@n8n/expression-runtime 0.2.0 → 0.4.0

package/dist/esm/runtime/safe-globals.js

@@ -0,0 +1,110 @@
+// ============================================================================
+// Safe Wrappers for Security-Sensitive Globals
+// ============================================================================
+/**
+ * SafeObject - Blocks dangerous Object methods that could lead to RCE
+ *
+ * Blocked methods:
+ * - defineProperty, setPrototypeOf: Prevent prototype pollution
+ * - getOwnPropertyDescriptor: Prevent property descriptor manipulation
+ * - __defineGetter__, __defineSetter__: Legacy descriptor manipulation
+ */
+export const SafeObject = new Proxy(Object, {
+    get(target, prop) {
+        // Block dangerous methods (return undefined)
+        const blockedMethods = [
+            'defineProperty',
+            'defineProperties',
+            'setPrototypeOf',
+            'getOwnPropertyDescriptor',
+            'getOwnPropertyDescriptors',
+            '__defineGetter__',
+            '__defineSetter__',
+            '__lookupGetter__',
+            '__lookupSetter__',
+        ];
+        if (blockedMethods.includes(prop)) {
+            return undefined;
+        }
+        // Block getPrototypeOf by throwing (more secure than returning undefined)
+        if (prop === 'getPrototypeOf') {
+            throw new Error('Object.getPrototypeOf is not allowed');
+        }
+        // Allow other Object methods
+        const value = target[prop];
+        if (typeof value === 'function') {
+            // Use arrow function wrapper to preserve 'this' binding
+            return (...args) => value.apply(target, args);
+        }
+        return value;
+    },
+});
+/**
+ * SafeError - Blocks stack manipulation methods
+ *
+ * Blocked properties:
+ * - stackTraceLimit, captureStackTrace, prepareStackTrace: Prevent stack manipulation attacks
+ */
+export const SafeError = new Proxy(Error, {
+    get(target, prop) {
+        // Block stack manipulation (return undefined)
+        const blockedProps = ['stackTraceLimit', 'captureStackTrace', 'prepareStackTrace'];
+        if (blockedProps.includes(prop)) {
+            return undefined;
+        }
+        // Block dangerous methods
+        const blockedMethods = ['__defineGetter__', '__defineSetter__'];
+        if (blockedMethods.includes(prop)) {
+            return undefined;
+        }
+        const value = target[prop];
+        if (typeof value === 'function') {
+            return (...args) => value.apply(target, args);
+        }
+        return value;
+    },
+    set(target, prop, value) {
+        // Block setting prepareStackTrace
+        if (prop === 'prepareStackTrace') {
+            return false;
+        }
+        target[prop] = value;
+        return true;
+    },
+});
+// ============================================================================
+// ExpressionError - used by tournament-generated error handlers
+// ============================================================================
+export class ExpressionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ExpressionError';
+    }
+}
+// ============================================================================
+// Runtime sanitizer for dynamic property access
+// Generated by PrototypeSanitizer: obj[expr] → obj[this.__sanitize(expr)]
+// Must match the blocklist in packages/workflow/src/expression-sandboxing.ts
+// ============================================================================
+const unsafeObjectProperties = new Set([
+    '__proto__',
+    'prototype',
+    'constructor',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+    'toString',
+    'valueOf',
+    'toLocaleString',
+    'hasOwnProperty',
+    'isPrototypeOf',
+    'propertyIsEnumerable',
+]);
+export function __sanitize(value) {
+    if (typeof value === 'string' && unsafeObjectProperties.has(value)) {
+        throw new ExpressionError(`Cannot access "${value}" due to security concerns`);
+    }
+    return value;
+}
+//# sourceMappingURL=safe-globals.js.map

