@scalar/mock-server 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @scalar/mock-server
 
+## 0.14.0
+
+### Minor Changes
+
+- [#10082](https://github.com/scalar/scalar/pull/10082): Run `x-handler` and `x-seed` code in a real sandbox
+
+  Handler and seed code used to run with the `Function` constructor, which gave it full access to the Node.js host (`process`, `require`, and more). It now runs inside a QuickJS WebAssembly sandbox with memory and time limits, so even untrusted code from a remote or `$ref`-loaded document cannot reach the host.
+
+  The `store`, `faker`, `req`, `res`, `schema`, and `seed` APIs work as before. The one exception is faker methods that take a callback (for example `faker.helpers.multiple(fn)`), which are no longer supported because functions cannot cross the sandbox boundary.
+
+### Patch Changes
+
+- [#10079](https://github.com/scalar/scalar/pull/10079): Harden the mock server against SSRF and local file disclosure through OpenAPI `$ref`s. External `$ref` resolution now refuses to fetch private, loopback, link-local, and metadata addresses, and confines local file reads to the document's directory. The `fetchUrls` and `readFiles` bundling plugins gain opt-in `blockPrivateNetworks` and `basePath` options, so other callers keep their current behavior unless they opt in.
+
 ## 0.13.0
 
 ### Minor Changes

package/dist/utils/build-handler-context.d.ts

@@ -1,4 +1,3 @@
-import { faker } from '@faker-js/faker';
 import type { OpenAPIV3_1 } from '@scalar/openapi-types';
 import type { Context } from 'hono';
 import { type StoreOperationTracking, createStoreWrapper } from './store-wrapper.js';
@@ -7,7 +6,6 @@ import { type StoreOperationTracking, createStoreWrapper } from './store-wrapper
  */
 export type HandlerContext = {
     store: ReturnType<typeof createStoreWrapper>['wrappedStore'];
-    faker: typeof faker;
     req: {
         body: any;
         params: Record<string, string>;

package/dist/utils/build-handler-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-handler-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-handler-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMnC,OAAO,EAAE,KAAK,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEjF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,CAAA;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CAAA;AA4DD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,SAAS,CAAC,EAAE,WAAW,CAAC,eAAe,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAiD/B"}
+{"version":3,"file":"build-handler-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-handler-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMnC,OAAO,EAAE,KAAK,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEjF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,CAAA;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CAAA;AA4DD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,SAAS,CAAC,EAAE,WAAW,CAAC,eAAe,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAgD/B"}

package/dist/utils/build-handler-context.js

@@ -1,4 +1,3 @@
-import { faker } from '@faker-js/faker';
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { getResolvedRefDeep } from '@scalar/workspace-store/helpers/get-resolved-ref-deep';
 import { getExampleFromSchema } from '@scalar/workspace-store/request-example';
@@ -84,7 +83,6 @@ export async function buildHandlerContext(c, operation) {
     return {
         context: {
             store: wrappedStore,
-            faker,
             req: {
                 body,
                 params: pathParameters(c),

package/dist/utils/build-seed-context.d.ts

@@ -1,35 +1,17 @@
-import { faker } from '@faker-js/faker';
 import { createStoreWrapper } from './store-wrapper.js';
-/**
- * Seed helper function type.
- */
-type SeedHelper = {
-    /**
-     * Create n items using a factory function.
-     */
-    count: (n: number, factory: () => any) => any[];
-    /**
-     * Create items from an array of objects.
-     */
-    (items: any[]): any[];
-    /**
-     * Create a single item using a factory function (shorthand for count(1, factory)).
-     */
-    (factory: () => any): any;
-};
 /**
  * Context object provided to x-seed code.
+ *
+ * The `seed` helper itself lives inside the sandbox (see `sandbox.ts`); it
+ * persists generated items through this store using the schema key as the
+ * collection name.
  */
 export type SeedContext = {
     store: ReturnType<typeof createStoreWrapper>['wrappedStore'];
-    faker: typeof faker;
-    seed: SeedHelper;
     schema: string;
 };
 /**
- * Build the seed context with a seed helper function.
- * The seed helper automatically uses the schema key as the collection name.
+ * Build the seed context for a schema.
  */
 export declare function buildSeedContext(schemaKey: string): SeedContext;
-export {};
 //# sourceMappingURL=build-seed-context.d.ts.map

