@teleporthq/teleport-plugin-next-workflows 0.43.55 → 0.43.57

package/__tests__/prune-context-oversized-leaf.test.ts

@@ -0,0 +1,127 @@
+import { generateClientRuntimeCode } from '../src/executor-generator'
+
+// A server segment resolves its node configs from the context the CLIENT
+// POSTs, and `pruneContext` is what builds that payload. It used to replace
+// any context entry whose serialization exceeded 100 000 characters with a
+// single `{ __truncated: true }` marker — the entire entry, not just the part
+// that was too big.
+//
+// That is exactly the shape the profile form produces. Picking a new photo
+// writes the file's base64 dataURL into `accountFormData.image`, so the
+// `state-get-local-state` node that reads the form data ends up holding
+//   { value: { name: 'Ada Lovelace', image: 'data:image/png;base64,<~2 MB>' } }
+// The whole entry blew the budget, the server saw `{ __truncated: true }`,
+// `[<node>, 'value', 'name']` resolved to `undefined`, and `data-update-item`
+// DROPS an undefined column mapping — so saving a new picture silently stopped
+// saving the name (and every custom account property) alongside it.
+//
+// The pruner now descends: only the oversized LEAF becomes a marker, and every
+// sibling still crosses intact.
+
+type PruneFn = (ctx: Record<string, unknown>) => Record<string, any>
+
+function loadPruneContext(): PruneFn {
+  const src = generateClientRuntimeCode()
+  const grab = (pattern: RegExp, label: string): string => {
+    const match = src.match(pattern)
+    if (!match) {
+      throw new Error(`${label} not found in generated client runtime`)
+    }
+    return match[0]
+  }
+  const parts = [
+    grab(/const PRUNE_MAX_SERIALIZED_LENGTH = \d+;/, 'PRUNE_MAX_SERIALIZED_LENGTH'),
+    grab(/const PRUNE_MAX_DEPTH = \d+;/, 'PRUNE_MAX_DEPTH'),
+    ...[
+      'isDomNode',
+      'snapshotDomNode',
+      'domSerializationReplacer',
+      'serializeForPrune',
+      'prunedValue',
+      'pruneContext',
+    ].map((fn) => grab(new RegExp(`function ${fn}\\b[\\s\\S]*?\\n\\}`), fn)),
+  ]
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  return new Function(`${parts.join('\n')}\nreturn pruneContext;`)() as PruneFn
+}
+
+const HUGE = 'data:image/png;base64,' + 'A'.repeat(300000)
+
+describe('pruneContext salvages the small fields next to an oversized one', () => {
+  const pruneContext = loadPruneContext()
+
+  it('keeps sibling keys when one property is too large to send', () => {
+    const pruned = pruneContext({
+      formData: {
+        value: { name: 'Ada Lovelace', image: HUGE, role: 'user' },
+        key: 'accountFormData',
+      },
+    })
+
+    expect(pruned.formData.value.name).toBe('Ada Lovelace')
+    expect(pruned.formData.value.role).toBe('user')
+    expect(pruned.formData.key).toBe('accountFormData')
+    expect(pruned.formData.value.image).toEqual({ __truncated: true, type: 'string' })
+  })
+
+  it('salvages per-state entries inside the __stateValues bag', () => {
+    const pruned = pruneContext({
+      __stateValues: {
+        accountFormData: { name: 'Ada Lovelace', image: HUGE },
+        currentUser: { id: 'u-1', name: 'Ada Lovelace', image: 'https://cdn/old.png' },
+        accountFormButtonState: 'updating',
+      },
+    })
+
+    expect(pruned.__stateValues.currentUser).toEqual({
+      id: 'u-1',
+      name: 'Ada Lovelace',
+      image: 'https://cdn/old.png',
+    })
+    expect(pruned.__stateValues.accountFormButtonState).toBe('updating')
+    expect(pruned.__stateValues.accountFormData.name).toBe('Ada Lovelace')
+  })
+
+  it('keeps array element positions stable while truncating a heavy entry', () => {
+    const pruned = pruneContext({
+      picked: { value: [{ name: 'photo.png', type: 'image/png', dataURL: HUGE }], key: 'files' },
+    })
+
+    expect(pruned.picked.value).toHaveLength(1)
+    expect(pruned.picked.value[0].name).toBe('photo.png')
+    expect(pruned.picked.value[0].type).toBe('image/png')
+    expect(pruned.picked.value[0].dataURL).toEqual({ __truncated: true, type: 'string' })
+  })
+
+  it('still replaces a bare oversized value with a marker', () => {
+    const pruned = pruneContext({ blob: HUGE })
+    expect(pruned.blob).toEqual({ __truncated: true, type: 'string' })
+  })
+
+  it('leaves values that fit exactly as they were', () => {
+    const pruned = pruneContext({ small: { a: 1, b: [2, 3], c: null } })
+    expect(pruned.small).toEqual({ a: 1, b: [2, 3], c: null })
+  })
+
+  it('bounds what one oversized container may contribute to the payload', () => {
+    // Ten ~50 000-char siblings: each fits on its own, but the container as a
+    // whole does not. The per-container budget must stop the pruned copy from
+    // ballooning past what the old whole-value rule allowed.
+    const chunks: Record<string, string> = {}
+    for (let i = 0; i < 10; i++) {
+      chunks['chunk' + i] = 'x'.repeat(50000)
+    }
+    const pruned = pruneContext({ chunks })
+    expect(JSON.stringify(pruned).length).toBeLessThan(160000)
+    expect(pruned.chunks.chunk0).toBe('x'.repeat(50000))
+    expect(pruned.chunks.chunk9).toEqual({ __truncated: true, type: 'string' })
+  })
+
+  it('never emits a payload that cannot be JSON-serialized', () => {
+    const circular: Record<string, unknown> = { name: 'loop' }
+    circular.self = circular
+    const pruned = pruneContext({ circular, ok: { fine: true } })
+    expect(() => JSON.stringify({ context: pruned })).not.toThrow()
+    expect(pruned.ok).toEqual({ fine: true })
+  })
+})

