n8n-workflow 2.31.1 → 2.32.0

package/dist/cjs/expression.js

@@ -1,3 +1,4 @@
+"use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -31,589 +32,577 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-(function (factory) {
-    if (typeof module === "object" && typeof module.exports === "object") {
-        var v = factory(require, exports);
-        if (v !== undefined) module.exports = v;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Expression = void 0;
+const expression_runtime_1 = require("@n8n/expression-runtime");
+const luxon_1 = require("luxon");
+const errors_1 = require("./errors");
+const expression_extension_error_1 = require("./errors/expression-extension.error");
+const expression_error_1 = require("./errors/expression.error");
+const expression_evaluator_proxy_1 = require("./expression-evaluator-proxy");
+const expression_sandboxing_1 = require("./expression-sandboxing");
+const expression_helpers_1 = require("./expressions/expression-helpers");
+const LoggerProxy = __importStar(require("./logger-proxy"));
+const extensions_1 = require("./extensions");
+const expression_extension_1 = require("./extensions/expression-extension");
+const extended_functions_1 = require("./extensions/extended-functions");
+const IS_FRONTEND_IN_DEV_MODE = typeof process === 'object' &&
+    Object.keys(process).length === 1 &&
+    'env' in process &&
+    Object.keys(process.env).length === 0;
+const IS_FRONTEND = typeof process === 'undefined' || IS_FRONTEND_IN_DEV_MODE;
+const isSyntaxError = (error) => error instanceof SyntaxError || (error instanceof Error && error.name === 'SyntaxError');
+const isExpressionError = (error) => error instanceof expression_error_1.ExpressionError || error instanceof expression_extension_error_1.ExpressionExtensionError;
+const isTypeError = (error) => error instanceof TypeError || (error instanceof Error && error.name === 'TypeError');
+// Make sure that error get forwarded
+(0, expression_evaluator_proxy_1.setErrorHandler)((error) => {
+    if (isExpressionError(error))
+        throw error;
+});
+/**
+ * Map errors from the VM expression evaluator to host-side error types.
+ *
+ * The VM bridge can only reconstruct plain Error objects with .name set,
+ * because it can't import ExpressionError/ExpressionExtensionError from
+ * packages/workflow without creating a circular dependency.
+ *
+ * TODO: Move this reconstruction into the bridge once expression-runtime
+ * can depend on workflow error classes (or a shared error package exists).
+ */
+function mapVmError(error) {
+    if (isExpressionError(error))
+        return error;
+    // Runtime error types (TimeoutError, MemoryLimitError, etc.) must be
+    // checked before the name-based reconstruction below, because they
+    // extend the runtime's ExpressionError and share .name === 'ExpressionError'.
+    if (error instanceof expression_runtime_1.TimeoutError) {
+        const wrapped = new expression_error_1.ExpressionError('Expression timed out');
+        wrapped.cause = error;
+        return wrapped;
     }
-    else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "@n8n/expression-runtime", "luxon", "./errors", "./errors/expression-extension.error", "./errors/expression.error", "./expression-evaluator-proxy", "./expression-sandboxing", "./expressions/expression-helpers", "./logger-proxy", "./extensions", "./extensions/expression-extension", "./extensions/extended-functions"], factory);
+    if (error instanceof expression_runtime_1.MemoryLimitError) {
+        const wrapped = new expression_error_1.ExpressionError('Expression exceeded memory limit');
+        wrapped.cause = error;
+        return wrapped;
     }
-})(function (require, exports) {
-    "use strict";
-    var __syncRequire = typeof module === "object" && typeof module.exports === "object";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.Expression = void 0;
-    const expression_runtime_1 = require("@n8n/expression-runtime");
-    const luxon_1 = require("luxon");
-    const errors_1 = require("./errors");
-    const expression_extension_error_1 = require("./errors/expression-extension.error");
-    const expression_error_1 = require("./errors/expression.error");
-    const expression_evaluator_proxy_1 = require("./expression-evaluator-proxy");
-    const expression_sandboxing_1 = require("./expression-sandboxing");
-    const expression_helpers_1 = require("./expressions/expression-helpers");
-    const LoggerProxy = __importStar(require("./logger-proxy"));
-    const extensions_1 = require("./extensions");
-    const expression_extension_1 = require("./extensions/expression-extension");
-    const extended_functions_1 = require("./extensions/extended-functions");
-    const IS_FRONTEND_IN_DEV_MODE = typeof process === 'object' &&
-        Object.keys(process).length === 1 &&
-        'env' in process &&
-        Object.keys(process.env).length === 0;
-    const IS_FRONTEND = typeof process === 'undefined' || IS_FRONTEND_IN_DEV_MODE;
-    const isSyntaxError = (error) => error instanceof SyntaxError || (error instanceof Error && error.name === 'SyntaxError');
-    const isExpressionError = (error) => error instanceof expression_error_1.ExpressionError || error instanceof expression_extension_error_1.ExpressionExtensionError;
-    const isTypeError = (error) => error instanceof TypeError || (error instanceof Error && error.name === 'TypeError');
-    // Make sure that error get forwarded
-    (0, expression_evaluator_proxy_1.setErrorHandler)((error) => {
-        if (isExpressionError(error))
-            throw error;
-    });
-    /**
-     * Map errors from the VM expression evaluator to host-side error types.
-     *
-     * The VM bridge can only reconstruct plain Error objects with .name set,
-     * because it can't import ExpressionError/ExpressionExtensionError from
-     * packages/workflow without creating a circular dependency.
-     *
-     * TODO: Move this reconstruction into the bridge once expression-runtime
-     * can depend on workflow error classes (or a shared error package exists).
