Registry / serialization / subscript

subscript

JSON →
library10.3.2jsnpmunverified

Subscript is a modular and extensible expression parser and evaluator for JavaScript and TypeScript. It provides a lightweight core for building custom Domain Specific Languages (DSLs) and offers several ready-to-use presets, including `subscript` (common expressions), `justin` (JSON, templates, arrow functions, optional chaining), and `jessie` (a JavaScript subset supporting statements, functions, and control flow). The package is currently at version 10.3.2 and maintains an active release cadence with frequent minor and major updates introducing new syntax features, performance improvements, and API refinements. Key differentiators include its small bundle size (~2KB core), high performance for both parsing and evaluation, a minimal JSON-compatible Abstract Syntax Tree (AST), and built-in sandboxing to prevent prototype pollution and global access. It is designed to be universal, fast, and safe, making it suitable for templates, calculators, safe evaluation environments, and language subsets.

serializationweb-framework
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

The main `subscript` preset is the default export. All versions >=10.0.0 are ESM-only.

import subscript from 'subscript'

The `justin` preset is a named export from a specific module path, requiring the `.js` extension in ESM environments.

import justin from 'subscript/justin.js'

The `parse` function, along with `compile`, `binary`, `operator`, etc., are named exports from the main package entry point.

import { parse } from 'subscript'

The AST codegeneration utility is `codegen`, not `stringify`, and is located in a specific utility path.

import { codegen } from 'subscript/util/stringify.js'

Demonstrates parsing and evaluating a Jessie preset expression with functions and control flow, showcasing sandboxed execution and context passing.

import jessie from 'subscript/jessie.js' // Jessie is a JavaScript subset supporting statements, functions, and control flow. // It's ideal for safely evaluating user-defined logic or custom DSLs. let expression = ` function calculateFactorial(n) { if (n <= 1) return 1; return n * calculateFactorial(n - 1); } let result = calculateFactorial(process.env.FACTORIAL_NUMBER ? parseInt(process.env.FACTORIAL_NUMBER) : 5); result; `; // Compile the expression into an executable function. // The function takes a context object for variables and methods. let compiledFn = jessie(expression); // Execute the compiled function with a context. // Here, we're demonstrating a simple `process.env` access for dynamic input. // If process.env.FACTORIAL_NUMBER is '7', it will calculate factorial of 7. const context = {}; // Jessie expressions have no access to global scope by default. const result = compiledFn(context); console.log(`The factorial result is: ${result}`); // Expected output if FACTORIAL_NUMBER is 5: The factorial result is: 120
Debug
Known footguns
breakingSubscript versions 10.0.0 and above are ESM-only. Direct `require()` calls for the main package or its presets will result in an `ERR_REQUIRE_ESM` error. Ensure your project uses ES modules or a build step for compatibility.
breakingThe Abstract Syntax Tree (AST) structure has undergone significant changes across major versions (e.g., v6.0.0 removed Lisp tree, v7.0.0 reintroduced it, v9.0.0 refined groupings, v10.0.0 added template tags and new node types). If you have custom parsers, compilers, or AST transformers, they will likely break when upgrading between major versions.
breakingThe API for registering operators and literals (`set`, `parse.unary`, `parse.binary`, `parse.nary`) has evolved. For example, v6.0.0 simplified `set`, v7.1.1 added explicit `parse.unary`/`binary`/`nary` methods, and v8.0.0 changed primitive wrapping. Custom extensions may require significant refactoring.
breakingVersion 10.1.0 changed the JSON serialization format for regex literals (from `[, new RegExp('abc', 'gi')]` to `['//', 'abc', 'gi']`) and `undefined` values (from `[, undefined]` to `[]`). This impacts any applications that rely on round-tripping the AST through JSON serialization.
gotchaSubscript is designed for safety and explicitly blocks access to sensitive global objects and prototype chain manipulation by default (e.g., `__proto__`, `constructor`, `prototype`). Attempting to use these will result in `undefined` or a blocked operation.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
0 hits · last 30 days

No traffic data recorded yet.

Resources