unaffected (extracted earlier).

0.12.0 — 2026-07-20

Minor bump with breaking changes — see Changed. Lands the TjsDictDefaults mode and five VM-security fixes from a two-round adversarial review. Closes zero open GitHub issues (this release is security + dict-defaults, both internally driven); the per-mode opt-out those security/dict-defaults changes make more acute is tracked as #7, still open.

Security

Affected versions: the SSRF, ReDoS, capability-membrane, methodCall, and scope-name fixes below address vulnerabilities present in 0.11.0 and all earlier releases. Pinned consumers (VM embedders) should upgrade.

• Capability-boundary membrane on the VM. Every value an effects: 'io' atom returns (httpFetch, storeGet/storeQuery/vector search, llmPredict, agentRun, runCode/transpileCode, …) is now deep-copied through a structured-clone membrane before it enters guest state, at a single choke point in the atom exec wrapper. This closes a defense-in-depth hole surfaced by an adversarial review: previously a capability could hand the guest a live host reference — an object carrying callable methods (e.g. a Response with .json()/.text(), or any object with a function property) — which the guest could then invoke via methodCall to reach the host realm, or mutate while the host still held it. The membrane rejects functions, symbols, and other non-cloneable host references with a MonadicError (Capability boundary rejected the return of '<op>'), and gives clean data fresh identity so guest mutation can't alias host state. A budgeted, cycle-safe pre-walk caps the estimated payload size (membraneMaxBytes run option, default 4 MB) and rejects oversized returns before the copy allocates, so a hostile or broken capability can't OOM the VM through the capability boundary. Contract change: custom capabilities must return structured-cloneable data — a capability that returned a live Response must now return the fields the guest reads as a plain object ({ ok, status, body }); the default fetch path already normalizes to parsed body / text / data-URL and is unaffected.
• methodCall is now allowlisted, not blocklisted. Guest method invocations (str.toUpperCase(), arr.includes(x), d.format(), …) are restricted to an allowlist computed from the standard built-in prototypes, the curated builtin statics, and the VM's own wrapper types (Date/Set) — replacing the previous name-blocklist that admitted any method not literally named __proto__/constructor/prototype. Behind the membrane (guest values are plain data) this permits everything a guest legitimately calls and nothing else; the teeth are that call/apply/bind live only on Function.prototype and are therefore rejected, so a leaked function reference can't be re-invoked with a chosen this.
• SSRF guard (isBlockedUrl) now covers full private/loopback ranges. Previously only 127.0.0.1 (not the rest of 127.0.0.0/8, so 127.0.0.2 passed) and the single cloud metadata IP were blocked, and IPv6 private ranges weren't checked at all. Now blocks all of loopback 127/8, 0/8, private 10/8 · 172.16/12 · 192.168/16, link-local 169.254/16 (the whole cloud-metadata range), and — for IPv6 — ::1/::, unique-local fc00::/7, link-local fe80::/10, and IPv4-mapped addresses (::ffff:7f00:1 = 127.0.0.1) that embed a blocked IPv4. WHATWG URL normalization already collapses shorthand/decimal IPv4 (127.1, 2130706433) to canonical form before the check.
• regexMatch ReDoS hardening — length caps + a wider heuristic. The regex engine's backtracking is opaque to the fuel counter, so regexMatch now fails closed on three fronts: a pattern-length cap (1000 chars), an input-length cap (100 000 chars, checked after coercing the value to a string), and an extended suspicious-pattern check that also catches a quantified group repeated by an unbounded outer quantifier ((a+){2,}) in addition to the existing (a+)+/(.*)+ forms. Safe patterns (including bounded (abc){3} and grouped captures like (\d{3})-(\d{4})) are unaffected.
• VM scope variables can't be named a forbidden property. Binding a variable named __proto__/constructor/prototype (via varSet/constSet/varsLet/varsImport or an atom result .as('__proto__')) is now rejected — previously such a name would mutate the scope object's own prototype chain (createChildScope uses Object.create(state)) instead of creating a binding. No global prototype pollution was possible, but the scope corruption is now closed at the write sites, mirroring the member-access guard.

