windjammer 0.35.2

A simple language inspired by Go, Ruby, and Elixir that transpiles to Rust - 80% of Rust's power with 20% of the complexity
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
# Windjammer Roadmap 🗺️

*Last Updated: November 22, 2025*

This roadmap outlines our vision for making Windjammer the **ultimate systems programming language** with a complete ecosystem, zero lock-in, and world-class developer experience.

## 🎯 Repository Focus (Post v0.34.0)

As of v0.34.0, Windjammer has been restructured into focused repositories:
- **windjammer** (this repo) - Core language compiler and tooling
- **windjammer-ui** - Cross-platform UI framework (separate repo)
- **windjammer-game** - Game development framework (private)

This roadmap now focuses on **core language features** and **developer tooling**.

---

## ✅ Completed (v0.1.0 - v0.33.0)

### Core Language Features
- ✅ Complete lexer, parser, and code generator
- ✅ Ownership and lifetime inference
- ✅ Trait bound inference
- ✅ Pattern matching with guards
- ✅ Concurrency primitives (channels, spawn, defer)
- ✅ Decorator system
- ✅ Macro system (declarative)
- ✅ WASM support

### Optimization & Performance
- ✅ 15-phase optimization pipeline (99%+ Rust performance!)
- ✅ String interning (Phase 11)
- ✅ Dead code elimination (Phase 12)
- ✅ Loop optimization - LICM & unrolling (Phase 13)
- ✅ Escape analysis - stack allocation (Phase 14)
- ✅ SIMD vectorization (Phase 15)
- ✅ Salsa incremental compilation (276x faster hot builds!)

### Production Readiness
- ✅ Fuzzing infrastructure (cargo-fuzz)
- ✅ Memory safety tests
- ✅ Stress testing for large codebases
- ✅ Performance regression framework
- ✅ Security audit (A+ rating)
- ✅ Parser error recovery
- ✅ Cross-platform pre-commit hooks

### Risk-Free Adoption (v0.30.0)
- **"Eject to Rust" Feature** - One-way migration path to pure Rust
-`windjammer eject` CLI command
- ✅ Production-quality Rust code generation
-`Cargo.toml` generation with dependencies
- ✅ Formatted output with `rustfmt`, validated with `clippy`
- ✅ Zero vendor lock-in

### Developer Experience & AI Integration (v0.31.0-v0.31.1)

**Language Server Protocol (LSP):**
- ✅ Real-time type checking and error highlighting
- ✅ Auto-completion for functions, types, and variables
- ✅ Go-to-definition and find-references
- ✅ Hover documentation
- ✅ Inline code hints
- ✅ Refactoring support (rename, extract function, inline variable, move item, change signature)
- ✅ Integration with VS Code, IntelliJ, Neovim, Emacs
- ✅ Semantic syntax highlighting

**MCP Server (Model Context Protocol):**
- ✅ AI agent integration for Windjammer development (v0.31.0)
- ✅ 9 MCP tools: parse, analyze, generate, explain errors, search, get definition
-**Advanced refactoring tools**: extract_function, inline_variable, rename_symbol (v0.31.1)
-**Streamable HTTP transport** with session management (MCP 2025-06-18 spec) (v0.31.1)
- ✅ Natural language to Windjammer code translation
- ✅ Automated refactoring suggestions
- ✅ Intelligent error diagnosis and fixes
- ✅ Integration with Claude, ChatGPT, and other AI assistants
- ✅ Semantic code search and navigation
- ✅ Performance benchmarks for all MCP tools (v0.31.1)
- ✅ Shared Salsa database with LSP for consistency

**Why This Matters:**
- ✅ Modern IDEs are table stakes for professional developers
- ✅ Instant feedback loop improves productivity 10x
- ✅ Reduces cognitive load during development
-**MCP enables AI-first development workflow**
- ✅ AI agents can write, understand, and refactor Windjammer code
- ✅ Lowers barrier to entry for newcomers (AI as pair programmer)
- ✅ Future-proof for the AI-assisted development era