-     */
-    function mapVmError(error) {
-        if (isExpressionError(error))
-            return error;
-        // Runtime error types (TimeoutError, MemoryLimitError, etc.) must be
-        // checked before the name-based reconstruction below, because they
-        // extend the runtime's ExpressionError and share .name === 'ExpressionError'.
-        if (error instanceof expression_runtime_1.TimeoutError) {
-            const wrapped = new expression_error_1.ExpressionError('Expression timed out');
-            wrapped.cause = error;
-            return wrapped;
-        }
-        if (error instanceof expression_runtime_1.MemoryLimitError) {
-            const wrapped = new expression_error_1.ExpressionError('Expression exceeded memory limit');
-            wrapped.cause = error;
-            return wrapped;
-        }
-        if (error instanceof expression_runtime_1.SecurityViolationError) {
-            const wrapped = new expression_error_1.ExpressionError(error.message);
-            wrapped.cause = error;
-            return wrapped;
-        }
-        // Name-based reconstruction for errors that crossed the isolate boundary
-        if (error instanceof Error && error.name === 'ExpressionExtensionError') {
-            const reconstructed = new expression_extension_error_1.ExpressionExtensionError(error.message);
-            Object.assign(reconstructed, error);
-            return reconstructed;
-        }
-        if (error instanceof Error && error.name === 'ExpressionError') {
-            const reconstructed = new expression_error_1.ExpressionError(error.message);
-            Object.assign(reconstructed, error);
-            return reconstructed;
-        }
-        if (isSyntaxError(error))
-            return new expression_error_1.ExpressionError('invalid syntax');
-        if (error instanceof Error)
-            return error;
-        return new Error(String(error));
+    if (error instanceof expression_runtime_1.SecurityViolationError) {
+        const wrapped = new expression_error_1.ExpressionError(error.message);
+        wrapped.cause = error;
+        return wrapped;
     }
-    /**
-     * Creates a safe Object wrapper that removes dangerous static methods
-     * that could be used to bypass property access sanitization.
-     *
-     * Blocked methods:
-     * - defineProperty/defineProperties: Can set properties bypassing access checks
-     * - setPrototypeOf/getPrototypeOf: Can manipulate prototype chains
-     * - getOwnPropertyDescriptor(s): Can introspect sensitive properties
-     * - __defineGetter__/__defineSetter__: Legacy methods that can bypass set traps
-     * - __lookupGetter__/__lookupSetter__: Can introspect getters/setters
-     *
-     * Object.create is wrapped to prevent passing property descriptors (2nd argument)
-     */
-    const createSafeObject = () => {
-        const safeCreate = (proto) => {
-            // Only allow single-argument create (no property descriptors)
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-            return Object.create(proto);
-        };
-        // Block dangerous static and prototype methods
-        const blockedMethods = new Set([
-            // Static methods that can bypass property access checks
-            'defineProperty',
-            'defineProperties',
-            'setPrototypeOf',
-            'getPrototypeOf',
-            'getOwnPropertyDescriptor',
-            'getOwnPropertyDescriptors',
-            // Legacy methods that can bypass Proxy set traps
-            '__defineGetter__',
-            '__defineSetter__',
-            '__lookupGetter__',
-            '__lookupSetter__',
-        ]);
-        // Create a proxy that blocks dangerous methods
-        return new Proxy(Object, {
-            get(target, prop, receiver) {
-                if (blockedMethods.has(prop)) {
-                    return undefined;
-                }
-                // Wrap Object.create to prevent property descriptor argument
-                if (prop === 'create') {
-                    return safeCreate;
-                }
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-                return Reflect.get(target, prop, receiver);
-            },
-            // Block defineProperty trap to prevent __defineGetter__ from working
-            defineProperty() {
-                return false;
-            },
-        });
+    // Name-based reconstruction for errors that crossed the isolate boundary
+    if (error instanceof Error && error.name === 'ExpressionExtensionError') {
+        const reconstructed = new expression_extension_error_1.ExpressionExtensionError(error.message);
+        Object.assign(reconstructed, error);
+        return reconstructed;
+    }
+    if (error instanceof Error && error.name === 'ExpressionError') {
+        const reconstructed = new expression_error_1.ExpressionError(error.message);
+        Object.assign(reconstructed, error);
+        return reconstructed;
+    }
+    if (isSyntaxError(error))
+        return new expression_error_1.ExpressionError('invalid syntax');
+    if (error instanceof Error)
+        return error;
+    return new Error(String(error));
+}
+/**
+ * Creates a safe Object wrapper that removes dangerous static methods
+ * that could be used to bypass property access sanitization.
+ *
+ * Blocked methods:
+ * - defineProperty/defineProperties: Can set properties bypassing access checks
+ * - setPrototypeOf/getPrototypeOf: Can manipulate prototype chains
+ * - getOwnPropertyDescriptor(s): Can introspect sensitive properties
+ * - __defineGetter__/__defineSetter__: Legacy methods that can bypass set traps
+ * - __lookupGetter__/__lookupSetter__: Can introspect getters/setters
+ *
+ * Object.create is wrapped to prevent passing property descriptors (2nd argument)
+ */
+const createSafeObject = () => {
+    const safeCreate = (proto) => {
+        // Only allow single-argument create (no property descriptors)
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+        return Object.create(proto);
     };
-    /**
-     * List of properties that are blocked on Error and all Error subclasses.
-     * These properties can be exploited for sandbox escape via V8's stack trace API.