package/__tests__/runtime-storage-upload-never-hangs.test.ts

@@ -0,0 +1,195 @@
+// An upload must FAIL when it cannot succeed — it must never simply not finish.
+//
+// The incident: the runtime-storage worker's database connections went
+// half-open, so every request that touched the database waited for a reply that
+// was never coming. Nothing between the shopper and that socket had a deadline
+// — not the generated `/api/runtime-storage/upload` proxy, not the
+// `file-storage-upload` node — so the browser request stayed PENDING
+// indefinitely. The workflow never reached its error branch (there was no
+// error), the submitting flag was never cleared, and the review form was simply
+// dead with no message.
+//
+// Both halves are pinned here, including the relationship between them: the
+// proxy must give up FIRST, so the shopper is told what went wrong by the side
+// that knows, rather than by the client abandoning a request that was still
+// alive.
+
+import { Blob as NodeBlob } from 'buffer'
+import { nodeRegistry } from '../src'
+import {
+  UPLOAD_PROXY_TIMEOUT_MS,
+  generateRuntimeStorageUploadRoute,
+} from '../src/runtime-storage-generator'
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+import { installUploadGlobals, removeUploadGlobals } from './_helpers/abort-controller-stub'
+
+class FormDataStub {
+  public appended: Array<{ key: string; value: unknown; fileName?: string }> = []
+  public append(key: string, value: unknown, fileName?: string): void {
+    this.appended.push({ key, value, fileName })
+  }
+}
+
+const PICKED_FILE = {
+  name: 'photo.png',
+  size: 9,
+  type: 'image/png',
+  lastModified: 1,
+  dataURL: `data:image/png;base64,${Buffer.from('png-bytes').toString('base64')}`,
+}
+
+/** The literal timeout the generated client handler carries. */
+const clientTimeoutMs = (): number => {
+  const handlerSource = nodeRegistry['file-storage-upload'].generateHandler()
+  const match = /UPLOAD_TIMEOUT_MS\s*=\s*(\d+)/.exec(handlerSource)
+  if (!match) {
+    throw new Error('the file-storage-upload handler declares no UPLOAD_TIMEOUT_MS')
+  }
+  return Number(match[1])
+}
+
+describe('the generated upload proxy route', () => {
+  const route = generateRuntimeStorageUploadRoute()
+
+  it('aborts the upstream fetch on a deadline instead of awaiting it forever', () => {
+    expect(route).toContain('new AbortController()')
+    expect(route).toContain('signal: controller.signal')
+    expect(route).toContain(`var UPLOAD_TIMEOUT_MS = ${UPLOAD_PROXY_TIMEOUT_MS}`)
+    expect(route).toContain('clearTimeout(timer)')
+  })
+
+  it('answers a stalled upstream with a 504 the workflow can report', () => {
+    // A pending request tells the shopper nothing. A status does.
+    expect(route).toContain('res.status(504)')
+    expect(route).toContain("error: 'UPLOAD_TIMEOUT'")
+  })
+
+  it('survives an upstream that answers with something other than JSON', () => {
+    // A gateway 502 is an HTML page; parsing it as JSON used to throw inside the
+    // handler and be reported as a generic proxy failure, losing the status that
+    // explains it.
+    expect(route).toContain('await storageRes.text()')
+    expect(route).toContain('UPLOAD_UPSTREAM_INVALID_RESPONSE')
+  })
+
+  it('gives up BEFORE the client does, so the 504 is what the shopper sees', () => {
+    expect(UPLOAD_PROXY_TIMEOUT_MS).toBeLessThan(clientTimeoutMs())
+  })
+})
+
+describe('file-storage-upload: an upstream that never answers', () => {
+  let handler: HandlerFn
+
+  beforeEach(() => {
+    jest.useFakeTimers()
