@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.68

package/dist/esm/server-runtime-code.js

@@ -0,0 +1,299 @@
+/**
+ * `utils/workflows/server-runtime.js`: what every server route loads. It is the
+ * shared runtime utilities plus the parts only a server may run — the signed
+ * hand-off between server segments and the internal-call credential — so none
+ * of it reaches the browser bundle.
+ *
+ * WHY THE HAND-OFF IS SIGNED. A workflow runs as a chain of segments, and the
+ * result of every server segment reaches the next one THROUGH the caller: the
+ * browser holds the context between hops and posts it back. Without a check,
+ * a crafted request could hand a later server segment any "result" of an
+ * earlier one — an order marked valid, a password-reset token marked checked
+ * — and the later segment acted on it. So:
+ *
+ * - `segmentReply` signs every result its segment produced (`__sig`, an HMAC
+ *   keyed from NEXTAUTH_SECRET over the node id and the JSON value) and the
+ *   order of the context's keys as the caller will hold them (`__sigOrder`),
+ *   since `params` in custom JavaScript are read by position.
+ * - `claimSegmentContext` puts the keys back in that signed order (a key the
+ *   request left out keeps its slot, empty), empties every server result
+ *   whose signature does not hold or that the signed order does not list,
+ *   drops custom-node and loop bookkeeping a request cannot legitimately
+ *   carry, skips every node a server if / switch upstream did not choose
+ *   (or whose decision is missing), and takes `__previousNodeResult` from the
+ *   signed result of the server node that ran just before.
+ *
+ * What the BROWSER itself computes stays untrusted by design; a server segment
+ * that needs a trustworthy figure (a price, an owner) reads it from the
+ * database itself.
+ *
+ * The facts about the graph each route needs are baked into its
+ * SEGMENT_CONFIG at generation time (see segment-trust.ts).
+ */
+export const generateServerRuntimeCode = () => `'use strict';
+var crypto = require('crypto');
+var utils = require('./runtime-utils');
+
+var __stepKeyCache = { secret: null, key: null };
+
+function stepKey() {
+  var secret = process.env.NEXTAUTH_SECRET || '';
+  if (__stepKeyCache.secret !== secret) {
+    __stepKeyCache = {
+      secret: secret,
+      key: crypto.createHmac('sha256', secret).update('teleport-workflow-step:v1').digest()
+    };
+  }
+  return __stepKeyCache.key;
+}
+
+function mac(text) {
+  return crypto.createHmac('sha256', stepKey()).update(text).digest('hex');
+}
+
+// Without an app secret every key here would derive from '' — a value anyone
+// can compute — so nothing verifies: relayed server results are dropped and no
+// request passes as an internal call. (The generator gives every app with
+// server routes a secret.)
+function sameMac(given, expected) {
+  if (!process.env.NEXTAUTH_SECRET) {
+    return false;
+  }
+  if (typeof given !== 'string' || typeof expected !== 'string' || given.length !== expected.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
+}
+
+function has(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function isControlKey(key) {
+  return key.indexOf('__') === 0;
+}
+
+function resultMac(nodeId, value) {
+  var serialized;
+  try { serialized = JSON.stringify(value); } catch (e) { return null; }
+  if (serialized === undefined) return null;
+  return mac('result|' + nodeId + '|' + serialized);
+}
+
+function orderMac(keys) {
+  return mac('order|' + JSON.stringify(keys));
+}
+
+// The order the caller holds its keys in, as the last server segment signed
+// it; null when the request carries no valid signed order.
+function readSignedOrder(context) {
+  var order = context.__sigOrder;
+  if (!order || typeof order !== 'object' || !Array.isArray(order.keys)) return null;
+  for (var i = 0; i < order.keys.length; i++) {
+    if (typeof order.keys[i] !== 'string' || isControlKey(order.keys[i])) return null;
+  }
+  return sameMac(order.mac, orderMac(order.keys)) ? order.keys : null;
