whale-code 6.5.4 → 6.5.6

package/dist/server/lib/supabase-client.js

@@ -2,10 +2,12 @@
 // Fixes intermittent 520 errors from Cloudflare by retrying failed requests
 // and reusing client instances instead of creating new ones per request.
 // Circuit breaker prevents retry storms when Supabase is down.
+
 import { createClient } from "@supabase/supabase-js";
 const MAX_RETRIES = 3;
 const INITIAL_BACKOFF_MS = 500;
 const MAX_BACKOFF_MS = 5_000;
+
 // ── Circuit breaker ──
 // When Supabase is consistently failing, stop retrying to prevent:
 // 1. Retry storms that make Supabase worse
@@ -13,114 +15,124 @@ const MAX_BACKOFF_MS = 5_000;
 // 3. SSE stream stalls that freeze the CLI
 const CIRCUIT_FAILURE_THRESHOLD = 10; // Open circuit after 10 consecutive failures
 const CIRCUIT_RESET_MS = 30_000; // Try again after 30s
+
 let circuitFailures = 0;
 let circuitOpenUntil = 0;
+
 /** Check if circuit breaker allows the request */
 function isCircuitOpen() {
-    if (circuitFailures < CIRCUIT_FAILURE_THRESHOLD)
-        return false;
-    if (Date.now() >= circuitOpenUntil) {
-        // Half-open: allow one probe request
-        return false;
-    }
-    return true;
+  if (circuitFailures < CIRCUIT_FAILURE_THRESHOLD) return false;
+  if (Date.now() >= circuitOpenUntil) {
+    // Half-open: allow one probe request
+    return false;
+  }
+  return true;
 }
 function recordCircuitFailure() {
-    circuitFailures++;
-    if (circuitFailures >= CIRCUIT_FAILURE_THRESHOLD) {
-        circuitOpenUntil = Date.now() + CIRCUIT_RESET_MS;
-        if (circuitFailures === CIRCUIT_FAILURE_THRESHOLD) {
-            console.warn(`[supabase] Circuit breaker OPEN — ${circuitFailures} consecutive failures, pausing for ${CIRCUIT_RESET_MS / 1000}s`);
-        }
+  circuitFailures++;
+  if (circuitFailures >= CIRCUIT_FAILURE_THRESHOLD) {
+    circuitOpenUntil = Date.now() + CIRCUIT_RESET_MS;
+    if (circuitFailures === CIRCUIT_FAILURE_THRESHOLD) {
+      console.warn(`[supabase] Circuit breaker OPEN — ${circuitFailures} consecutive failures, pausing for ${CIRCUIT_RESET_MS / 1000}s`);
     }
+  }
 }
 function recordCircuitSuccess() {
-    if (circuitFailures > 0) {
-        console.info(`[supabase] Circuit breaker reset — connection recovered`);
-    }
-    circuitFailures = 0;
-    circuitOpenUntil = 0;
+  if (circuitFailures > 0) {
+    console.info(`[supabase] Circuit breaker reset — connection recovered`);
+  }
+  circuitFailures = 0;
+  circuitOpenUntil = 0;
 }
+
 /** Custom fetch with retry for 5xx errors + circuit breaker */
 function createRetryFetch(maxRetries = MAX_RETRIES) {
-    return async (input, init) => {
-        // Circuit breaker: fail fast when Supabase is known to be down
-        if (isCircuitOpen()) {
-            throw new Error("Supabase circuit breaker open — skipping request");
+  return async (input, init) => {
+    // Circuit breaker: fail fast when Supabase is known to be down
+    if (isCircuitOpen()) {
+      throw new Error("Supabase circuit breaker open — skipping request");
+    }
+    let lastError = null;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        const res = await fetch(input, {
+          ...init,
+          // Keep connection alive to reduce TCP handshake overhead
+          keepalive: true
+        });
+
+        // Retry on 5xx errors (Cloudflare 520 = origin error, 522 = timeout, 524 = timeout)
+        if (res.status >= 500 && attempt < maxRetries) {
+          recordCircuitFailure();
+          if (isCircuitOpen()) {
+            return res; // Don't retry if circuit just opened
+          }
+          const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);
+          console.warn(`[supabase] ${res.status} on ${typeof input === 'string' ? input.split('?')[0] : 'request'}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
+          await new Promise(r => setTimeout(r, backoff));
+          continue;
+        }
+        if (res.status < 500) {
+          recordCircuitSuccess();
         }
-        let lastError = null;
-        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            try {
-                const res = await fetch(input, {
-                    ...init,
-                    // Keep connection alive to reduce TCP handshake overhead
-                    keepalive: true,
-                });
-                // Retry on 5xx errors (Cloudflare 520 = origin error, 522 = timeout, 524 = timeout)
-                if (res.status >= 500 && attempt < maxRetries) {
-                    recordCircuitFailure();
-                    if (isCircuitOpen()) {
-                        return res; // Don't retry if circuit just opened
-                    }
-                    const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);
-                    console.warn(`[supabase] ${res.status} on ${typeof input === 'string' ? input.split('?')[0] : 'request'}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
-                    await new Promise(r => setTimeout(r, backoff));
-                    continue;
-                }
-                if (res.status < 500) {
-                    recordCircuitSuccess();
-                }
-                return res;
-            }
-            catch (err) {
-                lastError = err;
-                recordCircuitFailure();
-                // Retry on network errors (ECONNRESET, ETIMEDOUT, etc.)