Added

• Dictionary defaults — the TjsDictDefaults mode (docs/dictionary-defaults.md). In native tjs, (args = {x: 0, y: 0}) now has WebIDL-dictionary semantics: each member individually defaulted, partial payloads merged per member (recursively — place({pos: {x: 5}}) keeps pos.y and every other default), members type-checked with precise error paths, undefined members treated as absent, example-null members nullable-any, arrays replaced wholesale (element-checked), excess keys stripped with a once-per-site flight-recorder notice naming them, and prototype-pollution keys (__proto__/constructor/prototype) rejected outright. Complete payloads return by identity — zero allocation.
  • Faster than hand-rolling it, correct or not: the merge is emitted as shape-specialized code per signature; measured 91 ns/op on a complete 8-member/3-nested payload vs 276 for the careful hand-written spread merge and 107 for the incorrect shallow spread — while validating every member (three-tier methodology in experiments/dictionary-defaults/perf.bench.test.ts).
  • Mode-gated per PRINCIPLES.md: ON in native .tjs (like TjsEquals), OFF under dialect: 'js', fromTS, VM targets, and TjsCompat — JS-legal source keeps atomic JS default semantics exactly. TjsStrict enables it; TjsDictDefaults is a standalone directive. Impure object-literal defaults ({x: mkX()}) are a compile error in native mode (compute in the body, or use a colon-form param); non-literal defaults (args = live, x = 0, list = []) are untouched.
  • Required-ness needs no new syntax: : params are required (member-validated since Stage 0), = params are defaulted — mixed shapes use separate params, the platform convention.
  • .d.ts output is deep-partial for dictionary params: generateDTS emits args?: { pos?: { x?: number; y?: number }; label?: string } so TypeScript callers can pass the partials tjs accepts. Mode-gated (the transpile result now carries tjsModes); dialect-js output keeps required members, where partials genuinely aren't valid.
  • Lint catches excess keys at literal call sites (dict-default-excess-key). The runtime strips an undeclared key with a once-per-site notice, but at a literal call site (place({x, y, treshold})) it's almost always a typo — the linter now flags it statically, recursing into nested object literals (move({pos: {x, z}}) → move.pos). Mode-gated on TjsDictDefaults; skips arguments carrying a spread (the spread may supply the key) and non-literal arguments; covers named functions and arrow/function expressions bound to a const.

Changed

• Behavior change (native .tjs only): existing = {object literal} params now merge-on-partial, validate members, and strip excess keys. This is the visible face of the TjsDictDefaults mode above, called out separately because it changes code that was already legal. Before, function f(o = {x: 0, tag: ''}) treated the object as an atomic JS default with no validation; now:

  • f({x: 5}) → {x: 5, tag: ''} (was {x: 5} — tag is filled from the default),
  • f({x: 's'}) → MonadicError (was {x: 's'} — members are type-checked),
  • f({x: 1, extra: 9}) → {x: 1, tag: ''} + a once-per-site recorder notice (was {x: 1, tag: '', extra: 9} — excess keys are stripped).

  It transpiles either way, so a break is only visible at runtime. Migration: to keep the old atomic-default semantics, set dialect: 'js', add the TjsCompat directive, mark the function unsafe (skips all its validation, the merge included), or use a non-object default. There is no per-mode "off" directive to disable only TjsDictDefaults yet (see #7). The new excess-key lint (dict-default-excess-key) flags stray literal-call-site keys statically.

• Behavior change (VM embedders): capability returns must be structured-cloneable data, and guest methodCall is allowlisted. Repeated here from Security because it breaks custom-capability consumers: a capability that returned a live Response (or any object carrying methods / host references) now hard-fails at the boundary with Capability boundary rejected the return of '<op>'. Migration: normalize returns to plain data (Response → { ok, status, body }); the default httpFetch already does. Tune the size cap with the membraneMaxBytes run option (default 4 MB).

