LuaJIT runtime
This reference was audited against v2 commit 87824c4a82f4bb513874f2ede140ae36a67f48cc on 2026-10-12. The configured fork revision is 6b832995dc4faecd2e3473683df51bd0a9d47e09 with serialization profile ser1 (private dump version 0x80). The runtime and cloud compiler must use compatible revisions/profile; older cloud bytecode must be rebuilt when that profile changes.
Libraries
| Library | Access | Reference |
|---|---|---|
| Lua base functions, string, table, math, coroutine | Normal globals; approved tables also resolve through require | Lua 5.1 manual |
| bit | Global bit or require("bit") | LuaJIT BitOp |
| jit | Global jit or require("jit") | JIT controls |
| ffi | require("ffi"); no global ffi is created | FFI API |
LuaJIT adds Lua language extensions. The client does not open io, os, or debug. jit.util is disabled. Direct load, loadstring, loadfile, dofile, and string.dump are unavailable. These restrictions apply equally to local and cloud scripts.
Module loading
require("traceless") returns the shared custom root. Project modules are resolved by bundle name before approved built-ins, with a cache for each script instance. The names debug and jit.util are always denied, including matching project files. External filesystem/native searchers, preloads, and the stock package table are unavailable.
require permits the approved ffi, bit, jit, string, table, math, and coroutine tables. Module returns are cached; nil becomes true, while false can lead to re-execution on a subsequent require. Circular loading raises an error. Unload/replacement discards the instance's project-module cache.
Shared state
Cloud and local projects share one Lua state. Globals, FFI declarations, built-in tables, and the traceless root can affect other scripts. Keep project state local and avoid replacing shared functions or codec settings without coordinating their use.
FFI and unsafe native access remain unrestricted. Library removal and cloud validation are not an isolation boundary against native access; see FFI and security.
Script metadata
The runtime refreshes the shared __traceless global for the current script invocation. Capture its scalar values during the invocation instead of treating the global as a persistent identity for another callback or coroutine.
| Field | Type | Availability |
|---|---|---|
identity | string | Script storage/control identity |
local | boolean | Local developer project flag; read as __traceless["local"] |
version | integer | Current script version |
runtime_id | string | Configured runtime compatibility ID |
script_id | decimal string | Cloud only; preserves unsigned 64-bit precision |
account_id | integer | Cloud only |
delivered_at | decimal string | Cloud only; delivery timestamp |
watermark | 64-character hexadecimal string | Cloud only; inspection value populated after native validation |
Metadata is descriptive and is not a callable validation or authentication API.