feat: replace JavaScript compatibility routes with checked TypeScript

.github/workflows/ci.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -16,8 +16,10 @@ env:
 
 jobs:
   rust:
-    name: Rust lint and tests
+    name: Rust lint, tests, and CLI acceptance
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -26,18 +28,60 @@ jobs:
       - name: Format check
         run: cargo fmt --all -- --check
       - name: Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
       - name: Tests
-        run: cargo test --workspace -- --test-threads=1
-      - name: CLI smoke
+        env:
+          CARGO_PROFILE_TEST_OPT_LEVEL: "2"
+          CARGO_PROFILE_TEST_DEBUG_ASSERTIONS: "true"
+          CARGO_PROFILE_TEST_OVERFLOW_CHECKS: "true"
+        run: cargo test --locked --workspace -- --test-threads=1
+      - name: TypeScript, Lua, and version CLI smoke
         run: |
-          cargo run --bin pd-vm-compat-run -- examples/example.js
-          cargo run --bin pd-vm-compat-run -- examples/example.lua
-          cargo run --bin pd-vm-compat-run -- --version
+          cargo run --locked --bin pd-vm-compat-run -- examples/example.ts
+          cargo run --locked --bin pd-vm-compat-run -- examples/example.mts
+          cargo run --locked --bin pd-vm-compat-run -- examples/example.lua
+          cargo run --locked --bin pd-vm-compat-run -- --version
+      - name: Selected reference-array CLI smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          scratch="$(mktemp -d)"
+          trap 'rm -rf "$scratch"' EXIT
+          mkdir -p "$scratch/sorts"
+          cp tests/fixtures/typescript/bubble_sort.ts "$scratch/sorts/"
+          cat > "$scratch/main.ts" <<'EOF'
+          import { bubbleSort as sort } from "./sorts/bubble_sort.ts";
+          const sorted = sort([8, 3, 5, 1, 4, 2]);
+          const eq = sorted[0] === 1 && sorted[5] === 8;
+          eq ? 1 : 0;
+          EOF
+          cargo run --locked --bin pd-vm-compat-run -- --typescript-reference-arrays --fuel 100000 "$scratch/main.ts" | grep -F "Int(1)"
+      - name: Reject JavaScript CLI entry files
+        shell: bash
+        run: |
+          set -euo pipefail
+          scratch="$(mktemp -d)"
+          trap 'rm -rf "$scratch"' EXIT
+          for extension in js mjs cjs; do
+            source="$scratch/rejected.$extension"
+            log="$scratch/rejected.$extension.log"
+            printf 'const value = "JavaScript must be rejected";\n' > "$source"
+            if cargo run --locked --bin pd-vm-compat-run -- "$source" >"$log" 2>&1; then
+              echo "unexpectedly accepted .$extension entry file" >&2
+              exit 1
+            fi
+            if ! grep -Fq ".$extension" "$log"; then
+              cat "$log" >&2
+              echo "diagnostic did not identify .$extension" >&2
+              exit 1
+            fi
+          done
 
   binaries:
     name: pd-vm-compat-run (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -46,20 +90,43 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - name: Build pd-vm-compat-run
-        run: cargo build --bin pd-vm-compat-run --release
+        run: cargo build --locked --bin pd-vm-compat-run --release
+      - name: Run typed frontend and Lua smoke fixtures
+        run: |
+          cargo run --locked --bin pd-vm-compat-run --release -- examples/example.ts
+          cargo run --locked --bin pd-vm-compat-run --release -- examples/example.mts
+          cargo run --locked --bin pd-vm-compat-run --release -- examples/example.lua
+          cargo run --locked --bin pd-vm-compat-run --release -- --version
       - name: Stage pd-vm-compat-run artifact
         shell: bash
         run: |
+          set -euo pipefail
           mkdir -p dist
           suffix=""
           if [[ "${{ runner.os }}" == "Windows" ]]; then suffix=".exe"; fi
-          cp "target/release/pd-vm-compat-run${suffix}" "dist/pd-vm-compat-run-${{ runner.os }}-${{ runner.arch }}${suffix}"
+          source="target/release/pd-vm-compat-run${suffix}"
+          test -f "$source"
+          cp "$source" "dist/pd-vm-compat-run-${{ runner.os }}-${{ runner.arch }}${suffix}"
       - uses: actions/upload-artifact@v4
         with:
           name: pd-vm-compat-run-${{ runner.os }}-${{ runner.arch }}
           path: dist/*
-      - name: Upload pd-vm-compat-run release asset
-        if: startsWith(github.ref, 'refs/tags/')
+
+  release-assets:
+    name: Attach release assets
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [rust, binaries]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download all platform artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: pd-vm-compat-run-*
+          path: dist
+          merge-multiple: true
+      - name: Publish release assets
         uses: softprops/action-gh-release@v2
         with:
           files: dist/*