• Colon-form object params now enforce their member contract (Stage 0 of dictionary defaults, docs/dictionary-defaults.md). function f(args: {x: 0, y: 0}) has always documented "an object with integer x and y," but the emitted check was typeof args === 'object' only — partial payloads, wrong member types, and garbage members all passed while the full shape sat unused in fn.__tjs.params. Members are now required and type-checked (recursively, arrays included) with precise error paths (f.args.pos.y), matching typeMatches and the inline Type.check semantics. Excess members are still ignored (the excess-key policy belongs to the forthcoming merge mode). Scope: required (colon-form) params only — the JS-legal = form keeps plain-JS semantics, and code that hasn't opted into validation is unaffected. For TS-originated code this makes the runtime contract match what TypeScript itself enforces statically (greet({name}) against {name: string; age: number} is a TS compile error — and now a runtime MonadicError too).

0.11.0 — 2026-07-18

Minor bump — two new entry points (./import-resolver, ./import-resolver/worker), no breaking changes. This is the release tosijs-ui's doc system builds against.

Added

• tjs-lang/import-resolver (#20) — the playground's bundler-free bare-import machinery (TFS), promoted from demo/ to a real export so doc systems (tosijs-ui's live-example) can own import resolution instead of hand-rolling it. rewriteImports rewrites bare specifiers to a configurable same-origin prefix (/tfs/ default, e.g. /lib/); a service worker resolves them to a CDN — JSDelivr /+esm by default, an esm.sh allowlist for peer-dep dedup (react/react-dom), jsdelivr/·esmsh/·unpkg/· github/ hints — and caches via the Cache API.
  • The worker ships as the raw classic-script asset tjs-lang/import-resolver/worker (dist/import-resolver-worker.js, esbuild IIFE, 2.9KB): a service worker is origin-scoped, so consumers copy it into their public root and call registerImportResolver({ prefix, workerUrl, scope }). Config travels to the worker as a query string on its registered script URL — available before the first intercepted fetch and durable across worker restarts — so the client rewrite and the worker's routing derive from one ResolverConfig and cannot disagree.
  • The routing now has exactly one implementation (src/import-resolver/resolve.ts, pure, zero-dependency). It previously lived in three diverged copies: the demo client, the demo service worker, and a materially different reimplementation in the dev server (raw JSDelivr + its own package.json-exports resolution — a package could resolve differently through the fallback than through the worker). The dev server and the playground worker now consume the shared core; the playground's /iframe/ protocol stays demo-only, composed on top.
  • The previously-untested routing core is now covered (resolve.test.ts: parsing, CDN routing, hints, config round-trip, a client↔worker prefix-agreement guard, and an anti-drift smoke that parses the built worker as a classic script and checks the routing is embedded).

Documentation

• docs/dictionary-defaults.md — design spec for merge-on-partial object arguments (WebIDL-dictionary semantics for options bags), a gated native-TJS mode. Includes the measured finding that member-level object-param validation doesn't exist yet (the emitted check is typeof-only; the full shape metadata goes unused). Spike A (semantics harness + 33-case table suite) lives in experiments/dictionary-defaults/.

0.10.1 — 2026-07-17

Patch — a critical fix, no API changes. One behavior change (Is() on cyclic graphs now answers instead of crashing), noted under Changed.

