@n8n/expression-runtime 0.3.0 → 0.5.0

package/dist/cjs/runtime/safe-globals.js

@@ -0,0 +1,125 @@
+// ============================================================================
+// Safe Wrappers for Security-Sensitive Globals
+// ============================================================================
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ExpressionError = exports.SafeError = exports.SafeObject = void 0;
+    exports.__sanitize = __sanitize;
+    /**
+     * SafeObject - Blocks dangerous Object methods that could lead to RCE
+     *
+     * Blocked methods:
+     * - defineProperty, setPrototypeOf: Prevent prototype pollution
+     * - getOwnPropertyDescriptor: Prevent property descriptor manipulation
+     * - __defineGetter__, __defineSetter__: Legacy descriptor manipulation
+     */
+    exports.SafeObject = new Proxy(Object, {
+        get(target, prop) {
+            // Block dangerous methods (return undefined)
+            const blockedMethods = [
+                'defineProperty',
+                'defineProperties',
+                'setPrototypeOf',
+                'getOwnPropertyDescriptor',
+                'getOwnPropertyDescriptors',
+                '__defineGetter__',
+                '__defineSetter__',
+                '__lookupGetter__',
+                '__lookupSetter__',
+            ];
+            if (blockedMethods.includes(prop)) {
+                return undefined;
+            }
+            // Block getPrototypeOf by throwing (more secure than returning undefined)
+            if (prop === 'getPrototypeOf') {
+                throw new Error('Object.getPrototypeOf is not allowed');
+            }
+            // Allow other Object methods
+            const value = target[prop];
+            if (typeof value === 'function') {
+                // Use arrow function wrapper to preserve 'this' binding
+                return (...args) => value.apply(target, args);
+            }
+            return value;
+        },
+    });
+    /**
+     * SafeError - Blocks stack manipulation methods
+     *
+     * Blocked properties:
+     * - stackTraceLimit, captureStackTrace, prepareStackTrace: Prevent stack manipulation attacks
+     */
+    exports.SafeError = new Proxy(Error, {
+        get(target, prop) {
+            // Block stack manipulation (return undefined)
+            const blockedProps = ['stackTraceLimit', 'captureStackTrace', 'prepareStackTrace'];
+            if (blockedProps.includes(prop)) {
+                return undefined;
+            }
+            // Block dangerous methods
+            const blockedMethods = ['__defineGetter__', '__defineSetter__'];
+            if (blockedMethods.includes(prop)) {
+                return undefined;
+            }
+            const value = target[prop];
+            if (typeof value === 'function') {
+                return (...args) => value.apply(target, args);
+            }
+            return value;
+        },
+        set(target, prop, value) {
+            // Block setting prepareStackTrace
+            if (prop === 'prepareStackTrace') {
+                return false;
+            }
+            target[prop] = value;
+            return true;
+        },
+    });
+    // ============================================================================
+    // ExpressionError - used by tournament-generated error handlers
+    // ============================================================================
+    class ExpressionError extends Error {
+        constructor(message) {
+            super(message);
+            this.name = 'ExpressionError';
+        }
+    }
+    exports.ExpressionError = ExpressionError;
+    // ============================================================================
+    // Runtime sanitizer for dynamic property access
+    // Generated by PrototypeSanitizer: obj[expr] → obj[this.__sanitize(expr)]
+    // Must match the blocklist in packages/workflow/src/expression-sandboxing.ts
+    // ============================================================================
+    const unsafeObjectProperties = new Set([
+        '__proto__',
+        'prototype',
+        'constructor',
+        '__defineGetter__',
+        '__defineSetter__',
+        '__lookupGetter__',
+        '__lookupSetter__',
+        'toString',
+        'valueOf',
+        'toLocaleString',
+        'hasOwnProperty',
+        'isPrototypeOf',
+        'propertyIsEnumerable',
+    ]);
+    function __sanitize(value) {
+        if (typeof value === 'string' && unsafeObjectProperties.has(value)) {
+            throw new ExpressionError(`Cannot access "${value}" due to security concerns`);
+        }
+        return value;
+    }
+});
+//# sourceMappingURL=safe-globals.js.map

