@lowdefy/server-dev 6.0.0 → 7.0.0

package/lib/docs/openJourneyEmail.test.mjs

@@ -0,0 +1,187 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { jest } from '@jest/globals';
+
+import JourneyStepError from './JourneyStepError.js';
+import openJourneyEmail from './openJourneyEmail.js';
+
+const STARTED_AT = Date.parse('2026-09-27T10:00:00.000Z');
+
+let configDirectory;
+let outbox;
+
+beforeEach(() => {
+  configDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-journey-email-'));
+  outbox = path.join(configDirectory, '.lowdefy', 'mail');
+  fs.mkdirSync(outbox, { recursive: true });
+});
+
+afterEach(() => {
+  fs.rmSync(configDirectory, { recursive: true, force: true });
+});
+
+function writeMessage({ id, to, subject, secondsAfterStart = 1, html, text = null }) {
+  const message = {
+    id,
+    receivedAt: new Date(STARTED_AT + secondsAfterStart * 1000).toISOString(),
+    from: 'app@localhost',
+    to,
+    subject,
+    html:
+      html === undefined ? `<a href="http://localhost/${id}" target="_blank">Open ${id}</a>` : html,
+    text,
+  };
+  fs.writeFileSync(path.join(outbox, `${id}.json`), JSON.stringify(message));
+}
+
+function createPage({ onWait = () => {} } = {}) {
+  const page = {
+    opened: [],
+    goto: jest.fn(async (url) => {
+      const base64 = url.slice('data:text/html;charset=utf-8;base64,'.length);
+      page.opened.push(Buffer.from(base64, 'base64').toString());
+    }),
+    evaluate: jest.fn(async () => {}),
+    waitForTimeout: jest.fn(async () => onWait()),
+  };
+  return page;
+}
+
+test.each([
+  ['the newest message to the address', { to: 'ada@example.test' }, '000003'],
+  ['an address in any case', { to: 'ADA@Example.Test' }, '000003'],
+  [
+    'the newest subject containing the text',
+    { to: 'ada@example.test', subject: 'Verify' },
+    '000001',
+  ],
+  ['a later recipient of a message sent to several', { to: 'bob@example.test' }, '000002'],
+])('openJourneyEmail opens %s', async (_, params, expectedId) => {
+  writeMessage({
+    id: '000000',
+    to: ['ada@example.test'],
+    subject: 'Verify',
+    secondsAfterStart: -5,
+  });
+  writeMessage({ id: '000001', to: ['ada@example.test'], subject: 'Verify your email' });
+  writeMessage({
+    id: '000002',
+    to: ['ada@example.test', 'bob@example.test'],
+    subject: 'Your sign-in link',
+  });
+  writeMessage({ id: '000003', to: ['ada@example.test'], subject: 'Invited' });
+  const page = createPage();
+
+  await openJourneyEmail({ page, params, since: STARTED_AT, configDirectory, timeout: 1000 });
+
+  expect(page.opened).toEqual([
+    `<a href="http://localhost/${expectedId}" target="_blank">Open ${expectedId}</a>`,
+  ]);
+  // Links open where the email is, since each actor drives one tab.
+  const link = { removeAttribute: jest.fn() };
+  global.document = { querySelectorAll: jest.fn(() => [link]) };
+  await page.evaluate.mock.calls[0][0]();
+  delete global.document;
+  expect(link.removeAttribute).toHaveBeenCalledWith('target');
+});
+
+test('openJourneyEmail waits for a message that arrives after the step starts', async () => {
+  const page = createPage({
+    onWait: () => writeMessage({ id: '000001', to: ['ada@example.test'], subject: 'Verify' }),
+  });
+
+  await openJourneyEmail({
+    page,
+    params: { to: 'ada@example.test' },
+    since: STARTED_AT,
+    configDirectory,
+    timeout: 5000,
+  });
+
+  expect(page.waitForTimeout).toHaveBeenCalledTimes(1);
+  expect(page.opened).toHaveLength(1);
+});
+
+test('openJourneyEmail shows a text-only message escaped in a pre block', async () => {
+  writeMessage({
+    id: '000001',
+    to: ['ada@example.test'],
+    subject: 'Code',
+    html: null,
+    text: 'Your code is <1234> & "5"',
+  });
+  const page = createPage();
+
+  await openJourneyEmail({
+    page,
+    params: { to: 'ada@example.test' },
+    since: STARTED_AT,
+    configDirectory,
+    timeout: 1000,
+  });
+
+  expect(page.opened).toEqual(['<pre>Your code is &#60;1234&#62; &#38; &#34;5&#34;</pre>']);
+});
+
+const OLD_MESSAGE = {
+  id: '000000',
+  to: ['ada@example.test'],
+  subject: 'Old',
+  secondsAfterStart: -5,
+};
+const OTHER_MESSAGE = { id: '000001', to: ['bob@example.test'], subject: 'Verify your email' };
+
+test.each([
+  [
+    'names the messages this journey received',
+    [OLD_MESSAGE, OTHER_MESSAGE],
+    { to: 'ada@example.test', subject: 'Verify' },
+    'an email to "ada@example.test" with a subject containing "Verify"',
+    ['"Verify your email" to bob@example.test'],
+  ],
+  [
+    'says so when the journey received no mail at all',
+    [OLD_MESSAGE],
+    { to: 'ada@example.test' },
+    'an email to "ada@example.test"',
+    'no email received during this journey',
+  ],
+])(
+  'openJourneyEmail fails when none matches and %s',
+  async (_, messages, params, expected, actual) => {
+    messages.forEach(writeMessage);
+    const page = createPage();
+
+    const error = await openJourneyEmail({
+      page,
+      params,
+      since: STARTED_AT,
+      configDirectory,
+      timeout: 0,
+    }).catch((caught) => caught);
+
+    expect(error).toBeInstanceOf(JourneyStepError);
+    expect(error.message).toEqual(`Timed out after 0ms waiting for ${expected}.`);
+    expect(error.expected).toEqual(expected);
+    expect(error.actual).toEqual(actual);
+    expect(page.opened).toEqual([]);
+  }
+);

