@nocobase/plugin-flow-engine 2.3.0-alpha.1 → 2.3.0-beta.2

package/dist/server/template/resolver.js

@@ -7,11 +7,9 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -25,65 +23,68 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var resolver_exports = {};
 __export(resolver_exports, {
-  preprocessExpression: () => preprocessExpression,
+  resolveAnalyzedJsonTemplate: () => resolveAnalyzedJsonTemplate,
   resolveJsonTemplate: () => resolveJsonTemplate
 });
 module.exports = __toCommonJS(resolver_exports);
 var import_ses = require("ses");
-var import_lodash = __toESM(require("lodash"));
 var import_utils = require("@nocobase/utils");
 var import_contexts = require("./contexts");
+var import_variable_expression = require("./variable-expression");
 const BLOCKED_SANDBOX_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-const sandboxProxyCache = /* @__PURE__ */ new WeakMap();
-const sandboxProxyMeta = /* @__PURE__ */ new WeakMap();
-const EMPTY_SANDBOX_CONTEXT = {
-  getSandboxKeys: () => [],
-  getSandboxValue: () => void 0
-};
 let resolverLockdownReady = false;
 async function resolveJsonTemplate(template, ctx) {
-  const compile = async (source) => {
-    if (typeof source === "string" && /\{\{.*?\}\}/.test(source)) {
-      return await replacePlaceholders(source, ctx);
-    }
-    if (Array.isArray(source)) return Promise.all(source.map(compile));
-    if (source && typeof source === "object") {
-      const out = {};
-      for (const [k, v] of Object.entries(source)) out[k] = await compile(v);
-      return out;
-    }
-    return source;
-  };
-  return compile(template);
+  const analysis = (0, import_variable_expression.analyzeVariableTemplate)(template);
+  return resolveAnalyzedJsonTemplate(analysis, ctx, {
+    allowAll: true,
+    allowedPaths: /* @__PURE__ */ new Set(),
+    unrestrictedVariables: /* @__PURE__ */ new Set()
+  });
+}
+async function resolveAnalyzedJsonTemplate(analysis, ctx, policy) {
+  const policySnapshot = Object.freeze({
+    allowAll: policy.allowAll,
+    allowedPaths: new Set(policy.allowedPaths),
+    unrestrictedVariables: new Set(policy.unrestrictedVariables)
+  });
+  return resolveAnalyzedNode(analysis.value, ctx, policySnapshot);
+}
+async function resolveAnalyzedNode(node, ctx, policy) {
+  if (node.kind === "value") return node.value;
+  if (node.kind === "string") return replaceAnalyzedPlaceholders(node, ctx, policy);
+  if (node.kind === "array") return Promise.all(node.items.map((item) => resolveAnalyzedNode(item, ctx, policy)));
+  const out = {};
+  for (const [key, value] of Object.entries(node.entries)) {
+    out[key] = await resolveAnalyzedNode(value, ctx, policy);
+  }
+  return out;
 }
-async function replacePlaceholders(input, ctx) {
-  const single = input.match(/^\{\{\s*(.+)\s*\}\}$/);
-  if (single) {
-    const val = await evaluate(single[1], ctx);
-    return typeof val === "undefined" ? input : val;
+async function replaceAnalyzedPlaceholders(node, ctx, policy) {
+  const single = node.expressions.length === 1 && node.expressions[0].placeholderSpan.start === 0;
+  if (single && node.expressions[0].placeholderSpan.end === node.source.length) {
+    const value = await evaluateAnalyzedExpression(node.expressions[0], ctx, policy);
+    return typeof value === "undefined" ? node.source : value;
   }
-  const regex = /\{\{\s*(.+?)\s*\}\}/g;
-  let result = input;
-  const matches = [...input.matchAll(regex)];
-  for (const [full, inner] of matches) {
-    const value = await evaluate(inner, ctx);
-    if (typeof value !== "undefined") {
-      const replacement = typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
-      result = result.replace(full, replacement);
+  let result = "";
+  let cursor = 0;
+  for (const expression of node.expressions) {
+    result += node.source.slice(cursor, expression.placeholderSpan.start);
+    const placeholder = node.source.slice(expression.placeholderSpan.start, expression.placeholderSpan.end);
+    const value = await evaluateAnalyzedExpression(expression, ctx, policy);
+    if (typeof value === "undefined") {
+      result += placeholder;
+    } else {
+      result += typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