-     */
-    const blockedErrorProperties = new Set([
-        // V8 stack trace manipulation
-        'captureStackTrace',
-        'prepareStackTrace',
-        'stackTraceLimit',
+    // Block dangerous static and prototype methods
+    const blockedMethods = new Set([
+        // Static methods that can bypass property access checks
+        'defineProperty',
+        'defineProperties',
+        'setPrototypeOf',
+        'getPrototypeOf',
+        'getOwnPropertyDescriptor',
+        'getOwnPropertyDescriptors',
         // Legacy methods that can bypass Proxy set traps
         '__defineGetter__',
         '__defineSetter__',
         '__lookupGetter__',
         '__lookupSetter__',
     ]);
+    // Create a proxy that blocks dangerous methods
+    return new Proxy(Object, {
+        get(target, prop, receiver) {
+            if (blockedMethods.has(prop)) {
+                return undefined;
+            }
+            // Wrap Object.create to prevent property descriptor argument
+            if (prop === 'create') {
+                return safeCreate;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+            return Reflect.get(target, prop, receiver);
+        },
+        // Block defineProperty trap to prevent __defineGetter__ from working
+        defineProperty() {
+            return false;
+        },
+    });
+};
+/**
+ * List of properties that are blocked on Error and all Error subclasses.
+ * These properties can be exploited for sandbox escape via V8's stack trace API.
+ */
+const blockedErrorProperties = new Set([
+    // V8 stack trace manipulation
+    'captureStackTrace',
+    'prepareStackTrace',
+    'stackTraceLimit',
+    // Legacy methods that can bypass Proxy set traps
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/**
+ * Creates a safe Error constructor that removes dangerous static methods
+ * like captureStackTrace and prepareStackTrace which can be exploited for RCE.
+ *
+ * The V8 prepareStackTrace attack works by:
+ * 1. Setting Error.prepareStackTrace to a malicious function
+ * 2. Creating a new Error and accessing its .stack property
+ * 3. V8 calls the prepareStackTrace function with CallSite objects
+ * 4. CallSite.getThis() returns the real global object, escaping the sandbox
+ */
+const createSafeError = () => {
+    return new Proxy(Error, {
+        get(target, prop, receiver) {
+            if (blockedErrorProperties.has(prop)) {
+                return undefined;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+            return Reflect.get(target, prop, receiver);
+        },
+        set() {
+            // Prevent setting any properties on Error (like prepareStackTrace)
+            return false;
+        },
+        defineProperty() {
+            // Prevent defineProperty (blocks __defineGetter__ internally)
+            return false;
+        },
+    });
+};
+/**
+ * Creates a safe wrapper for Error subclasses (TypeError, SyntaxError, etc.)
+ * While prepareStackTrace is only on Error in V8, we wrap subclasses for defense in depth.
+ */
+const createSafeErrorSubclass = (ErrorClass) => {
+    return new Proxy(ErrorClass, {
+        get(target, prop, receiver) {
+            if (blockedErrorProperties.has(prop)) {
+                return undefined;
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+        set() {
+            return false;
+        },
+        defineProperty() {
+            return false;
+        },
+    });
+};
+class Expression {
+    timezone;
+    static expressionEngine = 'legacy';
+    static vmEvaluator;
+    constructor(timezone) {
+        this.timezone = timezone;
+    }
     /**
-     * Creates a safe Error constructor that removes dangerous static methods
-     * like captureStackTrace and prepareStackTrace which can be exploited for RCE.
-     *
-     * The V8 prepareStackTrace attack works by:
-     * 1. Setting Error.prepareStackTrace to a malicious function
-     * 2. Creating a new Error and accessing its .stack property
-     * 3. V8 calls the prepareStackTrace function with CallSite objects
-     * 4. CallSite.getThis() returns the real global object, escaping the sandbox
+     * Check if VM evaluator should be used for evaluation.
+     * @private
      */
-    const createSafeError = () => {
-        return new Proxy(Error, {
-            get(target, prop, receiver) {
-                if (blockedErrorProperties.has(prop)) {
-                    return undefined;
-                }
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-                return Reflect.get(target, prop, receiver);
-            },
-            set() {
-                // Prevent setting any properties on Error (like prepareStackTrace)
-                return false;
-            },
-            defineProperty() {
-                // Prevent defineProperty (blocks __defineGetter__ internally)
-                return false;
-            },
-        });
-    };
+    static shouldUseVm() {
+        return this.expressionEngine === 'vm' && !IS_FRONTEND && !!this.vmEvaluator;
+    }
     /**
-     * Creates a safe wrapper for Error subclasses (TypeError, SyntaxError, etc.)
-     * While prepareStackTrace is only on Error in V8, we wrap subclasses for defense in depth.
+     * Initialize the VM evaluator (if feature flag is enabled).
+     * Should be called once during application startup.
+     * Only available in Node.js environments (not in browser).
      */
-    const createSafeErrorSubclass = (ErrorClass) => {
-        return new Proxy(ErrorClass, {
-            get(target, prop, receiver) {
-                if (blockedErrorProperties.has(prop)) {
-                    return undefined;
-                }
-                return Reflect.get(target, prop, receiver);
-            },
-            set() {
-                return false;
-            },
-            defineProperty() {
-                return false;
-            },
-        });
-    };
-    class Expression {
-        timezone;
-        static expressionEngine = 'legacy';
-        static vmEvaluator;
-        constructor(timezone) {
-            this.timezone = timezone;
+    static async initExpressionEngine(options) {
+        if (options.engine !== 'vm' || IS_FRONTEND)
+            return;
+        this.expressionEngine = options.engine;
+        if (!this.vmEvaluator) {
+            // Dynamic import to avoid loading expression-runtime in browser environments
+            const { ExpressionEvaluator, IsolatedVmBridge } = await import('@n8n/expression-runtime');
+            this.vmEvaluator = new ExpressionEvaluator({
+                createBridge: () => new IsolatedVmBridge({
+                    timeout: options.bridgeTimeout,
+                    memoryLimit: options.bridgeMemoryLimit,
+                    logger: LoggerProxy,
+                }),
+                maxCodeCacheSize: options.maxCodeCacheSize,
+                poolSize: options.poolSize,
+                idleTimeoutMs: options.idleTimeoutMs,
+                hooks: {
+                    before: [expression_sandboxing_1.ThisSanitizer],
+                    after: [expression_sandboxing_1.PrototypeSanitizer, expression_sandboxing_1.DollarSignValidator],
+                },
+                logger: LoggerProxy,
+                observability: options.observability,
+            });
+            await this.vmEvaluator.initialize();
+        }
+    }
+    /** Returns whether an isolate was newly acquired; `false` means this caller already held one and must not release it. */
+    async acquireIsolate() {
+        if (Expression.vmEvaluator)
+            return await Expression.vmEvaluator.acquire(this);
+        return false;
+    }
+    async releaseIsolate() {
+        if (Expression.vmEvaluator)
+            await Expression.vmEvaluator.release(this);
+    }
+    /**
+     * Dispose the VM evaluator and release resources.
