[IshKebab]

Well, they claim "linear time". Constant time would be impossible.

But anyway they achieve that by being much more restrictive than just "not Turing complete", e.g. you can't define functions.

It certainly sounds like an attractive feature, but how much benefit is it really to restrict a language so much that it will probably run quickly enough compared to just setting a timeout or computation limit? The only advantage I can think of is that you get some kind of computation constraints that don't depend on the data... But this is a pretty niche requirement.

[kbolino]

It is a niche, yes. However, that niche is about adding some customizability to certain parts of a program, where Lua would be overkill. Moreover, hardening Lua, which is doable but not trivial, may be beyond the ability, interest, or simply time available to the developer. If you don't need the extra features Lua provides, why include them?

[IshKebab]

> If you don't need the extra features Lua provides, why include them?

The whole point of a feature like this is that you don't know what will be required. It's going to be pretty annoying when a user does find they need something that's impossible with CEL and they can't do it because the devs think they'll write slow code.

Lua is not very nice IMO, but I've used Rhai successfully in the past. It even has an operation limit feature already:

https://rhai.rs/book/safety/max-operations.html