### Multi-Target Compilation (v0.32.0) 🌐

**JavaScript Transpiler:**
- `wj build --target=javascript` command
- ✅ Transpile Windjammer → JavaScript (ES2020+)
- ✅ TypeScript definitions (`.d.ts` files)
- ✅ JSDoc comments for IDE support
- ✅ Node.js and Browser compatibility
- ✅ NPM package generation (`package.json`)
- ✅ Async/await detection and handling
- ✅ Clean, idiomatic ES2020+ output
- ✅ Integrated with unified CLI (`wj run --target=js`)

**Multi-Target Architecture:**
- `CodegenBackend` trait for extensibility
- ✅ Rust backend (native binaries)
- ✅ JavaScript backend (npm packages)
- ✅ WebAssembly backend (browser apps)
- ✅ Shared optimization pipeline (all 15 phases)
- ✅ Target-specific idiomatic code generation

**Why This Matters:**
- ✅ Write once, target Rust, JavaScript, or WASM
- ✅ Shared business logic across full-stack apps
- ✅ npm ecosystem access without abandoning Rust safety
- ✅ Browser deployment without compromising on language quality
- ✅ Positions Windjammer as truly **multi-platform**

### Enhanced JavaScript Support (v0.33.0) 🚀

**Production-Grade Features:**
- `--minify` - Compress output for production (50-70% smaller)
-`--tree-shake` - Dead code elimination at compile time
-`--source-maps` - Debug original Windjammer code in browser
-`--polyfills` - Support ES5, ES2015, ES2017, ES2020 targets
-`--v8-optimize` - Monomorphic calls, hidden classes, TurboFan patterns
- ✅ Web Workers - Automatic browser parallelism for `spawn` statements

**Implementation:**
- ✅ 744 lines of minifier logic
- ✅ Source map generation (v3 format)
- ✅ Tree shaking with usage analysis
- ✅ Polyfill generation for multiple targets
- ✅ V8 optimization patterns
- ✅ Web Worker code generation

**Testing & Quality:**
- **108 tests passing** (+18 enhanced JavaScript tests)
- ✅ Integration tests for all optimization flags
- ✅ CLI flag tests (`--minify`, `--tree-shake`, etc.)
- ✅ Zero regressions

**Why This Matters:**
- ✅ Production-ready JavaScript without external tooling
- ✅ Compete with TypeScript's ecosystem
- ✅ All-in-one tooling (no webpack, rollup, babel needed)
- ✅ Deploy to IE11+ or latest Chrome/Firefox/Safari

### Windjammer UI Framework + Game Engine (v0.34.0) 🎨🎮

**Cross-Platform UI & Games: Web, Desktop, Mobile**

**Inspiration:** Svelte + Dioxus + Tauri + Unity + Godot + Bevy

**What We Built:**
- **3 new crates**: `windjammer-ui`, `windjammer-ui-macro`, game module
-**Platform abstraction**: Web, Desktop (Tauri), Mobile (iOS/Android)
-**Reactive state**: Signal, Computed, Effect (Svelte-style)
-**Virtual DOM**: VNode, diff, patch system
-**#[component] macro**: Procedural macro with auto-generated constructors
-**Game framework**: ECS, physics, input, rendering, math
-**2D games working**: Platformer examples with gravity, collisions
-**3D-ready architecture**: Vec3, platform abstraction, renderer trait
-**51 tests passing**: Full test coverage
-**Idiomatic Windjammer**: No Rust leakage, clean syntax

**Component Model:**
```windjammer
#[component]
struct Counter {
    count: i32,
}

impl Counter {
    fn render() -> VNode {
        VElement::new("div")
            .child(VElement::new("h1")
                .child(VText::new(format!("Count: {count}"))))
            .child(VElement::new("button")
                .child(VText::new("Increment")))
            .into()
    }
}
```

**Game Framework:**
```windjammer
#[game_entity]
struct Player {
    position: Vec2,
    velocity: Vec2,
}

impl Player {
    fn update(delta: f32) {
        position += velocity * delta;  // Idiomatic!
    }
}
```