package/dist/cjs/runtime/safe-globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-globals.js","sourceRoot":"","sources":["../../../src/runtime/safe-globals.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;;;;;;;;;;;;;IAiH/E,gCAKC;IApHD;;;;;;;OAOG;IACU,QAAA,UAAU,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE;QAC3C,GAAG,CAAC,MAAM,EAAE,IAAI;YACf,6CAA6C;YAC7C,MAAM,cAAc,GAAG;gBACtB,gBAAgB;gBAChB,kBAAkB;gBAClB,gBAAgB;gBAChB,0BAA0B;gBAC1B,2BAA2B;gBAC3B,kBAAkB;gBAClB,kBAAkB;gBAClB,kBAAkB;gBAClB,kBAAkB;aAClB,CAAC;YAEF,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC7C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,0EAA0E;YAC1E,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACzD,CAAC;YAED,6BAA6B;YAC7B,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjC,wDAAwD;gBACxD,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;KACD,CAAC,CAAC;IAEH;;;;;OAKG;IACU,QAAA,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE;QACzC,GAAG,CAAC,MAAM,EAAE,IAAI;YACf,8CAA8C;YAC9C,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;YACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,0BAA0B;YAC1B,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YAChE,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAc,CAAC,EAAE,CAAC;gBAC7C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,MAAM,KAAK,GAAI,MAAc,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;YACtB,kCAAkC;YAClC,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC;YACd,CAAC;YACA,MAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC,CAAC;IAEH,+EAA+E;IAC/E,gEAAgE;IAChE,+EAA+E;IAE/E,MAAa,eAAgB,SAAQ,KAAK;QACzC,YAAY,OAAe;YAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC/B,CAAC;KACD;IALD,0CAKC;IAED,+EAA+E;IAC/E,gDAAgD;IAChD,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAE/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;QACtC,WAAW;QACX,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,sBAAsB;KACtB,CAAC,CAAC;IAEH,SAAgB,UAAU,CAAC,KAAc;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,eAAe,CAAC,kBAAkB,KAAK,4BAA4B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC"}

package/dist/cjs/runtime/serialize.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Prepare a value for transfer across the V8 isolate boundary.
+ *
+ * isolated-vm's `copy: true` uses structured clone, which strips prototypes
+ * from non-standard types. Luxon DateTime/Duration/Interval lose their class
+ * identity and arrive on the host as plain objects.
+ *
+ * This function recursively walks a value and converts types that don't
+ * survive structured clone into their string representations. It runs
+ * inside the isolate before the result is transferred.
+ *
+ * Note: JS Date objects survive structured clone with prototype intact
+ * (Date is a standard structured-cloneable type) and are not converted.
+ *
+ * Circular references are not handled — expression results should not
+ * contain cycles.
+ */
+export declare function __prepareForTransfer(value: unknown): unknown;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/cjs/runtime/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../../src/runtime/serialize.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2B5D"}

