@blokjs/shared 0.2.1 → 0.4.0

package/dist/types/Context.d.ts

@@ -6,20 +6,111 @@ import type FunctionContext from "./FunctionContext";
 import type LoggerContext from "./LoggerContext";
 import type RequestContext from "./RequestContext";
 import type ResponseContext from "./ResponseContext";
+import type StateContext from "./StateContext";
 import type VarsContext from "./VarsContext";
+/**
+ * The runtime context for a single workflow execution. One Context object
+ * is created per run and threaded through every step.
+ *
+ * **The two-tier read model:**
+ *
+ * - `ctx.prev` — the previous step's full result envelope ({ data, success,
+ *   error }). Overwritten on every step. Use for adjacent-step access.
+ *   Aliased by `ctx.response` for back-compat with v1.
+ *
+ * - `ctx.state[stepId]` — each step's `result.data` is automatically
+ *   persisted here under the step's `id` (or its `as` override). Use
+ *   for any-distance access. Aliased by `ctx.vars` for back-compat.
+ *
+ * **Side-channel publication:**
+ *
+ * - `ctx.publish(name, value)` — explicitly publish a value into state
+ *   from inside a node. Logged in Studio's trace tab. Use sparingly —
+ *   most nodes should just `return` their output and let the runner
+ *   persist it.
+ *
+ * **Request envelope aliases:**
+ *
+ * - `ctx.req` — alias for `ctx.request`. Read query, body, params,
+ *   headers, etc. via either form.
+ */
 type Context = {
     id: string;
     workflow_name?: string;
     workflow_path?: string;
+    /**
+     * Request envelope. Body, query, params, headers, etc.
+     *
+     * Also accessible as `ctx.req` (alias).
+     */
     request: RequestContext;
+    /**
+     * Alias for `ctx.request` — same object, read-only getter. v2
+     * authoring uses `req`; v1 authoring used `request`. Both work.
+     */
+    readonly req?: RequestContext;
+    /**
+     * Previous step's full result envelope. **Overwritten every step.**
+     * Use for adjacent-step access only; for cross-step access use
+     * `ctx.state[stepId]`.
+     *
+     * Aliased by `ctx.response` for v1 back-compat.
+     */
     response: ResponseContext;
+    /**
+     * Alias for `ctx.response` — same object. v2 authoring uses `prev`;
+     * v1 authoring used `response.data`. Both work.
+     */
+    readonly prev?: ResponseContext;
     error: ErrorContext;
     logger: LoggerContext;
     config: ConfigContext;
     func?: FunctionContext;
+    /**
+     * Accumulated step outputs by step `id`. Filled automatically when
+     * a step completes (unless `ephemeral: true`).
+     *
+     * Aliased by `ctx.vars` for v1 back-compat — both fields point at
+     * the same underlying object.
+     *
+     * Always initialized to `{}` by `TriggerBase.createContext`. Marked
+     * optional only so legacy code paths that hand-construct a Context
+     * (some tests, internal utilities) keep type-checking; production
+     * runs always have `state` defined.
+     */
+    state?: StateContext;
+    /**
+     * Alias for `ctx.state` — same underlying object. v2 authoring
+     * uses `state`; v1 authoring used `vars`. Both work.
+     *
+     * @deprecated Prefer `ctx.state` (or `$.state.<id>` from inputs).
+     */
     vars?: VarsContext;
     env?: EnvContext;
     eventLogger: GlobalLogger | unknown;
+    /**
+     * Explicit side-channel publication. Writes to state under `name`
+     * and emits a Studio trace event. Use only when a node needs to
+     * publish something other than its return value (most nodes don't).
+     */
+    publish?: (name: string, value: unknown) => void;
+    /**
+     * Tier 2 follow-up · cooperative cancellation. AbortSignal whose
+     * `aborted` flips to true when an operator cancels the run via
+     * `POST /__blok/runs/:runId/cancel` while it's in `running` status.
+     *
+     * Nodes that perform long-running work (loops, fetch, db queries)
+     * should consult `ctx.signal.aborted` periodically and abort early
+     * — or pass the signal to fetch/abort-aware APIs:
+     *
+     *     await fetch(url, { signal: ctx.signal });
+     *     if (ctx.signal?.aborted) throw new Error("aborted");
+     *
+     * Always present on contexts created by `TriggerBase.createContext`.
+     * Optional on the type for back-compat with hand-built contexts in
+     * tests.
+     */
+    signal?: AbortSignal;
     _PRIVATE_: unknown;
 };
 export default Context;