**Platform Support:**
- ✅ Web (JavaScript/WASM)
- ✅ Desktop (Tauri integration ready)
- ✅ Mobile (iOS/Android ready)

**Why This Matters:**
- ✅ ONE language for UI apps AND games
- ✅ Text-based scenes (Git-friendly)
- ✅ Smaller binaries (2-10MB vs 100MB+)
- ✅ Web-first (better than Unity/Godot/Bevy)
- ✅ Rust performance without Rust complexity

---

## 📅 Future Releases

---

### v0.35.0 - 3D Game Foundation 🎮

**Theme:** Bring 3D to Windjammer Games

**Features:**
- Camera system (perspective, orthographic)
- 3D transformations (position, rotation, scale)
- Basic mesh rendering (GLTF loading)
- 3D physics (Rapier integration)
- Lighting (directional, point, spot)
- First-person shooter example

**Why This Matters:**
- Unity/Unreal competitor
- Same language for 2D and 3D games
- Web-based 3D games (WebGL)
- DevTools integration

**Full-Stack Support:**
- HTTP server with routing
- WebSocket support for real-time
- Database integration (SQLx-style)
- Session management
- Authentication helpers
- API generation

**Why This Matters:**
- Complete solution for web development
- No need to learn separate frameworks
- Compile to WASM or JS
- Best-in-class performance
- Type-safe full-stack development
- Unified mental model

**Target Date:** Q3 2026

---

### v0.35.0 - Language Completeness 🔧

**Theme: Fill Language Gaps**

**Features:**
- **Bitwise operators**: `&`, `|`, `^`, `<<`, `>>`, `~`
- **Compound assignment operators**: `+=`, `-=`, `*=`, `/=`, `%=`, `&=`, `|=`, `^=`, `<<=`, `>>=`
- **Bit manipulation utilities**: `count_ones()`, `leading_zeros()`, `trailing_zeros()`, `rotate_left()`, `rotate_right()`
- **Hexadecimal and binary literals**: `0xFF`, `0b1010`
- **Bit field syntax**: Convenient bit manipulation patterns

**Why This Matters:**
- Essential for low-level programming (graphics, networking, embedded)
- Color manipulation (RGBA packing/unpacking)
- Flag sets and bit masks
- Performance-critical code
- Completeness vs other systems languages

**Target Date:** Q1 2026

---

### v0.36.0 - Advanced Type System 🔮

**Theme: Sophisticated Type Safety**

**Features:**
- Higher-kinded types (HKT)
- Rank-N polymorphism
- Associated type constructors
- Type-level computation
- Dependent types (basic)
- Refinement types
- Linear types (affine/relevant)
- Effect system (async, Result, Option)

**Practical Applications:**
```windjammer
// Effect system
fn read_file(path: string) -> Result<string> throws IoError {
    // Compiler tracks effects automatically
}

// Refinement types
type PositiveInt = int where |x| x > 0

fn divide(a: int, b: PositiveInt) -> int {
    // Guaranteed safe division
}

// Linear types
type File = linear resource
fn open(path: string) -> File
fn close(f: File) // Consumes File, must be called
```

**Why This Matters:**
- Eliminate entire classes of bugs at compile time
- More expressive abstractions
- Formalize effect tracking
- Competitive with Haskell/Scala/Idris
- Research-grade type safety for systems programming

**Target Date:** Q4 2026

---

### v0.35.0 - Debugger Integration 🐛

**Theme: Production Debugging**

**Features:**
- Source-level debugging (lldb/gdb integration)
- Breakpoints in Windjammer code
- Variable inspection with type info
- Call stack visualization
- Step through, step over, step into
- Conditional breakpoints
- Watch expressions
- Memory inspection
- Time-travel debugging (replay)

**IDE Integration:**
- VS Code debugger protocol
- IntelliJ debugging UI
- Web-based debugger (for WASM)

**Why This Matters:**
- Essential for production use
- Reduces debugging time drastically
- Lowers learning curve (familiar debugging UX)