-                if (attempt < maxRetries && !isCircuitOpen()) {
-                    const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);
-                    console.warn(`[supabase] Network error: ${lastError.message}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
-                    await new Promise(r => setTimeout(r, backoff));
-                    continue;
-                }
-            }
+        return res;
+      } catch (err) {
+        lastError = err;
+        recordCircuitFailure();
+
+        // Retry on network errors (ECONNRESET, ETIMEDOUT, etc.)
+        if (attempt < maxRetries && !isCircuitOpen()) {
+          const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);
+          console.warn(`[supabase] Network error: ${lastError.message}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);
+          await new Promise(r => setTimeout(r, backoff));
+          continue;
         }
-        throw lastError || new Error("Supabase request failed after retries");
-    };
+      }
+    }
+    throw lastError || new Error("Supabase request failed after retries");
+  };
 }
+
 // Singleton service role client — reused across all requests
 let _serviceClient = null;
 let _supabaseUrl = "";
 let _serviceRoleKey = "";
+
 /** Initialize the shared Supabase client (call once at startup) */
 export function initSupabase(url, serviceRoleKey) {
-    _supabaseUrl = url;
-    _serviceRoleKey = serviceRoleKey;
-    _serviceClient = null; // Reset on re-init
+  _supabaseUrl = url;
+  _serviceRoleKey = serviceRoleKey;
+  _serviceClient = null; // Reset on re-init
 }
+
 /** Get the shared service role Supabase client (singleton, retry-enabled) */
 export function getServiceClient() {
-    if (!_serviceClient) {
-        if (!_supabaseUrl || !_serviceRoleKey) {
-            throw new Error("Supabase not initialized. Call initSupabase() first.");
-        }
-        _serviceClient = createClient(_supabaseUrl, _serviceRoleKey, {
-            global: {
-                fetch: createRetryFetch(),
-            },
-            auth: {
-                autoRefreshToken: false,
-                persistSession: false,
-            },
-        });
+  if (!_serviceClient) {
+    if (!_supabaseUrl || !_serviceRoleKey) {
+      throw new Error("Supabase not initialized. Call initSupabase() first.");
     }
-    return _serviceClient;
+    _serviceClient = createClient(_supabaseUrl, _serviceRoleKey, {
+      global: {
+        fetch: createRetryFetch()
+      },
+      auth: {
+        autoRefreshToken: false,
+        persistSession: false
+      }
+    });
+  }
+  return _serviceClient;
 }
+
 /** Create a user-scoped client (for RLS context) — uses retry fetch */
 export function createUserClient(url, anonKey, token) {
-    return createClient(url, anonKey, {
-        global: {
-            headers: { Authorization: `Bearer ${token}` },
-            fetch: createRetryFetch(2), // Fewer retries for user requests
-        },
-    });
+  return createClient(url, anonKey, {
+    global: {
+      headers: {
+        Authorization: `Bearer ${token}`
+      },
+      fetch: createRetryFetch(2) // Fewer retries for user requests
+    }
+  });
 }
+//# sourceMappingURL=supabase-client.js.map

