@teleporthq/teleport-plugin-next-workflows 0.43.53 → 0.43.55

package/__tests__/order-details-route.test.ts

@@ -0,0 +1,238 @@
+import { ProjectUIDL } from '@teleporthq/teleport-types'
+import {
+  DEFAULT_ORDER_DETAILS_PREFIX,
+  readSuccessUrlPrefix,
+  resolveOrderDetailsRoutePrefix,
+} from '../src/ecommerce/order-details-route'
+import { __testables, rewriteLowStockCustomHandlers } from '../src/ecommerce-customhandler-rewriter'
+
+const { buildPaymentMetadataBuilder } = __testables
+
+/**
+ * ⛔ THE REPORTED DEFECT (run c133d485): a completed Stripe checkout redirected to
+ * `/order-details/ORD-1?payment=success` — a 404 — because the payment-metadata
+ * rewrite hard-coded that prefix while the site map routed the order-details page
+ * at `/orders/[order_number]`. The COD path was fine: it navigates through
+ * `navigation-go-to-page`, which reads the page's real route. Both paths must now
+ * read the SAME field.
+ */
+
+const goToOrderDetails = (overrides: Record<string, unknown> = {}) => ({
+  id: 'nav-1',
+  type: 'navigation-go-to-page',
+  config: {
+    pageId: '/orders/[order_number]',
+    targetPage: {
+      pageId: 'TQ_Spm9dxZZx6',
+      pageName: 'order-details',
+      staticUrl: '/orders',
+      isDetailsPage: true,
+      differentiatorColumn: 'order_number',
+      rowOwnerTable: 'teleport_orders',
+      ...overrides,
+    },
+  },
+})
+
+const uidlWithNodes = (nodes: unknown[]): ProjectUIDL =>
+  ({
+    workflows: { workflows: { placeOrder: { id: 'placeOrder', nodes } } },
+  } as unknown as ProjectUIDL)
+
+describe('resolveOrderDetailsRoutePrefix', () => {
+  it('reads the prefix from the order-details navigation node', () => {
+    expect(resolveOrderDetailsRoutePrefix(uidlWithNodes([goToOrderDetails()]))).toBe('/orders')
+  })
+
+  it('recognises the page by its orders row-owner table even when the name differs', () => {
+    const uidl = uidlWithNodes([
+      goToOrderDetails({ pageName: 'purchase-receipt', staticUrl: '/account/receipts' }),
+    ])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/account/receipts')
+  })
+
+  it('recognises the page by name when no row-owner table is stamped', () => {
+    const uidl = uidlWithNodes([
+      goToOrderDetails({ rowOwnerTable: undefined, staticUrl: '/shop/orders' }),
+    ])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/shop/orders')
+  })
+
+  it('falls back to the literal route, minus its dynamic segment, when staticUrl is unusable', () => {
+    const uidl = uidlWithNodes([goToOrderDetails({ staticUrl: '' })])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/orders')
+  })
+
+  it('never returns a staticUrl that still carries a dynamic segment', () => {
+    const uidl = uidlWithNodes([goToOrderDetails({ staticUrl: '/orders/[order_number]' })])
+    // Unusable as a prefix, so the pageId fallback answers instead.
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/orders')
+  })
+
+  it('strips a trailing slash', () => {
+    const uidl = uidlWithNodes([goToOrderDetails({ staticUrl: '/orders/' })])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/orders')
+  })
+
+  it('ignores navigation to OTHER details pages', () => {
+    const uidl = uidlWithNodes([
+      {
+        id: 'nav-2',
+        type: 'navigation-go-to-page',
+        config: {
+          pageId: '/products/[slug]',
+          targetPage: {
+            pageName: 'product-details',
+            staticUrl: '/products',
+            isDetailsPage: true,
+            rowOwnerTable: 'teleport_products',
+          },
+        },
+      },
+    ])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe(DEFAULT_ORDER_DETAILS_PREFIX)
+  })
+
+  it('ignores a NON-details page that happens to be named order-details', () => {
+    const uidl = uidlWithNodes([
+      goToOrderDetails({ isDetailsPage: false, rowOwnerTable: undefined, staticUrl: '/nope' }),
+    ])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe(DEFAULT_ORDER_DETAILS_PREFIX)
+  })
+
+  it('also scans custom workflow nodes', () => {
+    const uidl = {
+      workflows: {
+        workflows: {},
+        customNodes: { checkout: { id: 'checkout', nodes: [goToOrderDetails()] } },
+      },
+    } as unknown as ProjectUIDL
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe('/orders')
+  })
+
+  it('returns the default for a project with no workflows at all', () => {
+    expect(resolveOrderDetailsRoutePrefix({} as ProjectUIDL)).toBe(DEFAULT_ORDER_DETAILS_PREFIX)
+    expect(resolveOrderDetailsRoutePrefix({ workflows: {} } as unknown as ProjectUIDL)).toBe(
+      DEFAULT_ORDER_DETAILS_PREFIX
+    )
+  })
+
+  it('survives malformed nodes', () => {
+    const uidl = uidlWithNodes([null, 'nope', { type: 'navigation-go-to-page' }, { config: {} }])
+    expect(resolveOrderDetailsRoutePrefix(uidl)).toBe(DEFAULT_ORDER_DETAILS_PREFIX)
+  })
+})
+
+describe('buildPaymentMetadataBuilder — successUrl uses the resolved prefix', () => {
+  const run = (prefix: string) => {