+     * Should be called during application shutdown or test teardown.
+     */
+    static async disposeExpressionEngine() {
+        if (this.vmEvaluator) {
+            await this.vmEvaluator.dispose();
+            this.vmEvaluator = undefined;
         }
+    }
+    /**
+     * Get the active expression evaluation implementation.
+     * Used for testing and verification.
+     */
+    static getActiveImplementation() {
+        if (this.shouldUseVm())
+            return 'vm';
+        return 'legacy';
+    }
+    /**
+     * Set the expression engine programmatically.
+     *
+     * WARNING: This is a global setting — switching engines mid-execution could
+     * cause a workflow to evaluate some expressions with one engine and some with
+     * another. Only use this in benchmarks and tests, never in production code.
+     * In production, set `N8N_EXPRESSION_ENGINE` before process startup instead.
+     */
+    static setExpressionEngine(engine) {
+        this.expressionEngine = engine;
+    }
+    static initializeGlobalContext(data) {
         /**
-         * Check if VM evaluator should be used for evaluation.
-         * @private
+         * Denylist
          */
-        static shouldUseVm() {
-            return this.expressionEngine === 'vm' && !IS_FRONTEND && !!this.vmEvaluator;
+        data.document = {};
+        data.global = {};
+        data.window = {};
+        data.Window = {};
+        data.this = {};
+        data.globalThis = {};
+        data.self = {};
+        // Alerts
+        data.alert = {};
+        data.prompt = {};
+        data.confirm = {};
+        // Prevent Remote Code Execution
+        data.eval = {};
+        data.uneval = {};
+        data.setTimeout = {};
+        data.setInterval = {};
+        data.setImmediate = {};
+        data.clearImmediate = {};
+        data.queueMicrotask = {};
+        data.Function = {};
+        // Prevent Node.js module access
+        data.require = {};
+        data.module = {};
+        data.Buffer = {};
+        data.__dirname = {};
+        data.__filename = {};
+        // Prevent requests
+        data.fetch = {};
+        data.XMLHttpRequest = {};
+        // Prevent control abstraction
+        data.Promise = {};
+        data.Generator = {};
+        data.GeneratorFunction = {};
+        data.AsyncFunction = {};
+        data.AsyncGenerator = {};
+        data.AsyncGeneratorFunction = {};
+        // Prevent WASM
+        data.WebAssembly = {};
+        // Prevent Reflection
+        data.Reflect = {};
+        data.Proxy = {};
+        // These four names are inherited from `Object.prototype`. In the secure-mode
+        // task-runner sandbox `Object.prototype` is frozen, so plain assignment walks
+        // the prototype chain to the now read-only inherited property and throws in
+        // strict mode. Define them as own properties to overwrite them safely.
+        for (const key of [
+            '__lookupGetter__',
+            '__lookupSetter__',
+            '__defineGetter__',
+            '__defineSetter__',
+        ]) {
+            Object.defineProperty(data, key, {
+                value: undefined,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
         }
+        // Deprecated
+        data.escape = {};
+        data.unescape = {};
         /**
-         * Initialize the VM evaluator (if feature flag is enabled).
-         * Should be called once during application startup.
-         * Only available in Node.js environments (not in browser).
