@decaf-ts/integrations 0.3.10 → 0.3.11

package/lib/types/graph/shared/nodes/flow-control.d.mts

@@ -94,13 +94,14 @@ export declare class ReturnFlowNode extends Model {
     result: unknown;
 }
 /**
- * Code — sandboxed JS/TS code execution (ALFRED-5 §7).
+ * Code — sandboxed JS/TS code execution (ALFRED-5 §7, DECAF-32 §22.4).
  *
- * The engine does not implement the sandbox directly (§22.4). A future
- * executor may wrap the `CodeSandbox` contract (ALFRED-5 §7.17) as a
- * pluggable executor. The placeholder syntax (`{{ $input }}`, `{{ $item }}`,
- * `{{ $index }}`, `{{ $vars }}`, `{{ $node["Name"].output }}`) is Mastra-
- * agnostic and lives in the downstream project's `modules/core` (ALFRED-6).
+ * The engine's {@link CodeGraphNodeExecutor} delegates to the pluggable
+ * {@link CodeSandboxEvaluator}. The default
+ * `IsolatedVmCodeSandboxEvaluator` (backed by `isolated-vm`) enforces the
+ * Code Node restrictions: no imports, no requires, pure functions only. The
+ * sandbox context exposes `$input`, `$vars`, `$item`, `$index`, `$node`, and
+ * `$output` as data variables. TypeScript is supported via transpilation.
  */
 export declare class CodeFlowNode extends Model {
     input: unknown;

package/lib/types/index.d.cts

@@ -6,6 +6,6 @@
 export * from "./utils.d.cts";
 export * from "./namespaces/index.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "1deb3bb";
-export declare const FULL_VERSION = "0.3.9-1deb3bb";
+export declare const COMMIT = "857014d";
+export declare const FULL_VERSION = "0.3.10-857014d";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -6,6 +6,6 @@
 export * from "./utils.d.mts";
 export * from "./namespaces/index.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "1deb3bb";
-export declare const FULL_VERSION = "0.3.9-1deb3bb";
+export declare const COMMIT = "857014d";
+export declare const FULL_VERSION = "0.3.10-857014d";
 export declare const PACKAGE_NAME: string;

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.cts

@@ -7,7 +7,7 @@
  * the loop kinds. Additional executors can be registered on the returned
  * registry before it is handed to the {@link GraphExecutionEngine}.
  */
-import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor } from "../../graph/index.d.cts";
+import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor, IsolatedVmCodeSandboxEvaluator } from "../../graph/index.d.cts";
 /**
  * Builds a {@link GraphNodeExecutorRegistry} populated with the demo executors.
  *
@@ -21,7 +21,9 @@ import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor
  * - `graph-intake-workflow`, `graph-planning-pipeline`, `graph-draft-node`,
  *   `graph-review-node`, `graph-publish-workflow` — publishing workflow demo.
  * - `core.flow.*` — flow-control kinds (map, delay, return, merge, if, switch,
- *   parallel, errorBoundary, humanApproval, code).
+ *   parallel, errorBoundary, humanApproval). The `core.flow.code` kind is
+ *   registered in `onEngineCreated` via the real {@link CodeGraphNodeExecutor}
+ *   because it needs the engine's `codeSandboxEvaluator`.
  * - `core.agent` — agent node.
  * - `core.loop.foreach`, `core.loop.while`, `core.loop.until` — loop executors
  *   (registered after the engine is created via `onEngineCreated`).
@@ -32,7 +34,11 @@ import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor
 export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;
 /**
  * Builds a {@link GraphExecutionEngineConfig} populated with all demo executors
- * including loop executors that need a back-reference to the engine.
+ * including loop executors that need a back-reference to the engine and the
+ * Code node executor that needs the engine's `codeSandboxEvaluator`.
+ *
+ * The config wires an {@link IsolatedVmCodeSandboxEvaluator} (backed by
+ * `isolated-vm`) so the Code Node runs in a truly isolated V8 sandbox.
  *
  * @returns A config object ready for `new GraphExecutionEngine(config)`.
  */
@@ -41,5 +47,6 @@ export declare function createDemoEngineConfig(): {
     defaultOptions: {
         failFast: boolean;
     };
+    codeSandboxEvaluator: IsolatedVmCodeSandboxEvaluator;
     onEngineCreated: (engine: GraphExecutionEngine) => void;
 };

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.mts

@@ -7,7 +7,7 @@
  * the loop kinds. Additional executors can be registered on the returned
  * registry before it is handed to the {@link GraphExecutionEngine}.
  */
-import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor } from "../../graph/index.d.mts";
+import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor, IsolatedVmCodeSandboxEvaluator } from "../../graph/index.d.mts";
 /**
  * Builds a {@link GraphNodeExecutorRegistry} populated with the demo executors.
  *
@@ -21,7 +21,9 @@ import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor
  * - `graph-intake-workflow`, `graph-planning-pipeline`, `graph-draft-node`,
  *   `graph-review-node`, `graph-publish-workflow` — publishing workflow demo.
  * - `core.flow.*` — flow-control kinds (map, delay, return, merge, if, switch,
- *   parallel, errorBoundary, humanApproval, code).
+ *   parallel, errorBoundary, humanApproval). The `core.flow.code` kind is
+ *   registered in `onEngineCreated` via the real {@link CodeGraphNodeExecutor}
+ *   because it needs the engine's `codeSandboxEvaluator`.
  * - `core.agent` — agent node.
  * - `core.loop.foreach`, `core.loop.while`, `core.loop.until` — loop executors
  *   (registered after the engine is created via `onEngineCreated`).
@@ -32,7 +34,11 @@ import { GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor
 export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;
 /**
  * Builds a {@link GraphExecutionEngineConfig} populated with all demo executors
- * including loop executors that need a back-reference to the engine.
+ * including loop executors that need a back-reference to the engine and the
+ * Code node executor that needs the engine's `codeSandboxEvaluator`.
+ *
+ * The config wires an {@link IsolatedVmCodeSandboxEvaluator} (backed by
+ * `isolated-vm`) so the Code Node runs in a truly isolated V8 sandbox.
  *
  * @returns A config object ready for `new GraphExecutionEngine(config)`.
  */
@@ -41,5 +47,6 @@ export declare function createDemoEngineConfig(): {
     defaultOptions: {
         failFast: boolean;
     };
+    codeSandboxEvaluator: IsolatedVmCodeSandboxEvaluator;
     onEngineCreated: (engine: GraphExecutionEngine) => void;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decaf-ts/integrations",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.mts",
@@ -293,9 +293,13 @@
     "@decaf-ts/logging": "latest",
     "@decaf-ts/transactional-decorators": "latest",
     "@decaf-ts/ui-decorators": "latest",
+    "acorn": "^8.17.0",
+    "acorn-walk": "^8.3.5",
     "axios": "^1.7.9",
+    "isolated-vm": "^6.1.2",
     "node-fetch": "^3.3.2",
     "tslib": "^2.8.1",
+    "typescript": "^5.9.3",
     "uuid": "^11.1.1"
   },
   "devDependencies": {