+    handler = loadHandler('file-storage-upload')
+    installUploadGlobals({
+      FormData: FormDataStub,
+      Blob: NodeBlob,
+      atob: (encoded: string) => Buffer.from(encoded, 'base64').toString('binary'),
+    })
+  })
+
+  afterEach(() => {
+    jest.useRealTimers()
+    removeUploadGlobals(['fetch', 'FormData', 'Blob', 'atob'])
+  })
+
+  it('settles with a timeout error rather than never settling', async () => {
+    // The exact shape of the incident: a fetch that neither resolves nor
+    // rejects until something aborts it.
+    ;(globalThis as any).fetch = jest.fn(
+      (_url: string, init: { signal: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          init.signal.addEventListener('abort', () => {
+            const abortError = new Error('The operation was aborted.')
+            abortError.name = 'AbortError'
+            reject(abortError)
+          })
+        })
+    )
+
+    const pending = handler({ file: [PICKED_FILE] }, {}) as Promise<{
+      files: unknown[]
+      error: string
+      statusCode?: number
+    }>
+
+    jest.advanceTimersByTime(clientTimeoutMs())
+
+    const result = await pending
+    expect(result.files).toEqual([])
+    expect(result.statusCode).toBe(504)
+    expect(result.error.toLowerCase()).toContain('timed out')
+  })
+
+  it('passes an abort signal to the fetch at all', async () => {
+    const fetchMock = jest.fn(async (_url: string, _init: { signal?: { aborted: boolean } }) => ({
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify({ files: [] }),
+    }))
+    ;(globalThis as any).fetch = fetchMock
+
+    await handler({ file: [PICKED_FILE] }, {})
+
+    const init = fetchMock.mock.calls[0][1]
+    expect(init.signal).toBeDefined()
+    expect(typeof init.signal!.aborted).toBe('boolean')
+  })
+
+  it('reports the upstream status when the body is not JSON', async () => {
+    ;(globalThis as any).fetch = jest.fn(async () => ({
+      ok: false,
+      status: 502,
+      text: async () => '<html><body>Bad Gateway</body></html>',
+    }))
+
+    const result = (await handler({ file: [PICKED_FILE] }, {})) as {
+      error: string
+      statusCode: number
+    }
+
+    expect(result.statusCode).toBe(502)
+    // Never "Unexpected token <".
+    expect(result.error).toContain('502')
+  })
+
+  it('reports the readable message, not the machine code', async () => {
+    // Whatever this returns is toasted verbatim at the shopper. "Upload would
+    // exceed storage limit" is an explanation; "STORAGE_LIMIT_EXCEEDED" is not.
+    ;(globalThis as any).fetch = jest.fn(async () => ({
+      ok: false,
+      status: 413,
+      text: async () =>
+        JSON.stringify({
+          error: 'STORAGE_LIMIT_EXCEEDED',
+          message: 'Upload would exceed storage limit',
+          storageLimit: 20971520,
+        }),
+    }))
+
+    const result = (await handler({ file: [PICKED_FILE] }, {})) as {
+      error: string
+      statusCode: number
+      storageLimit: number
+    }
+
+    expect(result.error).toBe('Upload would exceed storage limit')
+    expect(result.statusCode).toBe(413)
+    // …and the numbers a "you need more room" message would want survive.
+    expect(result.storageLimit).toBe(20971520)
+  })
+
+  it('clears its timer on the happy path, so the tab is not held awake', async () => {
+    ;(globalThis as any).fetch = jest.fn(async () => ({
+      ok: true,
+      status: 200,
+      text: async () => JSON.stringify({ files: [{ url: 'https://cdn/a.png' }] }),
+    }))
+
+    await handler({ file: [PICKED_FILE] }, {})
+
+    expect(jest.getTimerCount()).toBe(0)
+  })
+})