package/dist/cjs/runtime/serialize.js

@@ -0,0 +1,67 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "luxon"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.__prepareForTransfer = __prepareForTransfer;
+    const luxon_1 = require("luxon");
+    /** Type guard: plain object with Object.prototype or null prototype. */
+    function isPlainObject(value) {
+        const proto = Object.getPrototypeOf(value);
+        return proto === Object.prototype || proto === null;
+    }
+    /**
+     * Prepare a value for transfer across the V8 isolate boundary.
+     *
+     * isolated-vm's `copy: true` uses structured clone, which strips prototypes
+     * from non-standard types. Luxon DateTime/Duration/Interval lose their class
+     * identity and arrive on the host as plain objects.
+     *
+     * This function recursively walks a value and converts types that don't
+     * survive structured clone into their string representations. It runs
+     * inside the isolate before the result is transferred.
+     *
+     * Note: JS Date objects survive structured clone with prototype intact
+     * (Date is a standard structured-cloneable type) and are not converted.
+     *
+     * Circular references are not handled — expression results should not
+     * contain cycles.
+     */
+    function __prepareForTransfer(value) {
+        if (value === null || value === undefined)
+            return value;
+        if (typeof value !== 'object')
+            return value;
+        // Luxon DateTime -> ISO string (toISO() returns null for invalid DateTime)
+        if (luxon_1.DateTime.isDateTime(value))
+            return value.toISO() ?? null;
+        // Luxon Duration -> ISO string (toISO() returns null for invalid Duration)
+        if (luxon_1.Duration.isDuration(value))
+            return value.toISO() ?? null;
+        // Luxon Interval -> ISO string (toISO() returns "Invalid Interval" for invalid Interval)
+        if (luxon_1.Interval.isInterval(value)) {
+            const iso = value.toISO();
+            return iso === 'Invalid Interval' ? null : iso;
+        }
+        // Array — walk elements
+        if (Array.isArray(value))
+            return value.map(__prepareForTransfer);
+        // Only walk plain objects — structured-cloneable types like Date, Map, Set,
+        // RegExp, Error, typed arrays survive copy:true with prototypes intact.
+        if (!isPlainObject(value))
+            return value;
+        // Plain object — walk values
+        const result = {};
+        for (const key of Object.keys(value)) {
+            result[key] = __prepareForTransfer(value[key]);
+        }
+        return result;
+    }
+});
+//# sourceMappingURL=serialize.js.map

package/dist/cjs/runtime/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../../src/runtime/serialize.ts"],"names":[],"mappings":";;;;;;;;;;;IAyBA,oDA2BC;IApDD,iCAAqD;IAErD,wEAAwE;IACxE,SAAS,aAAa,CAAC,KAAa;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAgB,oBAAoB,CAAC,KAAc;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,2EAA2E;QAC3E,IAAI,gBAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC;QAC7D,2EAA2E;QAC3E,IAAI,gBAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC;QAC7D,yFAAyF;QACzF,IAAI,gBAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAEjE,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAExC,6BAA6B;QAC7B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC"}

package/dist/{types → cjs/types}/bridge.d.ts

@@ -24,7 +24,7 @@ export interface RuntimeBridge {
      * Note: Synchronous for Node.js vm module (Slice 1).
      *       Will be async for isolated-vm (Slice 2).
      */
-    execute(code: string, data: Record<string, unknown>): unknown;
+    execute(code: string, data: Record<string, unknown>, options?: ExecuteOptions): unknown;
     /**
      * Dispose of the isolated context and free resources.
      * After disposal, the bridge cannot be used again.
@@ -58,4 +58,14 @@ export interface BridgeConfig {
      */
     debug?: boolean;
 }
+/** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+export declare const DEFAULT_BRIDGE_CONFIG: Required<BridgeConfig>;
+/** Options for a single execute() call. */
+export interface ExecuteOptions {
+    /**
+     * IANA timezone for this evaluation (e.g., 'America/New_York').
+     * Sets luxon Settings.defaultZone inside the isolate before execution.
+     */
+    timezone?: string;
+}
 //# sourceMappingURL=bridge.d.ts.map

package/dist/cjs/types/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAExF;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAIxD,CAAC;AAEF,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC9B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/cjs/types/bridge.js