package/dist/esm/runtime/safe-globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-globals.js","sourceRoot":"","sources":["../../../src/runtime/safe-globals.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE;IAC3C,GAAG,CAAC,MAAM,EAAE,IAAI;QACf,6CAA6C;QAC7C,MAAM,cAAc,GAAG;YACtB,gBAAgB;YAChB,kBAAkB;YAClB,gBAAgB;YAChB,0BAA0B;YAC1B,2BAA2B;YAC3B,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;SAClB,CAAC;QAEF,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzD,CAAC;QAED,6BAA6B;QAC7B,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACjC,wDAAwD;YACxD,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;CACD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE;IACzC,GAAG,CAAC,MAAM,EAAE,IAAI;QACf,8CAA8C;QAC9C,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,0BAA0B;QAC1B,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QAChE,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;QACtB,kCAAkC;QAClC,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACA,MAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,gEAAgE;AAChE,+EAA+E;AAE/E,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAED,+EAA+E;AAC/E,gDAAgD;AAChD,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAE/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,WAAW;IACX,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,UAAU;IACV,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,sBAAsB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,eAAe,CAAC,kBAAkB,KAAK,4BAA4B,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/esm/types/bridge.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Abstract interface for runtime bridges.
+ *
+ * A bridge manages communication between the host process and the isolated context.
+ * Different bridge implementations support different isolation mechanisms:
+ * - IsolatedVmBridge: Uses isolated-vm for Node.js backend (secure isolation with memory limits)
+ * - WebWorkerBridge: Uses Web Workers for browser frontend (Phase 2+)
+ * - Task Runner: TBD - May use IsolatedVmBridge locally or direct evaluation (Phase 2+)
+ */
+export interface RuntimeBridge {
+    /**
+     * Initialize the isolated context and load runtime code.
+     * Must be called before any execute() calls.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Execute JavaScript code in the isolated context.
+     *
+     * @param code - Transformed JavaScript code to execute
+     * @param data - Workflow data proxy from WorkflowDataProxy.getDataProxy()
+     * @returns Result of the expression evaluation.
+     *          Must be JSON-serializable (no functions, symbols, etc.)
+     *
+     * Note: Synchronous for Node.js vm module (Slice 1).
+     *       Will be async for isolated-vm (Slice 2).
+     */
+    execute(code: string, data: Record<string, unknown>): unknown;
+    /**
+     * Dispose of the isolated context and free resources.
+     * After disposal, the bridge cannot be used again.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Check if the bridge has been disposed.
+     * Disposed bridges cannot execute code.
+     */
+    isDisposed(): boolean;
+}
+/**
+ * Configuration for runtime bridges.
+ */
+export interface BridgeConfig {
+    /**
+     * Memory limit in MB for isolated context.
+     * Default: 128MB
+     */
+    memoryLimit?: number;
+    /**
+     * Timeout in milliseconds for expression execution.
+     * Default: 5000ms
+     */
+    timeout?: number;
+    /**
+     * Enable debug mode (inspector protocol).
+     * Default: false
+     *
+     * Phase 2+: Chrome DevTools debugging support
+     */
+    debug?: boolean;
+}
+/** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+export declare const DEFAULT_BRIDGE_CONFIG: Required<BridgeConfig>;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/esm/types/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;IAE9D;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAIxD,CAAC"}

package/dist/{types → esm/types}/bridge.js

@@ -4,5 +4,10 @@
 // This is the main interface all environments must implement.
 // Start here for CLI/backend (IsolatedVmBridge) or frontend (WebWorkerBridge).
 // ============================================================================
-export {};
+/** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+export const DEFAULT_BRIDGE_CONFIG = {
+    memoryLimit: 128,
+    timeout: 5000,
+    debug: false,
+};
 //# sourceMappingURL=bridge.js.map

package/dist/esm/types/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,8DAA8D;AAC9D,+EAA+E;AAC/E,+EAA+E;AAqE/E,iGAAiG;AACjG,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC5D,WAAW,EAAE,GAAG;IAChB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,KAAK;CACZ,CAAC"}