**Target Date:** Q1 2027

---

### v0.36.0 - Race Detector & Concurrency Analysis 🔍

**Theme: Go-Style Race Detection for Rust Performance**

**Features:**
- **Compile-time race detection** - Static analysis of concurrent code
- **Runtime race detector** - Instrumented builds (like Go's `-race` flag)
- **`wj test --race`** - Automatic race detection in tests
- **`wj run --race`** - Debug builds with race checking
- **Data race visualization** - Show conflicting accesses
- **Happens-before analysis** - Track synchronization primitives
- **Lock order analysis** - Detect potential deadlocks
- **Channel race detection** - Find send/receive races
- **Atomic operation tracking** - Verify memory ordering
- **Performance overhead tracking** - Show slowdown from instrumentation

**CLI Commands:**
```bash
# Run with race detection (2-10x slowdown)
wj run --race main.wj

# Test with race detection
wj test --race

# Build with race instrumentation
wj build --race --target debug

# Analyze race reports
wj race analyze race_report.json
```

**Example Output:**
```
==================
WARNING: DATA RACE
Write at 0x7f8a1c000010 by goroutine 7:
  main.wj:45 counter += 1
  
Previous read at 0x7f8a1c000010 by goroutine 6:
  main.wj:42 print(counter)

Goroutine 7 (running) created at:
  main.wj:40 spawn { increment() }
  
Goroutine 6 (running) created at:
  main.wj:39 spawn { read_counter() }
==================
```

**Why This Matters:**
- **Competitive advantage over Rust** - Easier to find concurrency bugs
- **Go-level DX** - Simple race detection like `go test -race`
- **Catches bugs Rust's type system misses** - Runtime races in `unsafe` code
- **Better than ThreadSanitizer** - Windjammer-aware, better error messages
- **Production debugging** - Optional runtime checks in staging

**Implementation Strategy:**
- **Static analysis** - Use dataflow analysis on Windjammer AST
- **Instrumentation** - Insert race detection code in codegen
- **Runtime library** - Lightweight race detector (inspired by Go's race detector)
- **Integration** - Works with LSP (show races in editor)
- **WASM support** - Detect races in browser workers

**Target Date:** Q2 2027

---

### v0.37.0 - Macro System v2 (Procedural Macros) 🪄

**Theme: Powerful Metaprogramming**

**Features:**
- Procedural macros (function-like, derive, attribute)
- Compile-time code generation
- Custom derive macros
- AST manipulation API
- Quasi-quoting syntax
- Macro debugging tools

**Examples:**
```windjammer
// Custom derive
@derive(Serialize, Deserialize)
struct User {
    name: string
    email: string
}

// Procedural macro
@sql("SELECT * FROM users WHERE id = ?")
fn get_user(id: int) -> User

// Attribute macro
@memoize
fn fibonacci(n: int) -> int {
    if n <= 1 { n }
    else { fibonacci(n-1) + fibonacci(n-2) }
}
```

**Why This Matters:**
- Reduce boilerplate dramatically
- Enable domain-specific languages (DSLs)
- Community-driven abstractions
- Matches Rust's macro capabilities

**Target Date:** Q2 2027

---

### v0.37.0 - Build System & Tooling 🛠️

**Theme: Batteries Included**

**Features:**
- Integrated build system (like Cargo)
- Cross-compilation support
- Profile-guided optimization (PGO)
- Link-time optimization (LTO)
- Binary size optimization
- Build caching (Salsa-powered)
- Parallel compilation
- Workspace support (monorepos)

**Developer Tools:**
- Code formatter (`wj fmt`)
- Linter (`wj lint`)
- Documentation generator (`wj doc`)
- Test runner (`wj test`)
- Benchmark harness (`wj bench`)
- Code coverage (`wj coverage`)
- Profiler integration

**Why This Matters:**
- Complete development workflow
- No external tools needed
- Consistent experience across projects

**Target Date:** Q3 2027

---

### v0.38.0 - WASM Optimization & Interop 🌐

**Theme: Best-in-Class WASM**

**Optimizations:**
- WASM-specific optimization passes
- Binary size reduction (50%+ smaller)
- Faster startup times
- Memory pooling for allocations
- SIMD.js fallbacks
- WebAssembly GC integration

