@n8n/expression-runtime 0.2.0 → 0.4.0

package/dist/cjs/runtime/safe-globals.js

@@ -0,0 +1,125 @@
+// ============================================================================
+// Safe Wrappers for Security-Sensitive Globals
+// ============================================================================
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ExpressionError = exports.SafeError = exports.SafeObject = void 0;
+    exports.__sanitize = __sanitize;
+    /**
+     * SafeObject - Blocks dangerous Object methods that could lead to RCE
+     *
+     * Blocked methods:
+     * - defineProperty, setPrototypeOf: Prevent prototype pollution
+     * - getOwnPropertyDescriptor: Prevent property descriptor manipulation
+     * - __defineGetter__, __defineSetter__: Legacy descriptor manipulation
+     */
+    exports.SafeObject = new Proxy(Object, {
+        get(target, prop) {
+            // Block dangerous methods (return undefined)
+            const blockedMethods = [
+                'defineProperty',
+                'defineProperties',
+                'setPrototypeOf',
+                'getOwnPropertyDescriptor',
+                'getOwnPropertyDescriptors',
+                '__defineGetter__',
+                '__defineSetter__',
+                '__lookupGetter__',
+                '__lookupSetter__',
+            ];
+            if (blockedMethods.includes(prop)) {
+                return undefined;
+            }
+            // Block getPrototypeOf by throwing (more secure than returning undefined)
+            if (prop === 'getPrototypeOf') {
+                throw new Error('Object.getPrototypeOf is not allowed');
+            }
+            // Allow other Object methods
+            const value = target[prop];
+            if (typeof value === 'function') {
+                // Use arrow function wrapper to preserve 'this' binding
+                return (...args) => value.apply(target, args);
+            }
+            return value;
+        },
+    });
+    /**
+     * SafeError - Blocks stack manipulation methods
+     *
+     * Blocked properties:
+     * - stackTraceLimit, captureStackTrace, prepareStackTrace: Prevent stack manipulation attacks
+     */
+    exports.SafeError = new Proxy(Error, {
+        get(target, prop) {
+            // Block stack manipulation (return undefined)
+            const blockedProps = ['stackTraceLimit', 'captureStackTrace', 'prepareStackTrace'];
+            if (blockedProps.includes(prop)) {
+                return undefined;
+            }
+            // Block dangerous methods
+            const blockedMethods = ['__defineGetter__', '__defineSetter__'];
+            if (blockedMethods.includes(prop)) {
+                return undefined;
+            }
+            const value = target[prop];
+            if (typeof value === 'function') {
+                return (...args) => value.apply(target, args);
+            }
+            return value;
+        },
+        set(target, prop, value) {
+            // Block setting prepareStackTrace
+            if (prop === 'prepareStackTrace') {
+                return false;
+            }
+            target[prop] = value;
+            return true;
+        },
+    });
+    // ============================================================================
+    // ExpressionError - used by tournament-generated error handlers
+    // ============================================================================
+    class ExpressionError extends Error {
+        constructor(message) {
+            super(message);
+            this.name = 'ExpressionError';
+        }
+    }
+    exports.ExpressionError = ExpressionError;
+    // ============================================================================
+    // Runtime sanitizer for dynamic property access
+    // Generated by PrototypeSanitizer: obj[expr] → obj[this.__sanitize(expr)]
+    // Must match the blocklist in packages/workflow/src/expression-sandboxing.ts
+    // ============================================================================
+    const unsafeObjectProperties = new Set([
+        '__proto__',
+        'prototype',
+        'constructor',
+        '__defineGetter__',
+        '__defineSetter__',
+        '__lookupGetter__',
+        '__lookupSetter__',
+        'toString',
+        'valueOf',
+        'toLocaleString',
+        'hasOwnProperty',
+        'isPrototypeOf',
+        'propertyIsEnumerable',
+    ]);
+    function __sanitize(value) {
+        if (typeof value === 'string' && unsafeObjectProperties.has(value)) {
+            throw new ExpressionError(`Cannot access "${value}" due to security concerns`);
+        }
+        return value;
+    }
+});
+//# sourceMappingURL=safe-globals.js.map