+    const code = buildPaymentMetadataBuilder(prefix)
+    const fn = new Function(code + '\nreturn customHandler;')() as (params: unknown[]) => {
+      successUrl: string
+    }
+    return fn([{ id: 'uuid-1', total_amount: 10 }, { result: 'ORD-1' }])
+  }
+
+  it('builds the redirect under the project route, not the hard-coded one', () => {
+    expect(run('/orders').successUrl).toBe('/orders/ORD-1?payment=success')
+    expect(run('/account/receipts').successUrl).toBe('/account/receipts/ORD-1?payment=success')
+  })
+
+  it('encodes the order number so an exotic token can never break the URL', () => {
+    const code = buildPaymentMetadataBuilder('/orders')
+    const fn = new Function(code + '\nreturn customHandler;')() as (params: unknown[]) => {
+      successUrl: string
+    }
+    const result = fn([{ id: 'uuid-1', total_amount: 10, order_number: 'ORD 1/2' }])
+    expect(result.successUrl).toBe('/orders/ORD%201%2F2?payment=success')
+  })
+})
+
+/**
+ * ⛔ THE HOLE THE TWO SOURCES ABOVE STILL LEFT: both depend on finding a
+ * `navigation-go-to-page` node that targets the order-details page. A project
+ * whose checkout has no such node — an AI-authored one, or an online-payment-
+ * only flow — fell straight through to `/order-details`, the very 404 this file
+ * exists to prevent, while the correct route was sitting in the `successUrl` of
+ * the node about to be replaced.
+ */
+describe('readSuccessUrlPrefix — the URL the node itself already declares', () => {
+  const handler = (literal: string) =>
+    `function customHandler(params) {\n  return {\n    successUrl: ${literal} + encodeURIComponent(orderNumber) + '?payment=success',\n  };\n}`
+
+  it('reads the prefix the GUI baked in, double- or single-quoted', () => {
+    expect(readSuccessUrlPrefix(handler('"/orders/"'))).toBe('/orders')
+    expect(readSuccessUrlPrefix(handler("'/shop/orders/'"))).toBe('/shop/orders')
+  })
+
+  it('reads a prefix with no trailing slash', () => {
+    expect(readSuccessUrlPrefix(handler('"/orders"'))).toBe('/orders')
+  })
+
+  it('refuses anything that is not a bare prefix', () => {
+    expect(readSuccessUrlPrefix(handler('"/orders/[order_number]/"'))).toBeNull()
+    expect(readSuccessUrlPrefix(handler('"/orders/?payment=success"'))).toBeNull()
+    expect(readSuccessUrlPrefix(handler('"orders/"'))).toBeNull()
+    // A bare root would build `successUrl: "//" + orderNumber` — a
+    // protocol-relative URL pointing at another host.
+    expect(readSuccessUrlPrefix(handler('"/"'))).toBeNull()
+  })
+
+  it('returns null when there is no successUrl literal to read', () => {
+    expect(readSuccessUrlPrefix('function customHandler(params) { return {}; }')).toBeNull()
+    expect(readSuccessUrlPrefix('')).toBeNull()
+    expect(readSuccessUrlPrefix(undefined as unknown as string)).toBeNull()
+  })
+})
+
+describe('the rewrite keeps the route the project or the node already knows', () => {
+  const AI_METADATA_NODE = (successUrl: string) => ({
+    id: 'meta-1',
+    type: 'general-custom-js',
+    config: {
+      code: `function customHandler(params) {
+  var order = params[14] || {};
+  return {
+    successUrl: '${successUrl}' + order.order_number + '?payment=success',
+    metadataJson: JSON.stringify({ orderId: order.id })
+  };
+}`,
+    },
+  })
+
+  const successUrlOf = (uidl: ProjectUIDL): string => {
+    rewriteLowStockCustomHandlers(uidl)
+    const nodes = (
+      uidl.workflows as unknown as {
+        workflows: Record<string, { nodes: Array<{ config?: { code?: string } }> }>
+      }
+    ).workflows.placeOrder.nodes
+    const rewritten = nodes.find((node) => (node.config?.code ?? '').includes('successUrl'))
+    const fn = new Function(rewritten!.config!.code + '\nreturn customHandler;')() as (
+      params: unknown[]
+    ) => { successUrl: string }
+    return fn([{ id: 'uuid-1', total_amount: 10 }, { result: 'ORD-1' }]).successUrl
+  }
+
+  it('THE REPORTED DEFECT: the project route wins over the old hard-coded one', () => {
+    const uidl = uidlWithNodes([goToOrderDetails(), AI_METADATA_NODE('/order-details/')])
+    expect(successUrlOf(uidl)).toBe('/orders/ORD-1?payment=success')
+  })
+
+  it('falls back to the URL the node declares when the project has no navigation node', () => {
+    const uidl = uidlWithNodes([AI_METADATA_NODE('/orders/')])
+    expect(successUrlOf(uidl)).toBe('/orders/ORD-1?payment=success')
+  })
+
+  it('the PROJECT still wins when the two disagree — the paid path must match the COD path', () => {
+    const uidl = uidlWithNodes([
+      goToOrderDetails({ staticUrl: '/account/receipts' }),
+      AI_METADATA_NODE('/orders/'),
+    ])
+    expect(successUrlOf(uidl)).toBe('/account/receipts/ORD-1?payment=success')
+  })
+
+  it('keeps the last-resort constant when neither source says anything', () => {
+    const uidl = uidlWithNodes([AI_METADATA_NODE('/')])
+    expect(successUrlOf(uidl)).toBe('/order-details/ORD-1?payment=success')
+  })
+})