+         * Allowlist
          */
-        static async initExpressionEngine(options) {
-            if (options.engine !== 'vm' || IS_FRONTEND)
-                return;
-            this.expressionEngine = options.engine;
-            if (!this.vmEvaluator) {
-                // Dynamic import to avoid loading expression-runtime in browser environments
-                const { ExpressionEvaluator, IsolatedVmBridge } = await (__syncRequire ? Promise.resolve().then(() => __importStar(require('@n8n/expression-runtime'))) : new Promise((resolve_1, reject_1) => { require(['@n8n/expression-runtime'], resolve_1, reject_1); }).then(__importStar));
-                this.vmEvaluator = new ExpressionEvaluator({
-                    createBridge: () => new IsolatedVmBridge({
-                        timeout: options.bridgeTimeout,
-                        memoryLimit: options.bridgeMemoryLimit,
-                        logger: LoggerProxy,
-                    }),
-                    maxCodeCacheSize: options.maxCodeCacheSize,
-                    poolSize: options.poolSize,
-                    idleTimeoutMs: options.idleTimeoutMs,
-                    hooks: {
-                        before: [expression_sandboxing_1.ThisSanitizer],
-                        after: [expression_sandboxing_1.PrototypeSanitizer, expression_sandboxing_1.DollarSignValidator],
-                    },
-                    logger: LoggerProxy,
-                    observability: options.observability,
-                });
-                await this.vmEvaluator.initialize();
-            }
+        // Dates
+        data.Date = Date;
+        data.DateTime = luxon_1.DateTime;
+        data.Interval = luxon_1.Interval;
+        data.Duration = luxon_1.Duration;
+        // Objects - use safe wrapper to block dangerous methods like defineProperty
+        data.Object = createSafeObject();
+        // Arrays
+        data.Array = Array;
+        data.Int8Array = Int8Array;
+        data.Uint8Array = Uint8Array;
+        data.Uint8ClampedArray = Uint8ClampedArray;
+        data.Int16Array = Int16Array;
+        data.Uint16Array = Uint16Array;
+        data.Int32Array = Int32Array;
+        data.Uint32Array = Uint32Array;
+        data.Float32Array = Float32Array;
+        data.Float64Array = Float64Array;
+        data.BigInt64Array = typeof BigInt64Array !== 'undefined' ? BigInt64Array : {};
+        data.BigUint64Array = typeof BigUint64Array !== 'undefined' ? BigUint64Array : {};
+        // Collections
+        data.Map = typeof Map !== 'undefined' ? Map : {};
+        data.WeakMap = typeof WeakMap !== 'undefined' ? WeakMap : {};
+        data.Set = typeof Set !== 'undefined' ? Set : {};
+        data.WeakSet = typeof WeakSet !== 'undefined' ? WeakSet : {};
+        // Errors - use safe wrappers to block prepareStackTrace, captureStackTrace,
+        // and other dangerous properties that could enable sandbox escape
+        data.Error = createSafeError();
+        data.TypeError = createSafeErrorSubclass(TypeError);
+        data.SyntaxError = createSafeErrorSubclass(SyntaxError);
+        data.EvalError = createSafeErrorSubclass(EvalError);
+        data.RangeError = createSafeErrorSubclass(RangeError);
+        data.ReferenceError = createSafeErrorSubclass(ReferenceError);
+        data.URIError = createSafeErrorSubclass(URIError);
+        // Internationalization
+        data.Intl = typeof Intl !== 'undefined' ? Intl : {};
+        // Text
+        // eslint-disable-next-line id-denylist
+        data.String = String;
+        data.RegExp = RegExp;
+        // Math
+        data.Math = Math;
+        // eslint-disable-next-line id-denylist
+        data.Number = Number;
+        data.BigInt = typeof BigInt !== 'undefined' ? BigInt : {};
+        data.Infinity = Infinity;
+        data.NaN = NaN;
+        data.isFinite = Number.isFinite;
+        data.isNaN = Number.isNaN;
+        data.parseFloat = parseFloat;
+        data.parseInt = parseInt;
+        // Structured data
+        data.JSON = JSON;
+        data.ArrayBuffer = typeof ArrayBuffer !== 'undefined' ? ArrayBuffer : {};
+        data.SharedArrayBuffer = typeof SharedArrayBuffer !== 'undefined' ? SharedArrayBuffer : {};
+        data.Atomics = typeof Atomics !== 'undefined' ? Atomics : {};
+        data.DataView = typeof DataView !== 'undefined' ? DataView : {};
+        data.encodeURI = encodeURI;
+        data.encodeURIComponent = encodeURIComponent;
+        data.decodeURI = decodeURI;
+        data.decodeURIComponent = decodeURIComponent;
+        // Other
+        // eslint-disable-next-line id-denylist
+        data.Boolean = Boolean;
+        data.Symbol = Symbol;
+    }
+    static resolveWithoutWorkflow(expression, data = {}) {
+        return (0, expression_evaluator_proxy_1.evaluateExpression)(expression, data);
+    }
+    /**
+     * Converts an object to a string in a way to make it clear that
+     * the value comes from an object
+     *
+     */
+    convertObjectValueToString(value) {
+        if (value instanceof luxon_1.DateTime && value.invalidReason !== null) {
+            throw new errors_1.UserError('invalid DateTime');
         }
-        /** Returns whether an isolate was newly acquired; `false` means this caller already held one and must not release it. */
-        async acquireIsolate() {
-            if (Expression.vmEvaluator)
-                return await Expression.vmEvaluator.acquire(this);
-            return false;
+        if (value === null) {
+            return 'null';
         }
-        async releaseIsolate() {
-            if (Expression.vmEvaluator)
-                await Expression.vmEvaluator.release(this);
+        let typeName = value.constructor.name ?? 'Object';
+        if (luxon_1.DateTime.isDateTime(value)) {
+            typeName = 'DateTime';
         }
-        /**
-         * Dispose the VM evaluator and release resources.
-         * Should be called during application shutdown or test teardown.
-         */
-        static async disposeExpressionEngine() {
-            if (this.vmEvaluator) {
-                await this.vmEvaluator.dispose();
-                this.vmEvaluator = undefined;
-            }
+        let result = '';
+        if (value instanceof Date) {
+            // We don't want to use JSON.stringify for dates since it disregards workflow timezone
+            result = luxon_1.DateTime.fromJSDate(value, {
+                zone: this.timezone,
+            }).toISO();
         }
-        /**
-         * Get the active expression evaluation implementation.
-         * Used for testing and verification.
-         */
-        static getActiveImplementation() {
-            if (this.shouldUseVm())
-                return 'vm';
-            return 'legacy';
+        else if (luxon_1.DateTime.isDateTime(value)) {
+            result = value.toString();
         }
-        /**
-         * Set the expression engine programmatically.
-         *
-         * WARNING: This is a global setting — switching engines mid-execution could
-         * cause a workflow to evaluate some expressions with one engine and some with
-         * another. Only use this in benchmarks and tests, never in production code.
-         * In production, set `N8N_EXPRESSION_ENGINE` before process startup instead.
