@n8n/expression-runtime 0.14.0 → 0.14.1

package/dist/cjs/runtime/jmespath.d.ts

@@ -0,0 +1,22 @@
+/**
+ * In-isolate `$jmespath` / `$jmesPath` implementation.
+ *
+ * Mirrors the host-side wrapper in `packages/workflow/src/workflow-data-proxy.ts`
+ * so that expressions resolve `$jmespath` from the in-isolate runtime via
+ * Tournament's polyfill, instead of falling through to the bridge's
+ * `callFunctionAtPath` channel. This shrinks the host-callable surface
+ * exposed by the data object.
+ *
+ * Behavioural parity with the host wrapper:
+ *   - Throws `ExpressionError` (same name) when args are wrong.
+ *   - Rejects queries that contain unsafe property tokens.
+ *   - Spreads non-array, non-null objects to drop proxies at the top level.
+ *
+ * Note on lazy proxies: when `data` is a lazy proxy (e.g. `$json`), each
+ * property access during `jmespath.search` triggers a synchronous host
+ * roundtrip via `getValueAtPath`. Functional but slow for deep traversals.
+ * Performance optimisation (e.g. bulk pre-fetch of the queried subtree) is
+ * a follow-up.
+ */
+export declare function jmesPath(data: unknown, query: string): unknown;
+//# sourceMappingURL=jmespath.d.ts.map

package/dist/cjs/runtime/jmespath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jmespath.d.ts","sourceRoot":"","sources":["../../../src/runtime/jmespath.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB9D"}

package/dist/cjs/runtime/jmespath.js

@@ -0,0 +1,112 @@
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "jmespath", "./safe-globals"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.jmesPath = jmesPath;
+    const jmespath = __importStar(require("jmespath"));
+    const safe_globals_1 = require("./safe-globals");
+    const unsafeJmespathProperties = [
+        '__proto__',
+        'prototype',
+        'constructor',
+        'getPrototypeOf',
+        'setPrototypeOf',
+        'getOwnPropertyDescriptor',
+        'getOwnPropertyDescriptors',
+        'defineProperty',
+        'defineProperties',
+        'mainModule',
+        'binding',
+        '_linkedBinding',
+        '_load',
+        'prepareStackTrace',
+        '__lookupGetter__',
+        '__lookupSetter__',
+        '__defineGetter__',
+        '__defineSetter__',
+        'caller',
+        'arguments',
+        'getBuiltinModule',
+        'dlopen',
+        'execve',
+        'loadEnvFile',
+    ];
+    const unsafeJmespathPropertyPattern = new RegExp(`\\b(?:${unsafeJmespathProperties.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})\\b`);
+    /**
+     * In-isolate `$jmespath` / `$jmesPath` implementation.
+     *
+     * Mirrors the host-side wrapper in `packages/workflow/src/workflow-data-proxy.ts`
+     * so that expressions resolve `$jmespath` from the in-isolate runtime via
+     * Tournament's polyfill, instead of falling through to the bridge's
+     * `callFunctionAtPath` channel. This shrinks the host-callable surface
+     * exposed by the data object.
+     *
+     * Behavioural parity with the host wrapper:
+     *   - Throws `ExpressionError` (same name) when args are wrong.
+     *   - Rejects queries that contain unsafe property tokens.
+     *   - Spreads non-array, non-null objects to drop proxies at the top level.
+     *
+     * Note on lazy proxies: when `data` is a lazy proxy (e.g. `$json`), each
+     * property access during `jmespath.search` triggers a synchronous host
+     * roundtrip via `getValueAtPath`. Functional but slow for deep traversals.
+     * Performance optimisation (e.g. bulk pre-fetch of the queried subtree) is
+     * a follow-up.
+     */
+    function jmesPath(data, query) {
+        if (typeof data !== 'object' || typeof query !== 'string') {
+            throw new safe_globals_1.ExpressionError('expected two arguments (Object, string) for this function');
+        }
+        // jmespath decodes escape sequences inside quoted identifiers, so the
+        // token check must run against an unescaped query. Reject any backslash
+        // up front to keep the property-name match meaningful.
+        if (query.includes('\\') || unsafeJmespathPropertyPattern.test(query)) {
+            throw new safe_globals_1.ExpressionError('Cannot access this property in a jmespath query due to security concerns');
+        }
+        if (data !== null && !Array.isArray(data) && typeof data === 'object') {
+            return jmespath.search({ ...data }, query);
+        }
+        // Array or null — pass through to jmespath which accepts both
+        return jmespath.search(data, query);
+    }
+});
+//# sourceMappingURL=jmespath.js.map

package/dist/cjs/runtime/jmespath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jmespath.js","sourceRoot":"","sources":["../../../src/runtime/jmespath.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuDA,4BAoBC;IA3ED,mDAAqC;IAErC,iDAAiD;IAEjD,MAAM,wBAAwB,GAAG;QAChC,WAAW;QACX,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,0BAA0B;QAC1B,2BAA2B;QAC3B,gBAAgB;QAChB,kBAAkB;QAClB,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,OAAO;QACP,mBAAmB;QACnB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,QAAQ;QACR,WAAW;QACX,kBAAkB;QAClB,QAAQ;QACR,QAAQ;QACR,aAAa;KACb,CAAC;IAEF,MAAM,6BAA6B,GAAG,IAAI,MAAM,CAC/C,SAAS,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CACtG,CAAC;IAEF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAgB,QAAQ,CAAC,IAAa,EAAE,KAAa;QACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAAe,CAAC,2DAA2D,CAAC,CAAC;QACxF,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,8BAAe,CACxB,0EAA0E,CAC1E,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAI,IAAgC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,8DAA8D;QAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAa,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC"}