package/__tests__/runtime-trigger-element-roundtrip.test.ts

@@ -31,9 +31,22 @@ function extractFn(name: string, returnExpr = name): Fn {
   if (!match) {
     throw new Error(`${name} not found in generated runtime`)
   }
-  // pruneContext depends on isDomNode/snapshotDomNode/domSerializationReplacer;
-  // mergeServerResults depends on isDomNode. Pull those in too when present.
-  const deps = ['isDomNode', 'snapshotDomNode', 'domSerializationReplacer']
+  // pruneContext depends on isDomNode/snapshotDomNode/domSerializationReplacer
+  // plus the recursive pruner (serializeForPrune/prunedValue) and its two size
+  // constants; mergeServerResults depends on isDomNode. Pull those in too.
+  const constDecls = ['PRUNE_MAX_SERIALIZED_LENGTH', 'PRUNE_MAX_DEPTH']
+    .map((c) => {
+      const m = src.match(new RegExp(`const ${c} = \\d+;`))
+      return m ? m[0] : ''
+    })
+    .join('\n')
+  const deps = [
+    'isDomNode',
+    'snapshotDomNode',
+    'domSerializationReplacer',
+    'serializeForPrune',
+    'prunedValue',
+  ]
     .filter((d) => d !== name)
     .map((d) => {
       const m = src.match(new RegExp(`function ${d}\\b[\\s\\S]*?\\n\\}`))
@@ -41,7 +54,7 @@ function extractFn(name: string, returnExpr = name): Fn {
     })
     .join('\n')
   // eslint-disable-next-line @typescript-eslint/no-implied-eval
-  return new Function(`${deps}\n${match[0]}\nreturn ${returnExpr};`)() as Fn
+  return new Function(`${constDecls}\n${deps}\n${match[0]}\nreturn ${returnExpr};`)() as Fn
 }
 
 // Minimal stand-in for a DOM element with a dataset (jsdom is not loaded here).
@@ -142,6 +155,32 @@ describe('trigger element survives the server-segment round-trip', () => {
     expect(context.fresh).toEqual({ ok: 1 })
   })
 
+  it('mergeServerResults never replaces the client __stateValues snapshot', () => {
+    // The server only ever READS __stateValues (template tokens, state-get-*
+    // handlers) and echoes back the PRUNED copy it was given — in which an
+    // oversized state (a picked photo's dataURL) has been replaced by a
+    // truncation marker. Merging that copy back would poison the snapshot the
+    // remaining client nodes resolve their object-property updates against.
+    const live = {
+      accountFormData: { name: 'Ada Lovelace', image: 'data:image/png;base64,AAAA' },
+      currentUser: { id: 'u-1', image: 'https://cdn/old.png' },
+    }
+    const context: Record<string, any> = { __stateValues: live }
+
+    mergeServerResults(
+      context,
+      {
+        __stateValues: { accountFormData: { name: 'Ada Lovelace', image: { __truncated: true } } },
+        'server-node': { updatedCount: 1 },
+      },
+      undefined
+    )
+
+    expect(context.__stateValues).toBe(live)
+    expect(context.__stateValues.currentUser.image).toBe('https://cdn/old.png')
+    expect(context['server-node']).toEqual({ updatedCount: 1 })
+  })
+
   it('mergeServerResults still protects the trigger node without an id (custom node)', () => {
     const el = fakeButton({ cartItemId: 'cart_abc' })
     const context: Record<string, any> = {

package/__tests__/stock-decrement-audit.test.ts

@@ -455,6 +455,83 @@ describe('reportStockWriteAudit — warns on unknown sites', () => {
   })
 })
 