@@ -0,0 +1,26 @@
+// ============================================================================
+// Phase 1.1: Bridge Interface (CORE - IMPLEMENT FIRST)
+//
+// This is the main interface all environments must implement.
+// Start here for CLI/backend (IsolatedVmBridge) or frontend (WebWorkerBridge).
+// ============================================================================
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DEFAULT_BRIDGE_CONFIG = void 0;
+    /** Default values for BridgeConfig. Bridge implementations should use this as their baseline. */
+    exports.DEFAULT_BRIDGE_CONFIG = {
+        memoryLimit: 128,
+        timeout: 5000,
+        debug: false,
+    };
+});
+//# sourceMappingURL=bridge.js.map

package/dist/cjs/types/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/types/bridge.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,8DAA8D;AAC9D,+EAA+E;AAC/E,+EAA+E;;;;;;;;;;;;;IAqE/E,iGAAiG;IACpF,QAAA,qBAAqB,GAA2B;QAC5D,WAAW,EAAE,GAAG;QAChB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;KACZ,CAAC"}

package/dist/{types → cjs/types}/evaluator.d.ts

@@ -1,8 +1,5 @@
+import type { TournamentHooks } from '@n8n/tournament';
 import type { RuntimeBridge } from './bridge';
-export interface TournamentHooks {
-    before?: Array<(ast: unknown) => unknown>;
-    after?: Array<(ast: unknown) => unknown>;
-}
 /**
  * Configuration for ExpressionEvaluator.
  *
@@ -64,9 +61,6 @@ export interface IExpressionEvaluator {
  * Later: Will implement deep lazy proxy for field-level data fetching.
  */
 export type WorkflowData = Record<string, unknown>;
-/**
- * Options for evaluate().
- */
 /**
  * Options for evaluate().
  *
@@ -78,6 +72,11 @@ export interface EvaluateOptions {
      * Overrides the bridge's default timeout.
      */
     timeout?: number;
+    /**
+     * IANA timezone for this evaluation (e.g., 'America/New_York').
+     * Sets luxon Settings.defaultZone inside the isolate before execution.
+     */
+    timezone?: string;
 }
 /**
  * Observability provider interface.

package/dist/cjs/types/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC;IAEtB;;OAEG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAEtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC;IAErF;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE1E;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAExE;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5E;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAExC;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAEhD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAEpC;;OAEG;IACH,GAAG,IAAI,IAAI,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/E;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE/D;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAChE;AASD;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAGjC,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;gBAND,OAAO,EAAE,MAAM,EACR,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACvB;CAKF;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;CAAG;AACxD,qBAAa,YAAa,SAAQ,eAAe;CAAG;AACpD,qBAAa,sBAAuB,SAAQ,eAAe;CAAG;AAC9D,qBAAa,WAAY,SAAQ,eAAe;CAAG"}

package/dist/cjs/types/evaluator.js

@@ -0,0 +1,47 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SyntaxError = exports.SecurityViolationError = exports.TimeoutError = exports.MemoryLimitError = exports.ExpressionError = void 0;
+    // ============================================================================
+    // Phase 1.4: Error Handling (IMPLEMENT WITH EVALUATOR)
+    //
+    // These error types provide structured error information.
+    // Start with basic Error, add these types in Phase 1.4.
+    // ============================================================================
+    /**
+     * Expression evaluation error.
+     */
+    class ExpressionError extends Error {
+        context;
+        constructor(message, context) {
+            super(message);
+            this.context = context;
+            this.name = 'ExpressionError';
+        }
+    }
+    exports.ExpressionError = ExpressionError;
+    /**
+     * Specific error types.
+     */
+    class MemoryLimitError extends ExpressionError {
+    }
+    exports.MemoryLimitError = MemoryLimitError;
+    class TimeoutError extends ExpressionError {
+    }
+    exports.TimeoutError = TimeoutError;
+    class SecurityViolationError extends ExpressionError {
+    }
+    exports.SecurityViolationError = SecurityViolationError;
+    class SyntaxError extends ExpressionError {
+    }
+    exports.SyntaxError = SyntaxError;
+});
+//# sourceMappingURL=evaluator.js.map

