@oomol-lab/open-flow 0.1.0-alpha.1 → 0.1.0-alpha.12

package/dist/common/webhook-trigger.js

@@ -1,4 +1,4 @@
-//#region ../../node_modules/dequal/lite/index.mjs
+//#region ../../node_modules/.bun/dequal@2.0.3/node_modules/dequal/lite/index.mjs
 var e = Object.prototype.hasOwnProperty;
 function t(n, r) {
 	var i, a;
@@ -144,6 +144,40 @@ var u = [], d = [{
 			}, "Disallowed origin");
 		}
 	},
+	{
+		fixture: {
+			inputsDef: u,
+			options: {
+				responseData: "<script>globalThis.compromised = true<\/script>",
+				responseHeaders: {
+					"access-control-allow-credentials": "true",
+					"content-security-policy": "default-src * 'unsafe-inline'",
+					"content-type": "text/html",
+					location: "https://attacker.example",
+					"set-cookie": "open_flow_operator_session=forged",
+					"x-accel-redirect": "/auth/session"
+				}
+			}
+		},
+		name: "prevents Flow responses from becoming executable or controlling deployment headers",
+		async verify(e) {
+			await c(await l(e), {
+				body: "<script>globalThis.compromised = true<\/script>",
+				headers: {
+					"access-control-allow-credentials": null,
+					"content-security-policy": "default-src 'none'; frame-ancestors 'none'; sandbox",
+					"content-type": "text/plain;charset=UTF-8",
+					location: null,
+					"referrer-policy": "no-referrer",
+					"set-cookie": null,
+					"x-accel-redirect": null,
+					"x-content-type-options": "nosniff",
+					"x-frame-options": "DENY"
+				},
+				status: 200
+			}, "Safe configured response");
+		}
+	},
 	{
 		fixture: { inputsDef: d },
 		name: "rejects invalid JSON, invalid payloads, invalid idempotency keys, and oversized bodies",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomol-lab/open-flow",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.12",
   "description": "TypeScript contracts and Browser runtime for Open Flow.",
   "license": "Apache-2.0",
   "repository": {
@@ -37,6 +37,10 @@
       "types": "./dist/common/integration-trigger.d.ts",
       "import": "./dist/common/integration-trigger.js"
     },
+    "./localization": {
+      "types": "./dist/common/localization.d.ts",
+      "import": "./dist/common/localization.js"
+    },
     "./poll-trigger": {
       "types": "./dist/common/poll-trigger.d.ts",
       "import": "./dist/common/poll-trigger.js"
@@ -45,17 +49,21 @@
       "types": "./dist/common/provider-triggers.d.ts",
       "import": "./dist/common/provider-triggers.js"
     },
-    "./project-change": {
-      "types": "./dist/browser/project-change.d.ts",
-      "import": "./dist/browser/project-change.js"
+    "./flow-authoring": {
+      "types": "./dist/browser/flow-authoring.d.ts",
+      "import": "./dist/browser/flow-authoring.js"
+    },
+    "./flow-change": {
+      "types": "./dist/browser/flow-change.d.ts",
+      "import": "./dist/browser/flow-change.js"
     },
-    "./project-encoding": {
-      "types": "./dist/common/project-encoding.d.ts",
-      "import": "./dist/common/project-encoding.js"
+    "./flow-encoding": {
+      "types": "./dist/common/flow-encoding.d.ts",
+      "import": "./dist/common/flow-encoding.js"
     },
-    "./project-semantics": {
-      "types": "./dist/common/project-semantics.d.ts",
-      "import": "./dist/common/project-semantics.js"
+    "./flow-semantics": {
+      "types": "./dist/common/flow-semantics.d.ts",
+      "import": "./dist/common/flow-semantics.js"
     },
     "./run-lifecycle": {
       "types": "./dist/common/run-lifecycle.d.ts",
@@ -84,6 +92,10 @@
     "./workbench.css": {
       "types": "./dist/browser/workbench.css.d.ts",
       "default": "./dist/browser/workbench.css"
+    },
+    "./theme.css": {
+      "types": "./dist/browser/theme.css.d.ts",
+      "default": "./dist/browser/theme.css"
     }
   },
   "files": [
@@ -93,6 +105,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
+    "effect": "4.0.0-rc.112",
     "react": "^18.3.1 || ^19.0.0",
     "react-dom": "^18.3.1 || ^19.0.0"
   },