package/dist/types/StateContext.d.ts

@@ -0,0 +1,21 @@
+/**
+ * StateContext — accumulated step outputs for a single workflow run.
+ *
+ * Every step's `result.data` lands here under the step's `id` (or its
+ * `as` override) automatically. Steps marked `ephemeral: true` skip
+ * persistence; steps marked `spread: true` shallow-merge their result
+ * keys into state.
+ *
+ * Read via `ctx.state[stepId]` or `$.state[stepId]` from a workflow's
+ * `inputs`. Always initialized to `{}` at run start — never undefined.
+ *
+ * Aliased by `ctx.vars` for backward compatibility with v1 workflows.
+ *
+ * @example
+ *   ctx.state["fetch-users"]   // the data returned by the fetch-users step
+ *   ctx.state.user             // when a step has `as: "user"`
+ */
+type StateContext = {
+    [key: string]: unknown;
+};
+export default StateContext;

package/dist/types/StateContext.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=StateContext.js.map

package/dist/types/StateContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StateContext.js","sourceRoot":"","sources":["../../src/types/StateContext.ts"],"names":[],"mappings":""}

package/dist/types/VarsContext.d.ts

@@ -1,5 +1,18 @@
-import type ParamsDictionary from "./ParamsDictionary";
+/**
+ * VarsContext — accumulated step outputs for a single workflow run.
+ *
+ * **Legacy alias for {@link StateContext}.** The two types describe the
+ * same underlying object (`ctx.state` and `ctx.vars` are aliases). v2
+ * code should prefer `ctx.state` / `StateContext`.
+ *
+ * Values can be any JSON-serializable shape — a step's output is whatever
+ * its node returned. The strict `ParamsDictionary` shape from earlier
+ * versions of Blok was inaccurate; real workflows have always stored
+ * arbitrary objects, arrays, primitives, etc. here.
+ *
+ * @deprecated Prefer {@link StateContext}.
+ */
 type VarsContext = {
-    [key: string]: ParamsDictionary;
+    [key: string]: unknown;
 };
 export default VarsContext;