package/dist/cjs/types/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/types/evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;IAiNA,+EAA+E;IAC/E,uDAAuD;IACvD,EAAE;IACF,0DAA0D;IAC1D,wDAAwD;IACxD,+EAA+E;IAE/E;;OAEG;IACH,MAAa,eAAgB,SAAQ,KAAK;QAGjC;QAFR,YACC,OAAe,EACR,OAKN;YAED,KAAK,CAAC,OAAO,CAAC,CAAC;YAPR,YAAO,GAAP,OAAO,CAKb;YAGD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC/B,CAAC;KACD;IAbD,0CAaC;IAED;;OAEG;IACH,MAAa,gBAAiB,SAAQ,eAAe;KAAG;IAAxD,4CAAwD;IACxD,MAAa,YAAa,SAAQ,eAAe;KAAG;IAApD,oCAAoD;IACpD,MAAa,sBAAuB,SAAQ,eAAe;KAAG;IAA9D,wDAA8D;IAC9D,MAAa,WAAY,SAAQ,eAAe;KAAG;IAAnD,kCAAmD"}

package/dist/{types → cjs/types}/index.d.ts

@@ -3,8 +3,9 @@
  *
  * This module exports all TypeScript interfaces and types for the expression runtime.
  */
-export type { RuntimeBridge, BridgeConfig } from './bridge';
+export type { RuntimeBridge, BridgeConfig, ExecuteOptions } from './bridge';
+export { DEFAULT_BRIDGE_CONFIG } from './bridge';
 export { RuntimeError } from './runtime';
-export type { EvaluatorConfig, IExpressionEvaluator, WorkflowData, EvaluateOptions, ObservabilityProvider, MetricsAPI, TracesAPI, Span, LogsAPI, TournamentHooks, } from './evaluator';
+export type { EvaluatorConfig, IExpressionEvaluator, WorkflowData, EvaluateOptions, ObservabilityProvider, MetricsAPI, TracesAPI, Span, LogsAPI, } from './evaluator';
 export { ExpressionError, MemoryLimitError, TimeoutError, SecurityViolationError, SyntaxError, } from './evaluator';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,YAAY,EACX,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,IAAI,EACJ,OAAO,GACP,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,WAAW,GACX,MAAM,aAAa,CAAC"}

package/dist/cjs/types/index.js

@@ -0,0 +1,30 @@
+/**
+ * Expression Runtime Types
+ *
+ * This module exports all TypeScript interfaces and types for the expression runtime.
+ */
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "./bridge", "./runtime", "./evaluator"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SyntaxError = exports.SecurityViolationError = exports.TimeoutError = exports.MemoryLimitError = exports.ExpressionError = exports.RuntimeError = exports.DEFAULT_BRIDGE_CONFIG = void 0;
+    var bridge_1 = require("./bridge");
+    Object.defineProperty(exports, "DEFAULT_BRIDGE_CONFIG", { enumerable: true, get: function () { return bridge_1.DEFAULT_BRIDGE_CONFIG; } });
+    // Runtime types
+    var runtime_1 = require("./runtime");
+    Object.defineProperty(exports, "RuntimeError", { enumerable: true, get: function () { return runtime_1.RuntimeError; } });
+    var evaluator_1 = require("./evaluator");
+    Object.defineProperty(exports, "ExpressionError", { enumerable: true, get: function () { return evaluator_1.ExpressionError; } });
+    Object.defineProperty(exports, "MemoryLimitError", { enumerable: true, get: function () { return evaluator_1.MemoryLimitError; } });
+    Object.defineProperty(exports, "TimeoutError", { enumerable: true, get: function () { return evaluator_1.TimeoutError; } });
+    Object.defineProperty(exports, "SecurityViolationError", { enumerable: true, get: function () { return evaluator_1.SecurityViolationError; } });
+    Object.defineProperty(exports, "SyntaxError", { enumerable: true, get: function () { return evaluator_1.SyntaxError; } });
+});
+//# sourceMappingURL=index.js.map

