@n8n/expression-runtime 0.14.0 → 0.14.1

package/dist/esm/runtime/jmespath.d.ts

@@ -0,0 +1,22 @@
+/**
+ * In-isolate `$jmespath` / `$jmesPath` implementation.
+ *
+ * Mirrors the host-side wrapper in `packages/workflow/src/workflow-data-proxy.ts`
+ * so that expressions resolve `$jmespath` from the in-isolate runtime via
+ * Tournament's polyfill, instead of falling through to the bridge's
+ * `callFunctionAtPath` channel. This shrinks the host-callable surface
+ * exposed by the data object.
+ *
+ * Behavioural parity with the host wrapper:
+ *   - Throws `ExpressionError` (same name) when args are wrong.
+ *   - Rejects queries that contain unsafe property tokens.
+ *   - Spreads non-array, non-null objects to drop proxies at the top level.
+ *
+ * Note on lazy proxies: when `data` is a lazy proxy (e.g. `$json`), each
+ * property access during `jmespath.search` triggers a synchronous host
+ * roundtrip via `getValueAtPath`. Functional but slow for deep traversals.
+ * Performance optimisation (e.g. bulk pre-fetch of the queried subtree) is
+ * a follow-up.
+ */
+export declare function jmesPath(data: unknown, query: string): unknown;
+//# sourceMappingURL=jmespath.d.ts.map

package/dist/esm/runtime/jmespath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jmespath.d.ts","sourceRoot":"","sources":["../../../src/runtime/jmespath.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB9D"}

package/dist/esm/runtime/jmespath.js

@@ -0,0 +1,66 @@
+import * as jmespath from 'jmespath';
+import { ExpressionError } from './safe-globals';
+const unsafeJmespathProperties = [
+    '__proto__',
+    'prototype',
+    'constructor',
+    'getPrototypeOf',
+    'setPrototypeOf',
+    'getOwnPropertyDescriptor',
+    'getOwnPropertyDescriptors',
+    'defineProperty',
+    'defineProperties',
+    'mainModule',
+    'binding',
+    '_linkedBinding',
+    '_load',
+    'prepareStackTrace',
+    '__lookupGetter__',
+    '__lookupSetter__',
+    '__defineGetter__',
+    '__defineSetter__',
+    'caller',
+    'arguments',
+    'getBuiltinModule',
+    'dlopen',
+    'execve',
+    'loadEnvFile',
+];
+const unsafeJmespathPropertyPattern = new RegExp(`\\b(?:${unsafeJmespathProperties.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})\\b`);
+/**
+ * In-isolate `$jmespath` / `$jmesPath` implementation.
+ *
+ * Mirrors the host-side wrapper in `packages/workflow/src/workflow-data-proxy.ts`
+ * so that expressions resolve `$jmespath` from the in-isolate runtime via
+ * Tournament's polyfill, instead of falling through to the bridge's
+ * `callFunctionAtPath` channel. This shrinks the host-callable surface
+ * exposed by the data object.
+ *
+ * Behavioural parity with the host wrapper:
+ *   - Throws `ExpressionError` (same name) when args are wrong.
+ *   - Rejects queries that contain unsafe property tokens.
+ *   - Spreads non-array, non-null objects to drop proxies at the top level.
+ *
+ * Note on lazy proxies: when `data` is a lazy proxy (e.g. `$json`), each
+ * property access during `jmespath.search` triggers a synchronous host
+ * roundtrip via `getValueAtPath`. Functional but slow for deep traversals.
+ * Performance optimisation (e.g. bulk pre-fetch of the queried subtree) is
+ * a follow-up.
+ */
+export function jmesPath(data, query) {
+    if (typeof data !== 'object' || typeof query !== 'string') {
+        throw new ExpressionError('expected two arguments (Object, string) for this function');
+    }
+    // jmespath decodes escape sequences inside quoted identifiers, so the
+    // token check must run against an unescaped query. Reject any backslash
+    // up front to keep the property-name match meaningful.
+    if (query.includes('\\') || unsafeJmespathPropertyPattern.test(query)) {
+        throw new ExpressionError('Cannot access this property in a jmespath query due to security concerns');
+    }
+    if (data !== null && !Array.isArray(data) && typeof data === 'object') {
+        return jmespath.search({ ...data }, query);
+    }
+    // Array or null — pass through to jmespath which accepts both
+    return jmespath.search(data, query);
+}
+//# sourceMappingURL=jmespath.js.map

package/dist/esm/runtime/jmespath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jmespath.js","sourceRoot":"","sources":["../../../src/runtime/jmespath.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,wBAAwB,GAAG;IAChC,WAAW;IACX,WAAW;IACX,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,0BAA0B;IAC1B,2BAA2B;IAC3B,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;IACR,WAAW;IACX,kBAAkB;IAClB,QAAQ;IACR,QAAQ;IACR,aAAa;CACb,CAAC;AAEF,MAAM,6BAA6B,GAAG,IAAI,MAAM,CAC/C,SAAS,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CACtG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,KAAa;IACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,2DAA2D,CAAC,CAAC;IACxF,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CACxB,0EAA0E,CAC1E,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAI,IAAgC,EAAE,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,8DAA8D;IAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAa,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n8n/expression-runtime",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Secure, isolated expression evaluation runtime for n8n",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -31,8 +31,8 @@
     "md5": "2.3.0",
     "title-case": "3.0.3",
     "transliteration": "2.3.5",
-    "@n8n/errors": "0.8.0",
-    "@n8n/tournament": "1.2.0"
+    "@n8n/tournament": "1.2.0",
+    "@n8n/errors": "0.8.0"
   },
   "devDependencies": {
     "@types/lodash": "4.17.17",