package/dist/server/lib/supabase-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-client.js","names":["createClient","MAX_RETRIES","INITIAL_BACKOFF_MS","MAX_BACKOFF_MS","CIRCUIT_FAILURE_THRESHOLD","CIRCUIT_RESET_MS","circuitFailures","circuitOpenUntil","isCircuitOpen","Date","now","recordCircuitFailure","console","warn","recordCircuitSuccess","info","createRetryFetch","maxRetries","input","init","Error","lastError","attempt","res","fetch","keepalive","status","backoff","Math","min","pow","split","Promise","r","setTimeout","err","message","_serviceClient","_supabaseUrl","_serviceRoleKey","initSupabase","url","serviceRoleKey","getServiceClient","global","auth","autoRefreshToken","persistSession","createUserClient","anonKey","token","headers","Authorization"],"sources":["../../../src/server/lib/supabase-client.ts"],"sourcesContent":["// lib/supabase-client.ts — Resilient Supabase client with circuit breaker\n// Fixes intermittent 520 errors from Cloudflare by retrying failed requests\n// and reusing client instances instead of creating new ones per request.\n// Circuit breaker prevents retry storms when Supabase is down.\n\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\n\nconst MAX_RETRIES = 3;\nconst INITIAL_BACKOFF_MS = 500;\nconst MAX_BACKOFF_MS = 5_000;\n\n// ── Circuit breaker ──\n// When Supabase is consistently failing, stop retrying to prevent:\n// 1. Retry storms that make Supabase worse\n// 2. Event loop blocking that causes health check failures\n// 3. SSE stream stalls that freeze the CLI\nconst CIRCUIT_FAILURE_THRESHOLD = 10;  // Open circuit after 10 consecutive failures\nconst CIRCUIT_RESET_MS = 30_000;       // Try again after 30s\n\nlet circuitFailures = 0;\nlet circuitOpenUntil = 0;\n\n/** Check if circuit breaker allows the request */\nfunction isCircuitOpen(): boolean {\n  if (circuitFailures < CIRCUIT_FAILURE_THRESHOLD) return false;\n  if (Date.now() >= circuitOpenUntil) {\n    // Half-open: allow one probe request\n    return false;\n  }\n  return true;\n}\n\nfunction recordCircuitFailure(): void {\n  circuitFailures++;\n  if (circuitFailures >= CIRCUIT_FAILURE_THRESHOLD) {\n    circuitOpenUntil = Date.now() + CIRCUIT_RESET_MS;\n    if (circuitFailures === CIRCUIT_FAILURE_THRESHOLD) {\n      console.warn(`[supabase] Circuit breaker OPEN — ${circuitFailures} consecutive failures, pausing for ${CIRCUIT_RESET_MS / 1000}s`);\n    }\n  }\n}\n\nfunction recordCircuitSuccess(): void {\n  if (circuitFailures > 0) {\n    console.info(`[supabase] Circuit breaker reset — connection recovered`);\n  }\n  circuitFailures = 0;\n  circuitOpenUntil = 0;\n}\n\n/** Custom fetch with retry for 5xx errors + circuit breaker */\nfunction createRetryFetch(maxRetries = MAX_RETRIES): typeof fetch {\n  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {\n    // Circuit breaker: fail fast when Supabase is known to be down\n    if (isCircuitOpen()) {\n      throw new Error(\"Supabase circuit breaker open — skipping request\");\n    }\n\n    let lastError: Error | null = null;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        const res = await fetch(input, {\n          ...init,\n          // Keep connection alive to reduce TCP handshake overhead\n          keepalive: true,\n        });\n\n        // Retry on 5xx errors (Cloudflare 520 = origin error, 522 = timeout, 524 = timeout)\n        if (res.status >= 500 && attempt < maxRetries) {\n          recordCircuitFailure();\n          if (isCircuitOpen()) {\n            return res; // Don't retry if circuit just opened\n          }\n          const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);\n          console.warn(`[supabase] ${res.status} on ${typeof input === 'string' ? input.split('?')