package/dist/cjs/runtime/safe-globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-globals.js","sourceRoot":"","sources":["../../../src/runtime/safe-globals.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;;;;;;;;;;;;;IAiH/E,gCAKC;IApHD;;;;;;;OAOG;IACU,QAAA,UAAU,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE;QAC3C,GAAG,CAAC,MAAM,EAAE,IAAI;YACf,6CAA6C;YAC7C,MAAM,cAAc,GAAG;gBACtB,gBAAgB;gBAChB,kBAAkB;gBAClB,gBAAgB;gBAChB,0BAA0B;gBAC1B,2BAA2B;gBAC3B,kBAAkB;gBAClB,kBAAkB;gBAClB,kBAAkB;gBAClB,kBAAkB;aAClB,CAAC;YAEF,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC7C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,0EAA0E;YAC1E,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACzD,CAAC;YAED,6BAA6B;YAC7B,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjC,wDAAwD;gBACxD,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;KACD,CAAC,CAAC;IAEH;;;;;OAKG;IACU,QAAA,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE;QACzC,GAAG,CAAC,MAAM,EAAE,IAAI;YACf,8CAA8C;YAC9C,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;YACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,0BAA0B;YAC1B,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YAChE,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC7C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;YACtB,kCAAkC;YAClC,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC;YACd,CAAC;YACA,MAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC,CAAC;IAEH,+EAA+E;IAC/E,gEAAgE;IAChE,+EAA+E;IAE/E,MAAa,eAAgB,SAAQ,KAAK;QACzC,YAAY,OAAe;YAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC/B,CAAC;KACD;IALD,0CAKC;IAED,+EAA+E;IAC/E,gDAAgD;IAChD,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAE/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;QACtC,WAAW;QACX,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,sBAAsB;KACtB,CAAC,CAAC;IAEH,SAAgB,UAAU,CAAC,KAAc;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,eAAe,CAAC,kBAAkB,KAAK,4BAA4B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC"}

package/dist/{types → cjs/types}/bridge.d.ts

@@ -58,4 +58,6 @@ export interface BridgeConfig {
      */
     debug?: boolean;
 }
+/** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+export declare const DEFAULT_BRIDGE_CONFIG: Required<BridgeConfig>;
 //# sourceMappingURL=bridge.d.ts.map

package/dist/cjs/types/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;IAE9D;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAIxD,CAAC"}

package/dist/cjs/types/bridge.js

@@ -0,0 +1,26 @@
+// ============================================================================
+// Phase 1.1: Bridge Interface (CORE - IMPLEMENT FIRST)
+//
+// This is the main interface all environments must implement.
+// Start here for CLI/backend (IsolatedVmBridge) or frontend (WebWorkerBridge).
+// ============================================================================
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DEFAULT_BRIDGE_CONFIG = void 0;
+    /** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+    exports.DEFAULT_BRIDGE_CONFIG = {
+        memoryLimit: 128,
+        timeout: 5000,
+        debug: false,
+    };
+});
+//# sourceMappingURL=bridge.js.map

package/dist/cjs/types/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,8DAA8D;AAC9D,+EAA+E;AAC/E,+EAA+E;;;;;;;;;;;;;IAqE/E,iGAAiG;IACpF,QAAA,qBAAqB,GAA2B;QAC5D,WAAW,EAAE,GAAG;QAChB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;KACZ,CAAC"}

package/dist/{types → cjs/types}/evaluator.d.ts

@@ -1,8 +1,5 @@
+import type { TournamentHooks } from '@n8n/tournament';
 import type { RuntimeBridge } from './bridge';
-export interface TournamentHooks {
-    before?: Array<(ast: unknown) => unknown>;
-    after?: Array<(ast: unknown) => unknown>;
-}
 /**
  * Configuration for ExpressionEvaluator.
  *

package/dist/cjs/types/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;OAEG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAEtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC;IAErF;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;GAEG;AACH;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE1E;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAExE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5E;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAExC;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAEhD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAEpC;;OAEG;IACH,GAAG,IAAI,IAAI,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/E;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAChE;AASD;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAGjC,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;gBAND,OAAO,EAAE,MAAM,EACR,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;CAKF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;CAAG;AACxD,qBAAa,YAAa,SAAQ,eAAe;CAAG;AACpD,qBAAa,sBAAuB,SAAQ,eAAe;CAAG;AAC9D,qBAAa,WAAY,SAAQ,eAAe;CAAG"}

