@teleporthq/teleport-plugin-next-workflows 0.43.50 → 0.43.53

package/dist/cjs/index.d.ts

@@ -6,6 +6,7 @@ export { collectSecrets } from './secret-collector';
 export { generateClientRuntimeCode, generateServerRuntimeCode, generateSharedRuntimeUtilsCode, } from './executor-generator';
 export { generateServerSegmentAPIRoute, generateStreamingServerSegmentAPIRoute, generateCronAPIRoute, generateWebhookWorkflowAPIRoute, getAPIRouteFileName, getCronRouteFileName, getWebhookRouteFileName, getWebhookRoutePath, hasStreamingAINode, } from './api-route-generator';
 export { generateTriggerCode } from './trigger-generator';
+export { SESSION_TOKEN_RESOLVER_FN, generateSessionTokenResolverCode, generateCommonJsSessionTokenResolverCode, } from './session-cookie-resolver';
 export { projectUsesRealtime, REALTIME_NODE_TYPES, REALTIME_TRIGGER_TYPES } from './graph-utils';
 export * from './realtime-generator';
 export { generateInvoiceFiles, resolveInvoiceDataSource } from './invoice';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,6BAA6B,EAC7B,sCAAsC,EACtC,oBAAoB,EACpB,+BAA+B,EAC/B,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAChG,cAAc,sBAAsB,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,6BAA6B,CAAA;AACpC,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,6BAA6B,EAC7B,sCAAsC,EACtC,oBAAoB,EACpB,+BAA+B,EAC/B,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,wCAAwC,GACzC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAChG,cAAc,sBAAsB,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EACL,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,6BAA6B,CAAA;AACpC,cAAc,SAAS,CAAA"}

package/dist/cjs/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateRuntimeStorageUploadRoute = exports.needsRuntimeStorageRoute = exports.generateWebhookFiles = exports.resolveInvoiceDataSource = exports.generateInvoiceFiles = exports.REALTIME_TRIGGER_TYPES = exports.REALTIME_NODE_TYPES = exports.projectUsesRealtime = exports.generateTriggerCode = exports.hasStreamingAINode = exports.getWebhookRoutePath = exports.getWebhookRouteFileName = exports.getCronRouteFileName = exports.getAPIRouteFileName = exports.generateWebhookWorkflowAPIRoute = exports.generateCronAPIRoute = exports.generateStreamingServerSegmentAPIRoute = exports.generateServerSegmentAPIRoute = exports.generateSharedRuntimeUtilsCode = exports.generateServerRuntimeCode = exports.generateClientRuntimeCode = exports.collectSecrets = exports.getClientSegments = exports.getServerSegments = exports.splitIntoSegments = exports.nodeRegistry = exports.NextWorkflowProjectPlugin = exports.createNextWorkflowPlugin = void 0;
+exports.generateRuntimeStorageUploadRoute = exports.needsRuntimeStorageRoute = exports.generateWebhookFiles = exports.resolveInvoiceDataSource = exports.generateInvoiceFiles = exports.REALTIME_TRIGGER_TYPES = exports.REALTIME_NODE_TYPES = exports.projectUsesRealtime = exports.generateCommonJsSessionTokenResolverCode = exports.generateSessionTokenResolverCode = exports.SESSION_TOKEN_RESOLVER_FN = exports.generateTriggerCode = exports.hasStreamingAINode = exports.getWebhookRoutePath = exports.getWebhookRouteFileName = exports.getCronRouteFileName = exports.getAPIRouteFileName = exports.generateWebhookWorkflowAPIRoute = exports.generateCronAPIRoute = exports.generateStreamingServerSegmentAPIRoute = exports.generateServerSegmentAPIRoute = exports.generateSharedRuntimeUtilsCode = exports.generateServerRuntimeCode = exports.generateClientRuntimeCode = exports.collectSecrets = exports.getClientSegments = exports.getServerSegments = exports.splitIntoSegments = exports.nodeRegistry = exports.NextWorkflowProjectPlugin = exports.createNextWorkflowPlugin = void 0;