     }
+    cursor = expression.placeholderSpan.end;
   }
-  return result;
+  return result + node.source.slice(cursor);
+}
+function createSandboxScope() {
+  return { proxyCache: /* @__PURE__ */ new WeakMap(), proxyMeta: /* @__PURE__ */ new WeakMap() };
 }
 function isObjectLike(value) {
   return value !== null && (typeof value === "object" || typeof value === "function");
@@ -97,8 +98,7 @@ function isBlockedSandboxKey(key) {
 function getSandboxDataDescriptor(source, key) {
   if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
   const descriptor = Reflect.getOwnPropertyDescriptor(source, key);
-  if (!descriptor || !("value" in descriptor)) return void 0;
-  if (key === "then" && typeof descriptor.value === "function") return void 0;
+  if (!descriptor || !("value" in descriptor) || typeof descriptor.value === "function") return void 0;
   return descriptor;
 }
 function getPrimitiveDataDescriptor(source, key) {
@@ -106,25 +106,22 @@ function getPrimitiveDataDescriptor(source, key) {
   return getSandboxDataDescriptor(Object(source), key);
 }
 function isSandboxContextSource(value) {
-  return value === EMPTY_SANDBOX_CONTEXT || value instanceof import_contexts.ServerBaseContext;
+  return value instanceof import_contexts.ServerBaseContext;
 }
-function wrapSandboxValue(value) {
+function wrapSandboxValue(scope, value) {
   if (isTrustedPromise(value)) {
-    return Promise.prototype.then.call(value, (resolved) => wrapSandboxValue(resolved));
+    return Promise.prototype.then.call(value, (resolved) => wrapSandboxValue(scope, resolved));
   }
+  if (typeof value === "function") return void 0;
   if (!isObjectLike(value)) return value;
-  if (sandboxProxyMeta.has(value)) return value;
-  const cached = sandboxProxyCache.get(value);
+  if (scope.proxyMeta.has(value)) return value;
+  const cached = scope.proxyCache.get(value);
   if (cached) return cached;
-  const kind = isSandboxContextSource(value) ? "context" : typeof value === "function" ? "function" : "data";
-  const proxy = kind === "context" ? createSandboxContextProxy(value) : kind === "function" ? createSandboxFunctionProxy(value) : createSandboxDataProxy(value);
-  sandboxProxyCache.set(value, proxy);
-  sandboxProxyMeta.set(proxy, { kind, source: value });
+  const proxy = isSandboxContextSource(value) ? createSandboxContextProxy(scope, value) : createSandboxDataProxy(scope, value);
+  scope.proxyCache.set(value, proxy);
+  scope.proxyMeta.set(proxy, value);
   return proxy;
 }
-function wrapRootSandboxContext(ctx) {
-  return wrapSandboxValue(isSandboxContextSource(ctx) ? ctx : EMPTY_SANDBOX_CONTEXT);
-}
 function ensureResolverLockdown() {
   if (resolverLockdownReady) return;
   (0, import_utils.lockdownSes)({
@@ -135,12 +132,13 @@ function ensureResolverLockdown() {
   });
   resolverLockdownReady = true;
 }
-function createSandboxContextProxy(source) {
+function createSandboxContextProxy(scope, source) {
   return new Proxy(/* @__PURE__ */ Object.create(null), {
     get: (_target, key) => {
-      if (isBlockedSandboxKey(key) || typeof key !== "string") return void 0;
-      if (!source.getSandboxKeys().includes(key)) return void 0;
-      return wrapSandboxValue(source.getSandboxValue(key));
+      if (isBlockedSandboxKey(key) || typeof key !== "string" || !source.getSandboxKeys().includes(key)) {
+        return void 0;
+      }
+      return wrapSandboxValue(scope, source.getSandboxValue(key));
     },
     has: (_target, key) => typeof key === "string" && source.getSandboxKeys().includes(key),
     ownKeys: () => source.getSandboxKeys(),
@@ -151,55 +149,31 @@ function createSandboxContextProxy(source) {
       return {
         configurable: true,
         enumerable: true,
-        value: wrapSandboxValue(source.getSandboxValue(key))
+        value: wrapSandboxValue(scope, source.getSandboxValue(key))
       };
     },
     getPrototypeOf: () => null,
+    setPrototypeOf: () => false,
+    preventExtensions: () => false,
     set: () => false,
     defineProperty: () => false,
     deleteProperty: () => false
   });
 }
-function createSandboxFunctionProxy(source) {
-  const callable = (...args) => Reflect.apply(source, void 0, args);
-  return new Proxy(callable, {
