@teleporthq/teleport-plugin-next-workflows 0.43.1

package/dist/cjs/runtime-storage-generator.d.ts

@@ -0,0 +1,3 @@
+export declare const needsRuntimeStorageRoute: (usedNodeTypes: Set<string>) => boolean;
+export declare const generateRuntimeStorageUploadRoute: () => string;
+//# sourceMappingURL=runtime-storage-generator.d.ts.map

package/dist/cjs/runtime-storage-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-storage-generator.d.ts","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,wBAAwB,kBAAmB,IAAI,MAAM,CAAC,KAAG,OAOrE,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAO,MA+CpD,CAAA"}

package/dist/cjs/runtime-storage-generator.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateRuntimeStorageUploadRoute = exports.needsRuntimeStorageRoute = void 0;
+const FILE_STORAGE_NODE_TYPES = new Set([
+    'file-storage-upload',
+    'file-storage-list',
+    'file-storage-get-details',
+    'file-storage-delete',
+]);
+const needsRuntimeStorageRoute = (usedNodeTypes) => {
+    for (const nt of usedNodeTypes) {
+        if (FILE_STORAGE_NODE_TYPES.has(nt)) {
+            return true;
+        }
+    }
+    return false;
+};
+exports.needsRuntimeStorageRoute = needsRuntimeStorageRoute;
+const generateRuntimeStorageUploadRoute = () => {
+    return `var RUNTIME_STORAGE_URL = process.env.RUNTIME_STORAGE_URL;
+var RUNTIME_STORAGE_API_KEY = process.env.RUNTIME_STORAGE_API_KEY;
+var RUNTIME_STORAGE_PROJECT_ID = process.env.RUNTIME_STORAGE_PROJECT_ID;
+
+module.exports = async function handler(req, res) {
+  if (req.method !== 'POST') {
+    res.status(405).json({ error: 'Method not allowed' });
+    return;
+  }
+
+  if (!RUNTIME_STORAGE_URL || !RUNTIME_STORAGE_API_KEY || !RUNTIME_STORAGE_PROJECT_ID) {
+    res.status(500).json({ error: 'Runtime storage is not configured' });
+    return;
+  }
+
+  try {
+    var targetUrl = RUNTIME_STORAGE_URL + '/project/' + RUNTIME_STORAGE_PROJECT_ID + '/upload';
+
+    var headers = {
+      'Authorization': 'Bearer ' + RUNTIME_STORAGE_API_KEY,
+    };
+
+    if (req.headers['content-type']) {
+      headers['content-type'] = req.headers['content-type'];
+    }
+    if (req.headers['content-length']) {
+      headers['content-length'] = req.headers['content-length'];
+    }
+
+    var storageRes = await fetch(targetUrl, {
+      method: 'POST',
+      headers: headers,
+      body: req,
+      duplex: 'half',
+    });
+
+    var data = await storageRes.json();
+    res.status(storageRes.status).json(data);
+  } catch (err) {
+    console.error('Runtime storage upload proxy error:', err);
+    res.status(500).json({ error: 'Upload proxy failed' });
+  }
+};
+
+module.exports.config = { api: { bodyParser: false } };
+`;
+};
+exports.generateRuntimeStorageUploadRoute = generateRuntimeStorageUploadRoute;
+//# sourceMappingURL=runtime-storage-generator.js.map

package/dist/cjs/runtime-storage-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-storage-generator.js","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":";;;AAAA,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,qBAAqB;IACrB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC,CAAA;AAEK,MAAM,wBAAwB,GAAG,CAAC,aAA0B,EAAW,EAAE;IAC9E,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE;QAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACnC,OAAO,IAAI,CAAA;SACZ;KACF;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAPY,QAAA,wBAAwB,4BAOpC;AAEM,MAAM,iCAAiC,GAAG,GAAW,EAAE;IAC5D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CR,CAAA;AACD,CAAC,CAAA;AA/CY,QAAA,iCAAiC,qCA+C7C"}

package/dist/cjs/secret-collector.d.ts

@@ -0,0 +1,5 @@
+import { UIDLWorkflows } from '@teleporthq/teleport-types';
+import { SecretEntry } from './types';
+export declare const collectSecrets: (workflows: UIDLWorkflows) => SecretEntry[];
+export declare const replaceSecretsInConfig: (config: Record<string, unknown>, nodeType: string, nodeId: string, secrets: SecretEntry[]) => Record<string, unknown>;
+//# sourceMappingURL=secret-collector.d.ts.map