 var workflow_component_plugin_1 = require("./workflow-component-plugin");
 Object.defineProperty(exports, "createNextWorkflowPlugin", { enumerable: true, get: function () { return workflow_component_plugin_1.createNextWorkflowPlugin; } });
 var workflow_project_plugin_1 = require("./workflow-project-plugin");
@@ -43,6 +43,10 @@ Object.defineProperty(exports, "getWebhookRoutePath", { enumerable: true, get: f
 Object.defineProperty(exports, "hasStreamingAINode", { enumerable: true, get: function () { return api_route_generator_1.hasStreamingAINode; } });
 var trigger_generator_1 = require("./trigger-generator");
 Object.defineProperty(exports, "generateTriggerCode", { enumerable: true, get: function () { return trigger_generator_1.generateTriggerCode; } });
+var session_cookie_resolver_1 = require("./session-cookie-resolver");
+Object.defineProperty(exports, "SESSION_TOKEN_RESOLVER_FN", { enumerable: true, get: function () { return session_cookie_resolver_1.SESSION_TOKEN_RESOLVER_FN; } });
+Object.defineProperty(exports, "generateSessionTokenResolverCode", { enumerable: true, get: function () { return session_cookie_resolver_1.generateSessionTokenResolverCode; } });
+Object.defineProperty(exports, "generateCommonJsSessionTokenResolverCode", { enumerable: true, get: function () { return session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode; } });
 var graph_utils_1 = require("./graph-utils");
 Object.defineProperty(exports, "projectUsesRealtime", { enumerable: true, get: function () { return graph_utils_1.projectUsesRealtime; } });
 Object.defineProperty(exports, "REALTIME_NODE_TYPES", { enumerable: true, get: function () { return graph_utils_1.REALTIME_NODE_TYPES; } });

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,yEAAsE;AAA7D,qIAAA,wBAAwB,OAAA;AACjC,qEAAqE;AAA5D,oIAAA,yBAAyB,OAAA;AAClC,iCAAsC;AAA7B,qGAAA,YAAY,OAAA;AACrB,uDAA4F;AAAnF,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAChE,uDAAmD;AAA1C,kHAAA,cAAc,OAAA;AACvB,2DAI6B;AAH3B,+HAAA,yBAAyB,OAAA;AACzB,+HAAA,yBAAyB,OAAA;AACzB,oIAAA,8BAA8B,OAAA;AAEhC,6DAU8B;AAT5B,oIAAA,6BAA6B,OAAA;AAC7B,6IAAA,sCAAsC,OAAA;AACtC,2HAAA,oBAAoB,OAAA;AACpB,sIAAA,+BAA+B,OAAA;AAC/B,0HAAA,mBAAmB,OAAA;AACnB,2HAAA,oBAAoB,OAAA;AACpB,8HAAA,uBAAuB,OAAA;AACvB,0HAAA,mBAAmB,OAAA;AACnB,yHAAA,kBAAkB,OAAA;AAEpB,yDAAyD;AAAhD,wHAAA,mBAAmB,OAAA;AAC5B,6CAAgG;AAAvF,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AACzE,uDAAoC;AACpC,qCAA0E;AAAjE,+GAAA,oBAAoB,OAAA;AAAE,mHAAA,wBAAwB,OAAA;AACvD,yDAA0D;AAAjD,yHAAA,oBAAoB,OAAA;AAC7B,yEAGoC;AAFlC,qIAAA,wBAAwB,OAAA;AACxB,8IAAA,iCAAiC,OAAA;AAEnC,0CAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,yEAAsE;AAA7D,qIAAA,wBAAwB,OAAA;AACjC,qEAAqE;AAA5D,oIAAA,yBAAyB,OAAA;AAClC,iCAAsC;AAA7B,qGAAA,YAAY,OAAA;AACrB,uDAA4F;AAAnF,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAAE,qHAAA,iBAAiB,OAAA;AAChE,uDAAmD;AAA1C,kHAAA,cAAc,OAAA;AACvB,2DAI6B;AAH3B,+HAAA,yBAAyB,OAAA;AACzB,+HAAA,yBAAyB,OAAA;AACzB,oIAAA,8BAA8B,OAAA;AAEhC,6DAU8B;AAT5B,oIAAA,6BAA6B,OAAA;AAC7B,6IAAA,sCAAsC,OAAA;AACtC,2HAAA,oBAAoB,OAAA;AACpB,sIAAA,+BAA+B,OAAA;AAC/B,0HAAA,mBAAmB,OAAA;AACnB,2HAAA,oBAAoB,OAAA;AACpB,8HAAA,uBAAuB,OAAA;AACvB,0HAAA,mBAAmB,OAAA;AACnB,yHAAA,kBAAkB,OAAA;AAEpB,yDAAyD;AAAhD,wHAAA,mBAAmB,OAAA;AAC5B,qEAIkC;AAHhC,oIAAA,yBAAyB,OAAA;AACzB,2IAAA,gCAAgC,OAAA;AAChC,mJAAA,wCAAwC,OAAA;AAE1C,6CAAgG;AAAvF,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AACzE,uDAAoC;AACpC,qCAA0E;AAAjE,+GAAA,oBAAoB,OAAA;AAAE,mHAAA,wBAAwB,OAAA;AACvD,yDAA0D;AAAjD,yHAAA,oBAAoB,OAAA;AAC7B,yEAGoC;AAFlC,qIAAA,wBAAwB,OAAA;AACxB,8IAAA,iCAAiC,OAAA;AAEnC,0CAAuB"}