Fixed

• Exponential blowup in deep-equal/format on shared-reference object graphs (#21 — critical; same defect class as oven-sh/bun#34178, and since tjs ships its own expect, Bun's fix did not cover us). A DAG built as {a: n, b: n} per level has O(depth) nodes but a 2^depth unfolded tree:
  • format() re-serialized shared references via raw JSON.stringify — 21MB at depth 20, verified OOM at depth 28 under bun/JSC — whenever an assertion failed. It now marks revisited objects as [shared] (which also fixes true cycles, where JSON.stringify used to throw and eat the assertion message) and hard-caps output at 16KB.
  • deepEqual walked all 2^depth paths on every assertion (~61s at depth 30). It now memoizes visited pairs — a revisit is assumed equal (sound: any false short-circuits to the top) — collapsing the walk to O(nodes).
  • Fixed in all five copies (the issue named one): the injected expectFunction (tests.ts), the transpile-time harness's __deepEqual and __format/formatValue (js-tests.ts, which also had no depth bound), the runtime Is(), and the emitted inline Is. Guarded by src/lang/dag-safety.test.ts, calibrated so a regression fails cleanly (timeouts / message-length assertions) instead of killing the machine.
  • Is() stays allocation-free on the hot path: pair memoization only engages past recursion depth 8 (exponential blowup requires depth; a shallow shared graph pays at most a small constant factor). Measured: flat/nested small-object compares within noise of pre-fix (~29ns/58ns per call); Is(dag(30), dag(30)) went from 101s to 3.2ms.

Changed

• Is() on two distinct-but-cyclic graphs now terminates and returns their structural equality (bisimulation semantics). Previously it recursed until stack overflow (RangeError). This is a behavior change to a language primitive, strictly in the direction of "gives an answer instead of crashing" — but if anything relied on the throw, note it here. Same applies to the test-harness deepEquals.

0.10.0 — 2026-07-16

Minor bump — additive features and fixes, no breaking changes.

Added

• Framework-free editor primitives — a new tjs-lang/editors entry point exporting collectScopeSymbols (AST scope extraction, destructuring included, carries origin), introspectValue (live value → members), and scopeCaptureEpilogue (capture a run's top-level bindings in-run, no re-execution). Acorn-only, no CodeMirror/Monaco/Ace dependency. Closes #10 — downstream consumers (tosijs-ui) were hand-rolling a worse regex copy of the scope extractor because it wasn't exported.
• tjs-lang/editors/codemirror now ships types. The editor build emits .d.ts and the export declares a types condition, so consumers stop re-declaring AutocompleteConfig by hand (#12). The five @codemirror/* packages the CodeMirror integration imports are now declared as optional peerDependencies — an undeclared import resolved locally by hoisting and hard-failed in a consumer's isolated install (#16).
• functionMetaToJSONSchema is now exported from tjs-lang/lang (it was only on src/lang/index.ts, which the subpath doesn't resolve to — the documented import failed with "Export not found"). Emitted standalone code also carries .toJSONSchema() / .strip() on its inline Type/Enum/Union stubs when a file uses them, so a TJS type can describe itself at runtime from inside emitted .js.
• Flight recorder (#17). The __tjs error ring buffer is now a black box for the whole runtime, not just a type-error log. New API on the module, the runtime object, and every createRuntime() instance: record(entry), records(filter?), clearRecords(), getRecordCount(), getDroppedCount(). Records carry a source (type/wasm/vm/app/…) and a severity (error/warning/notice), and can be filtered by either.
  • Reports today: type errors; wasm{} blocks that fell back to JS or failed to instantiate (surfacing the previously-silent fallback, #15); typed arrays copied in and out on every call because they weren't allocated with wasmBuffer() — previously silent and can be slower than plain JS (#9); every VM failure — fuel exhaustion, atom timeout, capability denial.
  • Records once per site, never per call — a recorder that fires inside a hot loop becomes the performance problem it exists to detect.
  • errors() is unchanged and still returns type errors only, so the documented clearErrors() → run → expect-none idiom keeps working. Notices never leak into it.
  • Emitted modules mirror their records into the installed global runtime, so a page with several TJS modules has one flight history rather than N isolated ones. Standalone emitted code (inline fallback runtime) starts reporting as soon as a runtime is installed, even if it loaded before one existed.
  • Recording never throws, never logs unbidden, and never alters control flow.
• Type-system north-star design note (docs/type-system-north-star.md): JSON-Schema + $predicate as the single source of truth for TJS types.