[0] : 'request'}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);\n          await new Promise(r => setTimeout(r, backoff));\n          continue;\n        }\n\n        if (res.status < 500) {\n          recordCircuitSuccess();\n        }\n\n        return res;\n      } catch (err) {\n        lastError = err as Error;\n        recordCircuitFailure();\n\n        // Retry on network errors (ECONNRESET, ETIMEDOUT, etc.)\n        if (attempt < maxRetries && !isCircuitOpen()) {\n          const backoff = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, attempt), MAX_BACKOFF_MS);\n          console.warn(`[supabase] Network error: ${lastError.message}, retry ${attempt + 1}/${maxRetries} in ${backoff}ms`);\n          await new Promise(r => setTimeout(r, backoff));\n          continue;\n        }\n      }\n    }\n\n    throw lastError || new Error(\"Supabase request failed after retries\");\n  };\n}\n\n// Singleton service role client — reused across all requests\nlet _serviceClient: SupabaseClient | null = null;\nlet _supabaseUrl: string = \"\";\nlet _serviceRoleKey: string = \"\";\n\n/** Initialize the shared Supabase client (call once at startup) */\nexport function initSupabase(url: string, serviceRoleKey: string): void {\n  _supabaseUrl = url;\n  _serviceRoleKey = serviceRoleKey;\n  _serviceClient = null; // Reset on re-init\n}\n\n/** Get the shared service role Supabase client (singleton, retry-enabled) */\nexport function getServiceClient(): SupabaseClient {\n  if (!_serviceClient) {\n    if (!_supabaseUrl || !_serviceRoleKey) {\n      throw new Error(\"Supabase not initialized. Call initSupabase() first.\");\n    }\n    _serviceClient = createClient(_supabaseUrl, _serviceRoleKey, {\n      global: {\n        fetch: createRetryFetch(),\n      },\n      auth: {\n        autoRefreshToken: false,\n        persistSession: false,\n      },\n    });\n  }\n  return _serviceClient;\n}\n\n/** Create a user-scoped client (for RLS context) — uses retry fetch */\nexport function createUserClient(url: string, anonKey: string, token: string): SupabaseClient {\n  return createClient(url, anonKey, {\n    global: {\n      headers: { Authorization: `Bearer ${token}` },\n      fetch: createRetryFetch(2), // Fewer retries for user requests\n    },\n  });\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAA6B,uBAAuB;AAEzE,MAAMC,WAAW,GAAG,CAAC;AACrB,MAAMC,kBAAkB,GAAG,GAAG;AAC9B,MAAMC,cAAc,GAAG,KAAK;;AAE5B;AACA;AACA;AACA;AACA;AACA,MAAMC,yBAAyB,GAAG,EAAE,CAAC,CAAE;AACvC,MAAMC,gBAAgB,GAAG,MAAM,CAAC,CAAO;;AAEvC,IAAIC,eAAe,GAAG,CAAC;AACvB,IAAIC,gBAAgB,GAAG,CAAC;;AAExB;AACA,SAASC,aAAaA,CAAA,EAAY;EAChC,IAAIF,eAAe,GAAGF,yBAAyB,EAAE,OAAO,KAAK;EAC7D,IAAIK,IAAI,CAACC,GAAG,CAAC,CAAC,IAAIH,gBAAgB,EAAE;IAClC;IACA,OAAO,KAAK;EACd;EACA,OAAO,IAAI;AACb;AAEA,SAASI,oBAAoBA,CAAA,EAAS;EACpCL,eAAe,EAAE;EACjB,IAAIA,eAAe,IAAIF,yBAAyB,EAAE;IAChDG,gBAAgB,GAAGE,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGL,gBAAgB;IAChD,IAAIC,eAAe,KAAKF,yBAAyB,EAAE;MACjDQ,OAAO,CAACC,IAAI,CAAC,qCAAqCP,eAAe,sCAAsCD,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACpI;EACF;AACF;AAEA,SAASS,oBAAoBA,CAAA,EAAS;EACpC,IAAIR,eAAe,GAAG,CAAC,EAAE;IACvBM,OAAO,CAACG,IAAI,CAAC,yDAAyD,CAAC;EACzE;EACAT,eAAe,GAAG,CAAC;EACnBC,gBAAgB,GAAG,CAAC;AACtB;;AAEA;AACA,SAASS,gBAAgBA,CAACC,UAAU,GAAGhB,WAAW,EAAgB;EAChE,OAAO,OAAOiB,KAAwB,EAAEC,IAAkB,KAAwB;IAChF;IACA,IAAIX,aAAa,CAAC,CAAC,EAAE;MACnB,MAAM,IAAIY,KAAK,CAAC,kDAAkD,CAAC;IACrE;IAEA,IAAIC,SAAuB,GAAG,IAAI;IAElC,KAAK,IAAIC,OAAO,GAAG,CAAC,EAAEA,OAAO,IAAIL,UAAU,EAAEK,OAAO,EAAE,EAAE;MACtD,IAAI;QACF,MAAMC,GAAG,GAAG,MAAMC,KAAK,CAACN,KAAK,EAAE;UAC7B,GAAGC,IAAI;UACP;UACAM,SAAS,EAAE;QACb,CAAC,CAAC;;QAEF;QACA,IAAIF,GAAG,CAACG,MAAM,IAAI,GAAG,IAAIJ,OAAO,GAAGL,UAAU,EAAE;UAC7CN,oBAAoB,CAAC,CAAC;UACtB,IAAIH,aAAa,CAAC,CAAC,EAAE;YACnB,OAAOe,GAAG,CAAC,CAAC;UACd;UACA,MAAMI,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC3B,kBAAkB,GAAG0B,IAAI,CAACE,GAAG,CAAC,CAAC,EAAER,OAAO,CAAC,EAAEnB,cAAc,CAAC;UACnFS,OAAO,CAACC,IAAI,CAAC,cAAcU,GAAG,CAACG,MAAM,OAAO,OAAOR,KAAK,KAAK,QAAQ,GAAGA,KAAK,CAACa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,WAAWT,OAAO,GAAG,CAAC,IAAIL,UAAU,OAAOU,OAAO,IAAI,CAAC;UAC9J,MAAM,IAAIK,OAAO,CAACC,CAAC,IAAIC,UAAU,CAACD,CAAC,EAAEN,OAAO,CAAC,CAAC;UAC9C;QACF;QAEA,IAAIJ,GAAG,CAACG,MAAM,GAAG,GAAG,EAAE;UACpBZ,oBAAoB,CAAC,CAAC;QACxB;QAEA,OAAOS,GAAG;MACZ,CAAC,CAAC,OAAOY,GAAG,EAAE;QACZd,SAAS,GAAGc,GAAY;QACxBxB,oBAAoB,CAAC,CAAC;;QAEtB;QACA,IAAIW,OAAO,GAAGL,UAAU,IAAI,CAACT,aAAa,CAAC,CAAC,EAAE;UAC5C,MAAMmB,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC3B,kBAAkB,GAAG0B,IAAI,CAACE,GAAG,CAAC,CAAC,EAAER,OAAO,CAAC,EAAEnB,cAAc,CAAC;UACnFS,OAAO,CAACC,IAAI,CAAC,6BAA6BQ,SAAS,CAACe,OAAO,WAAWd,OAAO,GAAG,CAAC,IAAIL,UAAU,OAAOU,OAAO,IAAI,CAAC;UAClH,MAAM,IAAIK,OAAO,CAACC,CAAC,IAAIC,UAAU,CAACD,CAAC,EAAEN,OAAO,CAAC,CAAC;UAC9C;QACF;MACF;IACF;IAEA,MAAMN,SAAS,IAAI,IAAID,KAAK,CAAC,uCAAuC,CAAC;EACvE,CAAC;AACH;;AAEA;AACA,IAAIiB,cAAqC,GAAG,IAAI;AAChD,IAAIC,YAAoB,GAAG,EAAE;AAC7B,IAAIC,eAAuB,GAAG,EAAE;;AAEhC;AACA,OAAO,SAASC,YAAYA,CAACC,GAAW,EAAEC,cAAsB,EAAQ;EACtEJ,YAAY,GAAGG,GAAG;EAClBF,eAAe,GAAGG,cAAc;EAChCL,cAAc,GAAG,IAAI,CAAC,CAAC;AACzB;;AAEA;AACA,OAAO,SAASM,gBAAgBA,CAAA,EAAmB;EACjD,IAAI,CAACN,cAAc,EAAE;IACnB,IAAI,CAACC,YAAY,IAAI,CAACC,eAAe,EAAE;MACrC,MAAM,IAAInB,KAAK,CAAC,sDAAsD,CAAC;IACzE;IACAiB,cAAc,GAAGrC,YAAY,CAACsC,YAAY,EAAEC,eAAe,EAAE;MAC3DK,MAAM,EAAE;QACNpB,KAAK,EAAER,gBAAgB,CAAC;MAC1B,CAAC;MACD6B,IAAI,EAAE;QACJC,gBAAgB,EAAE,KAAK;QACvBC,cAAc,EAAE;MAClB;IACF,CAAC,CAAC;EACJ;EACA,OAAOV,cAAc;AACvB;;AAEA;AACA,OAAO,SAASW,gBAAgBA,CAACP,GAAW,EAAEQ,OAAe,EAAEC,KAAa,EAAkB;EAC5F,OAAOlD,YAAY,CAACyC,GAAG,EAAEQ,OAAO,EAAE;IAChCL,MAAM,EAAE;MACNO,OAAO,EAAE;QAAEC,aAAa,EAAE,UAAUF,KAAK;MAAG,CAAC;MAC7C1B,KAAK,EAAER,gBAAgB,CAAC,CAAC,CAAC,CAAE;IAC9B;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/dist/server/lib/template-resolver.js

@@ -2,99 +2,88 @@
 //
 // Used by workflow engine to flow data between steps.
 // Extends the fillTemplate() pattern from utils.ts with workflow-specific contexts.
+
 const TEMPLATE_REGEX = /\{\{([^}]+)\}\}/g;
+
 /** Block prototype pollution / traversal attacks */
-const BLOCKED_PROPS = new Set([
-    "__proto__", "constructor", "prototype",
-    "__defineGetter__", "__defineSetter__",
-    "__lookupGetter__", "__lookupSetter__",
-]);
+const BLOCKED_PROPS = new Set(["__proto__", "constructor", "prototype", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__"]);
+
 /**
  * Safely walk a dot-path into an object, blocking dangerous property names.
  */
 function walkPath(value, parts, startIndex) {
-    let current = value;
-    for (let i = startIndex; i < parts.length; i++) {
-        if (current === null || current === undefined)
-            return undefined;
-        if (typeof current !== "object")
-            return undefined;
-        if (BLOCKED_PROPS.has(parts[i]))
-            return undefined; // Block prototype traversal
-        current = current[parts[i]];
-    }
-    return current;
+  let current = value;
+  for (let i = startIndex; i < parts.length; i++) {
+    if (current === null || current === undefined) return undefined;
+    if (typeof current !== "object") return undefined;
+    if (BLOCKED_PROPS.has(parts[i])) return undefined; // Block prototype traversal
+    current = current[parts[i]];
+  }
+  return current;
 }
+
 /**
  * Resolve a single template expression like "steps.check.output.count" against the context.