package/lib/docs/pageBlocks.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// The actions of every event of a block, flattened: a built event is
+// { try: [actions], catch: [actions] }.
+function eventActions(block) {
+  return Object.values(block.events ?? {}).flatMap((event) => {
+    if (type.isArray(event)) return event;
+    return [...(event?.try ?? []), ...(event?.catch ?? [])];
+  });
+}
+
+// Every block of a built page below its root, with the actions its events
+// run. The page root's own events (onInit, onMount) ran when the page opened;
+// no candidate triggers them.
+function pageBlocks(page) {
+  const blocks = [];
+  function visit(block) {
+    blocks.push({ blockId: block.blockId, actions: eventActions(block) });
+    childBlocks(block).forEach(visit);
+  }
+  childBlocks(page).forEach(visit);
+  return blocks;
+}
+
+function childBlocks(block) {
+  return ['slots', 'areas'].flatMap((key) =>
+    Object.values(block[key] ?? {}).flatMap((container) => container?.blocks ?? [])
+  );
+}
+
+export default pageBlocks;

package/lib/docs/pageBuildStatus.test.mjs

@@ -0,0 +1,103 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+const mockReviewPageBuilds = jest.fn();
+jest.unstable_mockModule('./reviewPageBuilds.js', () => ({
+  default: mockReviewPageBuilds,
+}));
+const mockBuildPageIfNeeded = jest.fn();
+jest.unstable_mockModule('../server/jitPageBuilder.js', () => ({
+  default: mockBuildPageIfNeeded,
+}));
+
+const { default: buildEditedPages, CONCURRENT_BUILDS } = await import('./buildEditedPages.js');
+const { default: getPageBuildStatus } = await import('./getPageBuildStatus.js');
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+test('buildEditedPages builds every edited page and returns their ids', async () => {
+  mockReviewPageBuilds.mockResolvedValue({ edited: ['a', 'b'], unbuilt: ['c'], failed: [] });
+  mockBuildPageIfNeeded.mockRejectedValueOnce(new Error('Page "a" build failed.'));
+  mockBuildPageIfNeeded.mockResolvedValueOnce(true);
+
+  const checked = await buildEditedPages();
+
+  expect(checked).toEqual(['a', 'b']);
+  expect(mockBuildPageIfNeeded.mock.calls.map(([args]) => args.pageId)).toEqual(['a', 'b']);
+});
+
+test('buildEditedPages builds at most a few pages at once', async () => {
+  const pageIds = Array.from({ length: 10 }, (_, index) => `page-${index}`);
+  mockReviewPageBuilds.mockResolvedValue({ edited: pageIds, unbuilt: [], failed: [] });
+  let running = 0;
+  let mostRunning = 0;
+  mockBuildPageIfNeeded.mockImplementation(async () => {
+    running += 1;
+    mostRunning = Math.max(mostRunning, running);
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    running -= 1;
+    return true;
+  });
+
+  const checked = await buildEditedPages();
+
+  expect(checked).toEqual(pageIds);
+  expect(mockBuildPageIfNeeded).toHaveBeenCalledTimes(10);