Changed

• LLM tests restructured into three lanes by what they prove, cutting the LLM cost of the pre-tag gate from ~82s (two files) to ~4s while adding deterministic coverage:
  • Plumbing → test:fast. The real LM Studio HTTP client (getLLMCapability) now has deterministic coverage (src/batteries/llm-transport.test.ts, ~40ms) against an in-process fixture server. It was previously exercised only live — backwards for code we own. (batteries.test.ts didn't cover it either: it mocks a reimplementation of predict/embed, not the real client.)
  • Live smoke pared. models.integration.test.ts audited five times (once per test); it now audits once in beforeAll and keeps only predict + embed shape checks. ~28s → ~4s.
  • AJS grokkability is its own advisory lane (bun run test:grok, behind RUN_GROK_TESTS, not in the gate). It measures whether a pinned small model (gemma-4-e2b) can write valid AJS — a load-bearing AJS premise — as a success rate over N samples vs a bar, and never fails on the rate (model variance ≠ code regression). Replaces transpiler-llm.test.ts, whose withRetry(1-of-3) passed on a 33% success rate and couldn't tell a healthy 90% from a degraded 35%.

Fixed

• The pre-tag gate no longer fails on LM Studio flakiness. The live playground-example LLM tests (demo/examples.test.ts) hit a real LM Studio, which is prone to transient 400s and dropped connections while models swap under memory pressure — a bad server moment, not a code regression, could block a release tag. They now retry the live call and degrade to the existing mock (with a visible warning) on persistent failure, so the gate blocks on code, never on server health. Safe because the LLM client's request/response shape is guarded deterministically by llm-transport.test.ts — a real malformed-request regression fails there, loudly; and a broken example still fails via its transpile/VM error. The fallback logic is itself covered by deterministic tests.
• The friendly "start LM Studio" error was dead under Bun. getLLMCapability detected a refused connection via e.cause?.code === 'ECONNREFUSED' (Node's shape), but Bun — our primary runtime — surfaces it as e.code === 'ConnectionRefused', so users got a raw "Unable to connect" instead of the actionable message. Now detects both. (Found by the new deterministic transport tests.)
• Every file in examples/ works again, and a guardrail keeps it that way (src/examples.test.ts runs each through tjs check and tjs run). Five of the seven were broken; nothing caught it because nothing ran them. Beyond the tjs run and WASM bugs below, this surfaced:
  • tjs run could not run any file with an import or an export. It evaluated emitted code with new AsyncFunction(code), and import/export are module-only syntax — a SyntaxError inside a function body. It even reported the failure as a syntax error in the source, pointing at a line the user never wrote. The emitted module is now written beside the source and imported, so relative and bare imports resolve exactly as they would for the original file.
  • tjs run executed your program twice. The transpile-time test harness evaluates the module to run signature tests, and then run evaluated it again — so every top-level side effect fired twice (console.log('hi') printed hi twice). Running a program no longer tests it; that is what tjs test / tjs check are for (the same position the Bun plugin already took).
  • Generics were dead on arrival in emitted code. A generic's predicate receives its type parameters as check functions — Generic Box<T> { predicate(obj, T) { … T(obj.value) } } — but the inline runtime spread the raw type arguments in, so T was the string '' and calling it threw checkT is not a function.
  • A runtime type's check() accepted anything of the right typeof. For an object example that means any object passed: User.check({ name: 'Alice' }) returned true for a type requiring name+age+email. It now matches the example structurally. A validator that answers "yes" to everything is worse than no validator.
  • .toJSONSchema() / .strip() did not exist in emitted code, so a TJS type could not describe itself from inside TJS — the "types are examples that survive to runtime" claim, unmet. Both are now emitted (only for files that use them).
  • tjs-lang/lang did not export functionMetaToJSONSchema. src/lang/index.ts did, but the subpath resolves to src/lang/transpiler.ts, and the two had drifted — so the documented import failed with "Export not found".
• WASM now instantiates synchronously, so an exported wasm function can be called the moment its module is imported. The bootstrap was a fire-and-forget async IIFE, so nothing was bound to globalThis until a microtask later. An inline wasm{} fallback{} block survives that window (it runs the JS fallback), but a wasm function declaration has no fallback — it calls the global directly. So import { dot } from 'tjs-lang/linalg'; dot(a, b, 3) threw __tjs_wasm_dot is not a function: a shipped entry point that could not be imported and used. new WebAssembly.Module is synchronous everywhere except a browser main thread with a >4KB module, which is now the only case that takes the async path — __tjs_wasm_ready() still resolves in both and remains what to await in a browser.
• Inline wasm{} block ids are no longer a per-file counter. Every module's first block claimed globalThis.__tjs_wasm_0, so two modules with inline wasm blocks overwrote each other's binding — and since the emitted call site guards the wasm path on that global merely existing, module A could find module B's compiled function and call it with A's captured variables. Ids are now salted with a content hash of the module (__tjs_wasm_<hash>_<n>), which is deterministic, so the metadata cache is unaffected. Named wasm function declarations keep their exact __tjs_wasm_<name> id — that name is the cross-file composition contract.
• A wasm{} block that failed to compile could still be called. It was left in the module as a stub (correct — function indices must stay stable for other blocks' call <i>) but was also exported and bound to globalThis, which made the call site's guard see a function and take the wasm path into a body that never compiled, invoking it with captures that don't exist in that scope. Failed blocks are no longer bound. (Reachable before this release too: the async instantiation window merely hid it from any caller that ran synchronously.)
• tjs run was preprocessing every file twice — it called preprocess() and then handed the already-preprocessed source to transpileToJS, which preprocesses internally. The first pass consumes the wasm blocks, so the emitter never saw them, emitted no wasm bootstrap, and ran the file with wasmBuffer undefined while every wasm{} block silently fell back to JS. It produced correct answers, which is why it went unnoticed.
• tjs run injected a runtime prelude that collided with the emitted code. It declared const { Type, Generic, ... }, while emitted code inlines its own function Type fallback — const Type plus function Type in one scope is a SyntaxError, reported against a line number the source file did not have. Emitted code is standalone by design; the prelude is gone.
• WASM module instantiation failures were swallowed by a bare .catch(() => {}) in the emitted bootstrap — the module vanished without a trace while every wasm{} block in the file silently ran its JS fallback. Now recorded as a warning.
• The inline runtime core (MonadicError + typeError + isMonadicError) was emitted from three copy-pasted source strings. A file needing checkFnShape and bang access without typeError would have declared class MonadicError twice in one scope (a SyntaxError in the emitted output). Not reachable in practice — but held shut by coincidence, not design. Now one definition, emitted once.