+// ────────────────────────────────────────────────────────────────────
+// `data-raw-query` sites. SQL belongs in a data node, never in a
+// `general-custom-js` node (whose source ships to the browser), so this
+// is where the decrement actually lives. The auditor originally only
+// understood the custom-js shape, which made it blind to BOTH the real
+// decrement and any rogue raw-SQL write against the products table.
+// ────────────────────────────────────────────────────────────────────
+describe('data-raw-query stock writes', () => {
+  const ALIASED_DECREMENT =
+    'UPDATE teleport_products AS p SET quantity = p.quantity - d.qty, updated_at = NOW() ' +
+    'FROM unnest($1::text[], $2::int[]) AS d(id, qty) ' +
+    'WHERE p.quantity IS NOT NULL AND p.id::text = d.id'
+
+  it('classifies the aliased, parameterised decrement as order-decrement', () => {
+    const result = classifyStockWriteSite('Place Order', {
+      type: 'data-raw-query',
+      config: { query: ALIASED_DECREMENT },
+    })
+    expect(result.category).toBe('order-decrement')
+    expect(result.sqlSnippet).toContain('UPDATE teleport_products')
+  })
+
+  it('still classifies the un-aliased decrement as order-decrement', () => {
+    const result = classifyStockWriteSite('Place Order', {
+      type: 'data-raw-query',
+      config: {
+        query: 'UPDATE teleport_products SET quantity = quantity - 1 WHERE id = $1',
+      },
+    })
+    expect(result.category).toBe('order-decrement')
+  })
+
+  it('treats an admin bulk statement as admin, not as an unexplained write', () => {
+    const result = classifyStockWriteSite('Admin Panel: Mark as Inactive Selected Products', {
+      type: 'data-raw-query',
+      config: {
+        query: 'UPDATE teleport_products SET status = $1, updated_at = NOW() WHERE id = ANY($2)',
+      },
+    })
+    expect(result.category).toBe('admin')
+  })
+
+  it('flags a raw write from an unrecognised workflow as unknown', () => {
+    const result = classifyStockWriteSite('Some Other Flow', {
+      type: 'data-raw-query',
+      config: { query: 'UPDATE teleport_products SET price = 0' },
+    })
+    expect(result.category).toBe('unknown')
+  })
+
+  it('collects raw-query writes but never read-only SELECTs', () => {
+    const sites = findStockWriteSites({
+      workflows: {
+        workflows: {
+          w1: {
+            id: 'w1',
+            name: 'Place Order',
+            nodes: [
+              { id: 'n1', type: 'data-raw-query', config: { query: ALIASED_DECREMENT } },
+              {
+                id: 'n2',
+                type: 'data-raw-query',
+                config: { query: 'SELECT id, quantity FROM teleport_products WHERE id = $1' },
+              },
+            ],
+          },
+        },
+      },
+      // tslint:disable-next-line:no-any
+    } as any)
+
+    expect(sites).toHaveLength(1)
+    expect(sites[0].nodeId).toBe('n1')
+    expect(sites[0].category).toBe('order-decrement')
+  })
+})
+
 // ────────────────────────────────────────────────────────────────────
 // Integration test against the REAL project UIDL fixture. This is the
 // load-bearing contract test: it locks in the current expected state

package/dist/cjs/ecommerce/stock-decrement.d.ts

@@ -17,6 +17,7 @@ export declare const classifyStockWriteSite: (workflowName: string, node: {
     type?: string;
     config?: {
         code?: string;
+        query?: string;
     };
 }) => {
     category: StockWriteSite['category'];