package/dist/esm/types/evaluator.d.ts

@@ -0,0 +1,194 @@
+import type { TournamentHooks } from '@n8n/tournament';
+import type { RuntimeBridge } from './bridge';
+/**
+ * Configuration for ExpressionEvaluator.
+ *
+ * Note: Slice 1 keeps this minimal. Tournament integration and code caching
+ * will be added in later slices.
+ */
+export interface EvaluatorConfig {
+    /**
+     * Runtime bridge implementation.
+     */
+    bridge: RuntimeBridge;
+    /**
+     * Observability provider for metrics, traces, and logs.
+     */
+    observability?: ObservabilityProvider;
+    /**
+     * AST security hooks for tournament expression transformation.
+     * Provided by the caller (e.g., workflow package's expression-sandboxing.ts).
+     * If omitted, expressions are transformed with no security hooks (dev/testing use).
+     */
+    hooks?: TournamentHooks;
+}
+/**
+ * Expression evaluator - main public API.
+ *
+ * This is the primary interface used by the workflow package.
+ */
+export interface IExpressionEvaluator {
+    /**
+     * Initialize the evaluator and bridge.
+     * Must be called before evaluate().
+     */
+    initialize(): Promise<void>;
+    /**
+     * Evaluate an expression string against workflow data.
+     *
+     * @param expression - Expression string (e.g., "{{ $json.email }}")
+     * @param data - Workflow data context
+     * @param options - Evaluation options
+     * @returns Result of the expression
+     *
+     * Note: Synchronous for Slice 1 (Node.js vm module).
+     *       Will be async for Slice 2 (isolated-vm).
+     */
+    evaluate(expression: string, data: WorkflowData, options?: EvaluateOptions): unknown;
+    /**
+     * Dispose of the evaluator and free resources.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Check if the evaluator has been disposed.
+     */
+    isDisposed(): boolean;
+}
+/**
+ * Workflow data proxy from WorkflowDataProxy.getDataProxy().
+ *
+ * For Slice 1: We pass this directly via VM context (simple pass-through).
+ * Later: Will implement deep lazy proxy for field-level data fetching.
+ */
+export type WorkflowData = Record<string, unknown>;
+/**
+ * Options for evaluate().
+ */
+/**
+ * Options for evaluate().
+ *
+ * Note: Slice 1 is minimal. Tournament options will be added later.
+ */
+export interface EvaluateOptions {
+    /**
+     * Custom timeout for this evaluation (in milliseconds).
+     * Overrides the bridge's default timeout.
+     */
+    timeout?: number;
+}
+/**
+ * Observability provider interface.
+ *
+ * Implementations: NoOpProvider, OpenTelemetryProvider, PostHogProvider
+ */
+export interface ObservabilityProvider {
+    /**
+     * Metrics API.
+     */
+    metrics: MetricsAPI;
+    /**
+     * Traces API.
+     */
+    traces: TracesAPI;
+    /**
+     * Logs API.
+     */
+    logs: LogsAPI;
+}
+/**
+ * Metrics API.
+ */
+export interface MetricsAPI {
+    /**
+     * Increment a counter.
+     */
+    counter(name: string, value: number, tags?: Record<string, string>): void;
+    /**
+     * Set a gauge value.
+     */
+    gauge(name: string, value: number, tags?: Record<string, string>): void;
+    /**
+     * Record a histogram value.
+     */
+    histogram(name: string, value: number, tags?: Record<string, string>): void;
+}
+/**
+ * Traces API.
+ */
+export interface TracesAPI {
+    /**
+     * Start a new span.
+     */
+    startSpan(name: string, attributes?: Record<string, unknown>): Span;
+}
+/**
+ * Span interface.
+ */
+export interface Span {
+    /**
+     * Set span status.
+     */
+    setStatus(status: 'ok' | 'error'): void;
+    /**
+     * Set span attribute.
+     */
+    setAttribute(key: string, value: unknown): void;
+    /**
+     * Record an exception.
+     */
+    recordException(error: Error): void;
+    /**
+     * End the span.
+     */
+    end(): void;
+}
+/**
+ * Logs API.
+ */
+export interface LogsAPI {
+    /**
+     * Log an error.
+     */
+    error(message: string, error?: Error, context?: Record<string, unknown>): void;
+    /**
+     * Log a warning.
+     */
+    warn(message: string, context?: Record<string, unknown>): void;
+    /**
+     * Log info.
+     */
+    info(message: string, context?: Record<string, unknown>): void;
+    /**
+     * Log debug.
+     */
+    debug(message: string, context?: Record<string, unknown>): void;
+}
+/**
+ * Expression evaluation error.
+ */
+export declare class ExpressionError extends Error {
+    context: {
+        expression?: string;
+        workflowId?: string;
+        nodeId?: string;
+        [key: string]: unknown;
+    };
+    constructor(message: string, context: {
+        expression?: string;
+        workflowId?: string;
+        nodeId?: string;
+        [key: string]: unknown;
+    });
+}
+/**
+ * Specific error types.
+ */
+export declare class MemoryLimitError extends ExpressionError {
+}
+export declare class TimeoutError extends ExpressionError {
+}
+export declare class SecurityViolationError extends ExpressionError {
+}
+export declare class SyntaxError extends ExpressionError {
+}
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/esm/types/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;OAEG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAEtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC;IAErF;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;GAEG;AACH;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE1E;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAExE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5E;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAExC;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAEhD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAEpC;;OAEG;IACH,GAAG,IAAI,IAAI,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/E;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAChE;AASD;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAGjC,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;gBAND,OAAO,EAAE,MAAM,EACR,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;CAKF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;CAAG;AACxD,qBAAa,YAAa,SAAQ,eAAe;CAAG;AACpD,qBAAa,sBAAuB,SAAQ,eAAe;CAAG;AAC9D,qBAAa,WAAY,SAAQ,eAAe;CAAG"}