.github/workflows/publish-crates.yml

@@ -1,153 +1,57 @@
-name: Publish crates
+name: Publish compat crate
 
 on:
-  push:
-    tags:
-      - 'v*'
-      - '[0-9]*'
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Version to publish. Defaults to the pushed tag name without leading v.'
-        required: false
+      compat_version:
+        description: Exact pd-vm-compat-frontends version already present in Cargo.toml
+        required: true
         type: string
       pd_vm_version:
-        description: 'pd-vm dependency version override'
-        required: false
-        type: string
-      pd_edge_abi_version:
-        description: 'pd-edge-abi dependency version override'
-        required: false
+        description: Published pd-vm registry release supporting the typed frontend API; no default is selected
+        required: true
         type: string
 
 concurrency:
-  group: publish-crates-${{ github.ref }}
+  group: publish-compat-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    env:
-      PACKAGE_ORDER: pd-vm-compat-frontends
-      PD_VM_VERSION: ${{ inputs.pd_vm_version || '0.1.0' }}
-      PD_EDGE_ABI_VERSION: ${{ inputs.pd_edge_abi_version || '0.1.1' }}
-      WORKSPACE_VERSION_OVERRIDES: rustscript-compat-frontends=${{ inputs.version }} rustscript=${{ inputs.pd_vm_version || '0.1.0' }} pd-edge=${{ inputs.pd_edge_abi_version || '0.1.1' }}
     steps:
       - name: Checkout compatibility frontends
         uses: actions/checkout@v4
-        with:
-          path: rustscript-compat-frontends
-      - name: Checkout rustscript dependency
-        uses: actions/checkout@v4
-        with:
-          repository: rustscript-lang/rustscript
-          path: rustscript
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-      - name: Publish crate
-        working-directory: rustscript-compat-frontends
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Test release preflight guards and rollback
+        run: python3 -m unittest discover -s scripts/tests -p 'test_*.py' -v
+      - name: Prepare the compat-only registry candidate
+        env:
+          COMPAT_VERSION: ${{ inputs.compat_version }}
+          PD_VM_VERSION: ${{ inputs.pd_vm_version }}
+        run: >-
+          python3 scripts/prepare-release.py
+          --compat-version "$COMPAT_VERSION"
+          --pd-vm-version "$PD_VM_VERSION"
+      - name: Verify package against the selected registry dependency
+        run: |
+          cargo fmt --all -- --check
+          cargo check --locked --workspace --all-targets
+      - name: Test prepared registry provenance and behavior
+        env:
+          PD_VM_EXPECTED_REGISTRY_VERSION: ${{ inputs.pd_vm_version }}
+        run: cargo test --locked --workspace -- --test-threads=1
+      - name: Package dry run
+        run: cargo publish --locked --dry-run --allow-dirty
+      - name: Publish compatibility crate only
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-          INPUT_VERSION: ${{ inputs.version }}
         run: |
           set -euo pipefail
           if [[ -z "${CARGO_REGISTRY_TOKEN:-}" ]]; then
             echo "CARGO_REGISTRY_TOKEN is required" >&2
             exit 1
           fi
-          version="${INPUT_VERSION:-}"
-          if [[ -z "$version" ]]; then
-            version="${GITHUB_REF_NAME#v}"
-          fi
-          if [[ -z "$version" ]]; then
-            echo "version is required" >&2
-            exit 1
-          fi
-          export PUBLISH_VERSION="$version"
-          python3 - <<'PY'
-          import os, re
-          from pathlib import Path
-
-          version = os.environ['PUBLISH_VERSION']
-          dep_versions = {
-              'pd-vm': os.environ.get('PD_VM_VERSION') or '0.1.0',
-              'pd-host-function': os.environ.get('PD_VM_VERSION') or '0.1.0',
-              'pd-edge-abi': os.environ.get('PD_EDGE_ABI_VERSION') or '0.1.1',
-          }
-          workspace_versions = {}
