
Ecosystem and production
The Provenance Was Valid. The Commit Was Not.
An npm provenance attestation binds a tarball to a repository, a workflow and a commit. Reading the payload shows what it never claims.
JavaScript, TypeScript, and the runtimes underneath
JS Ledger examines JavaScript, TypeScript, and the runtimes, frameworks, and tooling behind modern web applications.

Ecosystem and production
An npm provenance attestation binds a tarball to a repository, a workflow and a commit. Reading the payload shows what it never claims.
Recently filed

Frameworks
A single-pass push through a diamond recomputes the leaf twice, and the first result mixes a fresh value with a stale one. Two passes are what remove it.

Language internals
A naked type parameter splits its union before the conditional runs, so IsArray<string[] | number> comes back as 'no' | 'yes'. Read out of TypeScript 7.0.2.

Tooling and build
Vite 7 depends on esbuild and Rollup; Vite 8 on neither. Serving one module from both majors shows what the swap to Rolldown changed and what it left alone.

Runtime and performance
A hidden class is a node in a transition tree V8 keeps for the whole isolate — which is why an unrelated function can decide how your object is stored.

Language internals
One async function compiled three ways — TypeScript's ES5 emit, V8's bytecode and the spec's Await steps — and the microtask turns each one predicts.

Ecosystem and production
What package-lock.json actually records, what its integrity hashes do and do not prove, and where the real install-time risk sits.
Sections
Read in order