+}
+
+function restoreOrder(context, keys) {
+  var snapshot = {};
+  var all = Object.keys(context);
+  for (var i = 0; i < all.length; i++) {
+    snapshot[all[i]] = context[all[i]];
+    delete context[all[i]];
+  }
+  var placed = {};
+  for (var c = 0; c < all.length; c++) {
+    if (isControlKey(all[c])) {
+      context[all[c]] = snapshot[all[c]];
+      placed[all[c]] = true;
+    }
+  }
+  for (var k = 0; k < keys.length; k++) {
+    if (placed[keys[k]]) continue;
+    context[keys[k]] = has(snapshot, keys[k]) ? snapshot[keys[k]] : undefined;
+    placed[keys[k]] = true;
+  }
+  for (var r = 0; r < all.length; r++) {
+    if (!placed[all[r]]) context[all[r]] = snapshot[all[r]];
+  }
+}
+
+function dropUnsignedResults(segmentConfig, context, orderKeys) {
+  var ids = segmentConfig.signedNodeIds || [];
+  if (ids.length === 0) return;
+  var listed = {};
+  for (var o = 0; o < (orderKeys || []).length; o++) listed[orderKeys[o]] = true;
+  var sigs = context.__sig && typeof context.__sig === 'object' && !Array.isArray(context.__sig) ? context.__sig : {};
+  for (var i = 0; i < ids.length; i++) {
+    var id = ids[i];
+    if (!has(context, id) || context[id] === undefined) continue;
+    var expected = resultMac(id, context[id]);
+    if (!listed[id] || !expected || !sameMac(sigs[id], expected)) {
+      context[id] = undefined;
+    }
+  }
+}
+
+function stripForeignControlKeys(segmentConfig, context) {
+  if (!segmentConfig.customNodeIds) {
+    delete context.__isInsideCustomNode;
+    delete context.__customNodeIds;
+    delete context.__customParams;
+  }
+  var bodies = segmentConfig.loopBodies || {};
+  if (context.__loopNodeIds && typeof context.__loopNodeIds === 'object') {
+    var keptLoops = {};
+    Object.keys(context.__loopNodeIds).forEach(function(id) {
+      if (has(bodies, id) && context.__loopNodeIds[id]) keptLoops[id] = true;
+    });
+    context.__loopNodeIds = keptLoops;
+  } else {
+    delete context.__loopNodeIds;
+  }
+  if (Array.isArray(context.__loopScopeStack)) {
+    context.__loopScopeStack = context.__loopScopeStack
+      .filter(function(scope) { return scope && typeof scope.loopNodeId === 'string' && has(bodies, scope.loopNodeId); })
+      .map(function(scope) {
+        var claimed = scope.bodyNodeIds && typeof scope.bodyNodeIds === 'object' ? scope.bodyNodeIds : {};
+        var body = {};
+        bodies[scope.loopNodeId].forEach(function(id) { if (claimed[id]) body[id] = true; });
+        return { loopNodeId: scope.loopNodeId, bodyNodeIds: body };
+      });
+  } else {
+    delete context.__loopScopeStack;
+  }
+}
+
+function gateTook(gate, when, decision) {
+  if (!decision || typeof decision !== 'object') return false;
+  if (gate.kind === 'if') {
+    return typeof decision.result === 'boolean' && when === (decision.result ? 'true' : 'false');
+  }
+  if (decision.matchedCase === undefined || decision.matchedCase === null) return false;
+  if (when === 'default') return decision.matchedCase === 'default';
+  return when === 'case:' + decision.matchedCase;
+}
+
+function enforceBranchGates(segmentConfig, context) {
+  var gates = segmentConfig.branchGates || [];
+  if (gates.length === 0) return;
+  if (!context.__skippedNodes || typeof context.__skippedNodes !== 'object') context.__skippedNodes = {};
+  for (var g = 0; g < gates.length; g++) {
+    var gate = gates[g];
+    var decision = context[gate.id];
+    for (var b = 0; b < gate.branches.length; b++) {
+      var branch = gate.branches[b];
+      if (gateTook(gate, branch.when, decision)) continue;
+      for (var n = 0; n < branch.nodeIds.length; n++) context.__skippedNodes[branch.nodeIds[n]] = true;
+    }
+  }
+}
+
+function resetPreviousResult(segmentConfig, context) {
+  var from = segmentConfig.previousFrom;
+  if (!from) return;
+  if (from.fireAndForget) {
+    context.__previousNodeResult = null;
+    return;
+  }
+  var value = context[from.nodeId];
+  context.__previousNodeResult = value !== undefined ? value : {};
+}
+