  * Returns the resolved value, or undefined if the path doesn't exist.
  */
 function resolveExpression(expr, ctx) {
-    const trimmed = expr.trim();
-    // Built-in variables
-    if (trimmed === "now")
-        return new Date().toISOString();
-    if (trimmed === "today")
-        return new Date().toISOString().slice(0, 10);
-    if (trimmed === "timestamp")
-        return Date.now();
-    // Navigate the dot path
-    const parts = trimmed.split(".");
-    const root = parts[0];
-    let value;
-    if (root === "steps" && parts.length >= 2) {
-        const stepKey = parts[1];
-        const stepData = ctx.steps[stepKey];
-        if (!stepData)
-            return undefined;
-        value = walkPath(stepData, parts, 2);
-    }
-    else if (root === "trigger") {
-        value = walkPath(ctx.trigger, parts, 1);
-    }
-    else if (root === "input") {
-        value = walkPath(ctx.input, parts, 1);
-    }
-    else if (root === "workflow" && ctx.workflow) {
-        value = walkPath(ctx.workflow, parts, 1);
-    }
-    else if (root === "run" && ctx.run) {
-        value = walkPath(ctx.run, parts, 1);
-    }
-    else if (root === "env" && ctx.env) {
-        // P0 FIX: Only allow explicitly whitelisted env keys — never expose process.env
-        const ALLOWED_ENV_KEYS = new Set(["APP_URL", "APP_NAME", "NODE_ENV"]);
-        if (parts.length >= 2 && !ALLOWED_ENV_KEYS.has(parts[1]))
-            return undefined;
-        value = walkPath(ctx.env, parts, 1);
-    }
-    else {
-        return undefined;
-    }
-    return value;
+  const trimmed = expr.trim();
+
+  // Built-in variables
+  if (trimmed === "now") return new Date().toISOString();
+  if (trimmed === "today") return new Date().toISOString().slice(0, 10);
+  if (trimmed === "timestamp") return Date.now();
+
+  // Navigate the dot path
+  const parts = trimmed.split(".");
+  const root = parts[0];
+  let value;
+  if (root === "steps" && parts.length >= 2) {
+    const stepKey = parts[1];
+    const stepData = ctx.steps[stepKey];
+    if (!stepData) return undefined;
+    value = walkPath(stepData, parts, 2);
+  } else if (root === "trigger") {
+    value = walkPath(ctx.trigger, parts, 1);
+  } else if (root === "input") {
+    value = walkPath(ctx.input, parts, 1);
+  } else if (root === "workflow" && ctx.workflow) {
+    value = walkPath(ctx.workflow, parts, 1);
+  } else if (root === "run" && ctx.run) {
+    value = walkPath(ctx.run, parts, 1);
+  } else if (root === "env" && ctx.env) {
+    // P0 FIX: Only allow explicitly whitelisted env keys — never expose process.env
+    const ALLOWED_ENV_KEYS = new Set(["APP_URL", "APP_NAME", "NODE_ENV"]);
+    if (parts.length >= 2 && !ALLOWED_ENV_KEYS.has(parts[1])) return undefined;
+    value = walkPath(ctx.env, parts, 1);
+  } else {
+    return undefined;
+  }
+  return value;
 }
+
 /**
  * Resolve all {{...}} placeholders in a string.
  * If the entire string is a single template AND the resolved value is not a string,
  * return the raw value (preserving numbers, objects, arrays, booleans).
  */
 function resolveString(template, ctx) {
-    // Check if the entire string is a single template expression
-    const singleMatch = template.match(/^\{\{([^}]+)\}\}$/);
-    if (singleMatch) {
-        const resolved = resolveExpression(singleMatch[1], ctx);
-        return resolved !== undefined ? resolved : template;
-    }
-    // Multiple templates or mixed text — string interpolation
-    return template.replace(TEMPLATE_REGEX, (match, expr) => {
-        const resolved = resolveExpression(expr, ctx);
-        if (resolved === undefined)
-            return match;
-        if (typeof resolved === "object" && resolved !== null)
-            return JSON.stringify(resolved);
-        return String(resolved);
-    });
+  // Check if the entire string is a single template expression
+  const singleMatch = template.match(/^\{\{([^}]+)\}\}$/);
+  if (singleMatch) {
+    const resolved = resolveExpression(singleMatch[1], ctx);
+    return resolved !== undefined ? resolved : template;
+  }
+
+  // Multiple templates or mixed text — string interpolation
+  return template.replace(TEMPLATE_REGEX, (match, expr) => {
+    const resolved = resolveExpression(expr, ctx);
+    if (resolved === undefined) return match;
+    if (typeof resolved === "object" && resolved !== null) return JSON.stringify(resolved);
+    return String(resolved);
+  });
 }
+
 /**
  * Recursively resolve templates in any JSON-compatible value.