+  expect(mostRunning).toBe(CONCURRENT_BUILDS);
+});
+
+test('buildEditedPages builds nothing when no page was edited', async () => {
+  mockReviewPageBuilds.mockResolvedValue({ edited: [], unbuilt: ['a'], failed: [] });
+
+  expect(await buildEditedPages()).toEqual([]);
+  expect(mockBuildPageIfNeeded).not.toHaveBeenCalled();
+});
+
+test('getPageBuildStatus reports failed and unbuilt pages', async () => {
+  const failed = [
+    { pageId: 'a', errors: [{ type: 'ConfigError', message: 'Bad.', source: null }] },
+  ];
+  mockReviewPageBuilds.mockResolvedValue({ edited: [], unbuilt: ['c', 'd'], failed });
+
+  expect(await getPageBuildStatus()).toEqual({
+    failed,
+    unbuilt: 2,
+    unbuiltNote:
+      '2 page(s) have not been built since the dev server started, so this status does not cover them. lowdefy_check validates every page.',
+  });
+});
+
+test('getPageBuildStatus leaves out empty lists and notes', async () => {
+  mockReviewPageBuilds.mockResolvedValue({ edited: [], unbuilt: [], failed: [] });
+
+  expect(await getPageBuildStatus({ checked: [] })).toEqual({ checked: [], unbuilt: 0 });
+});
+
+test('getPageBuildStatus says an edited page is not rebuilt yet, or not seen after a wait', async () => {
+  mockReviewPageBuilds.mockResolvedValue({ edited: ['a'], unbuilt: [], failed: [] });
+
+  const before = await getPageBuildStatus();
+  expect(before.changedSinceBuild).toEqual(['a']);
+  expect(before.changedSinceBuildNote).toContain('Call with wait: true');
+
+  const after = await getPageBuildStatus({ checked: ['a'] });
+  expect(after.checked).toEqual(['a']);
+  expect(after.changedSinceBuildNote).toContain('has not rebuilt them');
+});

package/lib/{client/setPageId.js → docs/parseModuleSource.js}

@@ -14,19 +14,18 @@
   limitations under the License.
 */
 
-// location comes from the custom router (@lowdefy/client/adapters):
-// { pageId, pathname, search }. pageId is null at the root path.
-function setPageId(location, rootConfig) {
-  if (location.pageId === '404') {
-    return { redirect: false, pageId: '404' };
+// A module's source names its package and version: "github:owner/repo/path@ref"
+// is package "github:owner/repo/path" at version "ref"; a local "file:" source
+// is version "local".
+function parseModuleSource({ source }) {
+  if (source.startsWith('file:')) {
+    return { package: source, version: 'local' };
   }
-  if (!location.pageId) {
-    if (rootConfig.home.configured === false) {
-      return { redirect: true, pageId: rootConfig.home.pageId };
-    }
-    return { redirect: false, pageId: rootConfig.home.pageId };
+  const at = source.lastIndexOf('@');
+  if (at <= 0) {
+    return { package: source, version: null };
   }
-  return { redirect: false, pageId: location.pageId };
+  return { package: source.slice(0, at), version: source.slice(at + 1) };
 }
 