package/dist/cjs/secret-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-collector.d.ts","sourceRoot":"","sources":["../../src/secret-collector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4C,MAAM,4BAA4B,CAAA;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAoCrC,eAAO,MAAM,cAAc,cAAe,aAAa,KAAG,WAAW,EAmCpE,CAAA;AAqCD,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,OAAO,CAAC,YACrB,MAAM,UACR,MAAM,WACL,WAAW,EAAE,KACrB,OAAO,MAAM,EAAE,OAAO,CAYxB,CAAA"}

package/dist/cjs/secret-collector.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.replaceSecretsInConfig = exports.collectSecrets = void 0;
+const nodes_1 = require("./nodes");
+const KNOWN_SECRET_FIELDS = {
+    'ai-custom-prompt': ['token'],
+    'ai-sentiment-analysis': ['token'],
+    'ai-summarization': ['token'],
+    'ai-text-classifier': ['token'],
+    'ai-text-transform': ['token'],
+    'ai-detect-language': ['token'],
+    'ai-generate-text-embedding': ['token'],
+    'email-mailersend': ['apiKey'],
+    'email-mailgun': ['apiKey'],
+    'email-postmark': ['serverToken'],
+    'email-resend': ['apiKey'],
+    'email-sendgrid': ['apiKey'],
+    'sms-textmagic': ['apiKey'],
+    'sms-infobip': ['apiKey'],
+    'sms-twilio': ['accountSid', 'authToken'],
+    'sms-smsapi': ['accessToken'],
+    'general-http-request': [],
+    'payment-charge-user': ['secretKey', 'clientId', 'clientSecret'],
+    'payment-subscribe-to-plan': ['secretKey'],
+    'payment-cancel-plan': ['secretKey'],
+    'payment-create-customer': ['secretKey', 'clientId', 'clientSecret'],
+    'payment-create-product': ['secretKey'],
+    'payment-create-subscription': ['secretKey'],
+    'payment-get-customer': ['secretKey'],
+    'payment-get-product': ['secretKey'],
+    'payment-list-customers': ['secretKey'],
+    'payment-list-plans': ['secretKey'],
+    'payment-list-products': ['secretKey'],
+    'payment-list-subscriptions': ['secretKey'],
+    'payment-update-customer': ['secretKey'],
+};
+const collectSecrets = (workflows) => {
+    const secrets = [];
+    const seenEnvVars = new Set();
+    const processNode = (node) => {
+        const secretFields = getSecretFieldsForNode(node.type);
+        for (const field of secretFields) {
+            const value = node.config[field];
+            if (value && typeof value === 'string' && !isWorkflowContextValue(value)) {
+                const envVarName = generateEnvVarName(node.type, field, node.id);
+                if (!seenEnvVars.has(envVarName)) {
+                    seenEnvVars.add(envVarName);
+                    secrets.push({
+                        envVarName,
+                        value: value,
+                        nodeId: node.id,
+                        fieldName: field,
+                    });
+                }
+            }
+        }
+    };
+    const allWorkflows = workflows.workflows;
+    Object.values(allWorkflows).forEach((wf) => {
+        wf.nodes.forEach(processNode);
+    });
+    if (workflows.customNodes) {
+        Object.values(workflows.customNodes).forEach((cn) => {
+            cn.nodes.forEach(processNode);
+        });
+    }
+    return secrets;
+};
+exports.collectSecrets = collectSecrets;
+const getSecretFieldsForNode = (nodeType) => {
+    if (KNOWN_SECRET_FIELDS[nodeType]) {
+        return KNOWN_SECRET_FIELDS[nodeType];
+    }
+    if (nodeType.startsWith('integration-')) {
+        const generator = nodes_1.nodeRegistry[nodeType];
+        if (generator && 'secretFields' in generator) {
+            return generator.secretFields || [];
+        }
+        return ['token', 'apiKey', 'accessToken', 'secretKey'];
+    }
+    return [];
+};
+const generateEnvVarName = (nodeType, fieldName, nodeId) => {
+    const prefix = 'WORKFLOW_SECRET';
+    const typePart = nodeType.replace(/-/g, '_').toUpperCase();
+    const fieldPart = fieldName.replace(/([A-Z])/g, '_$1').toUpperCase();
+    const idPart = nodeId
+        .replace(/[^a-zA-Z0-9]/g, '_')
+        .substring(0, 8)
+        .toUpperCase();
+    return `${prefix}_${typePart}_${fieldPart}_${idPart}`;
+};
+const isWorkflowContextValue = (value) => {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.type === 'workflowContext');
+};
+const replaceSecretsInConfig = (config, nodeType, nodeId, secrets) => {
+    const result = Object.assign({}, config);
+    const secretFields = getSecretFieldsForNode(nodeType);
+    for (const field of secretFields) {
+        const secret = secrets.find((s) => s.nodeId === nodeId && s.fieldName === field);
+        if (secret) {
+            result[field] = secret.envVarName;
+        }
+    }
+    return result;
+};
+exports.replaceSecretsInConfig = replaceSecretsInConfig;
+//# sourceMappingURL=secret-collector.js.map

