2025-07-11

@endo/immutable-arraybuffer 1.1.2

• Removes @endo/immutable-arraybufer/shim-hermes.js and absorbs the necessary features into @endo/immutable-arraybuffer/shim.js. We are not qualifying this as a breaking change since the feature did not exist long enough to become relied upon.

@endo/marshal 1.8.0

• Introduces an environment variable config option ENDO_RANK_STRINGS to change the rank ordering of strings from the current (incorrect) ordering by UTF-16 code unit used by JavaScript's < and .sort() operations to (correct and OCapN-conformant) ordering by Unicode code point. It currently defaults to "utf16-code-unit-order", matching the previously-unconditional behavior.

@endo/pass-style 1.6.3

• The exported function name isObject is ambiguous. It is unclear whether it includes functions or not. (It does.) To avoid this confusion, we're deprecating isObject and suggesting to use the new export isPrimitive instead, that has the opposite answer. IOW, for all x, isObject(x) === !isPrimitive(x)

@endo/patterns 1.7.0

• @endo/marshal introduces an environment variable config option ENDO_RANK_STRINGS to change the rank ordering of strings from the current (incorrect) ordering by UTF-16 code unit used by JavaScript's < and .sort() operations to (correct and OCapN-conformant) ordering by Unicode code point. It currently defaults to "utf16-code-unit-order", matching the previously-unconditional behavior.
  • @endo/patterns provides a compareKeys partial order that delegates some ordering, including strings, to the rank ordering provided by @endo/marshal. So when the ENDO_RANK_STRINGS default is not overridden, then compareKeys also follows the (incorrect) UTF-16 code unit order. But when it is overridden, then compareKeys also follows the (correct) Unicode code-point order.
• In errors explaining why a specimen does not match a pattern, sometimes the error message contains a quoted form of a nested pattern. This quoting was done with q, producing an uninformative rendering of these nested patterns. Now this quoting is done with qp, which renders these nested patterns into readable Justin source code.

2026-06-17 Releases Suplemental

@endo/pass-style 1.6.2

• Fixes so that the package initializes on platforms that lack ArrayBuffer.prototype.transferToImmutable.

@endo/compartment-mapper 1.6.2

• Produces a stub for require.extensions in CommonJS modules to increase ecosystem compatibility.

@endo/immutable-arraybuffer 1.1.1

• Captures structuredClone early so that scuttling all properties of globalThis after initializing @endo/immutable-arraybuffer or @endo/immutable-arraybuffer/shim.js does not interfere with this module's designed behavior.

2025-06-17 Release

@endo/pass-style v1.6.1

BROKEN BUT PATCHED in 1.6.2, contains a fix but published with broken
dependency versions.
Inadvertently published without amending workspace protocol dependencies.

• Fixes so that the package initializes on platforms that lack
  ArrayBuffer.prototype.transferToImmutable and recognizes immutable
  ArrayBuffers as having a pass-style of byteArray on platforms have a
  sliceToImmutable, even if that is emulated with a shim using slice, even
  if they lack transferToImmutable.

2025-06-02 Releases

@endo/pass-style v1.6.0

BROKEN BUT PATCHED in 1.6.1, this version introduced a dependence on the
underlying platform supporting ArrayBuffer.prototype.transferToImmutable.
The patch restores the ability to use pass-style on older platforms without
the immutable ArrayBuffer shim (as entrained by ses).

• Introduces support for byteArray.

ses v1.13.0

• Two new stackFiltering: options are added

  • 'omit-frames' -- Only omit likely uninteresting frames. Keep original paths.
  • 'shorten-paths' -- Only shorten paths to text likely clickable in an IDE

  This fills out the matrix of what should have been orthogonal options. The existing 'concise' setting both omits likely uninteresting frames and shortens their paths. The existing 'verbose' setting does neither.

• Uses the @endo/immutable-arraybuffer shim to add ArrayBuffer.p.immutable, ArrayBuffer.p.transferToImmutable, and ArrayBuffer.p.sliceToImmutable to ses, in order to emulate the Immutable ArrayBuffer proposal. These make an ArrayBuffer-like object whose contents cannot be mutated. However, due to limitations of the shim

  • Unlike ArrayBuffer and SharedArrayBuffer this shim's ArrayBuffer-like object cannot be transfered or cloned between JS threads.
  • Unlike ArrayBuffer and SharedArrayBuffer, this shim's ArrayBuffer-like object cannot be used as the backing store of TypeArrays or DataViews.
  • The shim depends on the platform providing either structuredClone or Array.prototype.transfer. Node <= 16 and provides neither, causing the shim to fail to initialize, and therefore SES to fail to initialize on such platforms.
  • Current Hermes has even stronger constraints, lacking structuredClone, transfer, private fields, and even class syntax. This requires other coping strategies. See #2785
  • Even after the upcoming transferToImmutable proposal is implemented by the platform, the current code will still replace it with the shim implementation, in accord with shim best practices. See #2311 (comment) . It will require a later manual step to delete the shim or have it avoid overriting a platform implementation, after manual analysis of the compat implications.