package/dist/cjs/types/evaluator.js

@@ -0,0 +1,47 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SyntaxError = exports.SecurityViolationError = exports.TimeoutError = exports.MemoryLimitError = exports.ExpressionError = void 0;
+    // ============================================================================
+    // Phase 1.4: Error Handling (IMPLEMENT WITH EVALUATOR)
+    //
+    // These error types provide structured error information.
+    // Start with basic Error, add these types in Phase 1.4.
+    // ============================================================================
+    /**
+     * Expression evaluation error.
+     */
+    class ExpressionError extends Error {
+        context;
+        constructor(message, context) {
+            super(message);
+            this.context = context;
+            this.name = 'ExpressionError';
+        }
+    }
+    exports.ExpressionError = ExpressionError;
+    /**
+     * Specific error types.
+     */
+    class MemoryLimitError extends ExpressionError {
+    }
+    exports.MemoryLimitError = MemoryLimitError;
+    class TimeoutError extends ExpressionError {
+    }
+    exports.TimeoutError = TimeoutError;
+    class SecurityViolationError extends ExpressionError {
+    }
+    exports.SecurityViolationError = SecurityViolationError;
+    class SyntaxError extends ExpressionError {
+    }
+    exports.SyntaxError = SyntaxError;
+});
+//# sourceMappingURL=evaluator.js.map

package/dist/cjs/types/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;IA8MA,+EAA+E;IAC/E,uDAAuD;IACvD,EAAE;IACF,0DAA0D;IAC1D,wDAAwD;IACxD,+EAA+E;IAE/E;;OAEG;IACH,MAAa,eAAgB,SAAQ,KAAK;QAGjC;QAFR,YACC,OAAe,EACR,OAKN;YAED,KAAK,CAAC,OAAO,CAAC,CAAC;YAPR,YAAO,GAAP,OAAO,CAKb;YAGD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC/B,CAAC;KACD;IAbD,0CAaC;IAED;;OAEG;IACH,MAAa,gBAAiB,SAAQ,eAAe;KAAG;IAAxD,4CAAwD;IACxD,MAAa,YAAa,SAAQ,eAAe;KAAG;IAApD,oCAAoD;IACpD,MAAa,sBAAuB,SAAQ,eAAe;KAAG;IAA9D,wDAA8D;IAC9D,MAAa,WAAY,SAAQ,eAAe;KAAG;IAAnD,kCAAmD"}

package/dist/{types → cjs/types}/index.d.ts

@@ -4,8 +4,8 @@
  * This module exports all TypeScript interfaces and types for the expression runtime.
  */
 export type { RuntimeBridge, BridgeConfig } from './bridge';
-export type { RuntimeHostInterface, RuntimeGlobals, RuntimeConfig, LazyProxyConfig, } from './runtime';
+export { DEFAULT_BRIDGE_CONFIG } from './bridge';
 export { RuntimeError } from './runtime';
-export type { EvaluatorConfig, IExpressionEvaluator, WorkflowData, EvaluateOptions, ObservabilityProvider, MetricsAPI, TracesAPI, Span, LogsAPI, TournamentHooks, } from './evaluator';
+export type { EvaluatorConfig, IExpressionEvaluator, WorkflowData, EvaluateOptions, ObservabilityProvider, MetricsAPI, TracesAPI, Span, LogsAPI, } from './evaluator';
 export { ExpressionError, MemoryLimitError, TimeoutError, SecurityViolationError, SyntaxError, } from './evaluator';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,YAAY,EACX,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,IAAI,EACJ,OAAO,GACP,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,WAAW,GACX,MAAM,aAAa,CAAC"}

package/dist/cjs/types/index.js

@@ -0,0 +1,30 @@
+/**
+ * Expression Runtime Types
+ *
+ * This module exports all TypeScript interfaces and types for the expression runtime.
+ */
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "./bridge", "./runtime", "./evaluator"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SyntaxError = exports.SecurityViolationError = exports.TimeoutError = exports.MemoryLimitError = exports.ExpressionError = exports.RuntimeError = exports.DEFAULT_BRIDGE_CONFIG = void 0;
+    var bridge_1 = require("./bridge");
+    Object.defineProperty(exports, "DEFAULT_BRIDGE_CONFIG", { enumerable: true, get: function () { return bridge_1.DEFAULT_BRIDGE_CONFIG; } });
+    // Runtime types
+    var runtime_1 = require("./runtime");
+    Object.defineProperty(exports, "RuntimeError", { enumerable: true, get: function () { return runtime_1.RuntimeError; } });
+    var evaluator_1 = require("./evaluator");
+    Object.defineProperty(exports, "ExpressionError", { enumerable: true, get: function () { return evaluator_1.ExpressionError; } });
+    Object.defineProperty(exports, "MemoryLimitError", { enumerable: true, get: function () { return evaluator_1.MemoryLimitError; } });
+    Object.defineProperty(exports, "TimeoutError", { enumerable: true, get: function () { return evaluator_1.TimeoutError; } });
+    Object.defineProperty(exports, "SecurityViolationError", { enumerable: true, get: function () { return evaluator_1.SecurityViolationError; } });
+    Object.defineProperty(exports, "SyntaxError", { enumerable: true, get: function () { return evaluator_1.SyntaxError; } });
+});
+//# sourceMappingURL=index.js.map