-    apply: (_target, _thisArg, argArray) => wrapSandboxValue(Reflect.apply(source, void 0, argArray)),
-    get: (_target, key) => {
-      if (key === "length" || key === "name") return Reflect.get(source, key);
-      return void 0;
-    },
-    has: (_target, key) => key === "length" || key === "name",
-    ownKeys: () => [],
-    getOwnPropertyDescriptor: () => void 0,
-    getPrototypeOf: () => null,
-    set: () => false,
-    defineProperty: () => false,
-    deleteProperty: () => false
-  });
-}
-function createSandboxDataProxy(source) {
+function createSandboxDataProxy(scope, source) {
   const target = Array.isArray(source) ? new Array(source.length) : /* @__PURE__ */ Object.create(null);
   return new Proxy(target, {
     get: (_target, key) => {
       const descriptor = getSandboxDataDescriptor(source, key);
-      if (!descriptor) return void 0;
-      const value = descriptor.value;
-      return typeof value === "function" ? wrapSandboxValue(value.bind(source)) : wrapSandboxValue(value);
-    },
-    has: (_target, key) => {
-      if (isBlockedSandboxKey(key) || typeof key !== "string") return false;
-      return !!getSandboxDataDescriptor(source, key);
+      return descriptor ? wrapSandboxValue(scope, descriptor.value) : void 0;
     },
+    has: (_target, key) => !!getSandboxDataDescriptor(source, key),
     ownKeys: () => {
-      const keys = Reflect.ownKeys(source).filter((key) => {
-        if (typeof key !== "string" || isBlockedSandboxKey(key)) return false;
-        return !!getSandboxDataDescriptor(source, key);
-      });
+      const keys = Reflect.ownKeys(source).filter((key) => !!getSandboxDataDescriptor(source, key));
       if (Array.isArray(source) && !keys.includes("length")) keys.push("length");
       return keys;
     },
     getOwnPropertyDescriptor: (proxyTarget, key) => {
-      if (isBlockedSandboxKey(key) || typeof key === "symbol") return void 0;
       if (Array.isArray(source) && key === "length") {
         return Reflect.getOwnPropertyDescriptor(proxyTarget, key);
       }
@@ -209,29 +183,32 @@ function createSandboxDataProxy(source) {
         configurable: true,
         enumerable: descriptor.enumerable,
         writable: false,
-        value: wrapSandboxValue(descriptor.value)
+        value: wrapSandboxValue(scope, descriptor.value)
       };
     },
     getPrototypeOf: () => null,
+    setPrototypeOf: () => false,
+    preventExtensions: () => false,
     set: () => false,
     defineProperty: () => false,
     deleteProperty: () => false
   });
 }
-async function unwrapSandboxValue(value, seen = /* @__PURE__ */ new WeakMap()) {
+async function unwrapSandboxValue(scope, value, seen = /* @__PURE__ */ new WeakMap()) {
   const resolved = isTrustedPromise(value) ? await value : value;
+  if (typeof resolved === "function") return void 0;
   if (!isObjectLike(resolved)) return resolved;
-  const meta = sandboxProxyMeta.get(resolved);
-  if ((meta == null ? void 0 : meta.kind) === "function" || typeof resolved === "function") return void 0;
-  const source = (meta == null ? void 0 : meta.source) ?? resolved;
-  if (!isObjectLike(source)) return source;
+  const meta = scope.proxyMeta.get(resolved);
+  const source = meta ?? resolved;
+  if (typeof source === "function") return void 0;
   if (seen.has(source)) return seen.get(source);
+  if (Buffer.isBuffer(source)) return Buffer.prototype.toJSON.call(source);
   if (isSandboxContextSource(source)) {
     const out2 = {};
     seen.set(source, out2);
     for (const key of source.getSandboxKeys()) {
       if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
-      out2[key] = await unwrapSandboxValue(wrapSandboxValue(source.getSandboxValue(key)), seen);
+      out2[key] = await unwrapSandboxValue(scope, wrapSandboxValue(scope, source.getSandboxValue(key)), seen);
     }
     return out2;
   }
@@ -241,9 +218,9 @@ async function unwrapSandboxValue(value, seen = /* @__PURE__ */ new WeakMap()) {
     const lengthDescriptor = Reflect.getOwnPropertyDescriptor(source, "length");
     const length = typeof (lengthDescriptor == null ? void 0 : lengthDescriptor.value) === "number" ? lengthDescriptor.value : 0;
     for (let index = 0; index < length; index++) {
