ES-Runtime

Website | Docs | API

Part of the Open Tech Foundation ecosystem.

V8-based ECMAScript runtime, WinterTC-compliant, I/O-injectable, capability-secured.

Shapes

It ships in two shapes from the same core:

• Embeddable library (es-runtime) — a driven (tick/poll) runtime with all I/O injected via provider traits and V8 kept behind an engine abstraction.
• Standalone CLI (esrun) — a thin binary that wires the default tokio providers and runs JavaScript files end-to-end.

Install

A prebuilt, checksum-verified binary:

Linux / macOS:

curl -fsSL https://raw.githubusercontent.com/Open-Tech-Foundation/ES-Runtime/main/install.sh | bash

Windows (PowerShell):

irm https://raw.githubusercontent.com/Open-Tech-Foundation/ES-Runtime/main/install.ps1 | iex

Or build from source — a single self-contained binary at target/release/esrun, no extra files or asset directory:

cargo build --release -p es-runtime-cli   # or the alias: cargo build-cli

Run JavaScript

Run JS files like node/bun:

esrun examples/hello.js
esrun examples/modules/main.mjs   # ES module: import/export + top-level await
esrun -e='console.log(6 * 7)'
esrun --env-file=.env app.mjs     # load env vars from a .env file
esrun --deny-all app.mjs          # run with no host access at all
esrun --deny-net app.mjs          # or deny one capability at a time
esrun --help

esrun grants every capability by default. Two modes restrict a run, and they cannot be combined:

esrun --deny-net --deny-run app.mjs                     # everything, minus these
esrun --deny-all --allow-imports --allow-net app.mjs    # nothing, plus these
esrun --deny-all --allow-net=api.example.com app.mjs    # ...narrowed to a list

Names: read, write, imports, net, listen, env, run, signals. --allow-<name> requires --deny-all, and seven of them also take a comma-separated list that narrows the grant — paths, addresses, program names, variable names, signal names. A denied operation throws NotAllowedError; importing a runtime: module always works.

What a run may load is a separate question from what running code may reach, so it has a separate mechanism — --import-policy=./import-policy.json takes JSON with "allow" and/or "deny" lists of package names and paths. See SECURITY.md.

TypeScript

esrun doesn't execute TypeScript, but it ships editor types for the runtime:* modules:

esrun types --install   # writes the defs into node_modules/@opentf/esrun and wires tsconfig.json

esrun types alone prints them to stdout. See esrun.opentechf.org/docs/typescript.

Development

Build, test, and benchmark from source:

Task	Command
Build everything (lib + CLI)	cargo build-all
Build just the esrun binary	cargo build-cli
Run tests	cargo test --workspace
Lints + format check	cargo clippy --workspace --all-targets -- -D warnings · cargo fmt --check
Supply-chain gates	cargo deny check · cargo audit
Startup/throughput microbenchmark	cargo run --release -p es-runtime-default-providers --example bench
Cross-runtime benchmark	bench/run.sh (see bench/README.md)

License

Licensed under the Apache License, Version 2.0. See the NOTICE file for attribution.

ES-Runtime
Copyright 2026 Open Tech Foundation <https://opentechf.org> and its contributors