Parses, structurally validates against an AST allowlist, and compiles a transform/formula
expression into a pure AST-interpreted CompiledExpression closure.
Security invariants:
Never invokes new Function or eval — eliminates dynamic JS compilation, CSP unsafe-eval
dependence, and ambient host-global reachability (process, globalThis, fetch, Buffer, …).
Own-property-only object reads — prototype-chain climbs (constructor, __proto__,
prototype) are blocked at both compile time and runtime.
Intrinsic-bound method dispatch — instance methods dispatch only against intrinsic
String / Array / Number / Boolean / Date receivers, never arbitrary functions stored
on untrusted data records.
Parses, structurally validates against an AST allowlist, and compiles a transform/formula expression into a pure AST-interpreted CompiledExpression closure.
Security invariants:
new Functionoreval— eliminates dynamic JS compilation, CSPunsafe-evaldependence, and ambient host-global reachability (process,globalThis,fetch,Buffer, …).constructor,__proto__,prototype) are blocked at both compile time and runtime.String/Array/Number/Boolean/Datereceivers, never arbitrary functions stored on untrusted data records.