-      const descriptor = Reflect.getOwnPropertyDescriptor(source, String(index));
-      if (!descriptor || !("value" in descriptor)) continue;
-      out2.push(await unwrapSandboxValue(descriptor.value, seen));
+      const descriptor = getSandboxDataDescriptor(source, String(index));
+      if (!descriptor) continue;
+      out2.push(await unwrapSandboxValue(scope, descriptor.value, seen));
     }
     return out2;
   }
@@ -251,190 +228,144 @@ async function unwrapSandboxValue(value, seen = /* @__PURE__ */ new WeakMap()) {
   const out = {};
   seen.set(source, out);
   for (const key of Object.keys(source)) {
-    if (BLOCKED_SANDBOX_KEYS.has(key)) continue;
     const descriptor = getSandboxDataDescriptor(source, key);
     if (!descriptor) continue;
-    out[key] = await unwrapSandboxValue(descriptor.value, seen);
+    out[key] = await unwrapSandboxValue(scope, descriptor.value, seen);
   }
   return out;
 }
-function getRootSandboxValue(ctx, key) {
-  if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
-  if (isSandboxContextSource(ctx)) {
-    if (!ctx.getSandboxKeys().includes(key)) return void 0;
-    return wrapSandboxValue(ctx.getSandboxValue(key));
+function getRootSandboxValue(scope, ctx, key) {
+  if (BLOCKED_SANDBOX_KEYS.has(key) || !isSandboxContextSource(ctx) || !ctx.getSandboxKeys().includes(key)) {
+    return void 0;
   }
-  return void 0;
+  return wrapSandboxValue(scope, ctx.getSandboxValue(key));
 }
-async function getSandboxProperty(value, key) {
+async function getSandboxProperty(scope, value, key) {
   if (BLOCKED_SANDBOX_KEYS.has(key)) return void 0;
   const resolved = isTrustedPromise(value) ? await value : value;
   if (resolved == null) return void 0;
-  const meta = isObjectLike(resolved) ? sandboxProxyMeta.get(resolved) : void 0;
-  const source = (meta == null ? void 0 : meta.source) ?? resolved;
+  const meta = isObjectLike(resolved) ? scope.proxyMeta.get(resolved) : void 0;
+  const source = meta ?? resolved;
   if (isSandboxContextSource(source)) {
     if (!source.getSandboxKeys().includes(key)) return void 0;
-    return wrapSandboxValue(source.getSandboxValue(key));
-  }
-  if (typeof source === "function") {
-    return key === "length" || key === "name" ? Reflect.get(source, key) : void 0;
+    return wrapSandboxValue(scope, source.getSandboxValue(key));
   }
+  if (typeof source === "function") return void 0;
   if (!isObjectLike(source)) {
     const descriptor2 = getPrimitiveDataDescriptor(source, key);
-    if (!descriptor2 || typeof descriptor2.value === "function") return void 0;
-    return wrapSandboxValue(descriptor2.value);
+    return descriptor2 ? wrapSandboxValue(scope, descriptor2.value) : void 0;
   }
   const descriptor = getSandboxDataDescriptor(source, key);
-  if (!descriptor) return void 0;
-  const current = descriptor.value;
-  return typeof current === "function" ? wrapSandboxValue(current.bind(source)) : wrapSandboxValue(current);
+  return descriptor ? wrapSandboxValue(scope, descriptor.value) : void 0;
 }
-async function evaluate(expr, ctx) {
-  try {
-    const raw = expr.trim();
-    const dotOnly = raw.match(
-      /^ctx\.([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\.([a-zA-Z_$][a-zA-Z0-9_$-]*(?:\.[a-zA-Z_$][a-zA-Z0-9_$-]*)*))?$/
-    );
-    if (dotOnly) {
-      const first = dotOnly[1];
-      const rest = dotOnly[2];
-      const base = getRootSandboxValue(ctx, first);
-      if (!rest) return await unwrapSandboxValue(wrapSandboxValue(base));
-      const resolved = await asyncGetValuesByPath(base, rest);
-      if (typeof resolved !== "undefined" || !rest.includes("-")) {
-        return await unwrapSandboxValue(resolved);
-      }
-    }
-    const transformed = preprocessExpression(raw);
-    ensureResolverLockdown();
-    const compartment = new Compartment({
-      ctx: wrapRootSandboxContext(ctx),
-      __get: wrapSandboxValue((varName, path) => getAtPath(ctx, varName, path))
-    });
-    const wrapped = `(async () => { try { return ${transformed}; } catch (e) { return undefined; } })()`;
-    return await unwrapSandboxValue(await compartment.evaluate(wrapped));
-  } catch (_2) {
+function copyRuntimeSegments(segments) {