**JavaScript Interop:**
- Seamless JS ↔ WASM calls
- Automatic bindings generation
- Zero-copy string passing
- Shared memory support
- Promise/async integration
- DOM manipulation helpers

**Tooling:**
- WASM module inspector
- Performance profiling
- Bundle size analysis
- Browser compatibility testing

**Why This Matters:**
- WASM is the future of web development
- Competitive with AssemblyScript/Rust-WASM
- Enables high-performance web apps

**Target Date:** Q4 2027

---

### v0.39.0 - Package Manager (`wj pkg`) 📦

**Theme: Ecosystem Growth**

**Core Features:**
- Dependency management system
- Central package registry
- Semantic versioning with lock files
- `wj.toml` manifest format
- `wj pkg add/remove/update` commands
- Transitive dependency resolution
- Build script support
- Private package support (for enterprises)

**Registry Features (windjammer.dev/packages):**
- Package search and discovery
- Documentation hosting
- Download statistics
- Version compatibility matrix
- Security advisories
- AI-powered package recommendations

**Why This Matters:**
- Enables code reuse and sharing
- Critical for ecosystem growth
- Makes Windjammer viable for large projects
- Community building and collaboration
- Central hub for ecosystem growth

**Target Date:** Q1 2028

---

### v0.40.0 - Security-by-Design Compiler Analysis 🔒

**Theme: Zero-Trust Security Model**

**Inspired by:** [Deno's permission system](https://docs.deno.com/runtime/fundamentals/security/), capability-based security, principle of least privilege

**Compiler-Enforced Permissions:**
- **Network Access Control** - Track and restrict network calls at compile time
  - `@permission(network: "api.example.com")` - Explicit allowlist
  - Detect unauthorized network access attempts
  - Prevent DNS rebinding attacks
  - Warn about connecting to localhost from web contexts
  
- **File System Sandboxing** - Fine-grained file access tracking
  - `@permission(fs_read: ["./data", "./config"])` - Explicit read paths
  - `@permission(fs_write: ["./output"])` - Explicit write paths
  - Detect path traversal vulnerabilities
  - Prevent reading sensitive files (`.env`, private keys, etc.)
  
- **Environment Variable Safety** - Control env var access
  - `@permission(env: ["DATABASE_URL", "API_KEY"])` - Explicit allowlist
  - Detect hardcoded secrets vs env vars
  - Warn about reading sensitive env vars in untrusted contexts
  
- **Subprocess Execution** - Restrict command execution
  - `@permission(run: ["git", "npm"])` - Explicit command allowlist
  - Detect shell injection vulnerabilities
  - Prevent privilege escalation attempts
  - Track subprocess spawning for audit

**Advanced Static Analysis:**
- **Taint Analysis** - Track data flow from untrusted sources
  - User input → database query (SQL injection detection)
  - User input → shell command (command injection detection)
  - User input → eval/reflection (code injection detection)
  - Network data → file system (path traversal detection)
  
- **Information Flow Control** - Prevent data leaks
  - Detect sensitive data flowing to network
  - Track personally identifiable information (PII)
  - Prevent secrets leaking to logs
  - Ensure encryption for sensitive data transmission
  
- **Capability Analysis** - Least privilege enforcement
  - Detect over-privileged code (asking for more than needed)
  - Suggest minimum permission sets
  - Flag unused permissions
  - Recommend permission reduction

**Security Linting Rules (Beyond gosec):**
- `untrusted-input` - Track all user input without validation
- `sql-injection` - Enhanced with taint analysis
- `command-injection` - Shell command construction analysis
- `path-traversal` - File path validation
- `xxe-vulnerability` - XML external entity detection
- `deserialization-of-untrusted-data` - Unsafe deserialization
- `timing-attack` - Constant-time comparison enforcement
- `cryptographic-weakness` - Weak cipher/hash detection
- `insecure-randomness` - Non-cryptographic RNG for security
- `unvalidated-redirect` - Open redirect vulnerabilities
- `cors-misconfiguration` - Permissive CORS policies
- `jwt-security` - JWT best practices enforcement