package/dist/cjs/session-cookie-resolver.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Resolving the NextAuth session token in a generated route, WITHOUT asking
+ * `process.env.NEXTAUTH_URL` what the session cookie is called.
+ *
+ * ## ⛔ THE REPORTED DEFECT
+ *
+ * A published project showed "Failed to load dashboard data. Please refresh."
+ * on the home page, "Failed to load meeting data." on the list page and "could
+ * not fetch the templates" on a third — for a user who was signed in, on a page
+ * whose own `/api/auth/session` returned that user. The failing call was the
+ * page-load workflow's server segment, answering **401 `Unauthenticated`** from
+ * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
+ * requests at the same route returned **33 × 401 and 17 × 200**, while 40
+ * concurrent `/api/auth/session` calls resolved the user 40/40.
+ *
+ * ## The mechanism
+ *
+ * next-auth v4's `getToken()` derives the cookie it reads from an env var:
+ *
+ * ```js
+ * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
+ * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
+ * ```
+ *
+ * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
+ * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
+ * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
+ * repair is process-local: it fixes the value for whichever serverless instance
+ * happened to serve an auth request, and for no other. Every other instance
+ * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
+ * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
+ * `getToken` looks for `next-auth.session-token`, the browser is holding
+ * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
+ * reported as anonymous.
+ *
+ * Hence the coin-flip: it depends on whether the instance that served your
+ * request had previously served an auth request. Nothing about the session, the
+ * secret or the cookie is wrong.
+ *
+ * The same defect is why the generated middleware carries a `hasSessionCookie`
+ * fallback and a round trip to `/api/auth/session`, attributed there to an
+ * "Edge runtime quirk" — the Edge process holds that same localhost value.
+ *
+ * ## The rule
+ *
+ * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
+ * env var that describes the deployment.** So this resolver reads which session
+ * cookie the caller actually sent, and tells `getToken` exactly that — falling
+ * back to the request's own protocol when the cookie header is unavailable.
+ *
+ * Emitted as plain ES5 text and inlined into each generated route: a route that
+ * carries its own copy cannot be broken by a missing sibling module or an
+ * untraced dependency, and every call site gets the identical implementation
+ * from this one definition.
+ */
+/** The `__tq`-prefixed globals the emitted snippet declares. */
+export declare const SESSION_TOKEN_RESOLVER_FN = "__tqResolveSessionToken";
+/**
+ * ES5 source for the shared session-token resolver, safe to inline into any
+ * generated CommonJS route or ESM middleware.
+ *
+ * Declares:
+ *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
+ *    parsed properly (a substring test would see `next-auth.session-token`
+ *    inside `__Secure-next-auth.session-token` and pick the wrong one).
+ *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
+ *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
+ *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
+ *
+ * `getToken` is passed IN rather than required here, so the same body serves a
+ * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
+ * (static `import`). Pure, total, never throws, no env reads.