+  if (!Array.isArray(segments)) return void 0;
+  const copy = [];
+  for (const segment of segments) {
+    if (typeof segment !== "string" && typeof segment !== "number") return void 0;
+    copy.push(segment);
+  }
+  return copy;
+}
+function isPathAllowed(varName, segments, policy) {
+  if (typeof varName !== "string") return void 0;
+  const runtimeSegments = copyRuntimeSegments(segments);
+  if (!runtimeSegments) return void 0;
+  if (!policy.allowAll && !policy.unrestrictedVariables.has(varName) && !policy.allowedPaths.has((0, import_variable_expression.getVariableCanonicalKey)(varName, runtimeSegments))) {
     return void 0;
   }
+  return runtimeSegments;
 }
-async function getAtPath(ctx, varName, path) {
+async function resolveGuardedPath(scope, ctx, policy, aggregateArrays, varName, segments) {
   try {
-    let current = getRootSandboxValue(ctx, varName);
-    if (!path) return current;
-    const norm = String(path || "").replace(/^\./, "");
-    const segments = import_lodash.default.toPath(norm);
-    for (const seg of segments) {
-      if (current == null) return void 0;
-      current = await getSandboxProperty(current, seg);
-    }
-    return wrapSandboxValue(current);
-  } catch (_2) {
+    const runtimeSegments = isPathAllowed(varName, segments, policy);
+    if (!runtimeSegments || typeof varName !== "string") return void 0;
+    const root = getRootSandboxValue(scope, ctx, varName);
+    return resolveSandboxSegments(scope, root, runtimeSegments, aggregateArrays);
+  } catch (_) {
     return void 0;
   }
 }
-async function asyncGetValuesByPath(obj, path, defaultValue) {
-  try {
-    let currentValue = await obj;
-    if (!currentValue) return defaultValue;
-    const keys = String(path || "").split(".");
-    let result = [];
-    let shouldReturnArray = false;
-    for (let i = 0; i < keys.length; i++) {
-      const key = keys[i];
-      if (Array.isArray(currentValue)) {
-        shouldReturnArray = true;
-        const rest = keys.slice(i).join(".");
-        const parts = await Promise.all(
-          Array.prototype.map.call(currentValue, (el) => asyncGetValuesByPath(el, rest, defaultValue))
-        );
-        for (const p of parts) {
-          if (Array.isArray(p)) {
-            for (let index = 0; index < p.length; index++) {
-              if (typeof p[index] !== "undefined") result.push(p[index]);
-            }
-          } else if (typeof p !== "undefined") result.push(p);
-        }
-        break;
-      }
-      currentValue = await getSandboxProperty(currentValue, key);
-      if (i === keys.length - 1) {
-        result.push(currentValue);
-      }
+async function resolveSandboxSegments(scope, value, segments, aggregateArrays) {
+  var _a;
+  const resolved = isTrustedPromise(value) ? await value : value;
+  if (!segments.length || resolved == null) return resolved;
+  const [segment, ...rest] = segments;
+  const meta = isObjectLike(resolved) ? scope.proxyMeta.get(resolved) : void 0;
+  const source = meta ?? resolved;
+  const key = String(segment);
+  if (aggregateArrays && typeof segment === "string" && Array.isArray(source) && key !== "length") {
+    const result = [];
+    const length = (_a = Reflect.getOwnPropertyDescriptor(source, "length")) == null ? void 0 : _a.value;
+    for (let index = 0; index < (typeof length === "number" ? length : 0); index++) {
+      const descriptor = getSandboxDataDescriptor(source, String(index));
+      if (!descriptor) continue;
+      const part = await resolveSandboxSegments(scope, descriptor.value, segments, true);
+      await appendAggregatedValue(scope, result, part);
     }
-    result = result.filter((item) => typeof item !== "undefined");
-    if (result.length === 0) return defaultValue;
-    if (shouldReturnArray) return result.filter((item) => item !== null);
-    return result[0];
-  } catch (_2) {
-    return defaultValue;
+    return wrapSandboxValue(
+      scope,
+      result.filter((item) => item !== null)
+    );
   }
+  const next = await getSandboxProperty(scope, resolved, key);
+  return resolveSandboxSegments(scope, next, rest, aggregateArrays);
 }
-function preprocessExpression(expression) {
-  let out = "";
-  let i = 0;