package/__tests__/resolve-config-template-params.test.ts

@@ -0,0 +1,174 @@
+import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
+import { generateServerSegmentAPIRoute } from '../src/api-route-generator'
+
+/**
+ * Regression: every component-bodied transactional email shipped with its
+ * `{{token}}` merge fields unfilled.
+ *
+ * The fill was pasted at individual call sites instead of living in the one
+ * function every path shares. It reached only three of the sixteen sites — the
+ * client executor, and the main + loop-body loops of the cron/webhook route —
+ * so the MAIN loop of `generateServerSegmentAPIRoute`, where every ordinary
+ * page workflow's email node actually executes, never applied it. Delivered
+ * result: literal `{{customerName}}` / `{{orderNumber}}` in the body, the same
+ * in the SUBJECT line, an un-expanded `<!--tq:each products-->` row block, and
+ * `href="{{resetUrl}}"` on the password-reset button — an invalid relative URL
+ * that mail clients drop, so the button had no link at all.
+ *
+ * These tests EXECUTE the emitted runtime rather than grepping it: the defect
+ * was never a missing function, it was a function nobody called.
+ */
+
+type ResolveConfig = (
+  config: Record<string, unknown>,
+  context: Record<string, unknown>
+) => Record<string, unknown>
+
+function loadRuntime(): { resolveConfig: ResolveConfig } {
+  const code = generateSharedRuntimeUtilsCode()
+  const moduleShim = { exports: {} as Record<string, unknown> }
+  // eslint-disable-next-line no-new-func
+  new Function('module', 'exports', 'require', 'process', code)(
+    moduleShim,
+    moduleShim.exports,
+    () => ({}),
+    { env: {} }
+  )
+  const exported = (moduleShim.exports as { resolveConfig?: ResolveConfig }).resolveConfig
+  if (typeof exported !== 'function') {
+    throw new Error('server-runtime does not export resolveConfig')
+  }
+  return { resolveConfig: exported }
+}
+
+const wfCtx = (nodeId: string, path: string[]) => ({
+  type: 'workflowContext',
+  nodeId,
+  path: [nodeId, ...path],
+})
+
+describe('resolveConfig fills component-bodied email templates', () => {
+  const { resolveConfig } = loadRuntime()
+
+  const context = {
+    assemble: {
+      customerName: 'Jane Cooper',
+      orderNumber: 'ORD-42',
+      products: [
+        { product_name: 'Beans', quantity: '2', unit_price: '12.00', currency: 'USD' },
+        { product_name: 'Mug', quantity: '1', unit_price: '15.00', currency: 'USD' },
+      ],
+    },
+    buildRef: { result: 'WDR-7' },
+  }
+
+  const emailConfig = (over: Record<string, unknown> = {}) => ({
+    to: 'jane@example.com',
+    subject: 'New withdrawal request {{requestReference}} for order {{orderNumber}}',
+    body: '<p>Submitted by {{customerName}} for order {{orderNumber}}.</p>',
+    templateParams: [
+      { key: 'customerName', value: wfCtx('assemble', ['customerName']) },
+      { key: 'orderNumber', value: wfCtx('assemble', ['orderNumber']) },
+      { key: 'requestReference', value: wfCtx('buildRef', ['result']) },
+      { key: 'products', value: wfCtx('assemble', ['products']) },
+      { key: 'companyName', value: 'Acme Inc.' },
+    ],
+    ...over,
+  })
+
+  it('fills the BODY from workflow-context-bound params', () => {
+    const resolved = resolveConfig(emailConfig(), context)
+    expect(resolved.body).toBe('<p>Submitted by Jane Cooper for order ORD-42.</p>')
