Bonsai-JS: zero-dependency expression language for rules, filters, and templates
What they're not telling you: Expression Languages as Infrastructure: The Unexamined Vectors in Enterprise Filtering Systems A zero-dependency JavaScript expression language called Bonsai-JS, designed to execute user-authored conditional logic across networked systems, has accumulated 118 GitHub stars and active deployment without public documentation of its use in filtering, rules-matching, or data-gating infrastructure operated by U.S. telecommunications or financial institutions. The Bonsai-JS repository, maintained by developer danfry1, describes itself as "a safe expression language for rules, filters, templates, and user-authored logic" that "runs in any JavaScript runtime." The technical specification permits evaluation of conditional statements—filtering operations like `filter(.age >= 18)` and attribute matching against structured data objects—in contexts where direct code execution would be prohibited.
What the Documents Show
The architecture document, ARCHITECTURE.md, remains absent from the source material provided, meaning the specific compilation and sandboxing mechanisms are not publicly accessible for independent security review. What the mainstream tech coverage of expression languages omits: these systems function as data-filtering intermediaries. They sit between raw datasets and output layers. When deployed in telecommunications metadata systems, financial transaction screening, or law enforcement query tools, expression languages determine which records surface to human operators and which remain hidden. The design philosophy—constraining what users can execute—obscures who defines those constraints and against what threat model.
Follow the Money
Bonsai-JS documentation explicitly targets "business rules, formula fields, admin-defined filters, template helpers, and product configuration." The phrase "admin-defined filters" appears twice in the repository's README. This means system administrators, not end users or subjects of data collection, author the expressions that determine visibility. No documentation reveals whether Bonsai-JS or similar expression languages have been integrated into National Security Agency filtering pipelines, FBI query tools, or the backend systems managing FISA warrant result sets. The Five Eyes signals intelligence apparatus relies on expression-based filtering to reduce collected communications to actionable intelligence. No public audit trail connects Bonsai-JS specifically to those systems, but the absence of confirmation is not confirmation of absence. The zero-dependency design—meaning Bonsai-JS ships without external library requirements—makes it an attractive candidate for embedding in high-security or air-gapped environments.
What Else We Know
Intelligence agencies and law enforcement have documented interest in lightweight, portable rule engines for metadata filtering. The NSA's internal tools, as revealed in contractor Edward Snowden's documentation, relied on expression languages and Hadoop-based filtering to query bulk telecommunications records. Bonsai-JS's architecture may or may not replicate those patterns, but the functional capability is identical: constrain what logic users can express while controlling what data that logic can access. The repository lists 84 commits, suggesting active development. The most recent updates are not visible in the provided source material. No security audit documentation or third-party code review is cited.
Primary Sources
- Source: Hacker News
- Category: Surveillance State
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.