@oomol-lab/open-flow 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/common/webhook-trigger.js

@@ -1,4 +1,4 @@
-//#region ../../node_modules/dequal/lite/index.mjs
+//#region ../../node_modules/.bun/dequal@2.0.3/node_modules/dequal/lite/index.mjs
 var e = Object.prototype.hasOwnProperty;
 function t(n, r) {
 	var i, a;
@@ -144,6 +144,40 @@ var u = [], d = [{
 			}, "Disallowed origin");
 		}
 	},
+	{
+		fixture: {
+			inputsDef: u,
+			options: {
+				responseData: "<script>globalThis.compromised = true<\/script>",
+				responseHeaders: {
+					"access-control-allow-credentials": "true",
+					"content-security-policy": "default-src * 'unsafe-inline'",
+					"content-type": "text/html",
+					location: "https://attacker.example",
+					"set-cookie": "open_flow_operator_session=forged",
+					"x-accel-redirect": "/auth/session"
+				}
+			}
+		},
+		name: "prevents Flow responses from becoming executable or controlling deployment headers",
+		async verify(e) {
+			await c(await l(e), {
+				body: "<script>globalThis.compromised = true<\/script>",
+				headers: {
+					"access-control-allow-credentials": null,
+					"content-security-policy": "default-src 'none'; frame-ancestors 'none'; sandbox",
+					"content-type": "text/plain;charset=UTF-8",
+					location: null,
+					"referrer-policy": "no-referrer",
+					"set-cookie": null,
+					"x-accel-redirect": null,
+					"x-content-type-options": "nosniff",
+					"x-frame-options": "DENY"
+				},
+				status: 200
+			}, "Safe configured response");
+		}
+	},
 	{
 		fixture: { inputsDef: d },
 		name: "rejects invalid JSON, invalid payloads, invalid idempotency keys, and oversized bodies",

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@oomol-lab/open-flow",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.10",
   "description": "TypeScript contracts and Browser runtime for Open Flow.",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oomol-lab/open-flow.git",
+    "directory": "packages/open-flow"
+  },
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
@@ -40,17 +45,21 @@
       "types": "./dist/common/provider-triggers.d.ts",
       "import": "./dist/common/provider-triggers.js"
     },
-    "./project-change": {
-      "types": "./dist/browser/project-change.d.ts",
-      "import": "./dist/browser/project-change.js"
+    "./flow-authoring": {
+      "types": "./dist/browser/flow-authoring.d.ts",
+      "import": "./dist/browser/flow-authoring.js"
+    },
+    "./flow-change": {
+      "types": "./dist/browser/flow-change.d.ts",
+      "import": "./dist/browser/flow-change.js"
     },
-    "./project-encoding": {
-      "types": "./dist/common/project-encoding.d.ts",
-      "import": "./dist/common/project-encoding.js"
+    "./flow-encoding": {
+      "types": "./dist/common/flow-encoding.d.ts",
+      "import": "./dist/common/flow-encoding.js"
     },
-    "./project-semantics": {
-      "types": "./dist/common/project-semantics.d.ts",
-      "import": "./dist/common/project-semantics.js"
+    "./flow-semantics": {
+      "types": "./dist/common/flow-semantics.d.ts",
+      "import": "./dist/common/flow-semantics.js"
     },
     "./run-lifecycle": {
       "types": "./dist/common/run-lifecycle.d.ts",
@@ -88,6 +97,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
+    "effect": "4.0.0-rc.112",
     "react": "^18.3.1 || ^19.0.0",
     "react-dom": "^18.3.1 || ^19.0.0"
   },