package/dist/cjs/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;IAIH,mCAAiD;IAAxC,+GAAA,qBAAqB,OAAA;IAE9B,gBAAgB;IAChB,qCAAyC;IAAhC,uGAAA,YAAY,OAAA;IAerB,yCAMqB;IALpB,4GAAA,eAAe,OAAA;IACf,6GAAA,gBAAgB,OAAA;IAChB,yGAAA,YAAY,OAAA;IACZ,mHAAA,sBAAsB,OAAA;IACtB,wGAAA,WAAW,OAAA"}

package/dist/cjs/types/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAG9B,IAAI,EAAE,MAAM;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFxC,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKzC"}

package/dist/cjs/types/runtime.js

@@ -0,0 +1,39 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RuntimeError = void 0;
+    /**
+     * Runtime error thrown inside isolated context.
+     *
+     * These errors are thrown by the runtime code when something goes wrong during
+     * expression evaluation. The bridge must catch these and translate them to the
+     * appropriate ExpressionError subclass (see evaluator.ts).
+     *
+     * Translation mapping:
+     * - code: 'MEMORY_LIMIT' → MemoryLimitError
+     * - code: 'TIMEOUT' → TimeoutError
+     * - code: 'SECURITY_VIOLATION' → SecurityViolationError
+     * - code: 'SYNTAX_ERROR' → SyntaxError
+     * - other → ExpressionError
+     */
+    class RuntimeError extends Error {
+        code;
+        details;
+        constructor(message, code, details) {
+            super(message);
+            this.code = code;
+            this.details = details;
+            this.name = 'RuntimeError';
+        }
+    }
+    exports.RuntimeError = RuntimeError;
+});
+//# sourceMappingURL=runtime.js.map

package/dist/cjs/types/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/types/runtime.ts"],"names":[],"mappings":";;;;;;;;;;;;IAAA;;;;;;;;;;;;;OAaG;IACH,MAAa,YAAa,SAAQ,KAAK;QAG9B;QACA;QAHR,YACC,OAAe,EACR,IAAY,EACZ,OAAiC;YAExC,KAAK,CAAC,OAAO,CAAC,CAAC;YAHR,SAAI,GAAJ,IAAI,CAAQ;YACZ,YAAO,GAAP,OAAO,CAA0B;YAGxC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC5B,CAAC;KACD;IATD,oCASC"}

