Function validate

packages/js-runtime/src/validate.ts:18–280

(code: string)

 * by checking the AST for allowed operations only (allowlist approach)
 */
export function validate(code: string): {
  valid: boolean;
  error?: string;
} {
  if (!code || typeof code !== 'string') {
    return { valid: false, error: 'Code must be a non-empty string' };
  }

  try {
    // Parse the code to AST
    const ast = parse(code, {
      sourceType: 'module',
      allowReturnOutsideFunction: true,
      plugins: ['typescript'],
    });

    // Validate root structure: must be exactly one function expression
    const program = ast.program;
    const body = program.body;

    if (body.length === 0) {
      return { valid: false, error: 'Code cannot be empty' };
    }

    if (body.length > 1) {
      return {
        valid: false,
        error:
          'Code must contain only a single function. Multiple statements are not allowed.',
      };
    }

    const rootStatement = body[0]!;

    // Must be an expression statement containing a function
    if (rootStatement.type !== 'ExpressionStatement') {
      if (rootStatement.type === 'VariableDeclaration') {
        return {
          valid: false,
          error:
            'Variable declarations (const, let, var) are not allowed. Use a direct function expression instead.',
        };
      }
      if (rootStatement.type === 'FunctionDeclaration') {
        return {
          valid: false,
          error:
            'Function declarations are not allowed. Use an arrow function or function expression instead: (payload) => { ... } or function(payload) { ... }',
        };
      }
      return {
        valid: false,
        error: 'Code must be a function expression or arrow function',
      };
    }

    const rootExpression = rootStatement.expression;
    if (rootExpression.type !== 'ArrowFunctionExpression') {