package/dist/cjs/secret-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-collector.js","sourceRoot":"","sources":["../../src/secret-collector.ts"],"names":[],"mappings":";;;AAEA,mCAAsC;AAEtC,MAAM,mBAAmB,GAA6B;IACpD,kBAAkB,EAAE,CAAC,OAAO,CAAC;IAC7B,uBAAuB,EAAE,CAAC,OAAO,CAAC;IAClC,kBAAkB,EAAE,CAAC,OAAO,CAAC;IAC7B,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,mBAAmB,EAAE,CAAC,OAAO,CAAC;IAC9B,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,4BAA4B,EAAE,CAAC,OAAO,CAAC;IACvC,kBAAkB,EAAE,CAAC,QAAQ,CAAC;IAC9B,eAAe,EAAE,CAAC,QAAQ,CAAC;IAC3B,gBAAgB,EAAE,CAAC,aAAa,CAAC;IACjC,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,gBAAgB,EAAE,CAAC,QAAQ,CAAC;IAC5B,eAAe,EAAE,CAAC,QAAQ,CAAC;IAC3B,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,YAAY,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACzC,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B,sBAAsB,EAAE,EAAE;IAC1B,qBAAqB,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;IAChE,2BAA2B,EAAE,CAAC,WAAW,CAAC;IAC1C,qBAAqB,EAAE,CAAC,WAAW,CAAC;IACpC,yBAAyB,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;IACpE,wBAAwB,EAAE,CAAC,WAAW,CAAC;IACvC,6BAA6B,EAAE,CAAC,WAAW,CAAC;IAC5C,sBAAsB,EAAE,CAAC,WAAW,CAAC;IACrC,qBAAqB,EAAE,CAAC,WAAW,CAAC;IACpC,wBAAwB,EAAE,CAAC,WAAW,CAAC;IACvC,oBAAoB,EAAE,CAAC,WAAW,CAAC;IACnC,uBAAuB,EAAE,CAAC,WAAW,CAAC;IACtC,4BAA4B,EAAE,CAAC,WAAW,CAAC;IAC3C,yBAAyB,EAAE,CAAC,WAAW,CAAC;CACzC,CAAA;AAEM,MAAM,cAAc,GAAG,CAAC,SAAwB,EAAiB,EAAE;IACxE,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,MAAM,WAAW,GAAG,CAAC,IAAsB,EAAE,EAAE;QAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAChC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE;gBACxE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;oBAChC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;oBAC3B,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU;wBACV,KAAK,EAAE,KAAe;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAA;iBACH;aACF;SACF;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,SAA0D,CAAA;IACzF,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACzC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,IAAI,SAAS,CAAC,WAAW,EAAE;QACzB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,EAA0B,EAAE,EAAE;YAC1E,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;KACH;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAnCY,QAAA,cAAc,kBAmC1B;AAED,MAAM,sBAAsB,GAAG,CAAC,QAAgB,EAAY,EAAE;IAC5D,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE;QACjC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAA;KACrC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;QACvC,MAAM,SAAS,GAAG,oBAAY,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,SAAS,IAAI,cAAc,IAAI,SAAS,EAAE;YAC5C,OAAQ,SAAiB,CAAC,YAAY,IAAI,EAAE,CAAA;SAC7C;QACD,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;KACvD;IAED,OAAO,EAAE,CAAA;AACX,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc,EAAU,EAAE;IACzF,MAAM,MAAM,GAAG,iBAAiB,CAAA;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACpE,MAAM,MAAM,GAAG,MAAM;SAClB,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;SACf,WAAW,EAAE,CAAA;IAChB,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE;IACzD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,IAAI,KAAK,iBAAiB,CAC9D,CAAA;AACH,CAAC,CAAA;AAEM,MAAM,sBAAsB,GAAG,CACpC,MAA+B,EAC/B,QAAgB,EAChB,MAAc,EACd,OAAsB,EACG,EAAE;IAC3B,MAAM,MAAM,qBAAQ,MAAM,CAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAErD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAA;QAChF,IAAI,MAAM,EAAE;YACV,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;SAClC;KACF;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAjBY,QAAA,sBAAsB,0BAiBlC"}