package/dist/utils/Mapper.d.ts

@@ -1,10 +1,119 @@
 import type Context from "../types/Context";
 import type ParamsDictionary from "../types/ParamsDictionary";
+/**
+ * Mapper — the workflow input resolver.
+ *
+ * Every step's `inputs` object is walked by `replaceObjectStrings`
+ * before the step runs (see `NodeBase.process` → `blueprintMapper`).
+ * Two template syntaxes are recognised:
+ *
+ * 1. **`${path.to.value}`** — interpolated string placeholder.
+ *    Resolved via lodash `_.get(data, key)` first, with a JS-eval
+ *    fallback when the key is not in `data`. Multiple placeholders
+ *    in one string are concatenated.
+ *
+ * 2. **`"js/..."`** — full-string JS expression. The string is
+ *    replaced ENTIRELY by the result of evaluating the expression
+ *    (after stripping the `js/` prefix) against the live `ctx`.
+ *    Returns whatever value the expression produces (string, number,
+ *    object, array, etc.) — preserves type fidelity end-to-end.
+ *
+ * Both syntaxes evaluate inside a sandboxed `Function` with these
+ * names in scope: `ctx`, `data`, `func`, `vars`. (Symmetric scope
+ * across both syntaxes since v0.3.x — pre-v0.3.x `${...}` evaluator
+ * lacked `func`+`vars`, leading to surprising scope mismatches.)
+ *
+ * ## Failure modes — see {@link MapperResolutionError}
+ *
+ * Resolution failures (typo, undefined access, syntax error) used to
+ * be swallowed silently with a noisy `console.log("Mapper Error N", e)`
+ * — and worse, the unresolved expression string passed through to the
+ * node, producing silent miscompiles downstream. Since v0.3.x the
+ * Mapper packages every failure in a `MapperResolutionError` with full
+ * context (workflow, step, expression, underlying cause + heuristic
+ * hint) and routes it according to `BLOK_MAPPER_MODE`:
+ *
+ * - `"warn"` (default) — log via `ctx.logger.logLevel("warn", ...)`,
+ *   pass through the original string. Backward-compatible diagnostics.
+ * - `"strict"` — throw the error, fail the step fast. **Recommended
+ *   for production.**
+ * - `"silent"` — full suppression. Tests / opt-out only.
+ *
+ * ## Bug fixes shipped alongside the diagnostic upgrade (v0.3.x)
+ *
+ * - **Falsy values now preserved** — `_.get(data, key) || runJs(...)`
+ *   used to fall through to `runJs` when the lookup returned `0`,
+ *   `false`, `null`, or `""` (all valid values incorrectly treated
+ *   as missing). Now uses an explicit `=== undefined` check.
+ * - **Object interpolation now JSON-encodes** — `value as string`
+ *   used to produce `"[object Object]"` for object values. Now
+ *   round-trips via `JSON.stringify`.
+ * - **`js/` prefix stripping** uses `slice(3)` instead of
+ *   `replace("js/", "")` (the latter only strips the FIRST
+ *   occurrence — fragile if the expression itself contained `js/`).
+ */
+/**
+ * How the Mapper reacts to expression resolution failures. Read from
+ * the `BLOK_MAPPER_MODE` env var at every call (no caching) so unit
+ * tests can flip the mode between cases.
+ */
+export type MapperMode = "warn" | "strict" | "silent";
 declare class Mapper {
+    /**
+     * Walk an object recursively, resolving every string value via
+     * `replaceString`. Mutates in place. Used by `NodeBase.process` to
+     * resolve a step's `inputs` against the live `ctx` before the
+     * step runs.
+     *
+     * Object/array values are recursed into; primitive non-string
+     * values are left untouched. Null values are NOT recursed (avoids
+     * a TypeError on `for (const k in null)`).
+     */
     replaceObjectStrings(obj: ParamsDictionary, ctx: Context, data: ParamsDictionary): void;
-    replaceString: (strData: string, ctx: Context, data: ParamsDictionary) => string;
-    private runJs;
+    /**
+     * Resolve a single string. Returns `unknown` because a `js/...`
+     * expression may yield any value (number, object, array, etc.) —
+     * type fidelity is preserved across the resolver boundary.
+     *
+     * Pre-v0.3.x return was typed as `string` via `as string` cast
+     * which was a type lie; downstream consumers received the actual
+     * runtime value but couldn't see it through the type system.
+     */
+    replaceString: (strData: string, ctx: Context, data: ParamsDictionary) => unknown;
+    /**
+     * Resolve a `${path}` expression. Lodash lookup first; JS-eval
+     * fallback when the path is not in `data`. Returns the resolved
+     * value OR the failure sentinel.
+     */
+    private resolveTemplateExpression;
+    /**
+     * Evaluate a `js/...` full-string expression. Returns whatever the
+     * expression produces (any type), or — in warn/silent mode on
+     * failure — the original literal `js/...` string.
+     *
+     * Strict-mode failures throw `MapperResolutionError`.
+     */
     private jsMapper;
+    /**
+     * Apply the configured mode (`BLOK_MAPPER_MODE`) to a resolution
+     * failure. In strict mode, the error escapes here and propagates
+     * up through `replaceString` → `NodeBase.blueprintMapper` →
+     * `NodeBase.process` → step error envelope.
+     */
+    private handleResolutionError;
+    /**
+     * Sandboxed JS evaluation. Compiles the expression as a function
+     * body returning the expression value; binds `ctx`, `data`, `func`,
+     * `vars` as positional arguments; runs in `"use strict"` mode.
+     *
+     * Throws on any evaluation error (typo, undefined access, syntax,
+     * unknown identifier). Callers wrap in try/catch and translate to
+     * `MapperResolutionError`.
+     *
+     * Public via the prototype but documented as internal — the only
+     * supported call sites are inside this class.
+     */
+    private runJs;
 }
 declare const _default: Mapper;
 export default _default;