**Permission Manifest (`wj.toml`):**
```toml
[permissions]
# Network access
network = ["api.example.com", "db.example.com"]
network_deny = ["0.0.0.0", "127.0.0.1"]  # Prevent localhost access

# File system access
fs_read = ["./data", "./config"]
fs_write = ["./output", "./logs"]
fs_deny = [".env", "*.key", "*.pem"]  # Never access secrets

# Environment variables
env = ["DATABASE_URL", "API_KEY"]
env_deny = ["AWS_SECRET_KEY"]  # Never read cloud credentials

# Subprocess execution
run = ["git", "npm", "cargo"]
run_deny = ["curl", "wget"]  # Prevent arbitrary downloads

[security]
# Require all network calls to use TLS
require_tls = true

# Enforce input validation
require_validation = true

# Enable taint analysis
taint_tracking = true

# Require capability annotations
require_permissions = true
```

**Runtime Integration:**
```windjammer
// Compile-time permission checking
@permission(network: "api.github.com")
@permission(env: "GITHUB_TOKEN")
async fn fetch_repo(owner: string, repo: string) -> Result<Repo, Error> {
    // Compiler verifies:
    // 1. Network access to api.github.com is declared
    // 2. GITHUB_TOKEN env var access is declared
    // 3. No other permissions are used
    
    let token = env::var("GITHUB_TOKEN")?;  // ✅ Allowed
    let url = format!("https://api.github.com/repos/{}/{}", owner, repo);
    
    http::get(&url)  // ✅ Allowed (api.github.com in permission)
        .header("Authorization", format!("token {}", token))
        .send()
        .await
}

// ❌ Compile error: Network access to 'evil.com' not in permission list
async fn bad_function() {
    http::get("https://evil.com").await  // ERROR: Unauthorized network access
}
```

**Audit Mode:**
```bash
# Generate security audit report
wj audit --path src

# Output:
Security Audit Report
=====================

Network Access:
  ✓ api.github.com (declared, used in fetch_repo)
  ✓ db.example.com (declared, used in database::connect)
  ⚠ api.twitter.com (used but not declared in wj.toml)

File System:
  ✓ ./data (read, declared)
  ✗ ./.env (attempted read - BLOCKED)
  
Environment Variables:
  ✓ GITHUB_TOKEN (declared, used)
  ⚠ AWS_SECRET_KEY (attempted access - BLOCKED by deny list)

Vulnerabilities:
  ⚠ SQL injection risk in user_query.rs:45 (taint analysis)
  ⚠ Hardcoded secret in config.rs:12 (pattern match)
  ✗ Command injection in deploy.rs:89 (user input → subprocess)
  
Recommendations:
  1. Add @permission(network: "api.twitter.com") or remove usage
  2. Use parameterized queries in user_query.rs:45
  3. Move hardcoded secret to environment variable
  4. Sanitize user input before subprocess execution
```

**Comparison with Other Languages:**

| Feature | Node.js | Deno | Rust | Go | **Windjammer v0.40.0** |
|---------|---------|------|------|----|-----------------------|
| **Permission System** | ❌ None | ✅ Runtime | ❌ None | ❌ None | ✅ **Compile-time** |
| **Network Sandboxing** | ❌ No | ✅ `--allow-net` | ❌ No | ❌ No | ✅ **Fine-grained** |
| **File System Sandboxing** | ❌ No | ✅ `--allow-read/write` | ❌ No | ❌ No | ✅ **Path-specific** |
| **Taint Analysis** | ⚠️ Limited | ❌ No | ⚠️ External tools | ❌ No | ✅ **Built-in** |
| **SQL Injection Detection** | ⚠️ Linters | ❌ No | ⚠️ clippy (basic) | ⚠️ gosec | ✅ **Advanced** |
| **Audit Trail** | ❌ No | ⚠️ Runtime logs | ❌ No | ❌ No | ✅ **Compile-time report** |

**Why This Matters:**

1. **Security by Default** - Programs start with zero permissions, must explicitly request access
2. **Supply Chain Protection** - Dependencies can't access resources without declaration
3. **Audit Trail** - Complete compile-time visibility into all security-relevant operations
4. **Zero Runtime Overhead** - All checks happen at compile time
5. **Developer Education** - Forces thinking about security implications upfront

