The link format

A sandscript.run link carries one drone in its URL fragment as base64url(gzip(JSON)). The fragment never leaves the browser: a fragment is not sent in an HTTP request, so no server receives the program.

The wrapper

{
  "sandscriptRun": 1,
  "program": {
    "language": "sandscript",
    "name": "a clock",
    "source": "grant \"dom\" { ... }"
  },
  "grants": "<base64 of msgpack-marshalled identifier array>",
  "fonts": [
    {
      "family": "Inter",
      "url": "https://fonts.gstatic.com/...",
      "weight": 400,
      "style": "normal",
      "variable": true
    }
  ]
}

Compatibility rules

A link lives in other people's bookmarks, messages, and posts. Nobody can migrate bytes they do not hold, so the wrapper is designed to grow:

• The core never changes: a wrapper generation, a program, and its source. A reader of any generation can find those.
• An unknown top-level key is ignored, never an error. A later version can add metadata without breaking a link this version wrote.
• A higher generation is read, not refused. The reader says that it may not show everything the link declares.
• Only an unreadable core is refused: no source, a mistyped core field, an unsupported language, or a font origin outside the allowlist.

Grants travel marshalled

Declared grants travel as msgpack bytes, not as JSON strings. A SandScript grant identifier is an arbitrary expression, so an identifier is any value the membrane can carry. Marshalling also gives the page a sound way to compare what the visitor approved against what the drone asks for at run time: the comparison key is the encoding of the value, so every reference type works.

A declaration is the author's claim, never evidence: the author wrote both the list and the code. The page offers the declared set at the gate, and enforces only what the visitor ticks.

Fonts

A declared font is fetched by the page, so its origin is a real network destination for the visitor. Only two origins are honoured: https://cdn.urania-libs.com and https://fonts.gstatic.com. The gate names each origin before anything runs, and warns that a Google font download tells Google the visitor's network address.

Limits

• The program source is at most 524288 characters.
• The language must be sandscript.
• A grant identifier and a font family can each appear once.

Making a link

Import the codec this site itself uses and encode a wrapper:

import { encodeLink } from
  'https://sandscript.run/payload.js';

const fragment = await encodeLink({
  program: { name: 'a clock', source: droneSource },
  grants: ['dom'],
});
const link = `https://sandscript.run/#${fragment}`;

The consent contract

The fragment addresses the program, and a reload restores it. Consent is deliberately not addressable: no URL means "already accepted", because a link that could carry its own consent would defeat the gate. A reload asks again.