package/dist/utils/build-seed-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-seed-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-seed-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD;;GAEG;AACH,KAAK,UAAU,GAAG;IAChB;;OAEG;IACH,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,EAAE,CAAA;IAC/C;;OAEG;IACH,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAA;IACrB;;OAEG;IACH,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,CAAA;CAC1B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAgE/D"}
+{"version":3,"file":"build-seed-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-seed-context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAO/D"}

package/dist/utils/build-seed-context.js

@@ -1,60 +1,12 @@
-import { faker } from '@faker-js/faker';
 import { store } from '../libs/store.js';
 import { createStoreWrapper } from './store-wrapper.js';
 /**
- * Build the seed context with a seed helper function.
- * The seed helper automatically uses the schema key as the collection name.
+ * Build the seed context for a schema.
  */
 export function buildSeedContext(schemaKey) {
     const { wrappedStore } = createStoreWrapper(store);
-    /**
-     * Seed helper function that provides a Laravel-inspired API.
-     */
-    const seedHelper = ((arg1, arg2) => {
-        // Case 1: seed.count(n, factory)
-        if (typeof arg1 === 'number' && typeof arg2 === 'function') {
-            const count = arg1;
-            const factory = arg2;
-            const items = [];
-            for (let i = 0; i < count; i++) {
-                const item = factory();
-                const created = wrappedStore.create(schemaKey, item);
-                items.push(created);
-            }
-            return items;
-        }
-        // Case 2: seed(array)
-        if (Array.isArray(arg1)) {
-            const items = [];
-            for (const item of arg1) {
-                const created = wrappedStore.create(schemaKey, item);
-                items.push(created);
-            }
-            return items;
-        }
-        // Case 3: seed(factory) - single item
-        if (typeof arg1 === 'function') {
-            const factory = arg1;
-            const item = factory();
-            const created = wrappedStore.create(schemaKey, item);
-            return created;
-        }
-        throw new Error('Invalid seed() usage. Use seed.count(n, factory), seed(array), or seed(factory)');
-    });
-    // Add count method to the function
-    seedHelper.count = (n, factory) => {
-        const items = [];
-        for (let i = 0; i < n; i++) {
-            const item = factory();
-            const created = wrappedStore.create(schemaKey, item);
-            items.push(created);
-        }
-        return items;
-    };
     return {
         store: wrappedStore,
-        faker,
-        seed: seedHelper,
         schema: schemaKey,
     };
 }

package/dist/utils/execute-handler.d.ts

@@ -6,8 +6,11 @@ type HandlerExecutionResult = {
     result: any;
 };
 /**
- * Execute handler code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, req, res).
+ * Execute handler code inside the QuickJS sandbox.
+ *
+ * The handler can only reach the `store` and `faker` bridges and the injected
+ * `req`/`res` inputs. It cannot touch the host runtime, so even untrusted code
+ * from a remote or `$ref`-loaded document is safe to run.
  */
 export declare function executeHandler(code: string, context: HandlerContext): Promise<HandlerExecutionResult>;
 export {};

package/dist/utils/execute-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-handler.d.ts","sourceRoot":"","sources":["../../src/utils/execute-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D;;GAEG;AACH,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB3G"}
+{"version":3,"file":"execute-handler.d.ts","sourceRoot":"","sources":["../../src/utils/execute-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7D;;GAEG;AACH,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAQ3G"}

package/dist/utils/execute-handler.js

@@ -1,18 +1,16 @@
+import { runInSandbox } from './sandbox.js';
 /**
- * Execute handler code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, req, res).
+ * Execute handler code inside the QuickJS sandbox.
+ *
+ * The handler can only reach the `store` and `faker` bridges and the injected
+ * `req`/`res` inputs. It cannot touch the host runtime, so even untrusted code
+ * from a remote or `$ref`-loaded document is safe to run.
  */
 export async function executeHandler(code, context) {
-    // Create a function that executes the handler code with the context
-    // Using Function constructor to create a sandboxed environment
-    // The code is wrapped in a function body that returns the result
-    const handlerFunction = new Function('store', 'faker', 'req', 'res', `
-    ${code}
-  `);
-    const result = handlerFunction(context.store, context.faker, context.req, context.res);
-    // If the result is a Promise, await it
-    if (result instanceof Promise) {
-        return { result: await result };
-    }
+    const result = await runInSandbox({
+        code,
+        store: context.store,
+        jsonGlobals: { req: context.req, res: context.res },
+    });
     return { result };
 }