package/dist/cjs/security-scanner.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Codegen-time security gate. Run from `NextWorkflowProjectPlugin.runBefore`
+ * over every `general-custom-js` node's `config.code`. Refuses to generate
+ * code containing obvious protected-env-var access or sandbox-escape
+ * primitives so the codegen pipeline can't be coerced into shipping
+ * dangerous workflow code even if the GUI and services-worker layers were
+ * bypassed.
+ *
+ * Intentionally narrow + regex-based: the GUI runs the full AST scan
+ * (workflow-schema/src/security/scan-custom-js.ts) before the project
+ * reaches codegen, and the services-worker re-runs it on the publish
+ * payload. This file is the cheap third checkpoint — it catches the
+ * obvious naïve patterns and is cheap enough to run inside the codegen
+ * pipeline without pulling @babel/parser into this package.
+ *
+ * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
+ *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ */
+export declare const PROTECTED_ENV_NAMES: readonly ["TELEPORT_DB_CONNECTION_STRING", "RUNTIME_STORAGE_API_KEY", "RUNTIME_STORAGE_PROJECT_ID", "TELEPORT_PROJECT_TOKEN", "REALTIME_SERVER_API_KEY", "REALTIME_SERVER_URL", "PDF_SERVICE_URL", "PDF_SERVICE_API_KEY"];
+export interface CodegenSecurityViolation {
+    workflowId: string;
+    workflowName?: string;
+    nodeId: string;
+    rule: string;
+    message: string;
+}
+export declare class CodegenSecurityError extends Error {
+    readonly violations: CodegenSecurityViolation[];
+    constructor(violations: CodegenSecurityViolation[]);
+}
+interface WorkflowNodeLike {
+    id?: string;
+    config?: {
+        code?: string;
+    };
+}
+interface WorkflowLike {
+    id?: string;
+    name?: string;
+    nodes?: WorkflowNodeLike[];
+}
+interface WorkflowsContainer {
+    workflows?: Record<string, WorkflowLike>;
+}
+/**
+ * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
+ * any `general-custom-js` body trips the scanner.
+ *
+ * Per `general-custom-js` the only place a user can write JS is the `code`
+ * config field, so we look only there. Other node types use structured
+ * configs we don't touch.
+ */
+export declare function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer | undefined): void;
+export {};
+//# sourceMappingURL=security-scanner.d.ts.map

package/dist/cjs/security-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,mBAAmB,2NAStB,CAAA;AAEV,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,UAAU,EAAE,wBAAwB,EAAE;gBAAtC,UAAU,EAAE,wBAAwB,EAAE;CAWnE;AAED,UAAU,gBAAgB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3B;AAED,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CA2BjG"}

