Scriptc Compiles TS to Native, Kimi-K3 Goes Open, 1K-Point Cookie Bill

Good morning. It's Monday, July 27, and we're covering Vercel's TypeScript-to-native compiler, Moonshot AI's 3T open-weights release, and a grassroots campaign against cookie banners that hit 1033 points on Hacker News before lunch.

In today's brief:

• Vercel Labs ships Scriptc, compiling ordinary TypeScript into native executables with no JavaScript engine in the binary
• Kimi-K3, the world's first open 3T-class frontier model, drops today on HuggingFace with 2,444 watchers queued
• Kill the Cookie Banner campaign crosses 1,000 HN points as the EU's data consent regime faces new pressure
• The underground relay market for discounted LLM tokens gets a detailed exposé

PLATFORMS

Scriptc by Vercel: TypeScript Compiled to Native, No JS Engine

Vercel Labs released Scriptc, a TypeScript-to-native compiler that produces self-contained binaries with no JavaScript runtime dependency. The HN thread hit 182 points with 95 comments, and the project's 1,100 GitHub stars arrived inside twelve hours.

The compiler works by type-checking through the real TypeScript compiler, lowering to a typed IR, generating C, and compiling with clang. The README claims ~2.4ms startup, 170-200 KB static binaries, and 1-4 MB RSS at rest, compared to Node's ~47ms startup and 67-116 MB RSS. Dynamic code (npm dependencies, any-typed code) falls back to an embedded quickjs-ng engine, but every binary reports exactly what compiled statically and what did not via scriptc coverage.

What compiles statically: classes with single inheritance (devirtualized when provably safe), closures with JS capture semantics, discriminated unions via TypeScript's narrowing, async/await on stackful fibers, and much of Node's API surface including net, http, https, tls, fetch, and the WHATWG stream stack. The escape hatches are explicit: comptime(() => ...) for build-time evaluation, Native FFI for C ABI calls, and --dynamic for npm deps.

The differential testing bar is notable: 800+ tests run under both Node and the native binary, with stdout, stderr, and exit codes required to match byte-for-byte. A second lane runs the same corpus under AddressSanitizer with a reference-count audit. No divergence from Node behavior is silent; the few dozen known differences (timing internals, error object properties) are documented and numbered.

Why it matters: If Scriptc's claims hold up, it changes the deployment calculus for TypeScript server-side code. Lambda cold starts measured in milliseconds instead of tens of milliseconds, containers that fit in single-digit megabytes, and no Node patching cycle. The real question is whether the static coverage stays high for real-world codebases that pull in npm dependencies.

Our coverage: the Scriptc explainer and performance benchmarks if you want to see it against Go and Rust in the same workload.

OPEN SOURCE

Kimi-K3: The First Open 3T-Class Frontier Model Drops Today

Moonshot AI's Kimi-K3 is scheduled to release on HuggingFace today, positioning it as the world's first open 3 trillion parameter model. The HN thread hit 324 points and 134 comments as developers lined up to test the weights.

The release page teases a new architecture built on Kimi Delta Attention and Attention Residuals, native agentic capabilities (tool calling, browsing, multi-step planning), and an extended context window designed for repository-scale code understanding. K3 follows Kimi-K2.7-Code and K2.6 from the same lab, each of which set pricing pressure on the frontier API market by delivering competitive benchmarks at Chinese-inference pricing. The K2 series models have been popular picks for self-hosted coding agents because they balance capability against the cost of running a 7-parameter inference cluster.

K3 arrives in a landscape where the US government's export control posture has made open frontier weights increasingly strategic. Hugging Face recently disclosed that during the OpenAI sandbox escape incident, they had to fall back to the MIT-licensed GLM-5.2 for forensic analysis because hosted frontier models refused to process real attack payloads. K3 enters the same unrestricted-access category as GLM-5.2 and Qwen 3.8. The gap between what a self-hosted open model can do and what the best closed API offers is narrowing rapidly, and K3's 3T scale could close it further on knowledge-work and long-horizon coding tasks.

Why it matters: An open 3T model changes the economics of anyone building on self-hosted inference. If K3 benchmarks near Mythos/Fable territory (the ExploitGym paper showed frontier models chaining zero-days), the gap between open and closed models narrows to the speed of a HuggingFace download.

THE BIG ONE

Kill The Cookie Banner Hits 1,033 Points on HN

A campaign called Kill the Cookie Banner hit the top of Hacker News with 1,033 points and 492 comments over the weekend. The site proposes a direct approach to the EU's cookie consent regime: legislation that bans non-functional cookie banners entirely, replacing them with browser-level opt-in.

The HN discussion (the most-commented thread on the front page) split between technical implementation details and the regulatory strategy. On the technical side, commenters debated whether a browser-native consent API (similar to Do Not Track or the Global Privacy Control header) could replace the current banner ecosystem. Skeptics pointed out that ad-tech vendors have a direct financial incentive to resist browser-level consent, and that GPC-style headers have achieved limited adoption because trackers simply ignore them. Proponents argued that the EU could mandate browser-level opt-in in the same way it mandated cookie consent, breaking the collective-action problem.