-export default setPageId;
+export default parseModuleSource;

package/lib/docs/rails/authEngineActions.js

@@ -0,0 +1,53 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The actions-core action types that call the auth engine. A data-set journey
+// acts as an injected caller, which has no auth engine session, so these fail
+// every time for a harness reason, not the app's: a click that runs one fails
+// its step (see checkAuthActionsRan). A new actions-core action must be
+// classified here or in the test's list of the rest.
+const authEngineActions = new Set([
+  'AcceptInvitation',
+  'ChangePassword',
+  'EmailOtpSend',
+  'EmailOtpVerify',
+  'LeaveOrganization',
+  'ListOrganizations',
+  'Login',
+  'Logout',
+  'MagicLinkVerify',
+  'OAuthConsent',
+  'OAuthContinue',
+  'PasskeyDelete',
+  'PasskeyRegister',
+  'PasskeySignIn',
+  'PasskeyUpdate',
+  'PhoneNumberSendOtp',
+  'PhoneNumberVerify',
+  'RequestPasswordReset',
+  'ResetPassword',
+  'RevokeOtherSessions',
+  'SendVerificationEmail',
+  'SetActiveOrganization',
+  'SignUp',
+  'TwoFactorDisable',
+  'TwoFactorEnable',
+  'TwoFactorGenerateBackupCodes',
+  'TwoFactorVerify',
+  'UpdateSession',
+]);
+
+export default authEngineActions;

package/lib/docs/rails/authEngineActions.test.mjs

@@ -0,0 +1,69 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import actionsCoreTypes from '@lowdefy/actions-core/types';
+
+import authEngineActions from './authEngineActions.js';
+
+// Every actions-core action that does not call the auth engine. A new action
+// type fails the test below until it is added here or to authEngineActions.
+const NOT_AUTH_ENGINE = [
+  'CallAPI',
+  'CallMethod',
+  'CopyToClipboard',
+  'DisplayMessage',
+  'Fetch',
+  'GeolocationCurrentPosition',
+  'GetLocalStorage',
+  'Link',
+  'Publish',
+  'RemoveLocalStorage',
+  'Request',
+  'Reset',
+  'ResetValidation',
+  'ScrollTo',
+  'SetDarkMode',
+  'SetFocus',
+  'SetGlobal',
+  'SetLocale',
+  'SetLocalStorage',
+  'SetState',
+  'Subscribe',
+  'Throw',
+  'Unsubscribe',
+  'Validate',
+  'Wait',
+];
+
+test('every actions-core action type is classified as calling the auth engine or not', () => {
+  const unclassified = actionsCoreTypes.actions.filter(
+    (actionType) => !authEngineActions.has(actionType) && !NOT_AUTH_ENGINE.includes(actionType)
+  );
+  expect(unclassified).toEqual([]);
+});
+
+test('authEngineActions and the list of the rest name only actions-core action types, once', () => {
+  const known = new Set(actionsCoreTypes.actions);
+  expect([...authEngineActions].filter((actionType) => !known.has(actionType))).toEqual([]);
+  expect(NOT_AUTH_ENGINE.filter((actionType) => !known.has(actionType))).toEqual([]);
+  expect(NOT_AUTH_ENGINE.filter((actionType) => authEngineActions.has(actionType))).toEqual([]);
+});
+
+test('authEngineActions holds the sign-in, sign-up and session actions', () => {
+  ['Login', 'Logout', 'SignUp', 'TwoFactorVerify', 'PasskeySignIn', 'EmailOtpSend'].forEach(
+    (actionType) => expect(authEngineActions.has(actionType)).toBe(true)
+  );
+});