package/dist/cjs/security-scanner.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * Codegen-time security gate. Run from `NextWorkflowProjectPlugin.runBefore`
+ * over every `general-custom-js` node's `config.code`. Refuses to generate
+ * code containing obvious protected-env-var access or sandbox-escape
+ * primitives so the codegen pipeline can't be coerced into shipping
+ * dangerous workflow code even if the GUI and services-worker layers were
+ * bypassed.
+ *
+ * Intentionally narrow + regex-based: the GUI runs the full AST scan
+ * (workflow-schema/src/security/scan-custom-js.ts) before the project
+ * reaches codegen, and the services-worker re-runs it on the publish
+ * payload. This file is the cheap third checkpoint — it catches the
+ * obvious naïve patterns and is cheap enough to run inside the codegen
+ * pipeline without pulling @babel/parser into this package.
+ *
+ * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
+ *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertWorkflowsAreSecure = exports.CodegenSecurityError = exports.PROTECTED_ENV_NAMES = void 0;
+exports.PROTECTED_ENV_NAMES = [
+    'TELEPORT_DB_CONNECTION_STRING',
+    'RUNTIME_STORAGE_API_KEY',
+    'RUNTIME_STORAGE_PROJECT_ID',
+    'TELEPORT_PROJECT_TOKEN',
+    'REALTIME_SERVER_API_KEY',
+    'REALTIME_SERVER_URL',
+    'PDF_SERVICE_URL',
+    'PDF_SERVICE_API_KEY',
+];
+class CodegenSecurityError extends Error {
+    constructor(violations) {
+        super(`Codegen blocked by ${violations.length} security violation${violations.length === 1 ? '' : 's'}`);
+        this.violations = violations;
+        this.name = 'CodegenSecurityError';
+        // ES5 target breaks the prototype chain when extending built-ins like
+        // Error — restore it so `instanceof CodegenSecurityError` works.
+        Object.setPrototypeOf(this, CodegenSecurityError.prototype);
+    }
+}
+exports.CodegenSecurityError = CodegenSecurityError;
+/**
+ * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
+ * any `general-custom-js` body trips the scanner.
+ *
+ * Per `general-custom-js` the only place a user can write JS is the `code`
+ * config field, so we look only there. Other node types use structured
+ * configs we don't touch.
+ */
+function assertWorkflowsAreSecure(workflowsContainer) {
+    var _a, _b;
+    if (!(workflowsContainer === null || workflowsContainer === void 0 ? void 0 : workflowsContainer.workflows))
+        return;
+    const violations = [];
+    for (const [wfId, wf] of Object.entries(workflowsContainer.workflows)) {
+        if (!wf || !Array.isArray(wf.nodes))
+            continue;
+        for (const node of wf.nodes) {
+            const nodeAsUnknown = node;
+            if ((nodeAsUnknown === null || nodeAsUnknown === void 0 ? void 0 : nodeAsUnknown.type) !== 'general-custom-js')
+                continue;
+            const code = (_a = nodeAsUnknown.config) === null || _a === void 0 ? void 0 : _a.code;
+            if (typeof code !== 'string' || !code.trim())
+                continue;
+            const findings = scanForObviousViolations(code);
+            for (const finding of findings) {
+                violations.push({
+                    workflowId: wfId,
+                    workflowName: wf.name,
+                    nodeId: (_b = nodeAsUnknown.id) !== null && _b !== void 0 ? _b : '?',
+                    rule: finding.rule,
+                    message: finding.message,
+                });
+            }
+        }
+    }
+    if (violations.length > 0)
+        throw new CodegenSecurityError(violations);
+}
+exports.assertWorkflowsAreSecure = assertWorkflowsAreSecure;
+/**
+ * Regex-based scan. Sufficient at the codegen layer because:
+ *   - the GUI's AST scanner has already vetted the code.
+ *   - the services-worker re-runs the full AST scan on the publish payload.
+ *   - the runtime `process` Proxy preamble denies even successful escapes.
+ */
+function scanForObviousViolations(rawCode) {
+    const out = [];
+    const code = stripCommentsAndDecodeEscapes(rawCode);
+    for (const name of exports.PROTECTED_ENV_NAMES) {
+        if (new RegExp(`\\b${name}\\b`).test(code)) {
+            out.push({
+                rule: 'protected-env-access',
+                message: `references protected platform secret "${name}"`,
+            });
+        }
+    }
+    if (/\beval\s*\(/.test(code)) {
+        out.push({ rule: 'sandbox-escape-eval', message: 'calls eval(...)' });
+    }
+    if (/\b(?:new\s+)?Function\s*\(/.test(code)) {
+        out.push({
+            rule: 'sandbox-escape-function',
+            message: 'uses Function(...) or new Function(...)',
+        });
+    }
+    if (/\bwith\s*\(/.test(code)) {
+        out.push({ rule: 'sandbox-escape-with', message: 'uses a with statement' });
+    }
+    if (/\brequire\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(code)) {
+        out.push({
+            rule: 'forbidden-require',
+            message: 'requires a forbidden Node.js module',
+        });
+    }
+    if (/\bimport\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(code)) {
+        out.push({
+            rule: 'forbidden-dynamic-import',
+            message: 'dynamically imports a forbidden Node.js module',
+        });
+    }
+    if (/\b(?:globalThis|global)\s*[\.\[]\s*["'`]?process\b/.test(code)) {
+        out.push({
+            rule: 'indirect-process-access',
+            message: 'reaches process via globalThis / global',
+        });
+    }
+    // Mass enumeration of process.env
+    if (/\bObject\.(?:keys|values|entries|assign|fromEntries|getOwnProperty(?:Names|Symbols|Descriptors))\s*\(\s*(?:[^)]*,\s*)?process\.env\b/.test(code) ||
+        /\bJSON\.stringify\s*\(\s*process\.env\b/.test(code) ||
+        /\bReflect\.ownKeys\s*\(\s*process\.env\b/.test(code) ||
+        /\{\s*\.\.\.process\.env\b/.test(code) ||
+        /\bfor\s*\(\s*(?:var|let|const)?\s*\w+\s+(?:in|of)\s+process\.env\b/.test(code)) {
+        out.push({
+            rule: 'mass-env-enumeration',
+            message: 'enumerates or copies the entire process.env',
+        });
+    }
+    return out;
+}
+function stripCommentsAndDecodeEscapes(input) {
+    let stripped = input.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    stripped = stripped
+        .replace(/\\u\{([0-9a-fA-F]+)\}/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+        .replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+        .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)));
+    return stripped;
+}
+function safeFromCodePoint(code) {
+    if (!Number.isFinite(code) || code < 0 || code > 0x10ffff)
+        return '';
+    try {
+        return String.fromCodePoint(code);
+    }
+    catch (_a) {
+        return '';
+    }
+}
+//# sourceMappingURL=security-scanner.js.map