package/dist/esm/types/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":"AA8MA,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,0DAA0D;AAC1D,wDAAwD;AACxD,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGjC;IAFR,YACC,OAAe,EACR,OAKN;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QAPR,YAAO,GAAP,OAAO,CAKb;QAGD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;CAAG;AACxD,MAAM,OAAO,YAAa,SAAQ,eAAe;CAAG;AACpD,MAAM,OAAO,sBAAuB,SAAQ,eAAe;CAAG;AAC9D,MAAM,OAAO,WAAY,SAAQ,eAAe;CAAG"}

package/dist/esm/types/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Expression Runtime Types
+ *
+ * This module exports all TypeScript interfaces and types for the expression runtime.
+ */
+export type { RuntimeBridge, BridgeConfig } from './bridge';
+export { DEFAULT_BRIDGE_CONFIG } from './bridge';
+export { RuntimeError } from './runtime';
+export type { EvaluatorConfig, IExpressionEvaluator, WorkflowData, EvaluateOptions, ObservabilityProvider, MetricsAPI, TracesAPI, Span, LogsAPI, } from './evaluator';
+export { ExpressionError, MemoryLimitError, TimeoutError, SecurityViolationError, SyntaxError, } from './evaluator';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,YAAY,EACX,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,IAAI,EACJ,OAAO,GACP,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,WAAW,GACX,MAAM,aAAa,CAAC"}

package/dist/{types → esm/types}/index.js

@@ -3,6 +3,8 @@
  *
  * This module exports all TypeScript interfaces and types for the expression runtime.
  */
+export { DEFAULT_BRIDGE_CONFIG } from './bridge';
+// Runtime types
 export { RuntimeError } from './runtime';
 export { ExpressionError, MemoryLimitError, TimeoutError, SecurityViolationError, SyntaxError, } from './evaluator';
 //# sourceMappingURL=index.js.map

package/dist/esm/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAezC,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,WAAW,GACX,MAAM,aAAa,CAAC"}

package/dist/esm/types/runtime.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Runtime error thrown inside isolated context.
+ *
+ * These errors are thrown by the runtime code when something goes wrong during
+ * expression evaluation. The bridge must catch these and translate them to the
+ * appropriate ExpressionError subclass (see evaluator.ts).
+ *
+ * Translation mapping:
+ * - code: 'MEMORY_LIMIT' → MemoryLimitError
+ * - code: 'TIMEOUT' → TimeoutError
+ * - code: 'SECURITY_VIOLATION' → SecurityViolationError
+ * - code: 'SYNTAX_ERROR' → SyntaxError
+ * - other → ExpressionError
+ */
+export declare class RuntimeError extends Error {
+    code: string;
+    details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/esm/types/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAG9B,IAAI,EAAE,MAAM;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFxC,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKzC"}

package/dist/{types → esm/types}/runtime.js

@@ -1,9 +1,3 @@
-// ============================================================================
-// Phase 1.1: Runtime Interfaces (IMPLEMENT WITH BRIDGE)
-//
-// These interfaces define how the runtime (inside isolation) communicates
-// with the host. Implement these when building the runtime code.
-// ============================================================================
 /**
  * Runtime error thrown inside isolated context.
  *

package/dist/esm/types/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG9B;IACA;IAHR,YACC,OAAe,EACR,IAAY,EACZ,OAAiC;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAA0B;QAGxC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC5B,CAAC;CACD"}

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "@n8n/expression-runtime",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Secure, isolated expression evaluation runtime for n8n",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "dist/cjs/index.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    },
+    "./*": "./*"
+  },
   "keywords": [
     "n8n",
     "expression",
@@ -14,6 +23,8 @@
   ],
   "license": "SEE LICENSE IN LICENSE.md",
   "dependencies": {
+    "@n8n/tournament": "1.0.6",
+    "isolated-vm": "^6.0.2",
     "js-base64": "3.7.2",
     "jssha": "3.3.1",
     "lodash": "4.17.23",
@@ -27,15 +38,27 @@
     "@types/luxon": "3.2.0",
     "@types/md5": "^2.3.5",
     "typescript": "5.9.2",
-    "vitest": "^3.1.3"
+    "vitest": "^3.1.3",
+    "@n8n/typescript-config": "1.3.0"
   },
   "files": [
     "dist",
     "ARCHITECTURE.md",
-    "LICENSE.md"
+    "LICENSE.md",
+    "LICENSE_EE.md"
   ],
+  "homepage": "https://n8n.io",
+  "author": {
+    "name": "Jan Oberhauser",
+    "email": "jan@n8n.io"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/n8n-io/n8n.git"
+  },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc --build tsconfig.build.esm.json tsconfig.build.cjs.json && pnpm build:runtime",
+    "build:runtime": "node esbuild.config.js",
     "test": "vitest run",
     "test:dev": "vitest --watch --silent false",
     "typecheck": "tsc --noEmit"