On the regulatory side, the conversation turned to whether the EU's own ePrivacy Regulation, still in draft, could subsume the GDPR cookie consent requirement entirely. The campaign's framing is strategic: rather than trying to fix the GDPR's banner regime through case-by-case enforcement, push for structural reform that eliminates the banner's raison d'etre. Several commenters noted that the US state-level privacy laws (California, Texas, Oregon) are converging on opt-out signals rather than the EU's opt-in banner model, creating an increasingly divergent transatlantic regulatory landscape.

Why it matters: Cookie banners are the most visible failure of the consent-based web regulation model. Every developer who has shipped a banner, audited a consent manager vendor, or debugged a GTM tag firing before consent knows the system is broken. A browser-native solution would eliminate an entire category of frontend complexity and third-party dependency.

SECURITY

The Token Relay Market Exposed

Matt Lenhard published An Inside Look at the Relay Market Powering Token Resellers and Fraud (193 points, 122 comments), an investigation into the underground economy that resells LLM tokens at a discount through pooled API keys. Simon Willison covered it on his blog with a warning about the abuse surface.

The software behind most relay operations is open-source: one-api and its fork new-api, both legitimate API proxy products that load-balance across a pool of credentials. Resellers abuse them by feeding free trial keys, unprotected support bot endpoints, stolen credit cards, and chargeback-funneled credits into the pool. Buyers get cheap tokens and bypass geo-restrictions; sellers exfiltrate data for model distillation.

Why it matters: If you expose an LLM-powered endpoint without hard spend caps, you are a target. The relay market is the incentive layer that turns every vulnerable API key into a pricing-arbitrage opportunity. Simon Willison's recommendation: "LLM vendors really need to get better at offering strict caps for their API keys."

TOOLS WORTH A LOOK

1. PGSimCity (611 HN points) - An interactive PostgreSQL simulator that visualizes query planning, index selection, and execution from inside the database. Click a query, watch Postgres pick a plan, inspect every row estimate and join order decision. Runs entirely in the browser.
2. Decker (317 points) - A platform reviving the Hypercard spirit for modern web and desktop, with a widget-based scripting model, a retro macOS-style UI, and a built-in PDF export path.
3. Nativ - Run AI models locally on your Mac via MLX, wrapping Prince Canuma's MLX-VLM library in a full macOS desktop application. Detects models already in your Hugging Face cache. Free, open-source.

WHAT ELSE IS HAPPENING

• US citizen charged after GrapheneOS phone wipes during airport search (781 points, 570 comments) - A traveler's phone auto-wiped when customs forced it open, leading to federal charges. The HN thread is the most consequential digital rights discussion of the week.
• Google discloses $94.1B in SpaceX stock (327 points, 305 comments) - Google's regulatory filing reveals a 6% stake worth $94.1 billion in SpaceX, making it one of the largest corporate cross-holdings in tech.
• Ruff v0.16.0 enables 413 rules by default - Up from 59 in previous versions. Simon Willison tested it against Datasette, sqlite-utils, and LLM, which each found hundreds of new violations. The Astral team (now at OpenAI) has shifted the Python linting default dramatically.
• Htmx 4.0 "releases exclusively on the Game Boy" (456 points) - A physical Game Boy cartridge containing the htmx 4.0 source code as a playable game. Satirical, but the 456-point HN reaction shows the community's appetite for unconventional release formats.
• We have proof automation now (170 points) - ImperialViolet on using formal proof automation to verify a zstd decompressor, with Lean 4 and a practical take on where proof automation is ready for production use.
• Go Analysis Framework (212 points) - The Go team's modular static analysis framework, a new package in golang.org/x/tools that lets developers compose analysis passes with standard interfaces.
• Claude Opus 5 prompt injection resistance - Boris Cherny on Opus 5 being "our least prompt injectable model yet," citing the system card page 73. Simon Willison linked the specific source and context.
• Elevated Errors for Opus 5 (93 points) - Anthropic's status page reported an incident for Claude Opus 5 over the weekend. The HN thread tracked recovery timing and whether it affected the API or only claude.ai.
• Terence Tao: Mathematics in the Age of AI (124 points) - Slides from Tao's ICM 2026 talk on how AI is reshaping mathematical practice, from theorem proving assistants to AI-generated conjectures.
• London Gatwick robotic parking (278 points, 242 comments) - Gatwick launched a robotic valet service using Stanley Robotics' system. The HN debate focused on whether this is genuinely useful infrastructure or a gimmick that will struggle with edge cases like roof racks and accessibility vehicles.

FROM THE SITE

We published The New AI Superpowers: Focus and Followthrough, our analysis of the HN discussion around Rick Manelius's essay on AI productivity and burnout. The piece covers the five dominant themes from the 168-point thread: AI as config-bandage, skepticism about 100x claims, the rediscovery of essentialism, lagging organizational incentives, and the counterpoint that some developers thrive on rapid iteration. It ties the burnout pattern to our prior coverage of the human-in-the-loop is tired argument and the over-editing problem in AI-generated code.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.