package/dist/cjs/security-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEU,QAAA,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,yBAAyB;IACzB,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;CACb,CAAA;AAUV,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAA4B,UAAsC;QAChE,KAAK,CACH,sBAAsB,UAAU,CAAC,MAAM,sBACrC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,EAAE,CACH,CAAA;QALyB,eAAU,GAAV,UAAU,CAA4B;QAMhE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACF;AAZD,oDAYC;AAiBD;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CAAC,kBAAkD;;IACzF,IAAI,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,SAAS,CAAA;QAAE,OAAM;IAC1C,MAAM,UAAU,GAA+B,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QACrE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE;YAC3B,MAAM,aAAa,GAAG,IAIrB,CAAA;YACD,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,MAAK,mBAAmB;gBAAE,SAAQ;YACzD,MAAM,IAAI,GAAG,MAAA,aAAa,CAAC,MAAM,0CAAE,IAAI,CAAA;YACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAQ;YACtD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,EAAE,CAAC,IAAI;oBACrB,MAAM,EAAE,MAAA,aAAa,CAAC,EAAE,mCAAI,GAAG;oBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;aACH;SACF;KACF;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;AACvE,CAAC;AA3BD,4DA2BC;AAOD;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;IAEnD,KAAK,MAAM,IAAI,IAAI,2BAAmB,EAAE;QACtC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,yCAAyC,IAAI,GAAG;aAC1D,CAAC,CAAA;SACH;KACF;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAA;KACtE;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;KAC5E;IACD,IACE,kIAAkI,CAAC,IAAI,CACrI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;KACH;IACD,IACE,iIAAiI,CAAC,IAAI,CACpI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;KACH;IACD,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnE,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,kCAAkC;IAClC,IACE,sIAAsI,CAAC,IAAI,CACzI,IAAI,CACL;QACD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QACrD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,oEAAoE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC/E;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;KACH;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAChF,QAAQ,GAAG,QAAQ;SAChB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACnF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpE,IAAI;QACF,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;KAClC;IAAC,WAAM;QACN,OAAO,EAAE,CAAA;KACV;AACH,CAAC"}

package/dist/cjs/segment-splitter.d.ts

@@ -0,0 +1,6 @@
+import { UIDLWorkflow } from '@teleporthq/teleport-types';
+import { WorkflowSegment } from './types';
+export declare const splitIntoSegments: (workflow: UIDLWorkflow) => WorkflowSegment[];
+export declare const getServerSegments: (segments: WorkflowSegment[]) => WorkflowSegment[];
+export declare const getClientSegments: (segments: WorkflowSegment[]) => WorkflowSegment[];
+//# sourceMappingURL=segment-splitter.d.ts.map

package/dist/cjs/segment-splitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-splitter.d.ts","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAsC,MAAM,4BAA4B,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAwB,MAAM,SAAS,CAAA;AAuG/D,eAAO,MAAM,iBAAiB,aAAc,YAAY,KAAG,eAAe,EAgGzE,CAAA;AAiFD,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA"}