SandScript

SandScript is JavaScript with one addition and many restrictions. The language trades flexibility for predictability. It serves programs that need these properties:

• Sandboxed execution. A program has no host access except through an explicit capability.
• Predictable structure. The language keeps one way to do each thing, which suits generated code.
• Observable execution. A host can pause, inspect, and replay every step.
• Fuel-based execution. Every instruction consumes fuel, so computation stays bounded.

The one addition: the grant block

The grant block is the only construct that JavaScript does not have. It asks the host for a capability. Its optional denied arm receives control when the host refuses:

grant "dom" {
  document.body.append(line);
} denied {
  // The host refused. Recover here.
}

SandScript reserves the words grant and denied. JavaScript does not reserve them. A JavaScript program that uses either word as a name is therefore not a SandScript program.

Everything else is a restriction

Outside the grant block, SandScript only removes from JavaScript. It adds no operator, no expression form, and no implicit conversion. A program that contains no grant block is a valid JavaScript program with identical semantics.

File extension and media type

A SandScript source file uses the .drone extension. Its media type is text/sandscript. The type is a programme convention, not an IANA registration. Do not serve SandScript source as text/javascript: a consumer that receives text/javascript can execute the file in a full JavaScript runtime, outside the sandbox and the grant system.

This documentation

• The language — syntax, functions, classes, and the recorded deviations.
• Standard library — the built-in objects and functions.
• Errors — throw signals, rich error context, and why there are no stack traces.
• Grants — capability-based security and the denied block.
• Embedding — the session API, FFI, async execution, fuel, and snapshots.
• The link format — how this site carries a program in a URL fragment.

The SandScript repository owns the authoritative reference. This site restates it for readers of the runner.