Performance

• The Bun plugin (preloaded by bunfig.toml) no longer loads the whole transpiler at startup just to register a .tjs onLoad hook that most invocations never fire. The import moved inside the callback, cutting bun startup in this repo from ~34ms to ~18ms (bun's cold floor is ~11ms, so the preload had made it start slower than node). This is a saving per invocation — every bun test, every CLI run. It defers the transpiler rather than adding work: a run that does import a .tjs pays the same total.

Documentation

• MEMORY-PROFILE.md: what transpilation actually costs under bun vs node. fromTS calls only the TypeScript parser and emitter (createSourceFile + transpileModule), never createProgram or a type checker, so its memory is bounded by the largest file seen rather than by project size — a whole 36.7k-line project costs about half of what tsc costs to check it once. Also records a measured, unfixed inefficiency: transpileModule is called once per top-level statement and per class member (89 times for one 1,930-line file), which is ~70–80% of fromTS wall time and roughly 3× the cost of a single whole-file call.
• CLAUDE.md now defers cross-project defaults to ../tosijs-coding-practices, recording only tjs-lang-specific divergences.
• Explained why the full build is named make, not build (bun build is a Bun builtin — a build script would be silently shadowed).
• src/docs-index.test.ts enforces that llms.txt indexes every top-level/docs/ markdown file and every package.json entry point, and that its links resolve.
• Added a pre-commit hook (.githooks/, enabled by the prepare script) that checks staged files only with Prettier and ESLint, plus a repo-wide bun run format:check.

