|
| 1 | +# Deno |
| 2 | + |
| 3 | +Deno is a secure JavaScript/TypeScript runtime built on V8 and Rust, distributed |
| 4 | +as a single `deno` binary. TypeScript, formatting, linting, testing, and a |
| 5 | +standard library work with zero configuration. Programs are sandboxed by |
| 6 | +default; capabilities are granted explicitly via `--allow-*` flags. |
| 7 | + |
| 8 | +## CLI quick reference |
| 9 | + |
| 10 | +``` |
| 11 | +deno run main.ts # run a script (sandboxed by default) |
| 12 | +deno run -A main.ts # run with all permissions |
| 13 | +deno test # run tests (*_test.ts, *.test.ts) |
| 14 | +deno fmt # format code |
| 15 | +deno lint # lint code |
| 16 | +deno task <name> # run a task defined in deno.json |
| 17 | +deno add <package> # add a dependency to deno.json |
| 18 | +deno init my_project # scaffold a new project |
| 19 | +deno init --lib # scaffold a library |
| 20 | +deno init --serve # scaffold an HTTP server |
| 21 | +deno compile main.ts # compile to standalone binary |
| 22 | +deno install --global -A jsr:@std/http/file-server # install a CLI globally |
| 23 | +deno deploy # deploy to Deno Deploy |
| 24 | +``` |
| 25 | + |
| 26 | +## Permissions |
| 27 | + |
| 28 | +By default `deno run` blocks network, filesystem, and environment access. Grant |
| 29 | +specific capabilities with flags: |
| 30 | + |
| 31 | +- `--allow-net` — all network access |
| 32 | +- `--allow-net=example.com` — network access to specific hosts |
| 33 | +- `--allow-read` — all filesystem reads |
| 34 | +- `--allow-read=./data` — reads scoped to a path |
| 35 | +- `--allow-write` — all filesystem writes |
| 36 | +- `--allow-env` — environment variable access |
| 37 | +- `--allow-run` — subprocess execution |
| 38 | +- `-A` — all permissions (shorthand for all flags) |
| 39 | + |
| 40 | +Typical server invocation: |
| 41 | + |
| 42 | +``` |
| 43 | +deno run --allow-net --allow-read server.ts |
| 44 | +``` |
| 45 | + |
| 46 | +## Project configuration (deno.json) |
| 47 | + |
| 48 | +Deno auto-detects `deno.json` (or `deno.jsonc`) up the directory tree. Key |
| 49 | +fields: |
| 50 | + |
| 51 | +```jsonc |
| 52 | +{ |
| 53 | + // Tasks (run via `deno task <name>`) |
| 54 | + "tasks": { |
| 55 | + "dev": "deno run --watch --allow-net main.ts", |
| 56 | + "test": "deno test" |
| 57 | + }, |
| 58 | + |
| 59 | + // Import map — bare specifier aliases for dependencies |
| 60 | + "imports": { |
| 61 | + "@std/assert": "jsr:@std/assert@^1.0.0", |
| 62 | + "chalk": "npm:chalk@5" |
| 63 | + } |
| 64 | +} |
| 65 | +``` |
| 66 | + |
| 67 | +Dependencies are added manually or via `deno add`: |
| 68 | + |
| 69 | +``` |
| 70 | +deno add jsr:@std/http # from JSR (Deno-native registry) |
| 71 | +deno add npm:express # from npm |
| 72 | +``` |
| 73 | + |
| 74 | +## Module resolution and imports |
| 75 | + |
| 76 | +Deno supports three specifier types: |
| 77 | + |
| 78 | +```ts |
| 79 | +// JSR — Deno's native registry (preferred for Deno-first packages) |
| 80 | +import { assertEquals } from "jsr:@std/assert@^1.0.0"; |
| 81 | + |
| 82 | +// npm — use any npm package without an install step |
| 83 | +import chalk from "npm:chalk@5"; |
| 84 | + |
| 85 | +// node: — Node.js built-in modules |
| 86 | +import { readFile } from "node:fs/promises"; |
| 87 | +import { join } from "node:path"; |
| 88 | +``` |
| 89 | + |
| 90 | +When an import map is configured in `deno.json`, use bare specifiers instead: |
| 91 | + |
| 92 | +```ts |
| 93 | +import { assertEquals } from "@std/assert"; |
| 94 | +import chalk from "chalk"; |
| 95 | +``` |
| 96 | + |
| 97 | +## Node.js compatibility |
| 98 | + |
| 99 | +Deno implements Node.js built-in modules and supports `package.json`. Most |
| 100 | +Node.js projects run without modification. Key differences: |
| 101 | + |
| 102 | +- Node built-ins require the `node:` prefix (`import fs from "node:fs"`) |
