TransformScript evaluates expressions over supplied data and produces a result. Its security boundaries follow that model: the script defines the calculation, the input supplies the values, and the selected output format determines how the result is represented. Review a script for the data it reads, the checks it performs, and the information it includes in its output.

Language and Execution

A TransformScript uses the language's expressions, built-in functions, and functions defined within the script. It cannot run shell commands, load native libraries, or use Java extensions. The Function Library defines the supported operations.

Execution is contained in one script. An import directive does not load another script, file, or library; it is accepted for compatibility and ignored. Reusable logic belongs in functions defined within the script. Differences from DataWeave explains these language boundaries.

Input data is not evaluated as additional script text. If payload.expression contains the string 1 + 1, returning that field returns the string, not the number 2. Expressions written in the script determine which calculations run; a value read from the input does not become an expression merely because it resembles one.

Input Data and Validation

payload contains the supplied input. The input format determines its structure, such as an object parsed from JSON or a list of rows parsed from CSV. Additional named values must be defined in the script or supplied by its execution environment. Referencing an unbound name returns null.

Successful parsing establishes that the input can be read in the selected format. It does not establish that required fields are present, amounts are within an acceptable range, or related records agree. Use type checks, conditions, and explicit validation rules for those requirements. Treat a default value as a deliberate replacement for missing data, rather than evidence that the original input met the requirement.

Invalid syntax, unsupported operations, and failed type conversions produce errors. The treatment of missing values is different: a missing field can yield null, so a calculation that must have that field needs to check for it. Writing a TransformScript covers inputs and script structure.

Results and Serialization

The script controls which input fields appear in its result. Returning the complete payload preserves the source data, including fields that may be confidential. Select the fields the output needs instead of assuming that conversion to another format removes sensitive information.

An output directive serializes the result according to the selected format's rules. Build structured values and let the serializer represent them, rather than assembling document syntax by hand. Format-specific escaping preserves the document's structure; it does not verify the meaning of its contents or redact values. Input and Output Formats describes the supported formats, encodings, and escaping rules.

Processing Limits

TransformScript reads files fully into memory and does not stream. Input is limited to 100 MB and output to 200 MB. Size limits apply to processing, so a script that produces more data than its input still needs to keep the result within the output limit.

Expression nesting and recursive evaluation are also bounded; exceeding those limits produces an error. Design transformations for the expected data size and structure, including unusually large collections and deeply nested records. A small sample does not establish that the same calculation fits the limits for every input.

AI Calls

AI in TransformScript lets a script pass selected inputs and a prompt to an AI model and use its structured response in the result. Choose the information supplied to the call deliberately, especially when the source contains confidential fields.

An output schema constrains the response's shape and types. It does not establish that the returned values are factually correct or satisfy the data's business rules. Validate generated values before using them in further calculations, just as you would validate other supplied data. The AI data-processing reference explains how customer-requested AI processing handles data.