oss project
xpr-lang
A sandboxed expression language with byte-identical runtimes in TypeScript, Python, and Go.
- TypeScript
- Python
- Go
- Parser theory
- EBNF
- VitePress
- Vite
- CodeMirror
- Designed a sandboxed expression language with a formal EBNF specification for safe data-pipeline transforms - no I/O, no loops, no side effects.
- Implemented parsers and evaluators across TypeScript, Python, and Go with byte-identical conformance over 300+ YAML test cases.
- Shipped to npm + PyPI + Go modules with VitePress docs and an interactive browser playground (Vite + CodeMirror).
- v0.5 ships arrow functions, let bindings, spread, pipe operator, optional chaining, regex literals, destructuring, and 60+ built-in methods.
Why I built it
Most expression languages for data pipelines are either too unsafe (full JavaScript with eval), too primitive (cron-style templates), or runtime- specific (you write your pipeline expression once for Python, again for Go). xpr-lang fills the gap: one syntax, three implementations, formal guarantees about safety, and conformance-tested behaviour across runtimes.
Architecture highlights
- Single source of truth: the EBNF grammar in
xpr-lang/xpris the authoritative spec. Each runtime parses to the same AST shape. - YAML conformance suite: 300+ test cases driving identical behaviour across TS/Python/Go. CI on every PR.
- Zero I/O surface: no file, network, or OS access; no
import, noeval, no loops. Safe to evaluate untrusted user expressions. - Familiar syntax: arrow functions, pipe operator, optional chaining, destructuring, regex literals - if you know modern JS/Python, you can read xpr-lang.
- Three runtimes: TypeScript (
@xpr-lang/xpr), Python (xpr-lang), Go (github.com/xpr-lang/xpr-go).