InnerJS

A safe scripting language runtime (JS-like syntax, Lua-like embeddability). Parses a restricted JS subset, executes in an isolated interpreter (no JS eval), and returns JSON-like typed values with hard runtime limits.

Features (MVP)

• Data types: null, boolean, number (finite only), string, array, object, function (script-only)
• Variables: let, assignment, block scope
• Expressions: literals, arithmetic, comparison, strict equality (===/!==), boolean ops, array/object literals, property/index access, calls
• Statements: expression, return, if/else if/else, C-style for loop
• Functions: declarations, recursion (with depth limit)

Runtime safety

• Isolation: No access to JavaScript globals; execution is interpretation of an AST.
• Budgets: maxInstructions, maxCallDepth, maxArrayLength, maxObjectKeys, maxValueDepth, maxStringLength.

API

import { Runner } from 'innerjs';

const r = new Runner({ budgets: { maxInstructions: 100_000, maxCallDepth: 50 } });
r.load(`
	function add(a, b) { return a + b; }
`);
r.call('add', [1, 2]);        // 3
r.listFunctions();           // ['add']
r.evalExpr('1 + 2');         // 3 (after load)

Scripts

See examples/*.script for sample scripts. Run tests with npm test.

License

MIT