+  })
+
+  it('fills the SUBJECT too — the email title had the same defect', () => {
+    const resolved = resolveConfig(emailConfig(), context)
+    expect(resolved.subject).toBe('New withdrawal request WDR-7 for order ORD-42')
+  })
+
+  it('fills a literal (non-bound) param value', () => {
+    const resolved = resolveConfig(emailConfig({ body: '<p>Sent by {{companyName}}</p>' }), context)
+    expect(resolved.body).toBe('<p>Sent by Acme Inc.</p>')
+  })
+
+  it('expands the array-mapper row block before the flat fill', () => {
+    const resolved = resolveConfig(
+      emailConfig({
+        body: '<div><!--tq:each products--><li>{{quantity}}x {{product_name}} @ {{unit_price}} {{currency}}</li><!--/tq:each--></div>',
+      }),
+      context
+    )
+    expect(resolved.body).toBe(
+      '<div><li>2x Beans @ 12.00 USD</li><li>1x Mug @ 15.00 USD</li></div>'
+    )
+    expect(resolved.body).not.toContain('<!--tq:each')
+  })
+
+  it('produces a REAL href on a token-bound link', () => {
+    // The password-reset button serializes to href="{{resetUrl}}". Unfilled,
+    // that is a relative URL mail clients discard — the reported "the reset
+    // button has no link".
+    const resolved = resolveConfig(
+      {
+        subject: 'Password Reset Request',
+        body: '<a href="{{resetUrl}}">Reset password</a>',
+        templateParams: [{ key: 'resetUrl', value: wfCtx('buildLink', ['resetLink']) }],
+      },
+      { buildLink: { resetLink: 'https://shop.example.com/reset?token=abc' } }
+    )
+    expect(resolved.body).toBe(
+      '<a href="https://shop.example.com/reset?token=abc">Reset password</a>'
+    )
+  })
+
+  it('leaves configs without templateParams untouched', () => {
+    const resolved = resolveConfig({ query: 'SELECT 1', body: 'not {{anything}} special' }, context)
+    expect(resolved.body).toBe('not {{anything}} special')
+  })
+
+  it('does not choke when body/subject are absent or non-string', () => {
+    const resolved = resolveConfig(
+      { templateParams: [{ key: 'a', value: 'b' }], to: ['x@y.z'] },
+      context
+    )
+    expect(resolved.to).toEqual(['x@y.z'])
+  })
+})
+
+describe('the server-segment route reaches the fill', () => {
+  // The route that runs every ordinary page workflow's server nodes. It had no
+  // fill of its own; it must now get one purely by calling resolveConfig.
+  const route = generateServerSegmentAPIRoute(
+    {
+      id: 'server-1',
+      env: 'server',
+      nodeIds: ['n1'],
+      nodes: [
+        {
+          id: 'n1',
+          type: 'email-resend',
+          label: 'Send Withdrawal Confirmation Email',
+          stepNumber: 1,
+          config: {
+            to: 'a@b.c',
+            subject: 'Ref {{requestReference}}',
+            body: '<p>{{customerName}}</p>',
+            templateParams: [{ key: 'customerName', value: 'Jane' }],
+          },
+        },
+      ],
+      edges: [],
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any,
+    'Submit Withdrawal'
+  )
+
+  it('routes the node config through the shared resolveConfig', () => {
+    expect(route).toContain('const resolveConfig = utils.resolveConfig')
+    expect(route).toContain('resolveConfig(node.config, context)')
+  })
+
+  it('carries no private copy of the fill that could drift', () => {
+    expect(route).not.toContain('applyTemplateParams')
+  })
+})