package/dist/esm/bridge/isolated-vm-bridge.d.ts

@@ -0,0 +1,133 @@
+import type { RuntimeBridge, BridgeConfig, ExecuteOptions } from '../types';
+/**
+ * IsolatedVmBridge - Runtime bridge using isolated-vm for secure expression evaluation.
+ *
+ * This bridge creates a V8 isolate with:
+ * - Hard memory limit (128MB default)
+ * - No access to Node.js APIs
+ * - Timeout enforcement
+ * - Complete isolation from host process
+ *
+ * Context reuse pattern: Create isolate/context once, reset state between evaluations.
+ */
+export declare class IsolatedVmBridge implements RuntimeBridge {
+    private isolate;
+    private context?;
+    private initialized;
+    private disposed;
+    private config;
+    private scriptCache;
+    private valueAtPathRef?;
+    private arrayElementRef?;
+    private callFunctionRef?;
+    private resetDataProxiesRef?;
+    constructor(config?: BridgeConfig);
+    /**
+     * Initialize the isolate and create execution context.
+     *
+     * Steps:
+     * 1. Create context
+     * 2. Set up basic globals (global reference)
+     * 3. Load runtime bundle (DateTime, extend, proxy system)
+     * 4. Verify proxy system
+     *
+     * Must be called before execute().
+     */
+    initialize(): Promise<void>;
+    /**
+     * Load runtime bundle into the isolate.
+     *
+     * The runtime bundle includes:
+     * - DateTime, extend, extendOptional (expression engine globals)
+     * - SafeObject and SafeError wrappers
+     * - createDeepLazyProxy function
+     * - __data object initialization
+     *
+     * @private
+     * @throws {Error} If context not initialized or bundle loading fails
+     */
+    private loadVendorLibraries;
+    /**
+     * Verify the proxy system loaded correctly.
+     *
+     * The proxy system is loaded as part of the runtime bundle in loadVendorLibraries().
+     * This method verifies all required components are available.
+     *
+     * @private
+     * @throws {Error} If context not initialized or proxy system verification fails
+     */
+    private verifyProxySystem;
+    /**
+     * Inject the E() error handler into the isolate context.
+     *
+     * Tournament wraps expressions with try-catch that calls E(error, this).
+     * This handler:
+     * - Re-throws security violations from __sanitize
+     * - Swallows TypeErrors (failed attack attempts return undefined)
+     * - Re-throws all other errors
+     *
+     * @private
+     * @throws {Error} If context not initialized
+     */
+    private injectErrorHandler;
+    /**
+     * Reset data proxies in the isolate context.
+     *
+     * This method should be called before each execute() to:
+     * 1. Clear proxy caches from previous evaluations
+     * 2. Initialize fresh workflow data references
+     * 3. Expose workflow properties to globalThis
+     *
+     * The reset function runs in the isolate and calls back to the host
+     * via ivm.Reference callbacks to fetch workflow data.
+     *
+     * @private
+     * @throws {Error} If context not initialized or reset fails
+     */
+    private resetDataProxies;
+    /**
+     * Register callback functions for cross-isolate communication.
+     *
+     * Creates three ivm.Reference callbacks that the runtime bundle uses
+     * to fetch data from the host process:
+     *
+     * - __getValueAtPath: Returns metadata or primitive for a property path
+     * - __getArrayElement: Returns individual array elements
+     * - __callFunctionAtPath: Executes functions in host context
+     *
+     * These callbacks are called synchronously from isolate proxy traps.
+     *
+     * @param data - Current workflow data to use for callback responses
+     * @private
+     */
+    private registerCallbacks;
+    /**
+     * Execute JavaScript code in the isolated context.
+     *
+     * Flow:
+     * 1. Register callbacks as ivm.Reference for cross-isolate communication
+     * 2. Call resetDataProxies() to initialize workflow data proxies
+     * 3. Compile script (with caching for performance)
+     * 4. Execute with timeout enforcement
+     * 5. Return result (copied from isolate)
+     *
+     * @param code - JavaScript expression to evaluate
+     * @param data - Workflow data (e.g., { $json: {...}, $runIndex: 0 })
+     * @returns Result of the expression
+     * @throws {Error} If bridge not initialized or execution fails
+     */
+    execute(code: string, data: Record<string, unknown>, options?: ExecuteOptions): unknown;
+    /**
+     * Dispose of the isolate and free resources.
+     *
+     * After disposal, the bridge cannot be used again.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Check if the bridge has been disposed.
+     *
+     * @returns true if disposed, false otherwise
+     */
+    isDisposed(): boolean;
+}
+//# sourceMappingURL=isolated-vm-bridge.d.ts.map

package/dist/esm/bridge/isolated-vm-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-vm-bridge.d.ts","sourceRoot":"","sources":["../../../src/bridge/isolated-vm-bridge.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAwC5E;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IACrD,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAyB;IAIvC,OAAO,CAAC,WAAW,CAAiC;IAIpD,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,eAAe,CAAC,CAAgB;IACxC,OAAO,CAAC,eAAe,CAAC,CAAgB;IAKxC,OAAO,CAAC,mBAAmB,CAAC,CAAgB;gBAEhC,MAAM,GAAE,YAAiB;IAWrC;;;;;;;;;;OAUG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqCjC;;;;;;;;;;;OAWG;YACW,mBAAmB;IAoCjC;;;;;;;;OAQG;YACW,iBAAiB;IA+B/B;;;;;;;;;;;OAWG;YACW,kBAAkB;IA0BhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAiIzB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO;IAsDvF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB9B;;;;OAIG;IACH,UAAU,IAAI,OAAO;CAGrB"}