TablaM VS quickjs-emscripten

> Very curious if anyone knows how to pull this off.

I work in this space (small/mid-size).

The good news is that there are several "obvious" ways to pull this off because an ERP is the culmination of everything a company needs and does. So almost anything you can imagine on the software is part of it.

The bad news, and the reason everyone wants a solution, is that is truly a big space, and then you need E.V.E.R.Y.T.H.I.N.G.

---

My take is to start from the bottom, and build a much better version of Access/FoxPro (https://tablam.org).

Any medium/big ERP end being a specialized computing platform that needs:

- A programming language

- A database engine

- An orchestration engine

- ELT engine

- Auth

- UI/Report builders

And to be clear: NONE of the "programming language", "database engine", etc are a good fit today.

NONE.

This is the big thing, This is the reason (from a tech POW only) that most attempts fail.

This is the secret of why Cobol rule(d): Is all of this! but is too old! (also, this is why SQL still is best: Is almost this).

---

So, to pull this off, you need a team that knows what is "missing" from our current tools, makes a well-integrated package, and adds a "user-friendly" interface in a way that is palatable for the kind of user that uses excel (powerfully).

Is not that impossible. FoxPro was the best example of this kind of integrated solution.

P.D: This is my life's dream, to make this truth!

SEEKING VOLUNTEERS: TablaM relational language (https://tablam.org)

TablaM is an in-progress programming language to provide a more ergonomic experience for building data-oriented applications.

This means that where most languages are focused on low-level details or engineering at large, TablaM is tailored with some small & big design decisions to make it enjoyable to write applications for e-commerce, finance, ERPs, and similar.

Cool things:

- TablaM marry the array + relational models. It means we should get very little need for manual loops and all the ops are vectorized.

Yeah, I worked on https://tablam.org and https://spacetimedb.com.

It becomes pretty clear that `order` is a significant property to make useful (and performant!) programs. "Duplicates" is also required to make usefull programs.

One nonobvious reason for this: You wanna report that a `customer` has a duplicated key `1`. If you CAN'T model `[(customer.id = 1), (customer.id = 1)]` then you can't report errors! And `erroneous` data is VITAL to make useful programs because then the only possibility is "perfect" data, and that is not possible!

Another reason is that we want to `count` duplicates, to see `duplicates`, and other NON-obvious at first: "What is a duplicate?". Get fun with floats, Unicode, combining case and non-case sensitive input... and is obvious that for useful programs IS REQUIRED to support bags in an extended version of the relational model.

And yet...

IS very important to remember about `set semantics` and try to adhere to it when makes sense. Your query planner will like it. You "valid" constraints like it. And `unique index` like it. And so on...

Finally, for app development, I will "suggest" everyone use my lang https://tablam.org!

This is moe interesting than it looks, probably because the best part (IMHO) is about the type system, that is what enables the other ideas.

> In Julia, types are first-class and every value has a type

This is what I do from the start in https://tablam.org and only later found that is not common! Is so intuitive this way and simpler to check, by a lot. In fact, I waste so much time adapting type inference algorithms that are hard to translate because for some reason graphs are imposed on trees, types are second-class and live at a distance (and erased) and all is a mess this way.

The relational model already makes this so simple: `project / rename / extend` relational operators cover you.

From this other facilities become possible. Note how in `SQL` you don't have functions as first-class per se, but now try to imagine that a function is a table and suddenly, is much better!

My relational lang (https://tablam.org) that I wish to be a Excel + Access replacement is still half-backed.

I move it slowly in my personal computer but not much in public. Maybe adding another person will help me on that!

> what is a good alternative to Access (or Fox, I add)

Nothing.

Access is(was) in fact a worse alternative to Fox:

- Much worse DB engine, and that is saying a lot (FoxPro db can and get corrupted. A typical functionality that was added to any fox codebase was a utility to fix it)

- MUCH MUCH worse programming language (VB) that is neither good as-is, much less as a data-programing language.

Fox/dbase is the only data-oriented language that was relatively popular and fit for the use-case.

This is by a mile the main point: Is a desert looking for languages that are made for business app/data oriented programing (and much harder looking for something not weird).

The main options: Fox/dBase/Informix(? not remember), kdb+, Cobol, SQL(when extended as store procedure lang with loops and that)

--

This point is big. Having a good form builder (that is already rare) is not enough to be a real contender for this space. You need a language where making queries is truly nice.

In short, you need a language that is `LINQ/Relational` as first-class end-to-end.

- If this lang needs an ORM: FAIL.

- If this lang needs to compose strings to make a query: FAIL.

- If exist "impedance mismatch" between data manipulation/queries and the rest of the lang: FAIL.

- It should also support super-advanced types like date, decimal, currency and ideally dimensional units. Ideally algebraic types as today.

- It should have a version of Rust `serve, Into/From` for easy conversion between data + formats.

- It should look "normal" like python/swift with `LINQ` queries.

This is the lang I trying to build: https://tablam.org

> I asked was about querying data without ever using a SQL language, like tapping directly into the data.

I agree (making https://tablam.org to try a fix & working on https://github.com/clockworklabs/SpacetimeDB in the SQL conformance).