package/__tests__/utility-nodes.test.ts

@@ -11,12 +11,25 @@ import { utilityParseUrl } from '../src/nodes/utility/utility-parse-url'
 import { utilityFormatPhoneNumber } from '../src/nodes/utility/utility-format-phone-number'
 import { utilitySemanticSearch } from '../src/nodes/utility/utility-semantic-search'
 import { utilityHybridSearch } from '../src/nodes/utility/utility-hybrid-search'
+import { resolveHandlerEntryName } from '../src/nodes/types'
 
 /* tslint:disable:no-eval */
-function createHandler(generator: { generateHandler(): string }) {
-  const fnStr = generator.generateHandler()
-  const fn = eval('(' + fnStr + ')')
-  return fn
+// Loads a handler the way the generated project does — the source goes inside
+// an IIFE that returns the entry point by name (see `api-route-generator`).
+//
+// ⛔ The previous `eval('(' + source + ')')` assumed a handler emits nothing
+// but a bare function expression. That stopped being true the moment a handler
+// needed a shared prelude: the AI-provider utils emit `var` helpers ahead of
+// the entry, exactly as `ai-custom-prompt` has always done, and the wrapper
+// then failed with "Unexpected token 'var'".
+//
+// `eval` rather than `new Function` on purpose: it keeps module scope, so
+// handlers that `require('crypto')` and the ts-jest `__awaiter`/`__generator`
+// helpers both still resolve.
+function createHandler(generator: { nodeType: string; generateHandler(): string }) {
+  const source = generator.generateHandler().trim()
+  const entry = resolveHandlerEntryName(source, generator.nodeType)
+  return eval(`(function () {\n${source}\nreturn ${entry};\n})()`)
 }
 
