lanekeep_js/
lib.rs

1//! Embedded JavaScript sandbox and host API for lanekeep rules.
2//!
3//! The embedded QuickJS runtime, the capability-restricted host API, the TypeScript
4//! stripping step, and the module loader.
5//!
6//! The sandbox boundary lives here. Rule code reaches exactly the functions this crate
7//! exposes and nothing else: no ambient filesystem, no process, no network, no clock, no
8//! randomness. Those globals are not restricted, they are absent.
9//!
10//! Every addition to the host API widens the trust boundary and bumps the API version that
11//! feeds the cache key.
12//!
13//! # How absence is achieved
14//!
15//! Two mechanisms, and the first is much stronger than the second.
16//!
17//! **Not installed.** The engine's optional intrinsics are opted into rather than opted out
18//! of, so `Date`, `Performance` and `WeakRef` are never created. There is no original for a
19//! rule to reach: nothing to patch, nothing to restore, no prototype chain leading back.
20//!
21//! **Deleted at startup.** `Math.random` lives among the non-optional base objects, so it
22//! has to go afterwards. This is weaker in principle — deletion can be undone if a
23//! reference escapes — but a rule that defines its own `Math.random` has written
24//! deterministic code, which is all this needs to guarantee.
25//!
26//! Anything a host function does not offer, a rule cannot do. `fs`, `process`, `fetch`,
27//! `setTimeout` and friends were never part of this engine to begin with, which is asserted
28//! rather than assumed.
29//!
30//! # What is here so far
31//!
32//! The sandbox and its budgets. The host API, TypeScript stripping and the module loader
33//! arrive in later milestones.
34
35pub mod error;
36pub mod files;
37pub mod host;
38pub mod limits;
39pub mod loader;
40pub mod nodes;
41pub mod sandbox;
42pub mod typescript;
43
44pub use error::SandboxError;
45pub use files::{FileAccess, ReadError};
46pub use host::{
47    EmittedFact, HOST_API_VERSION, HostContext, ReduceContext, ReduceFact, ReduceReport, Report,
48    merge_file,
49};
50/// Re-exported so consumers can supply languages without depending on `lanekeep-lang` directly.
51pub use lanekeep_lang::Language;
52pub use limits::{
53    DEFAULT_GLOBAL_TIMEOUT, DEFAULT_MEMORY_BYTES, DEFAULT_RULE_TIMEOUT, Limits, RunClock,
54};
55pub use loader::{BuiltinSource, HOST_MODULE, ResolveError, RuleLoader, RuleResolver, RuleRoot};
56pub use nodes::{Handle, NodeArena};
57pub use sandbox::Sandbox;
58pub use typescript::{StripError, Unsupported, strip_types};
lanekeep_js/lib.rs

lanekeep_js/
lib.rs