0.9.1 — 2026-07-11

No breaking changes.

Added

• Inline-WASM developer feedback (from tosijs-ui adoption):
  • Silent wasm{} fallback now surfaces in result.warnings (UI-#1).
  • await __tjs_wasm_ready() awaitable ready signal (UI-#2).
  • __tjs_wasm_enabled enable/disable toggle (UI-#3).
  • f32x4 min/max, comparisons, and select for data-dependent SIMD (UI-#6).
• Auto-lint for i32 / i32 integer division, a WASM footgun (UI-#4), plus supported-control-flow-subset docs (UI-#5).

Changed

• TjsStrict now escalates an unverifiable predicate to a transpile error (default remains warn-only, preserving the subset invariant).

0.9.0 — 2026-07-06

Added

• Predicate verification wired into Type and Generic guards — verified predicates compile to fuel-bounded, DoS-safe native JS, with graceful fallback.
• Per-predicate verification status on the tjs() result (result.predicates, mirrored into result.warnings); exported PredicateVerification from tjs-lang/lang.
• ReDoS lint: the verifier rejects ReDoS-prone regexes.
• New package subpaths: tjs-lang/css (verified-predicate CSS validators — colors, dimensions, order-flexible shorthands, recursive style structure, $predicate schema builders, property-aware validation), tjs-lang/schema (tosijs-schema pre-wired with $predicate support), tjs-lang/runtime, and tjs-lang/bun-plugin.
• $predicate JSON-Schema keyword + createPredicateEvaluator (the tosijs-schema bridge).
• generateDTS reachable from tjs-lang/lang; editors/* rebuilt from source.

Fixed

• .d.ts emitter: bare params are required positions, not optional (valid TS).
• TS→TJS (fromTS) no longer leaks raw TS into Type/Generic blocks.

Changed (mildly breaking)

• fromTS is no longer re-exported from the main entry — import it from tjs-lang/lang/from-ts (keeps the TypeScript compiler out of the main bundle).

0.8.7 — 2026-07-01

Fixed

• Bare-assignment auto-const must not touch plain JS or redeclare bindings.
• A doc comment must start a line (mid-line /*# and /** are ignored).

0.8.6 — 2026-06-30

Fixed

• TS→TJS (fromTS) never leaks raw TS into Type/Generic blocks.

0.8.5 — 2026-06-30

Added

• Self-contained browser bundles for in-browser transpilation (tjs-lang/browser).

Fixed

• AJS == is footgun-free (not structural), consistent with TJS. (Recorded that the old structural == was also a fuel-bypass DoS; a future Is atom must be fuel-metered.)

0.8.4 — 2026-06-26

Added

• First-class predicate-safety verifier (src/lang/predicate.ts) + fuel-bounded, global-shadowed native predicate compiler.
• Atom effects: 'pure' | 'io' tag — the predicate-safety keystone.
• The $predicate JSON-Schema keyword + reference evaluator.
• suggest() — autocomplete completions mined from predicate clusters.
• Introspection-driven, destructuring-aware playground autocomplete (scope-aware symbol model + runtime-truth member completion via an introspection bridge).

Changed

• == is footgun-free (not structural) — stale docs corrected and pinned with tests.

(No 0.8.3 was tagged — the version was skipped.)

0.8.2 — 2026-06-24

Added

• Explicit source dialect (js | tjs) + extension-based resolution; restores the TJS ⊇ AJS subset invariant.
• AJS local helper functions.
• Playground surfaces inconclusive signature tests as a distinct state.

Fixed

• Run-level default timeout = max(atom timeout) × 2 (was a fixed 60s).
• Generous timeouts on embedding IO atoms (storeVectorize/storeVectorAdd).
• .prettierignore narrowed so format isn't ~50× slower.