+ */
+export declare const generateSessionTokenResolverCode: () => string;
+/**
+ * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
+ *
+ * The require is lazy and guarded because a project generated WITHOUT
+ * authentication does not ship `next-auth`; such a project also has no session
+ * to read, so resolving to `null` there is the correct answer rather than a
+ * module-load crash.
+ */
+export declare const generateCommonJsSessionTokenResolverCode: () => string;
+//# sourceMappingURL=session-cookie-resolver.d.ts.map

package/dist/cjs/session-cookie-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie-resolver.d.ts","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,4BAA4B,CAAA;AAiBlE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,QAAO,MA6JnD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wCAAwC,QAAO,MAsB3D,CAAA"}

package/dist/cjs/session-cookie-resolver.js

@@ -0,0 +1,282 @@
+"use strict";
+/**
+ * Resolving the NextAuth session token in a generated route, WITHOUT asking
+ * `process.env.NEXTAUTH_URL` what the session cookie is called.
+ *
+ * ## ⛔ THE REPORTED DEFECT
+ *
+ * A published project showed "Failed to load dashboard data. Please refresh."
+ * on the home page, "Failed to load meeting data." on the list page and "could
+ * not fetch the templates" on a third — for a user who was signed in, on a page
+ * whose own `/api/auth/session` returned that user. The failing call was the
+ * page-load workflow's server segment, answering **401 `Unauthenticated`** from
+ * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
+ * requests at the same route returned **33 × 401 and 17 × 200**, while 40
+ * concurrent `/api/auth/session` calls resolved the user 40/40.
+ *
+ * ## The mechanism
+ *
+ * next-auth v4's `getToken()` derives the cookie it reads from an env var:
+ *
+ * ```js
+ * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
+ * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
+ * ```
+ *
+ * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
+ * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
+ * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
+ * repair is process-local: it fixes the value for whichever serverless instance
+ * happened to serve an auth request, and for no other. Every other instance
+ * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
+ * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
+ * `getToken` looks for `next-auth.session-token`, the browser is holding
+ * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
+ * reported as anonymous.
+ *
+ * Hence the coin-flip: it depends on whether the instance that served your
+ * request had previously served an auth request. Nothing about the session, the
+ * secret or the cookie is wrong.
+ *
+ * The same defect is why the generated middleware carries a `hasSessionCookie`
+ * fallback and a round trip to `/api/auth/session`, attributed there to an
+ * "Edge runtime quirk" — the Edge process holds that same localhost value.
+ *
+ * ## The rule
+ *
+ * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
+ * env var that describes the deployment.** So this resolver reads which session
+ * cookie the caller actually sent, and tells `getToken` exactly that — falling
+ * back to the request's own protocol when the cookie header is unavailable.
+ *
+ * Emitted as plain ES5 text and inlined into each generated route: a route that
+ * carries its own copy cannot be broken by a missing sibling module or an
+ * untraced dependency, and every call site gets the identical implementation
+ * from this one definition.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateCommonJsSessionTokenResolverCode = exports.generateSessionTokenResolverCode = exports.SESSION_TOKEN_RESOLVER_FN = void 0;
+/** The `__tq`-prefixed globals the emitted snippet declares. */
+exports.SESSION_TOKEN_RESOLVER_FN = '__tqResolveSessionToken';
+/**
+ * Session-cookie names next-auth/Auth.js writes, with the `secureCookie` flag
+ * that produces each. Order within a protocol is irrelevant — only ONE of these
+ * is ever present — but the https/http split decides which pair is tried first.
+ *
+ * `__Host-` is deliberately absent: next-auth uses it only for the CSRF and
+ * callback cookies, never for the session token.
+ */
+const KNOWN_SESSION_COOKIES = [
+    { name: '__Secure-next-auth.session-token', secure: true },
+    { name: 'next-auth.session-token', secure: false },
+    { name: '__Secure-authjs.session-token', secure: true },
+    { name: 'authjs.session-token', secure: false },
+];
+/**
+ * ES5 source for the shared session-token resolver, safe to inline into any
+ * generated CommonJS route or ESM middleware.
+ *
+ * Declares:
+ *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
+ *    parsed properly (a substring test would see `next-auth.session-token`
+ *    inside `__Secure-next-auth.session-token` and pick the wrong one).