-  const n = expression.length;
-  while (i < n) {
-    const dotIdx = expression.indexOf("ctx.", i);
-    const brkIdx = expression.indexOf("ctx[", i);
-    let idx = -1;
-    if (dotIdx === -1) idx = brkIdx;
-    else if (brkIdx === -1) idx = dotIdx;
-    else idx = Math.min(dotIdx, brkIdx);
-    if (idx === -1) {
-      out += expression.slice(i);
-      break;
-    }
-    out += expression.slice(i, idx);
-    let j = idx + 3;
-    let varName = null;
-    let pathStr = "";
-    if (expression[j] === ".") {
-      j += 1;
-      const varMatch = /^[a-zA-Z_$][a-zA-Z0-9_$]*/.exec(expression.slice(j));
-      if (!varMatch) {
-        out += "ctx.";
-        i = j;
-        continue;
-      }
-      varName = varMatch[0];
-      j += varName.length;
-    } else if (expression[j] === "[") {
-      const m = /^\[("((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)')\]/.exec(expression.slice(j));
-      if (!m) {
-        out += "ctx[";
-        i = j;
-        continue;
-      }
-      varName = m[2] ?? m[3];
-      j += m[0].length;
-    } else {
-      out += expression.slice(idx, idx + 3);
-      i = idx + 3;
-      continue;
-    }
-    while (j < n) {
-      if (expression[j] === ".") {
-        const m = /^\.[a-zA-Z_$][a-zA-Z0-9_$]*/.exec(expression.slice(j));
-        if (!m) break;
-        pathStr += m[0];
-        j += m[0].length;
-      } else if (expression[j] === "[") {
-        const m = /^(\[(?:\d+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')\])/.exec(expression.slice(j));
-        if (!m) break;
-        pathStr += m[1];
-        j += m[1].length;
-      } else {
-        break;
-      }
-    }
-    const argPath = pathStr ? `, ${JSON.stringify(pathStr)}` : "";
-    out += `(await __get(${JSON.stringify(varName)}${argPath}))`;
-    i = j;
+async function appendAggregatedValue(scope, result, value) {
+  var _a;
+  const resolved = isTrustedPromise(value) ? await value : value;
+  const meta = isObjectLike(resolved) ? scope.proxyMeta.get(resolved) : void 0;
+  const source = meta ?? resolved;
+  if (!Array.isArray(source)) {
+    if (typeof resolved !== "undefined") result.push(resolved);
+    return;
+  }
+  const length = (_a = Reflect.getOwnPropertyDescriptor(source, "length")) == null ? void 0 : _a.value;
+  for (let index = 0; index < (typeof length === "number" ? length : 0); index++) {
+    const descriptor = getSandboxDataDescriptor(source, String(index));
+    if (descriptor) result.push(wrapSandboxValue(scope, descriptor.value));
+  }
+}
+function isStandalonePath(expression) {
+  const path = expression.paths[0];
+  return !!path && expression.paths.length === 1 && !expression.source.slice(0, path.span.start - expression.expressionSpan.start).trim() && !expression.source.slice(path.span.end - expression.expressionSpan.start).trim();
+}
+function createGuardedCallable(source) {
+  const callable = (...args) => Reflect.apply(source, void 0, args);
+  return new Proxy(callable, {
+    apply: (_target, _thisArg, args) => Reflect.apply(source, void 0, args),
+    get: () => void 0,
+    has: () => false,
+    ownKeys: () => [],
+    getOwnPropertyDescriptor: () => void 0,
+    getPrototypeOf: () => null,
+    setPrototypeOf: () => false,
+    preventExtensions: () => false,
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+async function evaluateAnalyzedExpression(expression, ctx, policy) {
+  if (!expression.supported) return void 0;
+  try {
+    const scope = createSandboxScope();
+    const aggregateArrays = isStandalonePath(expression);
+    const helper = createGuardedCallable(
+      (varName, segments) => resolveGuardedPath(scope, ctx, policy, aggregateArrays, varName, segments)
+    );
+    ensureResolverLockdown();
+    const compartment = new Compartment();
+    const factory = compartment.evaluate(
+      `async (${expression.helperIdentifier}) => { try { return ${expression.compiled}; } catch (_) { return undefined; } }`
+    );
+    return await unwrapSandboxValue(scope, await factory(helper));
+  } catch (_) {
+    return void 0;
   }
-  return out;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  preprocessExpression,
+  resolveAnalyzedJsonTemplate,
   resolveJsonTemplate
 });