**Competitive Advantages:**

- ✅ **Only language with compile-time permission system** (Deno is runtime)
- ✅ **Zero runtime overhead** (compile-time analysis)
- ✅ **Better than Deno** - Catches issues at compile time, not runtime
- ✅ **Better than Rust** - Built-in, not external tools
- ✅ **Better than Go** - No gosec needed, it's built-in and smarter
- ✅ **Better than Node** - Actually has security controls

**Target Date:** Q2 2028

**References:**
- [Deno Security Model](https://docs.deno.com/runtime/fundamentals/security/)
- [Node's Security Problem](https://deno.com/learn/nodes-security-problem)
- [Capability-Based Security](https://en.wikipedia.org/wiki/Capability-based_security)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [CWE Top 25](https://cwe.mitre.org/top25/)

---

### v0.41.0+ - Future Possibilities 🔭

**Long-Term Vision:**

**Language Features:**
- Async/await syntax sugar (beyond `spawn`)
- Structured concurrency
- Algebraic effects
- Pattern synonyms
- View patterns
- Guards on types
- Type classes (Haskell-style)

**Platform Support:**
- Mobile targets (iOS, Android)
- Embedded systems (ARM Cortex-M)
- GPU compute (CUDA, OpenCL, Metal)
- Formal verification tools
- Certified compilation (CompCert-style)

**Ecosystem:**
- Standard library expansion
- Official web framework
- Database drivers (PostgreSQL, MySQL, SQLite)
- Cloud deployment tools (AWS Lambda, Cloudflare Workers)
- Container images (Docker, OCI)
- Package registry and distribution (windjammer.dev/packages)

**Tooling:**
- AI-powered code completion (fine-tuned LLM)
- Automatic performance optimization suggestions
- Security vulnerability scanner
- Dependency graph visualization
- Cloud IDE (GitHub Codespaces-style)

**Community:**
- Package registry and hub (windjammer.dev)
- Official blog and tutorials
- Conference (WJConf)
- Certification program
- Enterprise support

---

## 🎯 Strategic Goals

### Short-Term (2025-2026)
1. **Remove adoption barriers** (eject, LSP, package manager)
2. **Build ecosystem** (packages, tooling, docs)
3. **Grow community** (tutorials, examples, use cases)

### Mid-Term (2026-2027)
1. **Full-stack capability** (UX library, JS transpiler)
2. **Advanced features** (type system, macros v2)
3. **Production-grade tooling** (debugger, profiler)

### Long-Term (2027+)
1. **Industry adoption** (enterprises, startups)
2. **Research contributions** (type theory, optimization)
3. **Platform leadership** (best systems language for web)

---

## 🤝 Contributing

We welcome contributions! Areas of focus:
- **Core Language**: Parser, type checker, optimizer
- **Tooling**: LSP, build system, CLI
- **Ecosystem**: Packages, frameworks, libraries
- **Documentation**: Tutorials, guides, examples
- **Testing**: Fuzzing, benchmarks, real-world projects

See `CONTRIBUTING.md` for guidelines.

---

## 📊 Success Metrics

### Adoption
- ⭐ 10K GitHub stars by end of 2026
- 📦 1,000 packages in registry by 2028
- 👥 100 active contributors by end of 2027

### Performance
- ⚡ 100%+ of Rust performance (beat Rust on some benchmarks!)
- 🔥 < 1ms incremental compilation for typical changes
- 📦 < 1MB binary size for "Hello World"

### Developer Experience
- 💚 90%+ positive sentiment in surveys
- 📚 Comprehensive documentation for all features
- 🏆 "Most Loved Language" on Stack Overflow survey

---

## 🚀 Get Involved

- **Website**: [windjammer.dev](https://windjammer.dev) (coming soon)
- **GitHub**: [github.com/jeffreyfriedman/windjammer](https://github.com/jeffreyfriedman/windjammer)
- **Discord**: Community server (coming soon)
- **Twitter/X**: @windjammer_lang (coming soon)

**The future is bright! Join us in building the ultimate systems programming language.** 🌟