package/dist/utils/Mapper.js

@@ -1,55 +1,288 @@
 import _ from "lodash";
+import { MapperResolutionError } from "./MapperResolutionError";
+// =============================================================================
+// Internal sentinels + helpers
+// =============================================================================
+/**
+ * Returned by the template-resolution path to signal "this placeholder
+ * could not be resolved; leave the literal `${...}` in place". Using a
+ * Symbol avoids ambiguity with the legitimate `undefined` value an
+ * expression might produce.
+ */
+const TEMPLATE_RESOLUTION_FAILED = Symbol("TEMPLATE_RESOLUTION_FAILED");
+function readMode() {
+    const raw = process.env.BLOK_MAPPER_MODE;
+    if (raw === "strict")
+        return "strict";
+    if (raw === "silent")
+        return "silent";
+    return "warn";
+}
+function readStepContext(ctx) {
+    const ctxAny = ctx;
+    const stepInfo = ctxAny._stepInfo;
+    const stepName = typeof stepInfo?.name === "string" ? stepInfo.name : undefined;
+    const workflowName = typeof ctx.workflow_name === "string" ? ctx.workflow_name : undefined;
+    return { workflowName, stepName };
+}
+/**
+ * Build the actionable error message — every line carries information
+ * a developer can act on: WHERE it failed, WHAT failed, WHY it likely
+ * failed, and HOW to fix it.
+ */
+function buildErrorMessage(opts) {
+    const wf = opts.workflowName ?? "<unknown workflow>";
+    const step = opts.stepName ?? "<unknown step>";
+    const literal = opts.syntax === "js" ? `js/${opts.expression}` : `\${${opts.expression}}`;
+    const causeMsg = opts.cause instanceof Error ? opts.cause.message : String(opts.cause);
+    const hint = guessHint(opts.expression, causeMsg);
+    const lines = [
+        `[blok][mapper] Failed to resolve \`${literal}\` in step "${step}" of workflow "${wf}"`,
+        `  underlying: ${causeMsg}`,
+    ];
+    if (hint)
+        lines.push(`  hint: ${hint}`);
+    lines.push("  fix: verify the referenced ctx path exists at run time. Set BLOK_MAPPER_MODE=strict in production to fail fast on these errors.");
+    return lines.join("\n");
+}
+/**
+ * Heuristic — translate common JS evaluation errors into actionable
+ * developer hints. Returns `null` when the error doesn't match any
+ * known pattern (the underlying message is still surfaced).
+ */
+function guessHint(expression, errorMessage) {
+    // Most common case — `Cannot read properties of undefined (reading 'X')`
+    // or the older `Cannot read property 'X' of undefined`. Both forms
+    // appear depending on Node/Bun version.
+    const undefMatch = errorMessage.match(/Cannot read propert(?:y '(\w+)' of undefined|ies of undefined \(reading '(\w+)'\))/);
+    if (undefMatch) {
+        const prop = undefMatch[1] ?? undefMatch[2];
+        const segments = expression.split(".");
+        const parent = segments.slice(0, -1).join(".") || expression;
+        return `the path \`${parent}\` is undefined or doesn't have a "${prop}" field at run time. Check the trigger payload (ctx.req.body) or the upstream step's output (ctx.state.<id>).`;
+    }
+    // Identifier not in scope — only `ctx`, `data`, `func`, `vars` are
+    // available inside expressions.
+    const refMatch = errorMessage.match(/(\w+) is not defined/);
+    if (refMatch) {
+        return `\`${refMatch[1]}\` is not in scope. Available identifiers inside expressions: ctx, data, func, vars.`;
+    }
+    // Syntax error.
+    if (/SyntaxError/.test(errorMessage) || /Unexpected token/.test(errorMessage)) {
+        return "the expression is not valid JavaScript. Check for typos, unmatched parentheses, or stray characters.";
+    }
+    return null;
+}
+/**
+ * Route a warn-mode log line to the best available sink. Prefers
+ * `ctx.logger.logLevel("warn", ...)` so the warning lands in BOTH the
+ * console (via DefaultLogger) AND Studio's log viewer (via
+ * TracingLogger.normalizeLevel → addLog). Falls back to console.warn
+ * when no logger is attached (early-boot or hand-rolled test ctx).
+ */
+function logViaCtxOrConsole(ctx, message) {
+    const logger = ctx.logger;
+    if (logger?.logLevel) {
+        try {
+            logger.logLevel("warn", message);
+            return;
+        }
+        catch {
+            // fall through to console.warn — never let logging itself crash a step.
+        }
+    }
+    if (logger?.log) {
+        try {
+            logger.log(message);
+            return;
+        }
+        catch {
+            // fall through
+        }
+    }
+    console.warn(message);
+}
+/**