package/dist/cjs/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;IAIH,mCAAiD;IAAxC,+GAAA,qBAAqB,OAAA;IAE9B,gBAAgB;IAChB,qCAAyC;IAAhC,uGAAA,YAAY,OAAA;IAerB,yCAMqB;IALpB,4GAAA,eAAe,OAAA;IACf,6GAAA,gBAAgB,OAAA;IAChB,yGAAA,YAAY,OAAA;IACZ,mHAAA,sBAAsB,OAAA;IACtB,wGAAA,WAAW,OAAA"}

package/dist/cjs/types/runtime.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Runtime error thrown inside isolated context.
+ *
+ * These errors are thrown by the runtime code when something goes wrong during
+ * expression evaluation. The bridge must catch these and translate them to the
+ * appropriate ExpressionError subclass (see evaluator.ts).
+ *
+ * Translation mapping:
+ * - code: 'MEMORY_LIMIT' → MemoryLimitError
+ * - code: 'TIMEOUT' → TimeoutError
+ * - code: 'SECURITY_VIOLATION' → SecurityViolationError
+ * - code: 'SYNTAX_ERROR' → SyntaxError
+ * - other → ExpressionError
+ */
+export declare class RuntimeError extends Error {
+    code: string;
+    details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/cjs/types/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAG9B,IAAI,EAAE,MAAM;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFxC,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKzC"}

package/dist/cjs/types/runtime.js

@@ -0,0 +1,39 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RuntimeError = void 0;
+    /**
+     * Runtime error thrown inside isolated context.
+     *
+     * These errors are thrown by the runtime code when something goes wrong during
+     * expression evaluation. The bridge must catch these and translate them to the
+     * appropriate ExpressionError subclass (see evaluator.ts).
+     *
+     * Translation mapping:
+     * - code: 'MEMORY_LIMIT' → MemoryLimitError
+     * - code: 'TIMEOUT' → TimeoutError
+     * - code: 'SECURITY_VIOLATION' → SecurityViolationError
+     * - code: 'SYNTAX_ERROR' → SyntaxError
+     * - other → ExpressionError
+     */
+    class RuntimeError extends Error {
+        code;
+        details;
+        constructor(message, code, details) {
+            super(message);
+            this.code = code;
+            this.details = details;
+            this.name = 'RuntimeError';
+        }
+    }
+    exports.RuntimeError = RuntimeError;
+});
+//# sourceMappingURL=runtime.js.map

package/dist/cjs/types/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;;IAAA;;;;;;;;;;;;;OAaG;IACH,MAAa,YAAa,SAAQ,KAAK;QAG9B;QACA;QAHR,YACC,OAAe,EACR,IAAY,EACZ,OAAiC;YAExC,KAAK,CAAC,OAAO,CAAC,CAAC;YAHR,SAAI,GAAJ,IAAI,CAAQ;YACZ,YAAO,GAAP,OAAO,CAA0B;YAGxC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC5B,CAAC;KACD;IATD,oCASC"}