• The evalTaming option 'safe-eval' now can only throw error SES_DIRECT_EVAL. This allows SES to initialize with 'unsafe-eval' or 'no-eval' on hosts with no direct eval available such as Hermes for a successful lockdown that tolerates it's language features.

  The module name ses/hermes can now be required to call lockdown and repairIntrinsics only, Compartment is not yet available.

  It is currently compatible with Hermes v0.12.0, we plan to support v0.13.0 then subsequent Hermes tags or side-by-side versions built for React Native depending on ecosystem usage and official support, then Static Hermes when released.

  Also ses/hermes can now be hooked into bundlers such as Metro to run Hardened JS.

@endo/compartment-mapper v1.6.1

• The dev flag for mapNodeModules() is no longer deprecated. The concept of a "condition" (conditional exports) is disinct from the flag's original meaning (instructs mapNodeModules() to consider devDependencies when graphing packages). Users who have switched to using a development condition for dev's purpose are encouraged to switch back to using the dev flag instead. In a future release, the presence of a development condition will no longer mimic an enabled dev flag and will only be considered when evaluating conditional exports.

@endo/evasive-transform v2.0.0

• The sourceType option is now restricted to script and module only. Function signature types have changed to be more precise.

@endo/bundle-source v4.1.0

• The 'endoZipBase64' moduleFormat now utilizes the importHook option to exit dependencies whose specifiers return a truthy value.

@endo/import-bundle v1.5.0

• The 'endoZipBase64' moduleFormat now utilizes the importHook option.

@endo/marshal v1.7.0

• @endo/marshal now also exports a qp function meaning "quote passable"
  that renders its passable argument as a quasi-quoted Justin expression.
  This can be used with X, Fail etc the same way you currently use q.
  Since Justin is a subset of HardenedJS, there's no need for the quasi-quoted
  form to explain what language it is in.

2025-03-24

ses v1.12.0

• The evalTaming: option values are renamed:

  • from 'safeEval', 'unsafeEval', and 'noEval'
  • to 'safe-eval', 'unsafe-eval', and 'no-eval'

  in order to follow the convention that lockdown option values use kebob-case rather than camelCase. To avoid breaking old programs during the transition, the old names are deprecated, but continue to work for now.

• Evaluating a non-lexical name that is also absent on the global object of a compartment no longer throws a ReferenceError and instead produces undefined because it proves impossible to do so without revealing what properties exist on the host globalThis to compartmentalized code with a shim. This is a divergence from the expected behavior of a native Hardened JavaScript implementation, like XS.

@endo/patterns v1.5.0

• New pattern: M.containerHas(elementPatt, bound = 1n) motivated to support want patterns in Zoe, to pull out only bound number of elements that match elementPatt. bound must be a positive bigint.

• Closely related, @endo/patterns now exports containerHasSplit to support ERTP's use of M.containerHas on non-fungible (set, copySet) and semifungible (copyBag) assets, respectively. See Agoric/agoric-sdk#10952 .

@endo/import-bundle v1.4.0

• Adds support for test format bundles, which simply return a promise for an object that resembles a module exports namespace with the objects specified on the symbol-named property @exports, which is deliberately not JSON serializable or passable.
• Adds a typedImportBundle<ExpectedExportsNamespace> function with a proper type signature, to provide a narrower signature than any without disrupting existing usage.

@endo/bundle-source v4.0.0

• Replaces the implementation for the nestedEvaluate and getExport formats with one based on Endo's Compartment Mapper instead of Rollup, in order to obviate the need to reconcile source map transforms between Rollup and the underlying Babel generator. As a consequence, we no longer generate a source map for the bundle, but Babel ensures that we preserve line and column numbers between the original source and the bundled source.

@endo/compartment-mapper v1.6.0

• Accommodates CommonJS modules that use defineProperty on exports.

• Divides the role of makeBundle into makeScript and makeFunctor. The new makeScript replaces makeBundle without breaking changes, producing a JavaScript string that is suitable as a <script> tag in a web page.

• The new makeFunctor produces a JavaScript string that, when evaluated, produces a partially applied function, so the caller can provide runtime options.

• Both makeScript and makeFunctor now accept format, useEvaluate and sourceUrlPrefix options.

• The functor produced by makeFunctor now accepts evaluate, require, and sourceUrlPrefix runtime options.

• Both makeScript and makeFunctor now accept a format option. Specifiying the "cjs" format allows the bundle to exit to the host's CommonJS require for host modules.

• Adds sourceDirname to compartment descriptors in the compartment maps generated by mapNodeModules and uses these to provide better source URL comments for bundles generated by makeScript and makeFunctor, by default.

These changes collectively allow us to replace the implementation of nestedEvaluate and getExports formats in @endo/bundle-source, including the preservation of useful line numbers and file names in stack traces.

• mapNodeModules, importLocation and loadLocation now accept a log option for users to define a custom logging function. As of this writing, only mapNodeModules will potentially call this function if provided. Expansion of log messaging and support for the log option in more APIs is expected in the future.