0.8.1 — 2026-06-10

Fixed

• Broken npm main entry (index bundle) + structured-output predict fix.
• predict() omits an empty tools array so structured output works.
• Robust SIMD speedup timing in the demo (no more "Infinityx" in Firefox).

Changed

• Migrated to ESLint 10 + typescript-eslint 8 flat config.

0.8.0 — 2026-05-14

Added

• Cross-file WASM libraries: composable wasm function declarations, transpile-time module composition (wasm-to-wasm call resolution), and the tjs-lang/linalg SIMD stdlib subpath. See wasm-library-plan.md.

Entries below 0.8.0 are backfilled coarsely from the git tags and log (they predated this changelog). Only v0.2.0, v0.7.6, v0.7.7, v0.7.8 were tagged before 0.8.0, so the long 0.2.0 → 0.7.6 span is summarized as one entry rather than split across untagged versions.

0.7.8 — 2026-04-30

Added / Fixed

• AJS agent-loop fixes (PR #2): computed member access arr[i] in expressions, while error propagation (no more infinite fuel burn on a failing body), battery user type widened for multi-turn messages.
• Runtime: validate function-typed params on every call, pass-time function-shape checks, deep array validation (arr: [0] checks element types, not just array-ness), array-error propagation through nested params.
• Inference: rich function shapes (params + return types); function kind for arrow/function-expression defaults.
• Docs: classes and test { } blocks render as documentation; function-extraction fixes.
• Playground: SW-served iframe (all iframe fetches route through TFS), per-package / per-import CDN routing (JSDelivr /+esm default, esm.sh for React peer-dep dedup).

0.7.7 — 2026-04-27

Fixed

• Protect string literals from code transformations.

0.7.6 — 2026-04-26

The long feature-accretion phase (202 commits since 0.2.0, no intermediate tags — coarse summary):

Added

• Inline WASM: compiled at transpile time (with WAT comments), SIMD (v128/f32x4) intrinsics, wasmBuffer() zero-copy memory + vector search (~5× speedup), iframe instantiation.
• FunctionPredicate: first-class function types, generic FunctionPredicate<T>, structural validation, .d.ts emission.
• JSON Schema generation from TJS types + function signatures; Type.strip(); ecosystem compat tests (Zod, Effect, Radash, Superstruct, ts-pattern, Kysely).
• Complete .d.ts emission: constants, type aliases, rest params, auto-populated declaration blocks for round-tripping; DOM type handling in fromTS (130+ types).
• Error-history ring buffer (flight recorder) for catching silent monadic errors.
• Honest equality: == split into Eq (honest equality) vs Is (structural), tjsEquals symbol protocol, VM structural equality; typeof null === 'null'; NaN == NaN is true; IsBounded().
• TjsNoVar + const! (compile-time immutability, zero runtime cost); standalone JS output (emitted code runs without runtime setup); @tjs annotations and /* @tjs ... */ mode directives in TS source.
• Playground TFS service worker: dynamic module resolution, specifiers rewritten directly to /tfs/ URLs (import maps dropped); Firebase infra (Auth, Cloud Functions with Eval).

Changed

• ASI protection fixes (was breaking WASM multiline expressions); predicate reason strings in diagnostic type errors.

0.2.0 — 2026-01-29

The foundational release: the TJS→JS transpiler (runtime type metadata), the TypeScript→TJS converter, the AJS gas-metered VM (fuel metering, capability injection, monadic errors), the builder API, stored procedures (AST-as-token), Eval() safe eval, proportional fuel charging for memory-allocating ops, and the playground + editor integrations (Monaco / CodeMirror / Ace, linter, autocomplete POC).

Changed

• BREAKING — VM return flattened to value-based (202e72a): return now takes a value directly ({ op: 'return', value: {...} }) instead of schema-based state extraction. Removed the __result__ wrapper and the nested seq blocks around returns, so vm.run()'s result is exactly the value you return — no envelope, no intermediate wrapping. This is the VM-return-flattening change; it landed in 0.2.0 (before 0.7.8) and was only recorded in the git log until this backfill.