Code Executor Connector

What this connector is for

Runs custom JavaScript or TypeScript inside an isolated sandbox — a genuinely separate JS engine instance from the workflow server's own process, not just a restricted eval. Use it for logic that doesn't map cleanly to another connector or JSONata expression: custom transforms, conditional branching logic too complex for a single expression, building up a payload shape, etc. No connection is needed.

The sandbox has no filesystem access, no environment variables, and no real network access — see "What's available in the sandbox" below.

Execute Code

Configuring it

• Language — javascript or typescript. Defaults to javascript. TypeScript is transpiled to JavaScript before running (a compilation error fails the step with the TypeScript compiler's own error message).
• Code — required. Your script. Define a main() function (sync or async — an async function main() that awaits something works) as the entry point, or use a direct top-level return statement; either way, whatever value comes back becomes this step's output. You may import from the whitelisted libraries below — anything else throws Library "<name>" is not allowed before your code even runs.
• Timeout (ms) — defaults to 5000. Whatever you set is capped at 30000ms (30 seconds) — a larger value is silently clamped, not rejected. This is a real wall-clock ceiling on the whole step, not just CPU-bound execution: it also bounds time spent awaiting async work inside main() (e.g. a setTimeout-based delay), not only synchronous code.
• Memory Limit (MB) — defaults to 128. Capped at 512MB regardless of what you set. Code that exceeds its isolate's memory limit is terminated.

What's available in the sandbox

• Whitelisted imports — lodash, date-fns, uuid, zod, validator, jsonpath, jsonata, slugify, axios, jsonwebtoken. Only a curated subset of each library's functions is exposed (e.g. lodash's map/filter/groupBy/merge/... — not the entire library surface).
• axios does not make real HTTP requests. It's importable and lets you build request configs, but every method (get, post, put, delete, patch, request) immediately rejects with "HTTP requests not allowed in isolated VM". There is no outbound network access from inside this sandbox.
• context — read-only workflow data, injected without functions (to avoid clone errors) plus a few helper methods added separately:
  • context.workflowId, context.stepId, context.executionId, context.timestamp, context.environment.
  • context.steps — an array of prior steps ({ id, name, reference, index, body }), and each step is also exposed directly by its reference, e.g. context.getUser.body (mirrors {{getUser.body}} in other connectors). context.getStep(reference) looks one up dynamically by string.
  • context.trigger — the normalized trigger data (context.trigger.body, .headers, .query, .params), or null if the workflow wasn't triggered by a request.
  • context.variables — workflow variables keyed by name (context.variables.apiKey); context.getVariable(key) is equivalent. context.variableConfigs / context.getVariableConfig(key) give the full config (type, etc.) rather than just the value.
  • context.connections, context.connectionsById, context.connectionList — connection contexts for connections attached to this workflow.
  • context.utils — small helpers: parseJSON(str), stringifyJSON(obj), now() (ISO string), timestamp() (epoch ms), trim(str), toLowerCase(str), toUpperCase(str).
• console.log / .warn / .error / .info — available, but their output goes only to the platform's own server-side logs. It is not surfaced anywhere in the workflow builder (not in execution details, not in test results) — don't rely on console.log to inspect a value while building a workflow; return the value from main() instead and read it from this step's response.
• Functions can never be part of the returned result — anything you return is serialized (functions are stripped, circular references become "[Circular]", Dates become ISO strings) before leaving the sandbox.

Reading the response

• {{<stepReference>.response.data.<field>}} — whatever main() returned (or your top-level return value), verbatim. If you returned { total: 42 }, use {{<stepReference>.response.data.total}}.

For example, a step named "Compute Total" (reference computeTotal) whose code does:

function main() {
  const items = context.getOrderDetails.body.items;
  return { total: items.reduce((sum, i) => sum + i.price * i.qty, 0) };
}

reads back as {{computeTotal.response.data.total}}.

Examples

One example per whitelisted library, each using only the functions that library actually exposes inside the sandbox (see "What's available in the sandbox" above) — not the full npm package surface.

lodash — group orders by status:

import { groupBy } from 'lodash';

function main() {
  const orders = context.getOrders.body.data;
  return groupBy(orders, 'status');
}

date-fns — compute a due date and how many days remain:

import { format, addDays, differenceInDays } from 'date-fns';

function main() {
  const orderDate = new Date(context.getOrder.body.createdAt);
  const dueDate = addDays(orderDate, 14);
  return {
    orderDate: format(orderDate, 'yyyy-MM-dd'),
    dueDate: format(dueDate, 'yyyy-MM-dd'),
    daysUntilDue: differenceInDays(dueDate, new Date()),
  };
}

uuid — generate an idempotency key for a downstream request:

import { v4 as uuidv4 } from 'uuid';

function main() {
  return { idempotencyKey: uuidv4() };
}

zod — validate the trigger payload's shape before using it:

import { object, string, number, safeParse } from 'zod';

function main() {
  const schema = object({ email: string(), quantity: number() });
  const result = safeParse(schema, context.trigger.body);
  if (!result.success) {
    throw new Error('Invalid payload');
  }
  return result.data;
}

validator — check whether a submitted email is well-formed:

import { isEmail } from 'validator';

function main() {
  const email = context.trigger.body.email;
  return { email, isValid: isEmail(email) };
}

jsonpath — pull every SKU out of an order's line items:

import { query } from 'jsonpath';

function main() {
  return { skus: query(context.getOrder.body, '$.lineItems[*].sku') };
}

jsonata — evaluate an expression that's itself built at runtime (not something {{...}} templating alone can do):

import { evaluate } from 'jsonata';

function main() {
  return { total: evaluate('$sum(items.price)', context.getOrder.body) };
}

slugify — build a URL-safe handle from a product title:

import slugify from 'slugify';

function main() {
  return { handle: slugify(context.getProduct.body.title) };
}

jsonwebtoken — sign a short-lived token, using a workflow variable as the secret:

import jwt from 'jsonwebtoken';

function main() {
  return {
    token: jwt.sign(
      { userId: context.trigger.body.userId },
      context.variables.jwtSecret,
      { expiresIn: '1h' }
    ),
  };
}