@endo/evasive-transform v1.4.0

• Adds a sourceMap option so that the generated sourcemap can project back to the original source code without unmapLoc.
• Removes support for sourcemap unmapLoc because it is not used by contemporary Endo packages. The option is now ignored.

2025-01-23

ses v1.11.0

• Adds support for dynamic import in conjunction with an update to @endo/module-source.

• Specifying the long-discontinued mathTaming or dateTaming options logs a warning.

Incubating: Please do not rely on these features as they are under development and subject to breaking changes that will not be signaled by semver.

• Adds support for an XS-specific variant of the SES shim that is triggered with the xs package export condition. This version of SES preserves all the features of Compartment provided uniquely by the SES shim, but with the __native__ constructor option, loses support for importing precompiled module records and gains support for native ModuleSource.

@endo/module-source v1.2.0

• Supports dynamic import within a ModuleSource in conjunction with a related change in ses. For example, await import(specifier) can now call through to the surrounding compartment's importHook to load and evaluate further modules.
• Provides an XS-specific variant of @endo/module-source that adapts the native ModuleSource instead of entraining Babel.

@endo/compartment-mapper v1.5.0

• mapNodeModules and all functions that use it now tolerate the absence of expected packages. These packages are now omitted from the generated package skeleton map. So, loading a physically missing module now occurs during the load phase instead of the mapping phase.
• Adds a strict option to all functions that mapNodeModules to restore old behavior, which produces an error early if, for example, a non-optional peer dependency is missing. Peer dependencies are strictly required unless peerDependenciesMeta has an object with a truthy optional entry. Correct interpretation of peerDependencies is not distributed evenly, so this behavior is no longer the default.

Incubating: Please do not rely on these features as they are under development and subject to breaking changes that will not be signaled by semver.

• The module @endo/compartment-mapper/import-archive-parsers.js does not support modules in archives in their original ESM (mjs) or CommonJS (cjs) formats because they entrain Babel and a full JavaScript lexer that are not suitable for use in all environments, specifically XS. This version introduces an elective @endo/compartment-mapper/import-archive-all-parsers.js that has all of the precompiled module parsers (pre-cjs-json and pre-mjs-json) that Endo's bundler currently produces by default and additionally parsers for original sources (mjs, cjs). Also, provided the xs package condition, @endo/compartment-mapper/import-archive-parsers.js now falls through to the native ModuleSource and safely includes mjs and cjs without entraining Babel, but is only supported in conjunction with the __native__ option for Compartment, importArchive, parseArchive, and importBundle. With the node package condition (present by default when running ESM on node), @endo/compartment-mapper/import-archive-parsers.js also now includes mjs and cjs by entraining Babel, which performs adequately on that platform.
• Adds a __native__: true option to all paths to import, that indicates that the application will fall through to the native implementation of Compartment, currently only available on XS, which lacks support for precompiled module sources (as exist in many archived applications, particularly Agoric smart contract bundles) and instead supports loading modules from original sources (which is not possible at runtime on XS).

2024-11-13

ses v1.10.0

• Permit Promise.try, since it has reached Stage 4.

• Adds a reporting option to lockdown and repairIntrinsics.

  The default behavior is "platform" which will detect the platform and report warnings according to whether a web console, Node.js console, or print are available. The web platform is distinguished by the existence of window or importScripts (WebWorker). The Node.js behavior is to report all warnings to stderr visually consistent with use of a console group. SES will use print in the absence of a console. Captures the platform console at the time lockdown or repairIntrinsics are called, not at the time ses initializes.

  The "console" option forces the web platform behavior. On Node.js, this results in group labels being reported to stdout.

  The "none" option mutes warnings.

@endo/bundle-source v3.5.0

• Adds support for TypeScript type erasure using ts-blank-space applied to TypeScript modules with .ts, .mts, and .cts extensions, for any package that is not under a node_modules directory, immitating node --experimental-strip-types. As with .js extensions, the behavior of .ts is either consistent with .mts or .cts depending on the type in package.json.

@endo/compartment-mapper v1.4.0

• Adds options languageForExtension, moduleLanguageForExtension, commonjsLanguageForExtension, and languages to mapNodeModules and compartmentMapForNodeModules allowing for certain mappings from extension (e.g., ts) to language (e.g., mts or cts) to depend on the each package’s type in the way we already vary js between cjs and mjs. These options enter through the high level functions including makeArchive and importLocation.
• The new options workspaceLanguageForExtension, workspaceModuleLanguageForExtension, and workspaceCommonjsLanguageForExtension apply like the above except more specifically and for packages that are not physically located under a node_modules directory, indicating that JavaScript has not yet been generated from any non-JavaScript source files.
• Omits unused module descriptors from compartment-map.json in archived applications, potentially reducing file sizes.
• Fixes an issue where errors thrown from exit module hooks (importHook) would be thrown at parse-time when the parser uses heuristic import analysis instead of at runtime. Such errors will now be thrown at runtime, as originally intended. To those who expected the previous behavior: if you exist, please exercise caution when upgrading.