package/dist/utils/execute-seed.d.ts

@@ -6,8 +6,11 @@ type SeedExecutionResult = {
     result: any;
 };
 /**
- * Execute seed code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, seed, schema).
+ * Execute seed code inside the QuickJS sandbox.
+ *
+ * The seed code can only reach the `store` and `faker` bridges and the `seed`
+ * helper, which persists generated items through the store. It cannot touch the
+ * host runtime.
  */
 export declare function executeSeed(code: string, context: SeedContext): Promise<SeedExecutionResult>;
 export {};

package/dist/utils/execute-seed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-seed.d.ts","sourceRoot":"","sources":["../../src/utils/execute-seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD;;GAEG;AACH,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4BlG"}
+{"version":3,"file":"execute-seed.d.ts","sourceRoot":"","sources":["../../src/utils/execute-seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGvD;;GAEG;AACH,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CASlG"}

package/dist/utils/execute-seed.js

@@ -1,25 +1,17 @@
+import { runInSandbox } from './sandbox.js';
 /**
- * Execute seed code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, seed, schema).
+ * Execute seed code inside the QuickJS sandbox.
+ *
+ * The seed code can only reach the `store` and `faker` bridges and the `seed`
+ * helper, which persists generated items through the store. It cannot touch the
+ * host runtime.
  */
 export async function executeSeed(code, context) {
-    // Create a function that executes the seed code with the context
-    // Using Function constructor to create a sandboxed environment
-    // The code is wrapped in a function body that returns the result
-    const seedFunction = new Function('store', 'faker', 'seed', 'schema', `
-    ${code}
-  `);
-    // Execute the seed function with the context
-    try {
-        const result = seedFunction(context.store, context.faker, context.seed, context.schema);
-        // If the result is a Promise, await it
-        if (result instanceof Promise) {
-            return { result: await result };
-        }
-        return { result };
-    }
-    catch (error) {
-        // Re-throw to be caught by the caller
-        throw error;
-    }
+    const result = await runInSandbox({
+        code,
+        store: context.store,
+        jsonGlobals: { schema: context.schema },
+        includeSeed: true,
+    });
+    return { result };
 }

package/dist/utils/process-openapi-document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-openapi-document.d.ts","sourceRoot":"","sources":["../../src/utils/process-openapi-document.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACjD,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAiD/B"}
+{"version":3,"file":"process-openapi-document.d.ts","sourceRoot":"","sources":["../../src/utils/process-openapi-document.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,GACjD,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAsD/B"}

package/dist/utils/process-openapi-document.js

@@ -1,5 +1,8 @@
+import path from 'node:path';
+import { cwd } from 'node:process';
 import { bundle } from '@scalar/json-magic/bundle';
 import { fetchUrls, parseJson, parseYaml, readFiles } from '@scalar/json-magic/bundle/plugins/node';
+import { isFilePath } from '@scalar/json-magic/helpers/is-file-path';
 import { createMagicProxy } from '@scalar/json-magic/magic-proxy';
 import { upgrade } from '@scalar/openapi-upgrader';
 /**
@@ -29,11 +32,15 @@ export async function processOpenApiDocument(document) {
         };
     }
     let bundled;
+    // Confine local file `$ref`s to the document's own directory (or the working directory when the
+    // document is an object or inline string), and refuse to fetch private or internal addresses.
+    // Without these guards a `$ref` could read arbitrary local files or reach internal services.
+    const basePath = typeof document === 'string' && isFilePath(document) ? path.dirname(path.resolve(document)) : cwd();
     try {
         // Bundle external references with Node.js plugins
         // Include parseJson and parseYaml to handle string inputs
         bundled = await bundle(document, {
-            plugins: [parseJson(), parseYaml(), readFiles(), fetchUrls()],
+            plugins: [parseJson(), parseYaml(), readFiles({ basePath }), fetchUrls({ blockPrivateNetworks: true })],
             treeShake: false,
         });
     }