-         */
-        static setExpressionEngine(engine) {
-            this.expressionEngine = engine;
+        else {
+            result = JSON.stringify(value);
         }
-        static initializeGlobalContext(data) {
-            /**
-             * Denylist
-             */
-            data.document = {};
-            data.global = {};
-            data.window = {};
-            data.Window = {};
-            data.this = {};
-            data.globalThis = {};
-            data.self = {};
-            // Alerts
-            data.alert = {};
-            data.prompt = {};
-            data.confirm = {};
-            // Prevent Remote Code Execution
-            data.eval = {};
-            data.uneval = {};
-            data.setTimeout = {};
-            data.setInterval = {};
-            data.setImmediate = {};
-            data.clearImmediate = {};
-            data.queueMicrotask = {};
-            data.Function = {};
-            // Prevent Node.js module access
-            data.require = {};
-            data.module = {};
-            data.Buffer = {};
-            data.__dirname = {};
-            data.__filename = {};
-            // Prevent requests
-            data.fetch = {};
-            data.XMLHttpRequest = {};
-            // Prevent control abstraction
-            data.Promise = {};
-            data.Generator = {};
-            data.GeneratorFunction = {};
-            data.AsyncFunction = {};
-            data.AsyncGenerator = {};
-            data.AsyncGeneratorFunction = {};
-            // Prevent WASM
-            data.WebAssembly = {};
-            // Prevent Reflection
-            data.Reflect = {};
-            data.Proxy = {};
-            // These four names are inherited from `Object.prototype`. In the secure-mode
-            // task-runner sandbox `Object.prototype` is frozen, so plain assignment walks
-            // the prototype chain to the now read-only inherited property and throws in
-            // strict mode. Define them as own properties to overwrite them safely.
-            for (const key of [
-                '__lookupGetter__',
-                '__lookupSetter__',
-                '__defineGetter__',
-                '__defineSetter__',
-            ]) {
-                Object.defineProperty(data, key, {
-                    value: undefined,
-                    writable: true,
-                    enumerable: true,
-                    configurable: true,
-                });
-            }
-            // Deprecated
-            data.escape = {};
-            data.unescape = {};
-            /**
-             * Allowlist
-             */
-            // Dates
-            data.Date = Date;
-            data.DateTime = luxon_1.DateTime;
-            data.Interval = luxon_1.Interval;
-            data.Duration = luxon_1.Duration;
-            // Objects - use safe wrapper to block dangerous methods like defineProperty
-            data.Object = createSafeObject();
-            // Arrays
-            data.Array = Array;
-            data.Int8Array = Int8Array;
-            data.Uint8Array = Uint8Array;
-            data.Uint8ClampedArray = Uint8ClampedArray;
-            data.Int16Array = Int16Array;
-            data.Uint16Array = Uint16Array;
-            data.Int32Array = Int32Array;
-            data.Uint32Array = Uint32Array;
-            data.Float32Array = Float32Array;
-            data.Float64Array = Float64Array;
-            data.BigInt64Array = typeof BigInt64Array !== 'undefined' ? BigInt64Array : {};
-            data.BigUint64Array = typeof BigUint64Array !== 'undefined' ? BigUint64Array : {};
-            // Collections
-            data.Map = typeof Map !== 'undefined' ? Map : {};
-            data.WeakMap = typeof WeakMap !== 'undefined' ? WeakMap : {};
-            data.Set = typeof Set !== 'undefined' ? Set : {};
-            data.WeakSet = typeof WeakSet !== 'undefined' ? WeakSet : {};
-            // Errors - use safe wrappers to block prepareStackTrace, captureStackTrace,
-            // and other dangerous properties that could enable sandbox escape
-            data.Error = createSafeError();
-            data.TypeError = createSafeErrorSubclass(TypeError);
-            data.SyntaxError = createSafeErrorSubclass(SyntaxError);
-            data.EvalError = createSafeErrorSubclass(EvalError);
-            data.RangeError = createSafeErrorSubclass(RangeError);
-            data.ReferenceError = createSafeErrorSubclass(ReferenceError);
-            data.URIError = createSafeErrorSubclass(URIError);
-            // Internationalization
-            data.Intl = typeof Intl !== 'undefined' ? Intl : {};
-            // Text
-            // eslint-disable-next-line id-denylist
-            data.String = String;
-            data.RegExp = RegExp;
-            // Math
-            data.Math = Math;
-            // eslint-disable-next-line id-denylist
-            data.Number = Number;
-            data.BigInt = typeof BigInt !== 'undefined' ? BigInt : {};
-            data.Infinity = Infinity;
-            data.NaN = NaN;
-            data.isFinite = Number.isFinite;
-            data.isNaN = Number.isNaN;
-            data.parseFloat = parseFloat;
-            data.parseInt = parseInt;
-            // Structured data
-            data.JSON = JSON;
-            data.ArrayBuffer = typeof ArrayBuffer !== 'undefined' ? ArrayBuffer : {};
-            data.SharedArrayBuffer = typeof SharedArrayBuffer !== 'undefined' ? SharedArrayBuffer : {};
-            data.Atomics = typeof Atomics !== 'undefined' ? Atomics : {};
-            data.DataView = typeof DataView !== 'undefined' ? DataView : {};
-            data.encodeURI = encodeURI;
-            data.encodeURIComponent = encodeURIComponent;
-            data.decodeURI = decodeURI;
-            data.decodeURIComponent = decodeURIComponent;
-            // Other
-            // eslint-disable-next-line id-denylist
-            data.Boolean = Boolean;
-            data.Symbol = Symbol;
+        result = result
+            .replace(/,"/g, ', "') // spacing for
+            .replace(/":/g, '": '); // readability
+        return `[${typeName}: ${result}]`;
+    }
+    /**
+     * Resolves the parameter value.  If it is an expression it will execute it and
+     * return the result. For everything simply the supplied value will be returned.
