Script

Script (script.svc) runs tenant code in a sandbox. It is the escape hatch the rest of the platform uses: wherever a block lets you drop into custom logic — a bot’s hook points, a Data API pointcut, a pipeline’s transform, a rule’s helper — that code executes here.

The point is that customer code runs somewhere safe rather than inside the service that invoked it. A tenant script cannot exhaust the calling block’s memory, read another tenant’s state, or reach the network unless its namespace permits it.

Languages

Language	Runtime
JavaScript	Goja or V8
Lua	—
Go	Yaegi (interpreted)
Starlark	—
CEL	—
expr	—
WebAssembly	wazero

Pick by what the script is for. CEL and expr are the right choice for a single predicate — they are not general-purpose languages, and that is a feature when the script is “should this record be included”. JavaScript and Lua suit real logic. Starlark suits configuration that needs branching. WebAssembly is for shipping something compiled from elsewhere.

Isolation

• Process-level tenant isolation — scripts from different tenants do not share a process
• Resource quotas and limits — CPU, memory and wall-clock, enforced per execution
• Capability-scoped namespaces — a script reaches only what its namespaces grant

The third is the one to design around. A script’s blast radius is the set of namespaces bound into it, so the security question is not “is this script trustworthy” but “what did we hand it?”

Execution modes

Synchronous — call, block, get the result. For hooks and transforms on a request path.

Asynchronous — submit, poll or receive a callback. For anything long enough that holding the caller is wrong.

Two surfaces

Surface	Use
kis script	Authoring and testing locally
script.svc	The deployed service other blocks call

Same runtime, same namespaces, same semantics — so a script that behaves locally behaves the same in production.

Next

• Namespace Reference — everything a script can call
• Operations — deploying, quotas and what to watch