+// The keys the caller holds, in order, before this segment's own results were
+// dropped — segmentReply appends what the run adds, exactly as the caller's
+// merge will.
+var __incomingOrders = new WeakMap();
+
+function claimSegmentContext(segmentConfig, context) {
+  var orderKeys = readSignedOrder(context);
+  if (orderKeys) restoreOrder(context, orderKeys);
+  dropUnsignedResults(segmentConfig, context, orderKeys);
+  stripForeignControlKeys(segmentConfig, context);
+  __incomingOrders.set(context, Object.keys(context).filter(function(k) { return !isControlKey(k); }));
+  utils.claimSegmentContext(segmentConfig, context);
+  enforceBranchGates(segmentConfig, context);
+  resetPreviousResult(segmentConfig, context);
+}
+
+function segmentReply(segmentConfig, context, snapshot) {
+  var reply = utils.segmentReply(segmentConfig, context, snapshot);
+  var sigs = {};
+  var incoming = context.__sig && typeof context.__sig === 'object' && !Array.isArray(context.__sig) ? context.__sig : {};
+  Object.keys(incoming).forEach(function(id) {
+    if (typeof incoming[id] === 'string') sigs[id] = incoming[id];
+  });
+  var nodes = segmentConfig.nodes || [];
+  for (var i = 0; i < nodes.length; i++) {
+    var id = nodes[i].id;
+    if (!has(reply, id) || reply[id] === undefined) continue;
+    var signature = resultMac(id, reply[id]);
+    if (signature) sigs[id] = signature; else delete sigs[id];
+  }
+  reply.__sig = sigs;
+  var keys = (__incomingOrders.get(context) || []).slice();
+  var listed = {};
+  keys.forEach(function(k) { listed[k] = true; });
+  Object.keys(reply).forEach(function(k) {
+    if (!isControlKey(k) && !listed[k]) {
+      keys.push(k);
+      listed[k] = true;
+    }
+  });
+  reply.__sigOrder = { keys: keys, mac: orderMac(keys) };
+  return reply;
+}
+
+// A call one of this deployment's server routes makes to another (a webhook
+// or cron running a custom node's server segments). Only server code can mint
+// the token, so a route that must never be called from a browser checks it.
+function internalCallToken() {
+  return mac('internal-call|v1');
+}
+
+function isInternalCall(req) {
+  var given = req && req.headers ? req.headers['x-teleport-internal'] : '';
+  return typeof given === 'string' && sameMac(given, internalCallToken());
+}
+
+function internalRequestHeaders(req) {
+  var headers = utils.internalRequestHeaders(req);
+  headers['x-teleport-internal'] = internalCallToken();
+  return headers;
+}
+
+function isLoopbackHost(host) {
+  var name = String(host || '').replace(/:[0-9]+$/, '').toLowerCase();
+  return name === 'localhost' || name === '127.0.0.1' || name === '[::1]';
+}
+
+// The origin this deployment calls its own API routes on. On Vercel the
+// request's host is the domain Vercel routed to this deployment; anywhere
+// else the Host header is whatever the caller sent, so the canonical
+// NEXTAUTH_URL wins when it is set — internal calls carry credentials, and
+// they must never go to a host a request named. (A local development server
+// on another port than NEXTAUTH_URL's keeps its own loopback address.)
+function trustedBaseUrl(req) {
+  var headers = (req && req.headers) || {};
+  var host = headers.host || '';
+  var proto = headers['x-forwarded-proto'] || (isLoopbackHost(host) ? 'http' : 'https');
+  var requestOrigin = String(proto).split(',')[0].trim() + '://' + host;
+  if (process.env.VERCEL) return requestOrigin;
+  var configured = String(process.env.NEXTAUTH_URL || '').trim();
+  if (!configured) return requestOrigin;
+  var origin;
+  try { origin = new URL(configured).origin; } catch (e) { return requestOrigin; }
+  if (isLoopbackHost(host) && isLoopbackHost(new URL(origin).host)) return requestOrigin;
+  return origin;
+}
+
+module.exports = Object.assign({}, utils, {
+  claimSegmentContext: claimSegmentContext,
+  segmentReply: segmentReply,
+  internalRequestHeaders: internalRequestHeaders,
+  isInternalCall: isInternalCall,
+  trustedBaseUrl: trustedBaseUrl
+});
+`;
+//# sourceMappingURL=server-runtime-code.js.map