+ * Coerce a resolved value to its string form for `${...}` interpolation.
+ *
+ * Pre-v0.3.x used `value as string` which fell back to `String(value)`
+ * via implicit coercion — producing `"[object Object]"` for any object/
+ * array. Now JSON-encodes complex values so interpolated strings
+ * preserve information instead of silently miscompiling.
+ *
+ * - `null` / `undefined` → empty string (matches user intent for
+ *   missing optional fields)
+ * - `string` → identity
+ * - `number` / `boolean` / `bigint` → `String(value)`
+ * - everything else → `JSON.stringify(value)` with a defensive fallback
+ *   to `String(value)` for circular structures.
+ */
+function toInterpolatedString(value) {
+    if (value === null || value === undefined)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return String(value);
+    }
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        // JSON.stringify throws on circular references — degrade gracefully.
+        return String(value);
+    }
+}
+// =============================================================================
+// Mapper
+// =============================================================================
 class Mapper {
+    /**
+     * Walk an object recursively, resolving every string value via
+     * `replaceString`. Mutates in place. Used by `NodeBase.process` to
+     * resolve a step's `inputs` against the live `ctx` before the
+     * step runs.
+     *
+     * Object/array values are recursed into; primitive non-string
+     * values are left untouched. Null values are NOT recursed (avoids
+     * a TypeError on `for (const k in null)`).
+     */
     replaceObjectStrings(obj, ctx, data) {
         for (const key in obj) {
             if (Object.prototype.hasOwnProperty.call(obj, key)) {
                 const value = obj[key];
                 if (typeof value === "string") {
+                    // `ParamsDictionary[key]` is typed `string`, but the
+                    // runtime contract has always been "the resolved value
+                    // keeps its actual type" (so `js/ctx.req.body.count`
+                    // produces a number, not the string "42"). The
+                    // `as unknown as string` boundary cast acknowledges
+                    // that the type system can't express this widening
+                    // without changing the global ParamsDictionary shape
+                    // (a much larger refactor).
                     obj[key] = this.replaceString(value, ctx, data);
                 }
-                else if (typeof value === "object") {
+                else if (value !== null && typeof value === "object") {
                     this.replaceObjectStrings(value, ctx, data);
                 }
             }
         }
     }
+    /**
+     * Resolve a single string. Returns `unknown` because a `js/...`
+     * expression may yield any value (number, object, array, etc.) —
+     * type fidelity is preserved across the resolver boundary.
+     *
+     * Pre-v0.3.x return was typed as `string` via `as string` cast
+     * which was a type lie; downstream consumers received the actual
+     * runtime value but couldn't see it through the type system.
+     */
     replaceString = (strData, ctx, data) => {
         let str = strData;
-        // if (str.length > 15000) {
-        // 	throw new Error("Input too long");
-        // }
+        // === 1. `${path}` template interpolation ===
         const regex = /\${(.*?)}/g;
         const matches = str.match(regex);
         if (matches) {
             for (const match of matches) {
-                try {
-                    const key = match.replace(/\${/g, "").replace(/}/g, "");
-                    const value = _.get(data, key) || this.runJs(key, ctx, data);
-                    // if (value) str = this.parseBasedOnType(str.replace(match, value), typeof value);
-                    str = str.replace(match, value);
-                }
-                catch (e) {
-                    console.log("Mapper Error 1", e);
+                const key = match.slice(2, -1); // strip `${` and `}`
+                const value = this.resolveTemplateExpression(key, ctx, data);
+                if (value !== TEMPLATE_RESOLUTION_FAILED) {
+                    str = str.replace(match, toInterpolatedString(value));
                 }
+                // On failure: leave the literal `${...}` placeholder in
+                // place. The failure was already reported per the active
+                // mode (warn/strict/silent).
             }
         }
-        const result = this.jsMapper(str, ctx, data);
-        return result;