package/dist/utils/sandbox.d.ts

@@ -0,0 +1,25 @@
+import type { StoreInterface } from './store-wrapper.js';
+/**
+ * Options for {@link runInSandbox}.
+ */
+type RunInSandboxOptions = {
+    /** User-supplied handler or seed code. It runs inside an async wrapper, so top-level `return` and `await` work. */
+    code: string;
+    /** Host store bridge (already wrapped with operation tracking). */
+    store: StoreInterface;
+    /** Plain-JSON values exposed to the guest as globals (for example `req`, `res`, `schema`). */
+    jsonGlobals?: Record<string, unknown>;
+    /** When true, exposes the guest-side `seed` helper. Requires a `schema` entry in {@link jsonGlobals}. */
+    includeSeed?: boolean;
+};
+/**
+ * Execute untrusted handler or seed code inside a QuickJS WebAssembly sandbox.
+ *
+ * The guest has no access to the host runtime (`process`, `require`, `fetch`,
+ * the `Function` constructor, and so on). It can only talk to the `store` and
+ * `faker` bridges and read the injected JSON globals. Memory and time limits
+ * bound the remaining denial-of-service risk.
+ */
+export declare function runInSandbox(options: RunInSandboxOptions): Promise<unknown>;
+export {};
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/utils/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/utils/sandbox.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAiCrD;;GAEG;AACH,KAAK,mBAAmB,GAAG;IACzB,mHAAmH;IACnH,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,KAAK,EAAE,cAAc,CAAA;IACrB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,yGAAyG;IACzG,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,CAAA;AA8LD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAqEjF"}