  * - Strings: resolve {{...}} patterns
@@ -103,24 +92,24 @@ function resolveString(template, ctx) {
  * - Primitives: return as-is
  */
 export function resolveTemplate(value, ctx, depth = 0) {
-    // Guard against infinite recursion from circular or deeply nested structures
-    if (depth > 20)
-        return value;
-    if (typeof value === "string") {
-        return resolveString(value, ctx);
+  // Guard against infinite recursion from circular or deeply nested structures
+  if (depth > 20) return value;
+  if (typeof value === "string") {
+    return resolveString(value, ctx);
+  }
+  if (Array.isArray(value)) {
+    return value.map(item => resolveTemplate(item, ctx, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const resolved = {};
+    for (const [k, v] of Object.entries(value)) {
+      resolved[k] = resolveTemplate(v, ctx, depth + 1);
     }
-    if (Array.isArray(value)) {
-        return value.map((item) => resolveTemplate(item, ctx, depth + 1));
-    }
-    if (value !== null && typeof value === "object") {
-        const resolved = {};
-        for (const [k, v] of Object.entries(value)) {
-            resolved[k] = resolveTemplate(v, ctx, depth + 1);
-        }
-        return resolved;
-    }
-    return value;
+    return resolved;
+  }
+  return value;
 }
+
 /**
  * Evaluate a simple condition expression.
  * Supports: ==, !=, >, <, >=, <=, contains, !contains, exists, !exists
@@ -132,94 +121,83 @@ export function resolveTemplate(value, ctx, depth = 0) {
  *   "{{trigger.type}} != 'test'"
  */
 export function evaluateCondition(expression, ctx) {
-    // Resolve all templates in the expression first
-    const resolved = resolveString(expression, ctx);
-    const expr = typeof resolved === 'object' && resolved !== null
-        ? JSON.stringify(resolved)
-        : String(resolved);
-    // exists / !exists checks
-    if (expr.includes(" exists")) {
-        const parts = expr.split(/\s+exists/);
-        const val = parts[0].trim();
-        const isNegated = expression.trim().startsWith("!");
-        const exists = val !== "" && val !== "undefined" && val !== "null" && !val.includes("{{");
-        return isNegated ? !exists : exists;
+  // Resolve all templates in the expression first
+  const resolved = resolveString(expression, ctx);
+  const expr = typeof resolved === 'object' && resolved !== null ? JSON.stringify(resolved) : String(resolved);
+
+  // exists / !exists checks
+  if (expr.includes(" exists")) {
+    const parts = expr.split(/\s+exists/);
+    const val = parts[0].trim();
+    const isNegated = expression.trim().startsWith("!");
+    const exists = val !== "" && val !== "undefined" && val !== "null" && !val.includes("{{");
+    return isNegated ? !exists : exists;
+  }
+
+  // P1 FIX: Use regex-based matching with word boundaries to prevent data containing
+  // operator strings (e.g., "value >= 10" in a field) from being misinterpreted
+  const operatorPatterns = [[/\s!==\s/, "!=="], [/\s===\s/, "==="], [/\s!=\s/, "!="], [/\s==\s/, "=="], [/\s>=\s/, ">="], [/\s<=\s/, "<="], [/\s>\s/, ">"], [/\s<\s/, "<"], [/\scontains\s/, "contains"], [/\s!contains\s/, "!contains"]];
+  // Identify quoted regions to avoid matching operators inside them
+  const quoteRegions = [];
+  const quoteRe = /(['"])(?:(?!\1).)*\1/g;
+  let qm;
+  while ((qm = quoteRe.exec(expr)) !== null) {
+    quoteRegions.push([qm.index, qm.index + qm[0].length]);
+  }
+  for (const [pattern, op] of operatorPatterns) {
+    // Use the LAST match that is NOT inside a quoted string.