+        // === 2. `js/...` full-string evaluation ===
+        return this.jsMapper(str, ctx, data);
     };
-    runJs(str, ctx, data = {}, func = {}, vars = {}) {
-        return Function("ctx", "data", "func", "vars", `"use strict";return (${str});`)(ctx, data, func, vars);
+    /**
+     * Resolve a `${path}` expression. Lodash lookup first; JS-eval
+     * fallback when the path is not in `data`. Returns the resolved
+     * value OR the failure sentinel.
+     */
+    resolveTemplateExpression(key, ctx, data) {
+        // Lodash lookup. Use explicit `=== undefined` instead of `||`
+        // so falsy-but-valid values (0, false, "", null) are preserved.
+        const lookupValue = _.get(data, key);
+        if (lookupValue !== undefined)
+            return lookupValue;
+        // Fallback to JS evaluation against ctx. Symmetric with jsMapper:
+        // pass `ctx.func` and `ctx.vars` so `${func.X}` and `${vars.X}`
+        // have the same scope as `js/func.X` / `js/vars.X`.
+        try {
+            return this.runJs(key, ctx, data, (ctx.func ?? {}), (ctx.vars ?? {}));
+        }
+        catch (cause) {
+            const stepCtx = readStepContext(ctx);
+            const error = new MapperResolutionError(buildErrorMessage({ expression: key, syntax: "template", ...stepCtx, cause }), { expression: key, syntax: "template", ...stepCtx, cause });
+            this.handleResolutionError(ctx, error);
+            return TEMPLATE_RESOLUTION_FAILED;
+        }
     }
+    /**
+     * Evaluate a `js/...` full-string expression. Returns whatever the
+     * expression produces (any type), or — in warn/silent mode on
+     * failure — the original literal `js/...` string.
+     *
+     * Strict-mode failures throw `MapperResolutionError`.
+     */
     jsMapper(str, ctx, data) {
+        if (typeof str !== "string" || !str.startsWith("js/"))
+            return str;
+        // `slice(3)` strips exactly the leading `js/` prefix.
+        // Pre-v0.3.x used `replace("js/", "")` which only strips the
+        // FIRST occurrence — fragile if the expression itself contained
+        // the substring `js/` (e.g., a URL like `https://js/foo`).
+        const expression = str.slice(3);
         try {
-            if (typeof str === "string" && str.startsWith("js/")) {
-                const fn = str.replace("js/", "");
-                return this.runJs(fn, ctx, data, ctx.func, ctx.vars);
-            }
+            return this.runJs(expression, ctx, data, (ctx.func ?? {}), (ctx.vars ?? {}));
         }
-        catch (error) {
-            console.log("Mapper Error 2", error);
+        catch (cause) {
+            const stepCtx = readStepContext(ctx);
+            const error = new MapperResolutionError(buildErrorMessage({ expression, syntax: "js", ...stepCtx, cause }), {
+                expression,
+                syntax: "js",
+                ...stepCtx,
+                cause,
+            });
+            this.handleResolutionError(ctx, error);
+            return str; // pre-v0.3.x behavior — pass through the literal string
         }
-        return str;
+    }
+    /**
+     * Apply the configured mode (`BLOK_MAPPER_MODE`) to a resolution
+     * failure. In strict mode, the error escapes here and propagates
+     * up through `replaceString` → `NodeBase.blueprintMapper` →
+     * `NodeBase.process` → step error envelope.
+     */
+    handleResolutionError(ctx, error) {
+        const mode = readMode();
+        if (mode === "strict")
+            throw error;
+        if (mode === "silent")
+            return;
+        // mode === "warn"
+        logViaCtxOrConsole(ctx, error.message);
+    }
+    /**
+     * Sandboxed JS evaluation. Compiles the expression as a function
+     * body returning the expression value; binds `ctx`, `data`, `func`,
+     * `vars` as positional arguments; runs in `"use strict"` mode.
+     *
+     * Throws on any evaluation error (typo, undefined access, syntax,
+     * unknown identifier). Callers wrap in try/catch and translate to
+     * `MapperResolutionError`.
+     *
+     * Public via the prototype but documented as internal — the only
+     * supported call sites are inside this class.
+     */
+    runJs(str, ctx, data = {}, func = {}, vars = {}) {
+        // Function constructor (NOT eval) — creates a fresh function
+        // scope without lexical access to the surrounding module. Same
+        // security profile as the v1 implementation.
+        return Function("ctx", "data", "func", "vars", `"use strict";return (${str});`)(ctx, data, func, vars);
     }
 }
 export default new Mapper();