package/dist/utils/sandbox.js

@@ -0,0 +1,252 @@
+import { faker } from '@faker-js/faker';
+import { getQuickJS } from 'quickjs-emscripten';
+/**
+ * Maximum memory the sandboxed guest may allocate. Handler and seed code only
+ * shuffles small amounts of mock data around, so this is generous while still
+ * bounding a runaway allocation.
+ */
+const MEMORY_LIMIT_BYTES = 64 * 1024 * 1024;
+/**
+ * Maximum wall-clock time a single handler or seed run may take. This is the
+ * only defence against an infinite loop, since the guest cannot reach anything
+ * else on the host.
+ */
+const EXECUTION_TIMEOUT_MS = 1_000;
+/**
+ * Property names that let code climb from an object onto its prototype chain and
+ * ultimately reach the host `Function` constructor. They are never legitimate
+ * faker module or method names, so the bridge refuses to walk through them.
+ */
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/** Store methods the guest bridge is allowed to call. */
+const STORE_METHODS = new Set(['list', 'get', 'create', 'update', 'delete', 'clear']);
+/**
+ * The QuickJS WebAssembly module is expensive to instantiate, so it is loaded
+ * once and shared. Each run still gets its own isolated context and runtime.
+ */
+let quickJSModule;
+const loadQuickJS = () => (quickJSModule ??= getQuickJS());
+/**
+ * Walk faker with a guest-provided property path and invoke the resolved method.
+ * The faker instance lives on the host; only the path and JSON arguments cross
+ * the boundary, so guest code can never obtain a reference to faker itself.
+ */
+function callFaker(path, args) {
+    const method = path.at(-1);
+    if (method === undefined || FORBIDDEN_KEYS.has(method)) {
+        throw new Error(`faker: "${method}" is not accessible`);
+    }
+    // Resolve everything except the last segment to the faker module owning the method.
+    let receiver = faker;
+    for (const key of path.slice(0, -1)) {
+        if (FORBIDDEN_KEYS.has(key)) {
+            throw new Error(`faker: "${key}" is not accessible`);
+        }
+        receiver = receiver?.[key];
+        if (receiver === undefined || receiver === null) {
+            throw new Error(`faker: "${key}" does not exist`);
+        }
+    }
+    const fn = receiver?.[method];
+    if (typeof fn !== 'function') {
+        throw new Error(`faker: "${path.join('.')}" is not a function`);
+    }
+    // Bind to the resolved module so faker methods keep their expected `this`.
+    return fn.apply(receiver, args);
+}
+/**
+ * Run a store method requested by the guest and return a JSON envelope.
+ */
+function runStoreBridge(store, method, argsJson) {
+    try {
+        if (!STORE_METHODS.has(method)) {
+            throw new Error(`store: "${method}" is not a method`);
+        }
+        const args = JSON.parse(argsJson);
+        const result = store[method](...args);
+        return serializeEnvelope({ ok: true, value: result ?? null });
+    }
+    catch (error) {
+        return serializeEnvelope({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/**
+ * Run a faker call requested by the guest and return a JSON envelope.
+ */
+function runFakerBridge(pathJson, argsJson) {
+    try {
+        const path = JSON.parse(pathJson);
+        const args = JSON.parse(argsJson);
+        return serializeEnvelope({ ok: true, value: callFaker(path, args) ?? null });
+    }
+    catch (error) {
+        return serializeEnvelope({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/**
+ * Serialize a bridge envelope. Faker occasionally returns values such as `Date`
+ * that JSON cannot represent as-is; those are converted to their JSON form,
+ * which matches what handler code would send over the wire anyway.
+ */
+function serializeEnvelope(envelope) {
+    return JSON.stringify(envelope);
+}
+/**
+ * Guest-side bootstrap. It rebuilds `store` and `faker` on top of the host
+ * bridges so guest code sees the same API as before, but every call is just a
+ * JSON message to the host.
+ */
+const GUEST_PRELUDE = `
+  const __unwrap = (raw) => {
+    const parsed = JSON.parse(raw)
+    if (!parsed.ok) {
+      throw new Error(parsed.error)
+    }
+    return parsed.value
+  }
+
+  const store = {
+    list: (...args) => __unwrap(__store('list', JSON.stringify(args))),
+    get: (...args) => __unwrap(__store('get', JSON.stringify(args))),
+    create: (...args) => __unwrap(__store('create', JSON.stringify(args))),
+    update: (...args) => __unwrap(__store('update', JSON.stringify(args))),
+    delete: (...args) => __unwrap(__store('delete', JSON.stringify(args))),
+    clear: (...args) => __unwrap(__store('clear', JSON.stringify(args))),
+  }
+
+  const __makeFaker = (path) =>
+    new Proxy(function () {}, {
+      get: (_target, prop) => (typeof prop === 'string' ? __makeFaker(path.concat(prop)) : undefined),
+      apply: (_target, _thisArg, args) => __unwrap(__faker(JSON.stringify(path), JSON.stringify(args))),
+    })
+  const faker = __makeFaker([])
+`;
+/**
+ * Guest-side `seed` helper. It mirrors the Laravel-inspired API and runs the
+ * factory callbacks inside the sandbox, persisting through the `store` bridge.
+ */
+const SEED_PRELUDE = `
+  const seed = (() => {
+    const create = (item) => store.create(schema, item)
+    const helper = (arg1, arg2) => {
+      if (typeof arg1 === 'number' && typeof arg2 === 'function') {
+        const items = []
+        for (let index = 0; index < arg1; index++) {
+          items.push(create(arg2()))
+        }
+        return items
+      }
+      if (Array.isArray(arg1)) {
+        return arg1.map(create)
+      }
+      if (typeof arg1 === 'function') {
+        return create(arg1())
+      }
+      throw new Error('Invalid seed() usage. Use seed.count(n, factory), seed(array), or seed(factory)')
+    }
+    helper.count = (n, factory) => {
+      const items = []
+      for (let index = 0; index < n; index++) {
+        items.push(create(factory()))
+      }
+      return items
+    }
+    return helper
+  })()
+`;
+/**
+ * Assemble the full guest program: bridges, injected JSON globals, the optional
+ * seed helper, and the user code wrapped in an async IIFE whose result becomes
+ * the completion value QuickJS hands back.
+ */
+function buildGuestSource(code, jsonGlobalNames, includeSeed) {
+    const jsonGlobals = jsonGlobalNames.map((name) => `const ${name} = JSON.parse(__json_${name})`).join('\n');
+    return `
+    ${GUEST_PRELUDE}
+    ${jsonGlobals}
+    ${includeSeed ? SEED_PRELUDE : ''}
+    ;(async () => {
+      ${code}
+    })()
+  `;
+}
+/**
+ * Rebuild a host error from a dumped QuickJS error so callers see a normal
+ * `Error` instead of an opaque value.
+ */
+function toError(dumped) {
+    if (dumped instanceof Error) {
+        return dumped;
+    }
+    if (dumped && typeof dumped === 'object' && 'message' in dumped) {
+        const error = new Error(String(dumped.message));
+        const name = dumped.name;
+        if (typeof name === 'string') {
+            error.name = name;
+        }
+        return error;
+    }
+    return new Error(typeof dumped === 'string' ? dumped : 'Sandbox execution failed');
+}
+/**
+ * Execute untrusted handler or seed code inside a QuickJS WebAssembly sandbox.
+ *
+ * The guest has no access to the host runtime (`process`, `require`, `fetch`,
+ * the `Function` constructor, and so on). It can only talk to the `store` and
+ * `faker` bridges and read the injected JSON globals. Memory and time limits
+ * bound the remaining denial-of-service risk.
+ */
+export async function runInSandbox(options) {
+    const { code, store, jsonGlobals = {}, includeSeed = false } = options;
+    const quickJS = await loadQuickJS();
+    const context = quickJS.newContext();
+    try {
+        const { runtime } = context;
+        runtime.setMemoryLimit(MEMORY_LIMIT_BYTES);
+        const deadline = Date.now() + EXECUTION_TIMEOUT_MS;
+        runtime.setInterruptHandler(() => Date.now() > deadline);
+        // Host bridge: store operations run the real (tracked) store and return JSON.
+        const storeBridge = context.newFunction('__store', (methodHandle, argsHandle) => context.newString(runStoreBridge(store, context.getString(methodHandle), context.getString(argsHandle))));
+        context.setProp(context.global, '__store', storeBridge);
+        storeBridge.dispose();
+        // Host bridge: faker. Only a property path and JSON arguments cross the boundary.
+        const fakerBridge = context.newFunction('__faker', (pathHandle, argsHandle) => context.newString(runFakerBridge(context.getString(pathHandle), context.getString(argsHandle))));
+        context.setProp(context.global, '__faker', fakerBridge);
+        fakerBridge.dispose();
+        // Inject read-only inputs (req/res/schema) as JSON strings the guest parses.
+        for (const [name, value] of Object.entries(jsonGlobals)) {
+            const handle = context.newString(JSON.stringify(value ?? null));
+            context.setProp(context.global, `__json_${name}`, handle);
+            handle.dispose();
+        }
+        const evalResult = context.evalCode(buildGuestSource(code, Object.keys(jsonGlobals), includeSeed));
+        if (evalResult.error) {
+            const error = context.dump(evalResult.error);
+            evalResult.error.dispose();
+            throw toError(error);
+        }
+        // The completion value is the async IIFE's promise. Resolve it, then drain the
+        // job queue; every host bridge is synchronous, so one pass settles the promise.
+        const promiseHandle = evalResult.value;
+        const resolved = context.resolvePromise(promiseHandle);
+        promiseHandle.dispose();
+        const jobs = runtime.executePendingJobs();
+        if (jobs.error) {
+            const error = context.dump(jobs.error);
+            jobs.error.dispose();
+            throw toError(error);
+        }
+        const settled = await resolved;
+        if (settled.error) {
+            const error = context.dump(settled.error);
+            settled.error.dispose();
+            throw toError(error);
+        }
+        const value = context.dump(settled.value);
+        settled.value.dispose();
+        return value;
+    }
+    finally {
+        context.dispose();
+    }
+}