package/dist/cjs/ecommerce/stock-decrement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stock-decrement.d.ts","sourceRoot":"","sources":["../../../src/ecommerce/stock-decrement.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAKxD,eAAO,MAAM,sBAAsB,uCAAuC,CAAA;AAU1E,eAAO,MAAM,8BAA8B,SAAU,MAAM,KAAG,OAgC7D,CAAA;AAsBD,eAAO,MAAM,4BAA4B,wlDAqCrC,CAAA;AA8BJ,eAAO,MAAM,0BAA0B,oBAAqB,OAAO,KAAG,MA+HrE,CAAA;AAsBD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAGjD,UAAU,EAAE,MAAM,CAAA;CACnB;AA0ED,eAAO,MAAM,sBAAsB,iBACnB,MAAM,QACd;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAClD;IAAE,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAuC5D,CAAA;AAID,eAAO,MAAM,mBAAmB,SAAU,WAAW,KAAG,cAAc,EAwErE,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,cAAc,EAAE,cAAc,EAAE,CAAA;IAChC,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAID,eAAO,MAAM,oBAAoB,SAAU,WAAW,KAAG,eAQxD,CAAA;AAMD,eAAO,MAAM,qBAAqB,SAAU,WAAW,KAAG,eAmEzD,CAAA;AAuMD,UAAU,YAAY;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,iCAAiC,SAAU,WAAW,KAAG,YA6BrE,CAAA"}
+{"version":3,"file":"stock-decrement.d.ts","sourceRoot":"","sources":["../../../src/ecommerce/stock-decrement.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAKxD,eAAO,MAAM,sBAAsB,uCAAuC,CAAA;AAU1E,eAAO,MAAM,8BAA8B,SAAU,MAAM,KAAG,OAgC7D,CAAA;AAsBD,eAAO,MAAM,4BAA4B,wlDAqCrC,CAAA;AA8BJ,eAAO,MAAM,0BAA0B,oBAAqB,OAAO,KAAG,MA+HrE,CAAA;AAsBD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAGjD,UAAU,EAAE,MAAM,CAAA;CACnB;AAsGD,eAAO,MAAM,sBAAsB,iBACnB,MAAM,QACd;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAClE;IAAE,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAgE5D,CAAA;AAID,eAAO,MAAM,mBAAmB,SAAU,WAAW,KAAG,cAAc,EA2FrE,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,cAAc,EAAE,cAAc,EAAE,CAAA;IAChC,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAID,eAAO,MAAM,oBAAoB,SAAU,WAAW,KAAG,eAQxD,CAAA;AAMD,eAAO,MAAM,qBAAqB,SAAU,WAAW,KAAG,eAmEzD,CAAA;AAuMD,UAAU,YAAY;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,iCAAiC,SAAU,WAAW,KAAG,YA6BrE,CAAA"}