| 103 | +- npm packages can be imported via `npm:` specifiers without `node_modules` |
| 104 | +- Deno respects `package.json` if present, but prefers `deno.json` |
| 105 | + |
| 106 | +## Testing |
| 107 | + |
| 108 | +Deno has a built-in test runner. Tests are functions registered with |
| 109 | +`Deno.test()` and discovered by file name convention (*_test.ts, *.test.ts). |
| 110 | + |
| 111 | +```ts |
| 112 | +import { assertEquals } from "jsr:@std/assert"; |
| 113 | + |
| 114 | +Deno.test("addition works", () => { |
| 115 | + assertEquals(1 + 1, 2); |
| 116 | +}); |
| 117 | + |
| 118 | +Deno.test("async test", async () => { |
| 119 | + const data = await Promise.resolve("hello"); |
| 120 | + assertEquals(data, "hello"); |
| 121 | +}); |
| 122 | +``` |
| 123 | + |
| 124 | +Run tests: |
| 125 | + |
| 126 | +``` |
| 127 | +deno test # run all tests |
| 128 | +deno test src/ # run tests in a directory |
| 129 | +deno test --filter "add" # filter by test name |
| 130 | +deno test --coverage # collect coverage |
| 131 | +``` |
| 132 | + |
| 133 | +## HTTP server |
| 134 | + |
| 135 | +Deno provides `Deno.serve()` for HTTP servers: |
| 136 | + |
| 137 | +```ts |
| 138 | +Deno.serve({ port: 8000 }, (req: Request) => { |
| 139 | + return new Response("Hello, World!"); |
| 140 | +}); |
| 141 | +``` |
| 142 | + |
| 143 | +## Deno Deploy |
| 144 | + |
| 145 | +Deno Deploy is a managed edge platform for JavaScript/TypeScript apps. |
| 146 | + |
| 147 | +Deploy from the CLI: |
| 148 | + |
| 149 | +``` |
| 150 | +deno deploy |
| 151 | +``` |
| 152 | + |
| 153 | +Or connect a GitHub repo via https://console.deno.com/ for automatic deploys on |
| 154 | +push, with preview deploys per branch/PR. |
| 155 | + |
| 156 | +Framework apps (e.g., Fresh) typically use a build step: `deno task build`. |
| 157 | + |
| 158 | +Deno Deploy includes Deno KV, a built-in key-value database: |
| 159 | + |
| 160 | +```ts |
| 161 | +const kv = await Deno.openKv(); |
| 162 | +await kv.set(["users", "alice"], { name: "Alice", age: 30 }); |
| 163 | +const result = await kv.get(["users", "alice"]); |
| 164 | +``` |
| 165 | + |
| 166 | +## Deno Sandbox |
| 167 | + |
| 168 | +Deno Sandbox provides ephemeral Linux microVMs (sub-second startup) via API. |
| 169 | +Designed for executing untrusted code safely — particularly useful for AI agent |
| 170 | +workflows (generate code, execute, inspect output, iterate). |
| 171 | + |
| 172 | +SDKs: `@deno/sandbox` (JavaScript — works in Deno and Node), plus a Python SDK. |
| 173 | + |
| 174 | +Basic usage (JS): |
| 175 | + |
| 176 | +```ts |
| 177 | +import { Sandbox } from "@deno/sandbox"; |
| 178 | + |
| 179 | +const sandbox = await Sandbox.create(); |
| 180 | +const result = await sandbox.runCommand("echo hello"); |
| 181 | +console.log(result.output); // "hello" |
| 182 | +await sandbox.close(); |
| 183 | +``` |
| 184 | + |
| 185 | +Capabilities: |
| 186 | + |
| 187 | +- Full Linux environment (filesystem, processes, package managers) |
| 188 | +- Configurable region, memory, and lifetime |
| 189 | +- HTTP port exposure and SSH access |
| 190 | +- Persistent storage via volumes and snapshots |
| 191 | +- Network allowlisting (`allowNet: ["example.com"]`) |
| 192 | + |
| 193 | +Security model: Secrets never enter the sandbox. The platform substitutes secret |
| 194 | +values only on outbound requests to approved hosts, preventing exfiltration by |
| 195 | +generated code. |
| 196 | + |
| 197 | +## Key documentation links |
| 198 | + |
| 199 | +- Runtime docs: https://docs.deno.com/runtime/ |
| 200 | +- Deploy docs: https://docs.deno.com/deploy/ |
| 201 | +- Sandbox docs: https://docs.deno.com/sandbox/ |
| 202 | +- Standard library: https://jsr.io/@std |
| 203 | +- Examples: https://docs.deno.com/examples/ |
| 204 | +- AI skills: https://github.com/denoland/skills |
0 commit comments