-          for item in os.environ.get('WORKSPACE_VERSION_OVERRIDES', '').split():
-              if '=' in item:
-                  name, value = item.split('=', 1)
-                  if value:
-                      workspace_versions[name] = value
-          dep_re = re.compile(r'^(\s*([A-Za-z0-9_-]+)\s*=\s*\{)(.*)(\}\s*)$')
-          for path in Path('..').rglob('Cargo.toml'):
-              if '.git' in path.parts or 'target' in path.parts:
-                  continue
-              manifest_version = workspace_versions.get(path.parent.name, version)
-              lines = path.read_text().splitlines()
-              out = []
-              section = ''
-              for line in lines:
-                  stripped = line.strip()
-                  if stripped.startswith('[') and stripped.endswith(']'):
-                      section = stripped
-                  if section in ('[workspace.package]', '[package]') and stripped.startswith('version = '):
-                      line = re.sub(r'version\s*=\s*"[^"]*"', f'version = "{manifest_version}"', line)
-                  match = dep_re.match(line)
-                  if match and ('path' in match.group(3) or 'git' in match.group(3)):
-                      prefix, key, body, suffix = match.groups()
-                      package_match = re.search(r'package\s*=\s*"([^"]+)"', body)
-                      dep_name = package_match.group(1) if package_match else key
-                      dep_version = dep_versions.get(dep_name)
-                      if dep_version:
-                          body = re.sub(r'\s*,?\s*git\s*=\s*"[^"]*"', '', body)
-                          body = re.sub(r'\s*,?\s*rev\s*=\s*"[^"]*"', '', body)
-                          body = re.sub(r'\s*,?\s*path\s*=\s*"[^"]*"', '', body)
-                          if re.search(r'version\s*=\s*"[^"]*"', body):
-                              body = re.sub(r'version\s*=\s*"[^"]*"', f'version = "{dep_version}"', body)
-                          else:
-                              body = body.strip().strip(',')
-                              if body:
-                                  body = f'version = "{dep_version}", {body}'
-                              else:
-                                  body = f'version = "{dep_version}"'
-                          line = prefix + body + suffix
-                  out.append(line)
-              path.write_text('\n'.join(out) + '\n')
-          PY
-          python3 - <<'PY'
-          import os, subprocess, sys, time, urllib.error, urllib.request
-
-          version = os.environ['PUBLISH_VERSION']
-          packages = os.environ['PACKAGE_ORDER'].split()
-          token = os.environ['CARGO_REGISTRY_TOKEN']
-
-          def exists(crate, crate_version):
-              url = f'https://crates.io/api/v1/crates/{crate}/{crate_version}'
-              try:
-                  urllib.request.urlopen(url, timeout=20).read()
-                  return True
-              except urllib.error.HTTPError as exc:
-                  if exc.code == 404:
-                      return False
-                  raise
-
-          for package in packages:
-              if exists(package, version):
-                  print(f'{package} {version} already published; skipping')
-                  continue
-              for attempt in range(1, 19):
-                  print(f'publishing {package} {version}, attempt {attempt}')
-                  proc = subprocess.run([
-                      'cargo', 'publish', '-p', package, '--no-verify', '--allow-dirty', '--token', token,
-                  ], text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-                  print(proc.stdout)
-                  if proc.returncode == 0 or exists(package, version):
-                      break
-                  if attempt == 18:
-                      sys.exit(proc.returncode)
-                  time.sleep(20)
-          PY
+          cargo publish --locked --allow-dirty --token "$CARGO_REGISTRY_TOKEN"