Before I think SQL was bad. *Now I'm certain*. SQL is absurdly massive for things that could have collapse all the features 10x or more.

However, working in an RDBM now I also understand why is not desirable to make "raw" calls to the DB: The engine MUST mediate all the calls to make things works (from query optimization, execution, iteration, lock management, transaction management, etc).

Is incredible how much sophistication is in a simple `SELECT * FROM table`.

What I wish is to build a `Wasm-like` IR so that is what anybody target, and `SQL` is not the mediator.

In my case each lang I have learned (+12) I start coding a mini-ORM. I have done the same so many times, and that is a good way to learn from me. Also, I have to learn Rust building https://tablam.org.

It sounds puzzling, I start learning Rust with https://tablam.org and probably was making my life harder trying to do "advanced" stuff when not have any idea of what I was doing.

Based on your comment below I think you figured out the difference - but if you're looking to execute JS, you can pick between ShadowRealm (where available, or using a polyfill) or my library quickjs-emscripten.

Pros of quickjs-emscripten over ShadowRealm:

- You can use quickjs today in any browser with WASM. ShadowRealm isn't available yet, and polyfills have had security issues in the past. See https://www.figma.com/blog/an-update-on-plugin-security/

- In ShadowRealm eval, untrusted code can consume arbitrary CPU cycles. With QuickJS, you can control the CPU time used during an `eval` using an [interrupt handler] that's called periodically during the eval.

- In ShadowRealm eval, untrusted code can allocate arbitrary amounts of memory. With QuickJS, you can control both the [stack size] and the [heap size] available inside the runtime.

- quickjs-emscripten can do interesting things with custom module loaders and facades that allow synchronous code inside the runtime to call async code on the host.

Pros of ShadowRealm over QuickJS:

- ShadowRealm will (presumably?) execute code using your native runtime, probably v8, JavaScriptCore, or SpiderMonkey. Quickjs is orders of magnitude slower than JIT'd javascript performance of v8 etc. It's also slower than v8/JSC's interpreters, although not by a huge amount. See [benchmarks] from 2019.

- You can easily call and pass values to ShadowRealm imported functions. Talking to quickjs-emscripten guest code requires a lot of fiddly and manual object building.

- Overall the quickjs(-emscripten) API is verbose, and requires manual memory management of references to values inside the quickjs runtime.

[interrupt handler]: https://github.com/justjake/quickjs-emscripten/blob/main/doc...

[stack size]: https://github.com/justjake/quickjs-emscripten/blob/main/doc...

[heap size]: https://github.com/justjake/quickjs-emscripten/blob/main/doc...

[benchmarks]: https://bellard.org/quickjs/bench.html

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated.

I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox.

I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data.

When you're dealing with untrusted code you need a really robust sandbox. WebAssembly really should be that sandbox.

I'd like to support Python, JavaScript and maybe other languages too. I want to take a user-provided string of code in one of those languages and execute that in a sandbox with a strict limit on both memory usage and time taken (so I can't be crashed by a "while True" loop). If memory or time limit are exceeded, I want to get an exception which I can catch and return an error message to the user.

I've been exploring options for this for quite a while now. The furthest I've got was running Pyodide inside of Deno: https://til.simonwillison.net/deno/pyodide-sandbox

Surprisingly I've not found a good pattern for running a JavaScript interpreter in a WASM sandbox yet. https://github.com/justjake/quickjs-emscripten looks promising but I've not found the right recipe to call it from server-side Python or Deno yet.

Can Extism help with this? I'm confident I'm not the only person who's looking for a solution here!

"Safely execute untrusted Javascript in your Javascript, and execute synchronous code that uses async functions" quickjs-emscripten, NPM

This maybe, as a start?

https://github.com/justjake/quickjs-emscripten

QuickJS Running in WebAssembly\ (17 comments)

The library was inspired by Figma’s blog posts about their plug-in system: https://github.com/justjake/quickjs-emscripten#background

If you need to call into user-generated Javascript synchronously or have greater control over the sandbox environment, you can use WebAssembly to run a Javascript interpreter: https://github.com/justjake/quickjs-emscripten#quickjs-emscr...

QuickJS in WebAssembly is much slower than your browser's native Javascript runtime, but possibly faster than async calls using postMessage. As an added bonus, it can make async functions in the host appear to be synchronous inside the sandbox using asyncify: https://emscripten.org/docs/porting/asyncify.html.

You can use One Weird Trick with generator functions to make your code "generic" over synchronicity. I use this technique to avoid needing to implement both sync and async versions of some functions in my quickjs-emscripten library.

The great part about this technique as a library author is that unlike choosing to use a Promise return type, this technique is invisible in my public API. I can write a function like `export function coolAlgorithm(getData: (request: I) => O | Promise): R | Promise`, and we get automatic performance improvement if the user's function happens to return synchronously, without mystery generator stuff showing up in the function signature.

Helper to make a function that can be either sync or async: https://github.com/justjake/quickjs-emscripten/blob/ff211447...

Uses: https://cs.github.com/justjake/quickjs-emscripten?q=yield*+l...

This seems like a pretty nice, recently enabled way of getting a sandboxed js environment: QuickJS compiled to WASM: https://github.com/justjake/quickjs-emscripten.