Cap'n Web's biggest weakness right now is that it doesn't validate types at all, but TypeScript can easily lead people to a false sense of security. It's really awkward to write type checks for the types that TS is already assuming are accurate.
I believe the right solution is to create a code generator that, given TypeScript types, generates runtime type-checking code for each type, which can be applied as a wrapper (wrapping each method to check the inputs or returns).
TypeScript famously doesn't want to support this kind of thing, and the port to Go has made it harder. But I think we can do it. One idea is to trick the type checker itself into building the generated code as a string and then outputting it in a diagnostic, which we can then intercept and save to a file.
Note that we would not need to support the entire TS type system – only types that are RPC-compatible (structured clone).
Cap'n Web's biggest weakness right now is that it doesn't validate types at all, but TypeScript can easily lead people to a false sense of security. It's really awkward to write type checks for the types that TS is already assuming are accurate.
I believe the right solution is to create a code generator that, given TypeScript types, generates runtime type-checking code for each type, which can be applied as a wrapper (wrapping each method to check the inputs or returns).
TypeScript famously doesn't want to support this kind of thing, and the port to Go has made it harder. But I think we can do it. One idea is to trick the type checker itself into building the generated code as a string and then outputting it in a diagnostic, which we can then intercept and save to a file.
Note that we would not need to support the entire TS type system – only types that are RPC-compatible (structured clone).