+ *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
+ *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
+ *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
+ *
+ * `getToken` is passed IN rather than required here, so the same body serves a
+ * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
+ * (static `import`). Pure, total, never throws, no env reads.
+ */
+const generateSessionTokenResolverCode = () => {
+    return `// GENERATED — see generateSessionTokenResolverCode in
+// @teleporthq/teleport-plugin-next-workflows/src/session-cookie-resolver.ts.
+//
+// next-auth's getToken() picks the session cookie name from
+// process.env.NEXTAUTH_URL, which a generated project ships as a localhost
+// default — so on a published https domain it looks for the non-secure cookie
+// and reports a signed-in user as anonymous. These helpers read the cookie the
+// request actually carries and tell getToken exactly which one it is.
+var __TQ_SESSION_COOKIES = ${JSON.stringify(KNOWN_SESSION_COOKIES.map((c) => [c.name, c.secure]))};
+
+// Every cookie NAME on the request. Parsed on the "; " separator rather than
+// matched as a substring: "next-auth.session-token" occurs inside
+// "__Secure-next-auth.session-token", so a substring test reports the plain
+// cookie as present whenever the secure one is, and getToken then decodes the
+// wrong (missing) cookie.
+function __tqCookieNamesPresent(req) {
+  var present = {};
+  var raw = '';
+  try {
+    var headers = req && req.headers;
+    if (headers && typeof headers.get === 'function') {
+      // Edge / fetch Headers.
+      raw = headers.get('cookie') || '';
+    } else if (headers) {
+      var value = headers.cookie || headers.Cookie;
+      raw = Array.isArray(value) ? value.join('; ') : value || '';
+    }
+  } catch (e) {
+    raw = '';
+  }
+  var parts = String(raw).split(';');
+  for (var i = 0; i < parts.length; i++) {
+    var eq = parts[i].indexOf('=');
+    if (eq > 0) {
+      present[parts[i].slice(0, eq).trim()] = true;
+    }
+  }
+  // Second source: the runtime's own parsed cookies. A Next.js API route hands
+  // over a plain object; the Edge RequestCookies exposes getAll().
+  try {
+    var cookies = req && req.cookies;
+    if (cookies && typeof cookies.getAll === 'function') {
+      var all = cookies.getAll() || [];
+      for (var a = 0; a < all.length; a++) {
+        if (all[a] && all[a].name) {
+          present[all[a].name] = true;
+        }
+      }
+    } else if (cookies && typeof cookies === 'object') {
+      for (var key in cookies) {
+        if (Object.prototype.hasOwnProperty.call(cookies, key)) {
+          present[key] = true;
+        }
+      }
+    }
+  } catch (e) {
+    /* the header pass above is enough */
+  }
+  return present;
+}
+
+// Is this request https? Read from the proxy header the platform sets, then the
+// socket, then the URL — never from an env var describing the deployment.
+function __tqRequestIsSecure(req) {
+  try {
+    var headers = (req && req.headers) || {};
+    var proto =
+      typeof headers.get === 'function'
+        ? headers.get('x-forwarded-proto')
+        : headers['x-forwarded-proto'];
+    if (Array.isArray(proto)) {
+      proto = proto[0];
+    }
+    if (typeof proto === 'string' && proto) {
+      // A chain of proxies appends: "https,http" — the client-facing hop is first.
+      return proto.split(',')[0].trim().toLowerCase() === 'https';
+    }
+    if (req && req.nextUrl && req.nextUrl.protocol === 'https:') {
+      return true;
+    }
+    if (req && req.socket && req.socket.encrypted) {
+      return true;
+    }
+    if (req && req.connection && req.connection.encrypted) {
+      return true;
+    }
+    if (typeof (req && req.url) === 'string' && req.url.indexOf('https://') === 0) {
+      return true;
+    }
+  } catch (e) {
+    /* fall through to false */
+  }
+  return false;
+}
+
+// The { cookieName, secureCookie } pairs worth trying, most likely first.
+// Normally exactly one cookie is present and this returns a single entry; the
+// list only grows when a site has been reached over both http and https.