+     *
+     * @param {NodeParameterValue} parameterValue - The parameter value to resolve
+     * @param {IWorkflowDataProxyData} data - The workflow data proxy data
+     * @param {boolean} [returnObjectAsString=false] - Whether to convert objects to strings
+     */
+    resolveSimpleParameterValue(parameterValue, data, returnObjectAsString = false) {
+        // Check if it is an expression
+        if (!(0, expression_helpers_1.isExpression)(parameterValue)) {
+            // Is no expression so return value
+            return parameterValue;
         }
-        static resolveWithoutWorkflow(expression, data = {}) {
-            return (0, expression_evaluator_proxy_1.evaluateExpression)(expression, data);
+        // Is an expression
+        // Remove the equal sign
+        parameterValue = parameterValue.substr(1);
+        // Support only a subset of process properties
+        data.process =
+            typeof process !== 'undefined'
+                ? {
+                    arch: process.arch,
+                    env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE !== 'false' ? {} : process.env,
+                    platform: process.platform,
+                    pid: process.pid,
+                    ppid: process.ppid,
+                    release: process.release,
+                    version: process.version,
+                    versions: process.versions,
+                }
+                : {};
+        Expression.initializeGlobalContext(data);
+        const usingVm = Expression.shouldUseVm();
+        // Expression extensions — only attached for the legacy engine.
+        //
+        // In the VM engine, function-typed bindings on `data` are
+        // structurally unreachable: the bridge's `getValueAtPath` returns
+        // `undefined` for any function-typed value, and the in-isolate
+        // runtime resolves helpers itself via Tournament's polyfill
+        // (see packages/@n8n/expression-runtime/src/runtime/context.ts,
+        // where bare `extend(...)` calls bind to the in-isolate copy on
+        // `target.extend`). Setting them on `data` in VM mode would be
+        // dead code.
+        if (!usingVm) {
+            data.extend = extensions_1.extend;
+            data.extendOptional = extensions_1.extendOptional;
         }
-        /**
-         * Converts an object to a string in a way to make it clear that
-         * the value comes from an object
-         *
-         */
-        convertObjectValueToString(value) {
-            if (value instanceof luxon_1.DateTime && value.invalidReason !== null) {
-                throw new errors_1.UserError('invalid DateTime');
-            }
-            if (value === null) {
-                return 'null';
-            }
-            let typeName = value.constructor.name ?? 'Object';
-            if (luxon_1.DateTime.isDateTime(value)) {
-                typeName = 'DateTime';
-            }
-            let result = '';
-            if (value instanceof Date) {
-                // We don't want to use JSON.stringify for dates since it disregards workflow timezone
-                result = luxon_1.DateTime.fromJSDate(value, {
-                    zone: this.timezone,
-                }).toISO();
-            }
-            else if (luxon_1.DateTime.isDateTime(value)) {
-                result = value.toString();
-            }
-            else {
-                result = JSON.stringify(value);
-            }
-            result = result
-                .replace(/,"/g, ', "') // spacing for
-                .replace(/":/g, '": '); // readability
-            return `[${typeName}: ${result}]`;
+        // In VM mode, strip `$jmesPath` / `$jmespath` from the data proxy.
+        // WorkflowDataProxy adds them, but the in-isolate `target.$jmespath`
+        // shadows them via Tournament's polyfill (see
+        // packages/@n8n/expression-runtime/src/runtime/context.ts). The delete
+        // makes them unreachable via direct path lookup through the bridge
+        // too, so the bridge can never invoke the host-side copies.
+        if (usingVm) {
+            delete data.$jmesPath;
+            delete data.$jmespath;
         }
-        /**
-         * Resolves the parameter value.  If it is an expression it will execute it and
-         * return the result. For everything simply the supplied value will be returned.
-         *
-         * @param {NodeParameterValue} parameterValue - The parameter value to resolve
-         * @param {IWorkflowDataProxyData} data - The workflow data proxy data
-         * @param {boolean} [returnObjectAsString=false] - Whether to convert objects to strings
-         */
-        resolveSimpleParameterValue(parameterValue, data, returnObjectAsString = false) {
-            // Check if it is an expression
-            if (!(0, expression_helpers_1.isExpression)(parameterValue)) {
-                // Is no expression so return value
-                return parameterValue;
-            }
-            // Is an expression
-            // Remove the equal sign
-            parameterValue = parameterValue.substr(1);
-            // Support only a subset of process properties
-            data.process =
-                typeof process !== 'undefined'
-                    ? {
-                        arch: process.arch,
-                        env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE !== 'false' ? {} : process.env,
-                        platform: process.platform,
-                        pid: process.pid,
-                        ppid: process.ppid,
-                        release: process.release,
-                        version: process.version,
-                        versions: process.versions,
-                    }
-                    : {};
-            Expression.initializeGlobalContext(data);
-            const usingVm = Expression.shouldUseVm();
-            // Expression extensions — only attached for the legacy engine.
-            //
-            // In the VM engine, function-typed bindings on `data` are
-            // structurally unreachable: the bridge's `getValueAtPath` returns
-            // `undefined` for any function-typed value, and the in-isolate
-            // runtime resolves helpers itself via Tournament's polyfill
-            // (see packages/@n8n/expression-runtime/src/runtime/context.ts,
-            // where bare `extend(...)` calls bind to the in-isolate copy on
-            // `target.extend`). Setting them on `data` in VM mode would be
-            // dead code.
-            if (!usingVm) {
-                data.extend = extensions_1.extend;
-                data.extendOptional = extensions_1.extendOptional;
-            }
-            // In VM mode, strip `$jmesPath` / `$jmespath` from the data proxy.
