I'm also building a workflow engine on the side, but don't want to see you run into security issues :)
Look into the realms TC39 proposal, the SES TC39 proposal, or running (no joke) a lightweight ES6 environment in webassembly to eval your code.
https://github.com/tc39/proposal-realms/#ecmascript-spec-pro...
Unless you have generated the JS code yourself, in which case it is safe.
What kind of perf are you getting with QuickJS? If you have to evaluate an expression 10,000 times is QuickJS at least half as quick as eval?
RE. perf, I initially used Realms and it was fine. Right now I'm using wasm for templating and cuelang parsing - the speed is _good enough_ for the current UI, though I haven't really done strict performance testing yet, being honest :(
This reminded me to a series of posts by Figma in which they described how their JS plugin system works [1].
I remember there were plenty of security reasons why eval was not the best way to go. I wonder if you guys took this into account?
[1] https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...
AFAIK, workers are strings in and strings out. Often serialization is the most expensive operation, so adding additional serialization/deserialization steps can decrease performance overall.
The only use case I can imagine that would really benefit is computation-heavy with minimal input/output.
Until there is safe shared memory (please correct me if I'm wrong) I don't see many compelling use cases for web workers.