+function __tqSessionTokenCandidates(req) {
+  var present = __tqCookieNamesPresent(req);
+  var secure = __tqRequestIsSecure(req);
+  var candidates = [];
+  for (var i = 0; i < __TQ_SESSION_COOKIES.length; i++) {
+    var name = __TQ_SESSION_COOKIES[i][0];
+    var isSecureName = __TQ_SESSION_COOKIES[i][1];
+    if (present[name] || present[name + '.0']) {
+      candidates.push({ cookieName: name, secureCookie: isSecureName });
+    }
+  }
+  candidates.sort(function (a, b) {
+    if (a.secureCookie === b.secureCookie) {
+      return 0;
+    }
+    return a.secureCookie === secure ? -1 : 1;
+  });
+  if (candidates.length === 0) {
+    // No cookie we recognise. The project may configure a custom cookie name in
+    // authOptions, so hand getToken the request's own protocol and let it apply
+    // its defaults — same behaviour as before this resolver existed, minus the
+    // localhost env var.
+    candidates.push({ secureCookie: secure });
+  }
+  return candidates;
+}
+
+// The decoded session token, or null. Tries each candidate cookie in turn so a
+// project that renamed its cookie, or one reached over both protocols, still
+// resolves. Never throws.
+function ${exports.SESSION_TOKEN_RESOLVER_FN}(getToken, req, secret) {
+  if (!secret || typeof getToken !== 'function') {
+    return Promise.resolve(null);
+  }
+  var candidates = __tqSessionTokenCandidates(req);
+  var attempt = function (index) {
+    if (index >= candidates.length) {
+      return Promise.resolve(null);
+    }
+    var candidate = candidates[index];
+    var params = { req: req, secret: secret, secureCookie: candidate.secureCookie };
+    if (candidate.cookieName) {
+      params.cookieName = candidate.cookieName;
+    }
+    return Promise.resolve()
+      .then(function () {
+        return getToken(params);
+      })
+      .catch(function () {
+        return null;
+      })
+      .then(function (token) {
+        return token || attempt(index + 1);
+      });
+  };
+  return attempt(0);
+}
+`;
+};
+exports.generateSessionTokenResolverCode = generateSessionTokenResolverCode;
+/**
+ * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
+ *
+ * The require is lazy and guarded because a project generated WITHOUT
+ * authentication does not ship `next-auth`; such a project also has no session
+ * to read, so resolving to `null` there is the correct answer rather than a
+ * module-load crash.
+ */
+const generateCommonJsSessionTokenResolverCode = () => {
+    return `${(0, exports.generateSessionTokenResolverCode)()}
+// Lazy + guarded: a project generated without authentication has no next-auth
+// installed, and no session to read either — null is the right answer there.
+function __tqGetTokenFn() {
+  try {
+    var jwt = require('next-auth/jwt');
+    return jwt && typeof jwt.getToken === 'function' ? jwt.getToken : null;
+  } catch (e) {
+    return null;
+  }
+}
+
+// The session token for this request, or null. Reads NEXTAUTH_SECRET itself.
+function __tqSessionToken(req) {
+  var secret = process.env.NEXTAUTH_SECRET;
+  if (!secret) {
+    return Promise.resolve(null);
+  }
+  return ${exports.SESSION_TOKEN_RESOLVER_FN}(__tqGetTokenFn(), req, secret);
+}
+`;
+};
+exports.generateCommonJsSessionTokenResolverCode = generateCommonJsSessionTokenResolverCode;
+//# sourceMappingURL=session-cookie-resolver.js.map

package/dist/cjs/session-cookie-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie-resolver.js","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAEH,gEAAgE;AACnD,QAAA,yBAAyB,GAAG,yBAAyB,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAqD;IAC9E,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC1D,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,EAAE;IAClD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE;CAChD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACI,MAAM,gCAAgC,GAAG,GAAW,EAAE;IAC3D,OAAO;;;;;;;;6BAQoB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwHtF,iCAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BnC,CAAA;AACD,CAAC,CAAA;AA7JY,QAAA,gCAAgC,oCA6J5C;AAED;;;;;;;GAOG;AACI,MAAM,wCAAwC,GAAG,GAAW,EAAE;IACnE,OAAO,GAAG,IAAA,wCAAgC,GAAE;;;;;;;;;;;;;;;;;;WAkBnC,iCAAyB;;CAEnC,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,wCAAwC,4CAsBpD"}