 describe('utility-csv-parse', () => {
@@ -567,7 +580,7 @@ describe('utility-semantic-search', () => {
       { title: 'Python guide', content: 'Python for beginners' },
       { title: 'Advanced JavaScript', content: 'Deep dive into JS patterns' },
     ]
-    const result = await handler({ query: 'JavaScript', collection }, {})
+    const result = await handler({ query: 'JavaScript', documents: collection }, {})
     expect(result.results.length).toBeGreaterThan(0)
     expect(result.results[0].item.title).toContain('JavaScript')
   })
@@ -578,7 +591,7 @@ describe('utility-semantic-search', () => {
       { title: 'B', embedding: [0, 1, 0] },
       { title: 'C', embedding: [0.9, 0.1, 0] },
     ]
-    const result = await handler({ queryEmbedding: [1, 0, 0], collection }, {})
+    const result = await handler({ queryEmbedding: [1, 0, 0], documents: collection }, {})
     expect(result.results.length).toBeGreaterThan(0)
     expect(result.results[0].item.title).toBe('A')
   })
@@ -589,12 +602,12 @@ describe('utility-semantic-search', () => {
       { title: 'B', embedding: [0.9, 0.1, 0] },
       { title: 'C', embedding: [0.8, 0.2, 0] },
     ]
-    const result = await handler({ queryEmbedding: [1, 0, 0], collection, topK: 2 }, {})
+    const result = await handler({ queryEmbedding: [1, 0, 0], documents: collection, topK: 2 }, {})
     expect(result.results.length).toBe(2)
   })
 
   it('returns error for empty inputs', async () => {
-    const result = await handler({ query: '', collection: [] }, {})
+    const result = await handler({ query: '', documents: [] }, {})
     expect(result.error).toBeTruthy()
   })
 })
@@ -612,7 +625,7 @@ describe('utility-hybrid-search', () => {
       { title: 'JS patterns', embedding: [0.8, 0.2, 0] },
     ]
     const result = await handler(
-      { query: 'JavaScript', queryEmbedding: [1, 0, 0], collection, fields: ['title'] },
+      { query: 'JavaScript', queryEmbedding: [1, 0, 0], documents: collection, fields: ['title'] },
       {}
     )
     expect(result.results.length).toBeGreaterThan(0)
@@ -621,13 +634,16 @@ describe('utility-hybrid-search', () => {
 
   it('works with text-only (no embeddings)', async () => {
     const collection = [{ title: 'JavaScript basics' }, { title: 'Python guide' }]
-    const result = await handler({ query: 'JavaScript', collection, fields: ['title'] }, {})
+    const result = await handler(
+      { query: 'JavaScript', documents: collection, fields: ['title'] },
+      {}
+    )
     expect(result.results.length).toBe(1)
     expect(result.hasSemanticScores).toBe(false)
   })
 
   it('returns error for empty query', async () => {
-    const result = await handler({ query: '', collection: [] }, {})
+    const result = await handler({ query: '', documents: [] }, {})
     expect(result.error).toBeTruthy()
   })
 })

package/dist/cjs/api-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAqBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAgXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAsbF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAuFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AA4RD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAsMF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}
+{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAqBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAsXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAgcF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAuFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AAoRD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MA0MF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}

package/dist/cjs/api-route-generator.js

@@ -82,7 +82,11 @@ module.exports = async function handler(req, res) {
     // are drained by the settle below rather than being lost when we reply.
     context.__pendingNodePromises = [];${requestInjection}
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
-    context.__baseUrl = __proto + '://' + req.headers.host;${auth.guardCall}
+    context.__baseUrl = __proto + '://' + req.headers.host;
+    // Credentials for this deployment's calls to its own /api/data routes —
+    // without them a protected deployment 401s itself and every data node
+    // returns no rows. See internalRequestHeaders in runtime-utils.
+    context.__internalHeaders = utils.internalRequestHeaders(req);${auth.guardCall}
     const sortedNodes = SEGMENT_CONFIG.nodes.slice().sort(function(a, b) { return a.stepNumber - b.stepNumber; });
 
