Cocoar.JsEval.Module.AngleSharp 5.0.0

Cocoar.JsEval

JavaScript/TypeScript execution library for .NET, built on Jint.

Features

• JavaScript execution via Jint (ES2025 support)
• Execution methods: ExecuteAsync(string) / ExecuteAsync(prepared module) (standard), Evaluate(string) / Evaluate(prepared), EvaluateAsync()
• Pre-parsed scripts (Prepare() / PrepareModule()) for maximum throughput
• Sandboxed() + AllowOnly / DenyTypes for untrusted rules with real CLR objects
• TypeScript 6.0 transpilation with embedded compiler
• fetch() API with opt-in sandboxing
• Automatic .NET Task → JS Promise interop
• console.log/warn/error/debug via ILogger
• setTimeout/setInterval support
• Extensible module system (HTTP, Database, SMTP, Templates, and more)
• .d.ts generation for IntelliSense support
• Built for .NET 10

Quick Start

dotnet add package Cocoar.JsEval.Engine

Basic JavaScript Execution

services.AddJsEval();

var engine = sp.GetRequiredService<JsEngine>();
engine.SetValue("name", "World");
engine.Evaluate("var greeting = 'Hello, ' + name + '!';");
var result = engine.GetValue<string>("greeting"); // "Hello, World!"

Untrusted Rules

Two independent axes, and an untrusted script wants both. Sandboxed() governs what a script can do on its own — strict mode, no eval/Function, no reflection, and memory, recursion, stack, array and regex limits. AllowOnly and DenyTypes govern what it can reach: passing an object otherwise grants everything reachable from it.

services.AddJsEval(b => b
    .Sandboxed()                                   // hardens the runtime, latches
    .AllowOnly(a => a
        .Member((Customer c) => c.Name)
        .Member((Customer c) => c.Age))
    .DenyTypes(typeof(DbContext), typeof(IServiceProvider)));

Sandboxed() latches in both directions — EnableFetch() before or after it throws — so the guarantee never depends on the order the builder is written in. It hardens the runtime but does not narrow the object graph; that is what AllowOnly is for. Isolation between scripts is the engine instance: resolve a separate engine per script source.

With ES Modules

services.AddJsEval(b => b
    .AddModule<CommonModule>()
    .AddModule<HttpModule>()
);

var engine = sp.GetRequiredService<JsEngine>();
await engine.ExecuteAsync(@"
    import * as common from 'common';
    export function newId() { return common.Guid.New().toString(); }
");
var id = engine.InvokeFunction("newId"); // fresh GUID each call

ES-module semantics: top-level code runs once per unique script on a given engine — repeated ExecuteAsync calls return the cached module namespace. Put per-call work inside exported functions and invoke them via InvokeFunction. For true per-call re-execution use the lightweight Evaluate(string) path.

Pre-Parsed Scripts (for repeated execution)

// Parse once (thread-safe, cacheable)
var prepared = JsEngine.Prepare("query.WhereResponsible(ctx.UserId);");

// Execute many times — no re-parsing
engine.SetValue("ctx", accessContext);
engine.SetValue("query", queryBuilder);
engine.Evaluate(prepared);

TypeScript Transpilation

dotnet add package Cocoar.JsEval.TypeScript

services.AddTsTranspiler();

var transpiler = sp.GetRequiredService<TsTranspiler>();
var js = transpiler.Transpile(tsCode);  // transpile once
await engine.ExecuteAsync(js);          // execute

fetch()

services.AddJsEval(b => b.EnableFetch());

const response = await fetch('https://api.example.com/data');
const body = await response.text();
console.log(response.status, response.ok);

.NET async → JS Promise (automatic)

engine.SetValue("loadData", new Func<string, Task<string>>(async id => {
    return await db.FindAsync(id);
}));

const data = await loadData('item-123'); // .NET Task becomes a Promise

Execution Methods

ExecuteAsync is the default/standard method for trusted integration scripts and provides the full module system. For tenant- or end-user-authored rules, resolve a Sandboxed() engine with an AllowOnly surface. Evaluate is a lightweight execution mode for scripts you control and know do not need modules.

Packages

License

Apache-2.0 — COCOAR e.U.