-            // WorkflowDataProxy adds them, but the in-isolate `target.$jmespath`
-            // shadows them via Tournament's polyfill (see
-            // packages/@n8n/expression-runtime/src/runtime/context.ts). The delete
-            // makes them unreachable via direct path lookup through the bridge
-            // too, so the bridge can never invoke the host-side copies.
-            if (usingVm) {
-                delete data.$jmesPath;
-                delete data.$jmespath;
-            }
-            Object.defineProperty(data, expression_sandboxing_1.sanitizerName, {
-                value: expression_sandboxing_1.sanitizer,
-                writable: false,
-                configurable: false,
+        Object.defineProperty(data, expression_sandboxing_1.sanitizerName, {
+            value: expression_sandboxing_1.sanitizer,
+            writable: false,
+            configurable: false,
+        });
+        Object.assign(data, extended_functions_1.extendedFunctions);
+        const constructorValidation = new RegExp(/\.\s*constructor/gm);
+        if (parameterValue.match(constructorValidation)) {
+            throw new expression_error_1.ExpressionError('Expression contains invalid constructor function call', {
+                causeDetailed: 'Constructor override attempt is not allowed due to security concerns',
+                runIndex: data.$thisRunIndex,
+                itemIndex: data.$thisItemIndex,
             });
-            Object.assign(data, extended_functions_1.extendedFunctions);
-            const constructorValidation = new RegExp(/\.\s*constructor/gm);
-            if (parameterValue.match(constructorValidation)) {
-                throw new expression_error_1.ExpressionError('Expression contains invalid constructor function call', {
-                    causeDetailed: 'Constructor override attempt is not allowed due to security concerns',
-                    runIndex: data.$thisRunIndex,
-                    itemIndex: data.$thisItemIndex,
-                });
-            }
-            // Execute the expression
-            const extendedExpression = (0, expression_extension_1.extendSyntax)(parameterValue);
-            const returnValue = this.renderExpression(extendedExpression, data);
-            if (typeof returnValue === 'function') {
-                if (returnValue.name === 'DateTime')
-                    throw new errors_1.UserError('this is a DateTime, please access its methods');
-                throw new errors_1.UserError('this is a function, please add ()');
-            }
-            else if (typeof returnValue === 'string') {
-                return returnValue;
-            }
-            else if (returnValue !== null && typeof returnValue === 'object') {
-                if (returnObjectAsString) {
-                    return this.convertObjectValueToString(returnValue);
-                }
-            }
+        }
+        // Execute the expression
+        const extendedExpression = (0, expression_extension_1.extendSyntax)(parameterValue);
+        const returnValue = this.renderExpression(extendedExpression, data);
+        if (typeof returnValue === 'function') {
+            if (returnValue.name === 'DateTime')
+                throw new errors_1.UserError('this is a DateTime, please access its methods');
+            throw new errors_1.UserError('this is a function, please add ()');
+        }
+        else if (typeof returnValue === 'string') {
             return returnValue;
         }
-        renderExpression(expression, data) {
-            // Use VM evaluator if engine is set to 'vm' and we're not in the browser
-            if (Expression.expressionEngine === 'vm' && !IS_FRONTEND) {
-                if (!Expression.vmEvaluator) {
-                    throw new errors_1.UnexpectedError('N8N_EXPRESSION_ENGINE=vm is enabled but VM evaluator is not initialized. Call Expression.initExpressionEngine() during application startup.');
-                }
-                try {
-                    const result = Expression.vmEvaluator.evaluate(expression, data, this, {
-                        timezone: this.timezone,
-                    });
-                    return result;
-                }
-                catch (error) {
-                    throw mapVmError(error);
-                }
+        else if (returnValue !== null && typeof returnValue === 'object') {
+            if (returnObjectAsString) {
+                return this.convertObjectValueToString(returnValue);
+            }
+        }
+        return returnValue;
+    }
+    renderExpression(expression, data) {
+        // Use VM evaluator if engine is set to 'vm' and we're not in the browser
+        if (Expression.expressionEngine === 'vm' && !IS_FRONTEND) {
+            if (!Expression.vmEvaluator) {
+                throw new errors_1.UnexpectedError('N8N_EXPRESSION_ENGINE=vm is enabled but VM evaluator is not initialized. Call Expression.initExpressionEngine() during application startup.');
             }
-            // Fall back to current implementation
             try {
-                return (0, expression_evaluator_proxy_1.evaluateExpression)(expression, data);
+                const result = Expression.vmEvaluator.evaluate(expression, data, this, {
+                    timezone: this.timezone,
+                });
+                return result;
             }
             catch (error) {
-                if (isExpressionError(error))
-                    throw error;
-                if (isSyntaxError(error))
-                    throw new errors_1.UserError('invalid syntax');
-                if (isTypeError(error) && IS_FRONTEND && error.message.endsWith('is not a function')) {
-                    const match = error.message.match(/(?<msg>[^.]+is not a function)/);
-                    if (!match?.groups?.msg)
-                        return null;
-                    throw new errors_1.UserError(match.groups.msg);
-                }
+                throw mapVmError(error);
+            }
+        }
+        // Fall back to current implementation
+        try {
+            return (0, expression_evaluator_proxy_1.evaluateExpression)(expression, data);
+        }
+        catch (error) {
+            if (isExpressionError(error))
+                throw error;
+            if (isSyntaxError(error))
+                throw new errors_1.UserError('invalid syntax');
+            if (isTypeError(error) && IS_FRONTEND && error.message.endsWith('is not a function')) {
+                const match = error.message.match(/(?<msg>[^.]+is not a function)/);
+                if (!match?.groups?.msg)
+                    return null;
+                throw new errors_1.UserError(match.groups.msg);
             }
-            return null;
         }
+        return null;
     }
-    exports.Expression = Expression;
-});
+}
+exports.Expression = Expression;
 //# sourceMappingURL=expression.js.map