package/dist/utils/store-wrapper.d.ts

@@ -2,7 +2,7 @@ import type { Store } from '../libs/store.js';
 /**
  * Public interface of the Store class (methods only, no private properties).
  */
-type StoreInterface = Pick<Store, 'list' | 'get' | 'create' | 'update' | 'delete' | 'clear'>;
+export type StoreInterface = Pick<Store, 'list' | 'get' | 'create' | 'update' | 'delete' | 'clear'>;
 /**
  * Represents a single store operation with its result.
  */

package/dist/utils/store-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-wrapper.d.ts","sourceRoot":"","sources":["../../src/utils/store-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAE1C;;GAEG;AACH,KAAK,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAA;AAE5F;;GAEG;AACH,KAAK,cAAc,GAAG;IACpB,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1D,mCAAmC;IACnC,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,0CAA0C;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG;IAChD,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CA2CA"}
+{"version":3,"file":"store-wrapper.d.ts","sourceRoot":"","sources":["../../src/utils/store-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAE1C;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAA;AAEnG;;GAEG;AACH,KAAK,cAAc,GAAG;IACpB,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1D,mCAAmC;IACnC,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,0CAA0C;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG;IAChD,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CA2CA"}

package/package.json

@@ -16,7 +16,7 @@
     "swagger",
     "cli"
   ],
-  "version": "0.13.0",
+  "version": "0.14.0",
   "engines": {
     "node": ">=22"
   },
@@ -56,13 +56,14 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "hono": "^4.12.7",
+    "quickjs-emscripten": "0.32.0",
     "yaml": "^2.9.0",
-    "@scalar/helpers": "0.11.2",
-    "@scalar/json-magic": "0.13.3",
+    "@scalar/helpers": "0.11.3",
+    "@scalar/json-magic": "0.13.4",
     "@scalar/openapi-types": "0.9.5",
     "@scalar/openapi-upgrader": "0.2.15",
-    "@scalar/workspace-store": "0.59.0",
-    "@scalar/types": "0.18.3"
+    "@scalar/types": "0.19.0",
+    "@scalar/workspace-store": "0.60.0"
   },
   "devDependencies": {
     "@types/node": "^24.1.0",