package/dist/cjs/ecommerce/stock-decrement.js

@@ -312,6 +312,37 @@ const isAdminWorkflowName = (name) => {
     // classify correctly.
     return /\badmin\b/i.test(name);
 };
+/**
+ * The decrement statement itself, in every shape a builder has emitted.
+ *
+ * The table may carry an alias and the column may be qualified through it —
+ * `UPDATE teleport_products AS p SET quantity = p.quantity - d.qty …` — which is
+ * what the parameterised `data-raw-query` form uses. An un-aliased
+ * `SET quantity = quantity - …` is the older shape and still matches.
+ */
+const ORDER_DECREMENT_SQL_RE = /UPDATE\s+teleport_products\s+(?:AS\s+)?\w*\s*SET\s+quantity\s*=\s*(?:\w+\.)?quantity\s*-/i;
+/** The GREATEST / NULL-preserving guards, independent of how the row is addressed. */
+const ORDER_DECREMENT_GUARD_RES = [
+    /quantity\s*=\s*GREATEST\s*\(\s*\d+\s*,\s*COALESCE\s*\(\s*(?:\w+\.)?quantity/i,
+    /quantity\s*=\s*CASE\s+WHEN\s+(?:\w+\.)?quantity\s+IS\s+NULL\s+THEN\s+NULL\s+ELSE\s+GREATEST/i,
+];
+/**
+ * Whether a bare SQL string is the order stock decrement.
+ *
+ * Used for `data-raw-query` nodes, which is where the decrement lives now: SQL
+ * belongs in a data node, never in a `general-custom-js` node whose source ships
+ * to the browser. Without this branch the auditor sees no decrement at all and
+ * would equally miss a rogue raw-SQL write to the products table.
+ */
+const looksLikeOrderDecrementSql = (sql) => {
+    if (typeof sql !== 'string' || sql.indexOf('teleport_products') < 0) {
+        return false;
+    }
+    if (ORDER_DECREMENT_SQL_RE.test(sql)) {
+        return true;
+    }
+    return ORDER_DECREMENT_GUARD_RES.some((re) => re.test(sql));
+};
 const looksLikeOrderDecrementCustomHandler = (code) => {
     if (typeof code !== 'string') {
         return false;
@@ -338,19 +369,16 @@ const looksLikeOrderDecrementCustomHandler = (code) => {
         // NULL-preserving shape (`quantity = CASE WHEN quantity IS NULL
         // THEN NULL ELSE GREATEST(0, quantity - CASE id …) END`).
         if (code.indexOf('teleport_products') >= 0) {
-            if (/quantity\s*=\s*quantity\s*-/.test(code)) {
-                return true;
-            }
-            if (/quantity\s*=\s*GREATEST\s*\(\s*\d+\s*,\s*COALESCE\s*\(\s*quantity/i.test(code)) {
+            if (/quantity\s*=\s*(?:\w+\.)?quantity\s*-/.test(code)) {
                 return true;
             }
-            if (/quantity\s*=\s*CASE\s+WHEN\s+quantity\s+IS\s+NULL\s+THEN\s+NULL\s+ELSE\s+GREATEST/i.test(code)) {
+            if (ORDER_DECREMENT_GUARD_RES.some((re) => re.test(code))) {
                 return true;
             }
         }
         return false;
     }
-    return /UPDATE\s+teleport_products\s+SET\s+quantity\s*=\s*quantity\s*-/i.test(code);
+    return ORDER_DECREMENT_SQL_RE.test(code);
 };
 // Pull the first 300 chars of any SQL string in a custom-js handler.
 // Just for log readability when the auditor warns.
@@ -364,6 +392,26 @@ const extractSqlSnippet = (code) => {
 const classifyStockWriteSite = (workflowName, node) => {
     const nodeType = node.type || '';
     const code = (node.config && node.config.code) || '';
+    const query = (node.config && node.config.query) || '';
+    // `data-raw-query` sites: the decrement's current home. The SQL is a plain
+    // string on the node, so it is matched directly rather than through the
+    // custom-handler marker logic (a data node carries no rewritten handler).
+    if (nodeType === 'data-raw-query') {
+        if (looksLikeOrderDecrementSql(query)) {
+            return { category: 'order-decrement', sqlSnippet: extractSqlSnippet(query) };
+        }
+        if (/UPDATE\s+teleport_products|DELETE\s+(?:FROM\s+)?teleport_products|INSERT\s+(?:INTO\s+)?teleport_products/i.test(query)) {
+            // The admin panel's BULK actions are raw-SQL by necessity (one statement
+            // for N rows), so the same workflow-name signal the structured-CRUD
+            // branch uses applies here — otherwise every bulk delete / status change
+            // would be reported as an unexplained write.
+            if (isAdminWorkflowName(workflowName)) {
+                return { category: 'admin', sqlSnippet: extractSqlSnippet(query) };
+            }
+            return { category: 'unknown', sqlSnippet: extractSqlSnippet(query) };
+        }
+        return { category: 'unknown', sqlSnippet: '' };
+    }
     // Raw-SQL custom-js sites: distinguish "decrement" from "other write".
     if (nodeType === 'general-custom-js') {
         if (looksLikeOrderDecrementCustomHandler(code)) {
@@ -429,6 +477,24 @@ const findStockWriteSites = (uidl) => {
                 });
                 continue;
             }
+            // Raw-SQL data-node branch. Same "writes only" rule as custom-js below:
+            // a SELECT against teleport_products is not a write site.
+            if (node.type === 'data-raw-query' && typeof config.query === 'string') {
+                if (/\b(UPDATE|DELETE\s+FROM|INSERT\s+INTO)\s+teleport_products\b/i.test(config.query)) {
+                    const { category, sqlSnippet } = (0, exports.classifyStockWriteSite)(workflowName, node);
+                    sites.push({
+                        workflowId,
+                        workflowName,
+                        workflowKind: kind,
+                        nodeId: node.id || '',
+                        nodeType: node.type,
+                        stepNumber: node.stepNumber,
+                        category,
+                        sqlSnippet,
+                    });
+                }
+                continue;
+            }
             // Raw-SQL custom-js branch: only count it when the code actually
             // writes (UPDATE / DELETE / INSERT) — read-only SELECTs on
             // teleport_products are not "write sites".