package/dist/esm/bridge/isolated-vm-bridge.d.ts

@@ -0,0 +1,132 @@
+import type { RuntimeBridge, BridgeConfig } from '../types';
+/**
+ * IsolatedVmBridge - Runtime bridge using isolated-vm for secure expression evaluation.
+ *
+ * This bridge creates a V8 isolate with:
+ * - Hard memory limit (128MB default)
+ * - No access to Node.js APIs
+ * - Timeout enforcement
+ * - Complete isolation from host process
+ *
+ * Context reuse pattern: Create isolate/context once, reset state between evaluations.
+ */
+export declare class IsolatedVmBridge implements RuntimeBridge {
+    private isolate;
+    private context?;
+    private initialized;
+    private disposed;
+    private config;
+    private scriptCache;
+    private valueAtPathRef?;
+    private arrayElementRef?;
+    private callFunctionRef?;
+    constructor(config?: BridgeConfig);
+    /**
+     * Initialize the isolate and create execution context.
+     *
+     * Steps:
+     * 1. Create context
+     * 2. Set up basic globals (global reference)
+     * 3. Load runtime bundle (DateTime, extend, proxy system)
+     * 4. Verify proxy system
+     *
+     * Must be called before execute().
+     */
+    initialize(): Promise<void>;
+    /**
+     * Load runtime bundle into the isolate.
+     *
+     * The runtime bundle includes:
+     * - DateTime, extend, extendOptional (expression engine globals)
+     * - SafeObject and SafeError wrappers
+     * - createDeepLazyProxy function
+     * - __data object initialization
+     *
+     * @private
+     * @throws {Error} If context not initialized or bundle loading fails
+     */
+    private loadVendorLibraries;
+    /**
+     * Verify the proxy system loaded correctly.
+     *
+     * The proxy system is loaded as part of the runtime bundle in loadVendorLibraries().
+     * This method verifies all required components are available.
+     *
+     * @private
+     * @throws {Error} If context not initialized or proxy system verification fails
+     */
+    private verifyProxySystem;
+    /**
+     * Inject the E() error handler into the isolate context.
+     *
+     * Tournament wraps expressions with try-catch that calls E(error, this).
+     * This handler:
+     * - Re-throws security violations from __sanitize
+     * - Swallows TypeErrors (failed attack attempts return undefined)
+     * - Re-throws all other errors
+     *
+     * @private
+     * @throws {Error} If context not initialized
+     */
+    private injectErrorHandler;
+    /**
+     * Reset data proxies in the isolate context.
+     *
+     * This method should be called before each execute() to:
+     * 1. Clear proxy caches from previous evaluations
+     * 2. Initialize fresh workflow data references
+     * 3. Expose workflow properties to globalThis
+     *
+     * The reset function runs in the isolate and calls back to the host
+     * via ivm.Reference callbacks to fetch workflow data.
+     *
+     * @private
+     * @throws {Error} If context not initialized or reset fails
+     */
+    private resetDataProxies;
+    /**
+     * Register callback functions for cross-isolate communication.
+     *
+     * Creates three ivm.Reference callbacks that the runtime bundle uses
+     * to fetch data from the host process:
+     *
+     * - __getValueAtPath: Returns metadata or primitive for a property path
+     * - __getArrayElement: Returns individual array elements
+     * - __callFunctionAtPath: Executes functions in host context
+     *
+     * These callbacks are called synchronously from isolate proxy traps.
+     *
+     * @param data - Current workflow data to use for callback responses
+     * @private
+     */
+    private registerCallbacks;
+    /**
+     * Execute JavaScript code in the isolated context.
+     *
+     * Flow:
+     * 1. Register callbacks as ivm.Reference for cross-isolate communication
+     * 2. Call resetDataProxies() to initialize workflow data proxies
+     * 3. Compile script (with caching for performance)
+     * 4. Execute with timeout enforcement
+     * 5. Return result (copied from isolate)
+     *
+     * @param code - JavaScript expression to evaluate
+     * @param data - Workflow data (e.g., { $json: {...}, $runIndex: 0 })
+     * @returns Result of the expression
+     * @throws {Error} If bridge not initialized or execution fails
+     */
+    execute(code: string, data: Record<string, unknown>): unknown;
+    /**
+     * Dispose of the isolate and free resources.
+     *
+     * After disposal, the bridge cannot be used again.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Check if the bridge has been disposed.
+     *
+     * @returns true if disposed, false otherwise
+     */
+    isDisposed(): boolean;
+}
+//# sourceMappingURL=isolated-vm-bridge.d.ts.map

package/dist/esm/bridge/isolated-vm-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-vm-bridge.d.ts","sourceRoot":"","sources":["../../../src/bridge/isolated-vm-bridge.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA0B5D;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IACrD,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAyB;IAIvC,OAAO,CAAC,WAAW,CAAiC;IAIpD,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,eAAe,CAAC,CAAgB;IACxC,OAAO,CAAC,eAAe,CAAC,CAAgB;gBAE5B,MAAM,GAAE,YAAiB;IAWrC;;;;;;;;;;OAUG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCjC;;;;;;;;;;;OAWG;YACW,mBAAmB;IAoCjC;;;;;;;;OAQG;YACW,iBAAiB;IA+B/B;;;;;;;;;;;OAWG;YACW,kBAAkB;IA0BhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAiIzB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IAsD7D;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB9B;;;;OAIG;IACH,UAAU,IAAI,OAAO;CAGrB"}