     for (let i = 0; i < sortedNodes.length; i++) {
@@ -184,10 +188,6 @@ module.exports = async function handler(req, res) {
             var bNode = bodyNodes[bi];
             var bResolved = resolveConfig(bNode.config, context);
             bResolved.__nodeId = bNode.id;
-            if (bResolved && Array.isArray(bResolved.templateParams)) {
-              if (typeof bResolved.body === 'string') { bResolved.body = utils.applyTemplateParams(bResolved.body, bResolved.templateParams); }
-              if (typeof bResolved.subject === 'string') { bResolved.subject = utils.applyTemplateParams(bResolved.subject, bResolved.templateParams); }
-            }
             if (bNode.type === 'general-if-statement') {
               context[bNode.id] = { result: utils.evaluateCondition(bResolved, context) };
               continue;
@@ -368,6 +368,12 @@ module.exports = async function handler(req, res) {
     await utils.settlePendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
+    // MUST be stripped before replying: the results payload below IS this
+    // context, serialized straight to the browser. __internalHeaders carries
+    // the visitor's forwarded cookie, and writing it into a JS-readable
+    // response body would hand the session token to any script on the page,
+    // undoing the httpOnly flag it was set with.
+    delete context.__internalHeaders;
     res.status(200).json({ success: true, results: context });
   } catch (error) {
     console.error('Workflow segment error:', error);
@@ -472,7 +478,11 @@ module.exports = async function handler(req, res) {
     // See the non-streaming segment route — shared queue for nested custom nodes.
     context.__pendingNodePromises = [];${requestInjection}
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
-    context.__baseUrl = __proto + '://' + req.headers.host;${auth.guardCall}
+    context.__baseUrl = __proto + '://' + req.headers.host;
+    // Credentials for this deployment's calls to its own /api/data routes —
+    // without them a protected deployment 401s itself and every data node
+    // returns no rows. See internalRequestHeaders in runtime-utils.
+    context.__internalHeaders = utils.internalRequestHeaders(req);${auth.guardCall}
     const sortedNodes = SEGMENT_CONFIG.nodes.slice().sort(function(a, b) { return a.stepNumber - b.stepNumber; });
     const executed = {};
 
@@ -787,6 +797,12 @@ module.exports = async function handler(req, res) {
     await utils.settlePendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
+    // MUST be stripped before replying: the results payload below IS this
+    // context, serialized straight to the browser. __internalHeaders carries
+    // the visitor's forwarded cookie, and writing it into a JS-readable
+    // response body would hand the session token to any script on the page,
+    // undoing the httpOnly flag it was set with.
+    delete context.__internalHeaders;
     if (streamStarted) {
       res.write('data: ' + JSON.stringify({ type: 'done', success: true, results: context }) + '\\n\\n');
       res.end();
@@ -1069,10 +1085,6 @@ const generateNodeExecutionLoop = (configVar, options) => {
       var __configError = utils.finalizeResolvedConfig(node.type, resolved);
       if (__configError) { throw new Error(__configError); }
       resolved.__nodeId = node.id;
-      if (resolved && Array.isArray(resolved.templateParams)) {
-        if (typeof resolved.body === 'string') { resolved.body = utils.applyTemplateParams(resolved.body, resolved.templateParams); }
-        if (typeof resolved.subject === 'string') { resolved.subject = utils.applyTemplateParams(resolved.subject, resolved.templateParams); }
-      }
 
       if (node.type === 'general-if-statement') {
         var condResult = utils.evaluateCondition(resolved, context);
@@ -1143,10 +1155,6 @@ const generateNodeExecutionLoop = (configVar, options) => {
             var bNode = bodyNodes[bi];
             var bResolved = resolveConfig(bNode.config, context);
             bResolved.__nodeId = bNode.id;
-            if (bResolved && Array.isArray(bResolved.templateParams)) {
-              if (typeof bResolved.body === 'string') { bResolved.body = utils.applyTemplateParams(bResolved.body, bResolved.templateParams); }
-              if (typeof bResolved.subject === 'string') { bResolved.subject = utils.applyTemplateParams(bResolved.subject, bResolved.templateParams); }
-            }
             if (bNode.type === 'general-if-statement') {
               context[bNode.id] = { result: utils.evaluateCondition(bResolved, context) };
               continue;
@@ -1448,7 +1456,11 @@ ${generateSignatureVerificationBlock(webhookConfig)}
     context.__pendingNodePromises = [];
     context[WORKFLOW_CONFIG.triggerNodeId] = triggerContext;
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
-    context.__baseUrl = __proto + '://' + req.headers.host;${requestInjection}
+    context.__baseUrl = __proto + '://' + req.headers.host;
+    // Credentials for this deployment's calls to its own /api/data routes —
+    // without them a protected deployment 401s itself and every data node
+    // returns no rows. See internalRequestHeaders in runtime-utils.
+    context.__internalHeaders = utils.internalRequestHeaders(req);${requestInjection}
 
 ${executionLoop}