+    const globalRe = new RegExp(pattern.source, "g");
+    let lastMatch = null;
+    let m;
+    while ((m = globalRe.exec(expr)) !== null) {
+      const idx = m.index;
+      const insideQuotes = quoteRegions.some(([s, e]) => idx > s && idx < e);
+      if (!insideQuotes) lastMatch = m;
+    }
+    if (!lastMatch || lastMatch.index === undefined) continue;
+    let left = expr.substring(0, lastMatch.index).trim();
+    let right = expr.substring(lastMatch.index + lastMatch[0].length).trim();
+
+    // Strip quotes from right side
+    if (right.startsWith("'") && right.endsWith("'") || right.startsWith('"') && right.endsWith('"')) {
+      right = right.slice(1, -1);
     }
-    // P1 FIX: Use regex-based matching with word boundaries to prevent data containing
-    // operator strings (e.g., "value >= 10" in a field) from being misinterpreted
-    const operatorPatterns = [
-        [/\s!==\s/, "!=="],
-        [/\s===\s/, "==="],
-        [/\s!=\s/, "!="],
-        [/\s==\s/, "=="],
-        [/\s>=\s/, ">="],
-        [/\s<=\s/, "<="],
-        [/\s>\s/, ">"],
-        [/\s<\s/, "<"],
-        [/\scontains\s/, "contains"],
-        [/\s!contains\s/, "!contains"],
-    ];
-    // Identify quoted regions to avoid matching operators inside them
-    const quoteRegions = [];
-    const quoteRe = /(['"])(?:(?!\1).)*\1/g;
-    let qm;
-    while ((qm = quoteRe.exec(expr)) !== null) {
-        quoteRegions.push([qm.index, qm.index + qm[0].length]);
+    if (left.startsWith("'") && left.endsWith("'") || left.startsWith('"') && left.endsWith('"')) {
+      left = left.slice(1, -1);
     }
-    for (const [pattern, op] of operatorPatterns) {
-        // Use the LAST match that is NOT inside a quoted string.
-        const globalRe = new RegExp(pattern.source, "g");
-        let lastMatch = null;
-        let m;
-        while ((m = globalRe.exec(expr)) !== null) {
-            const idx = m.index;
-            const insideQuotes = quoteRegions.some(([s, e]) => idx > s && idx < e);
-            if (!insideQuotes)
-                lastMatch = m;
-        }
-        if (!lastMatch || lastMatch.index === undefined)
-            continue;
-        let left = expr.substring(0, lastMatch.index).trim();
-        let right = expr.substring(lastMatch.index + lastMatch[0].length).trim();
-        // Strip quotes from right side
-        if ((right.startsWith("'") && right.endsWith("'")) || (right.startsWith('"') && right.endsWith('"'))) {
-            right = right.slice(1, -1);
-        }
-        if ((left.startsWith("'") && left.endsWith("'")) || (left.startsWith('"') && left.endsWith('"'))) {
-            left = left.slice(1, -1);
-        }
-        const numLeft = Number(left);
-        const numRight = Number(right);
-        const bothNumeric = !isNaN(numLeft) && !isNaN(numRight) && left !== "" && right !== "";
-        switch (op.trim()) {
-            case "===":
-            case "==":
-                return bothNumeric ? numLeft === numRight : left === right;
-            case "!==":
-            case "!=":
-                return bothNumeric ? numLeft !== numRight : left !== right;
-            case ">":
-                return bothNumeric ? numLeft > numRight : left > right;
-            case "<":
-                return bothNumeric ? numLeft < numRight : left < right;
-            case ">=":
-                return bothNumeric ? numLeft >= numRight : left >= right;
-            case "<=":
-                return bothNumeric ? numLeft <= numRight : left <= right;
-            case "contains":
-                return left.includes(right);
-            case "!contains":
-                return !left.includes(right);
-        }
+    const numLeft = Number(left);
+    const numRight = Number(right);
+    const bothNumeric = !isNaN(numLeft) && !isNaN(numRight) && left !== "" && right !== "";
+    switch (op.trim()) {
+      case "===":
+      case "==":
+        return bothNumeric ? numLeft === numRight : left === right;
+      case "!==":
+      case "!=":
+        return bothNumeric ? numLeft !== numRight : left !== right;
+      case ">":
+        return bothNumeric ? numLeft > numRight : left > right;
+      case "<":
+        return bothNumeric ? numLeft < numRight : left < right;
+      case ">=":
+        return bothNumeric ? numLeft >= numRight : left >= right;
+      case "<=":
+        return bothNumeric ? numLeft <= numRight : left <= right;
+      case "contains":
+        return left.includes(right);
+      case "!contains":
+        return !left.includes(right);
     }
-    // Truthy/falsy check — if expression resolved to a value
-    if (expr === "true" || expr === "1")
-        return true;
-    if (expr === "false" || expr === "0" || expr === "" || expr === "null" || expr === "undefined")
-        return false;
-    // If there are still unresolved templates, condition is false
-    if (expr.includes("{{"))
-        return false;
-    // Non-empty string is truthy
-    return expr.length > 0;
+  }
+
+  // Truthy/falsy check — if expression resolved to a value
+  if (expr === "true" || expr === "1") return true;
+  if (expr === "false" || expr === "0" || expr === "" || expr === "null" || expr === "undefined") return false;
+
+  // If there are still unresolved templates, condition is false
+  if (expr.includes("{{")) return false;
+
+  // Non-empty string is truthy
+  return expr.length > 0;
 }
+//# sourceMappingURL=template-resolver.js.map