package/dist/utils/Mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"Mapper.js","sourceRoot":"","sources":["../../src/utils/Mapper.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AAMvB,MAAM,MAAM;IACJ,oBAAoB,CAAC,GAAqB,EAAE,GAAY,EAAE,IAAsB;QACtF,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjD,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACtC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7C,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAEM,aAAa,GAAG,CAAC,OAAe,EAAE,GAAY,EAAE,IAAsB,EAAE,EAAE;QAChF,IAAI,GAAG,GAAG,OAAO,CAAC;QAElB,4BAA4B;QAC5B,sCAAsC;QACtC,IAAI;QACJ,MAAM,KAAK,GAAG,YAAY,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,IAAI,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACxD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;oBAC7D,mFAAmF;oBACnF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAe,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;QACF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAW,CAAC;QACvD,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IAEM,KAAK,CACZ,GAAW,EACX,GAAY,EACZ,OAAyB,EAAE,EAC3B,OAAwB,EAAE,EAC1B,OAAoB,EAAE;QAEtB,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxG,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAY,EAAE,IAAsB;QACjE,IAAI,CAAC;YACJ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;CACD;AAED,eAAe,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"Mapper.js","sourceRoot":"","sources":["../../src/utils/Mapper.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AAKvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAkEhE,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAEvF,SAAS,QAAQ;IAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,GAAyC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAA2C,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAM1B;IACA,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,GAAG,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG;QACb,sCAAsC,OAAO,eAAe,IAAI,kBAAkB,EAAE,GAAG;QACvF,iBAAiB,QAAQ,EAAE;KAC3B,CAAC;IACF,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CACT,mIAAmI,CACnI,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAkB,EAAE,YAAoB;IAC1D,yEAAyE;IACzE,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CACpC,oFAAoF,CACpF,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC;QAC7D,OAAO,cAAc,MAAM,sCAAsC,IAAI,+GAA+G,CAAC;IACtL,CAAC;IACD,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,sFAAsF,CAAC;IAC/G,CAAC;IACD,gBAAgB;IAChB,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,OAAO,sGAAsG,CAAC;IAC/G,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAKP,CAAC;IACb,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC;YACJ,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,MAAM,CAAC;YACR,wEAAwE;QACzE,CAAC;IACF,CAAC;IACD,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO;QACR,CAAC;QAAC,MAAM,CAAC;YACR,eAAe;QAChB,CAAC;IACF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;QACrE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,MAAM,MAAM;IACX;;;;;;;;;OASG;IACI,oBAAoB,CAAC,GAAqB,EAAE,GAAY,EAAE,IAAsB;QACtF,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC/B,qDAAqD;oBACrD,uDAAuD;oBACvD,qDAAqD;oBACrD,+CAA+C;oBAC/C,oDAAoD;oBACpD,mDAAmD;oBACnD,qDAAqD;oBACrD,4BAA4B;oBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAsB,CAAC;gBACtE,CAAC;qBAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxD,IAAI,CAAC,oBAAoB,CAAC,KAAoC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5E,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACI,aAAa,GAAG,CAAC,OAAe,EAAE,GAAY,EAAE,IAAsB,EAAW,EAAE;QACzF,IAAI,GAAG,GAAG,OAAO,CAAC;QAElB,8CAA8C;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;gBACrD,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7D,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;oBAC1C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvD,CAAC;gBACD,wDAAwD;gBACxD,yDAAyD;gBACzD,6BAA6B;YAC9B,CAAC;QACF,CAAC;QAED,6CAA6C;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF;;;;OAIG;IACK,yBAAyB,CAChC,GAAW,EACX,GAAY,EACZ,IAAsB;QAEtB,8DAA8D;QAC9D,gEAAgE;QAChE,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QAElD,kEAAkE;QAClE,gEAAgE;QAChE,oDAAoD;QACpD,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAoB,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgB,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CACtC,iBAAiB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAC7E,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAC1D,CAAC;YACF,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,OAAO,0BAA0B,CAAC;QACnC,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,GAAW,EAAE,GAAY,EAAE,IAAsB;QACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAClE,sDAAsD;QACtD,6DAA6D;QAC7D,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAoB,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgB,CAAC,CAAC;QAChH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;gBAC3G,UAAU;gBACV,MAAM,EAAE,IAAI;gBACZ,GAAG,OAAO;gBACV,KAAK;aACL,CAAC,CAAC;YACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,OAAO,GAAG,CAAC,CAAC,wDAAwD;QACrE,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,GAAY,EAAE,KAA4B;QACvE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9B,kBAAkB;QAClB,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CACZ,GAAW,EACX,GAAY,EACZ,OAAyB,EAAE,EAC3B,OAAwB,EAAE,EAC1B,OAAoB,EAAE;QAEtB,6DAA6D;QAC7D,+DAA+D;QAC/D,6CAA6C;QAC7C,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxG,CAAC;CACD;AAED,eAAe,IAAI,MAAM,EAAE,CAAC"}