package/lib/docs/rails/authEngineMethods.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The client auth method (lowdefy._internal.auth[method], the one the engine's
+// action methods call) behind each auth-engine action type, so a data-set run
+// can say which action ran when it sees a method called. The action types are
+// authEngineActions; authEngineMethods.test.mjs keeps the two in step.
+const authEngineMethods = {
+  acceptInvitation: 'AcceptInvitation',
+  changePassword: 'ChangePassword',
+  emailOtpSend: 'EmailOtpSend',
+  emailOtpVerify: 'EmailOtpVerify',
+  leaveOrganization: 'LeaveOrganization',
+  listOrganizations: 'ListOrganizations',
+  login: 'Login',
+  logout: 'Logout',
+  magicLinkVerify: 'MagicLinkVerify',
+  oauth2Consent: 'OAuthConsent',
+  oauth2Continue: 'OAuthContinue',
+  passkeyDelete: 'PasskeyDelete',
+  passkeyRegister: 'PasskeyRegister',
+  passkeySignIn: 'PasskeySignIn',
+  passkeyUpdate: 'PasskeyUpdate',
+  phoneNumberSendOtp: 'PhoneNumberSendOtp',
+  phoneNumberVerify: 'PhoneNumberVerify',
+  requestPasswordReset: 'RequestPasswordReset',
+  resetPassword: 'ResetPassword',
+  revokeOtherSessions: 'RevokeOtherSessions',
+  sendVerificationEmail: 'SendVerificationEmail',
+  setActiveOrganization: 'SetActiveOrganization',
+  signUp: 'SignUp',
+  twoFactorDisable: 'TwoFactorDisable',
+  twoFactorEnable: 'TwoFactorEnable',
+  twoFactorGenerateBackupCodes: 'TwoFactorGenerateBackupCodes',
+  twoFactorVerify: 'TwoFactorVerify',
+  updateSession: 'UpdateSession',
+};
+
+export default authEngineMethods;

package/lib/docs/rails/authEngineMethods.test.mjs

@@ -0,0 +1,36 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+
+import authEngineActions from './authEngineActions.js';
+import authEngineMethods from './authEngineMethods.js';
+
+test('authEngineMethods maps client auth methods to exactly the authEngineActions types', () => {
+  expect(new Set(Object.values(authEngineMethods))).toEqual(authEngineActions);
+  expect(Object.values(authEngineMethods)).toHaveLength(authEngineActions.size);
+});
+
+test('every method of authEngineMethods is a method the client creates', () => {
+  const source = fs.readFileSync(
+    new URL('../../../../../client/src/auth/createAuthMethods.js', import.meta.url),
+    'utf8'
+  );
+  const exported = source.slice(source.lastIndexOf('  return {'));
+  Object.keys(authEngineMethods).forEach((method) => {
+    expect(exported).toMatch(new RegExp(`^    ${method},?$`, 'm'));
+  });
+});

package/lib/docs/rails/checkAuthActionsRan.js

@@ -0,0 +1,66 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+import JourneyStepError from '../JourneyStepError.js';
+import authEngineMethods from './authEngineMethods.js';
+import installAuthActionRecorder from './installAuthActionRecorder.js';
+import readAuthActionRecorder from './readAuthActionRecorder.js';
+
+const RECORDER_KEY = '__lowdefyAuthActions';
+
+// On a data-set run (journey.dataSetRails), starts recording the auth-engine
+// actions the page executes, before a click acts. Journeys without a data set
+// record nothing.
+async function armAuthActionRecorder({ journey, page }) {
+  if (type.isUndefined(journey.dataSetRails)) {
+    return;
+  }
+  await page.evaluate(installAuthActionRecorder, {
+    key: RECORDER_KEY,
+    methods: Object.keys(authEngineMethods),
+  });
+}
+
+// After a click on a data-set run has settled, fails the step when an
+// auth-engine action executed: its callers are injected and have no auth
+// session, so it fails for a harness reason. An action the chain skipped (a
+// validation that stopped it, a skip: condition) never runs, so a click that
+// only might reach one is fine. blockId is the clicked block, when known.
+async function checkAuthActionsRan({ journey, page, blockId }) {
+  if (type.isUndefined(journey.dataSetRails)) {
+    return;
+  }
+  const called = await page.evaluate(readAuthActionRecorder, { key: RECORDER_KEY }).catch(() => []);
+  const actions = [...new Set(called.map((method) => authEngineMethods[method] ?? method))];
+  if (actions.length === 0) {
+    return;
+  }
+  const subject = type.isNone(blockId) ? 'A click' : `Block "${blockId}"`;
+  throw new JourneyStepError(
+    `${subject} ran the auth action ${actions.join(
+      ', '
+    )}, which a data-set journey cannot run: its users are injected and have no auth session. A click that skips the action (a failed validation, a skip condition) is fine.`,
+    {
+      expected: 'a click that runs no auth action',
+      actual: `a click that ran the auth action ${actions.join(', ')}`,
+    }
+  );
+}
+
+export { armAuthActionRecorder };
+export default checkAuthActionsRan;