package/dist/esm/server-runtime-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-runtime-code.js","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAW,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyQtD,CAAA"}

package/dist/esm/session-cookie-resolver.d.ts

@@ -1,84 +1,9 @@
 /**
- * Resolving the NextAuth session token in a generated route, WITHOUT asking
- * `process.env.NEXTAUTH_URL` what the session cookie is called.
- *
- * ## ⛔ THE REPORTED DEFECT
- *
- * A published project showed "Failed to load dashboard data. Please refresh."
- * on the home page, "Failed to load meeting data." on the list page and "could
- * not fetch the templates" on a third — for a user who was signed in, on a page
- * whose own `/api/auth/session` returned that user. The failing call was the
- * page-load workflow's server segment, answering **401 `Unauthenticated`** from
- * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
- * requests at the same route returned **33 × 401 and 17 × 200**, while 40
- * concurrent `/api/auth/session` calls resolved the user 40/40.
- *
- * ## The mechanism
- *
- * next-auth v4's `getToken()` derives the cookie it reads from an env var:
- *
- * ```js
- * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
- * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
- * ```
- *
- * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
- * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
- * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
- * repair is process-local: it fixes the value for whichever serverless instance
- * happened to serve an auth request, and for no other. Every other instance
- * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
- * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
- * `getToken` looks for `next-auth.session-token`, the browser is holding
- * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
- * reported as anonymous.
- *
- * Hence the coin-flip: it depends on whether the instance that served your
- * request had previously served an auth request. Nothing about the session, the
- * secret or the cookie is wrong.
- *
- * The same defect is why the generated middleware carries a `hasSessionCookie`
- * fallback and a round trip to `/api/auth/session`, attributed there to an
- * "Edge runtime quirk" — the Edge process holds that same localhost value.
- *
- * ## The rule
- *
- * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
- * env var that describes the deployment.** So this resolver reads which session
- * cookie the caller actually sent, and tells `getToken` exactly that — falling
- * back to the request's own protocol when the cookie header is unavailable.
- *
- * Emitted as plain ES5 text and inlined into each generated route: a route that
- * carries its own copy cannot be broken by a missing sibling module or an
- * untraced dependency, and every call site gets the identical implementation
- * from this one definition.
+ * The session-cookie resolver lives in teleport-shared so the per-table data
+ * routes (teleport-plugin-next-data-source) decode a session exactly the way
+ * the workflow routes do. This module keeps the plugin's public export path.
  */
-/** The `__tq`-prefixed globals the emitted snippet declares. */
 export declare const SESSION_TOKEN_RESOLVER_FN = "__tqResolveSessionToken";
-/**
- * ES5 source for the shared session-token resolver, safe to inline into any
- * generated CommonJS route or ESM middleware.
- *
- * Declares:
- *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
- *    parsed properly (a substring test would see `next-auth.session-token`
- *    inside `__Secure-next-auth.session-token` and pick the wrong one).
- *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
- *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
- *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
- *
- * `getToken` is passed IN rather than required here, so the same body serves a
- * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
- * (static `import`). Pure, total, never throws, no env reads.
- */
 export declare const generateSessionTokenResolverCode: () => string;
-/**
- * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
- *
- * The require is lazy and guarded because a project generated WITHOUT
- * authentication does not ship `next-auth`; such a project also has no session
- * to read, so resolving to `null` there is the correct answer rather than a
- * module-load crash.
- */
 export declare const generateCommonJsSessionTokenResolverCode: () => string;
 //# sourceMappingURL=session-cookie-resolver.d.ts.map

package/dist/esm/session-cookie-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-resolver.d.ts","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,4BAA4B,CAAA;AAiBlE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,QAAO,MA6JnD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wCAAwC,QAAO,MAsB3D,CAAA"}
+{"version":3,"file":"session-cookie-resolver.d.ts","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,4BAAkD,CAAA;AACxF,eAAO,MAAM,gCAAgC,cACW,CAAA;AACxD,eAAO,MAAM,wCAAwC,cACW,CAAA"}

package/dist/esm/session-cookie-resolver.js

@@ -1,277 +1,10 @@
+import { SessionCookieResolver } from '@teleporthq/teleport-shared';
 /**
- * Resolving the NextAuth session token in a generated route, WITHOUT asking
- * `process.env.NEXTAUTH_URL` what the session cookie is called.
- *
- * ## ⛔ THE REPORTED DEFECT
- *
- * A published project showed "Failed to load dashboard data. Please refresh."
- * on the home page, "Failed to load meeting data." on the list page and "could
- * not fetch the templates" on a third — for a user who was signed in, on a page
- * whose own `/api/auth/session` returned that user. The failing call was the
- * page-load workflow's server segment, answering **401 `Unauthenticated`** from
- * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
- * requests at the same route returned **33 × 401 and 17 × 200**, while 40
- * concurrent `/api/auth/session` calls resolved the user 40/40.
- *
- * ## The mechanism
- *
- * next-auth v4's `getToken()` derives the cookie it reads from an env var:
- *
- * ```js
- * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
- * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
- * ```
- *
- * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
- * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
- * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
- * repair is process-local: it fixes the value for whichever serverless instance
- * happened to serve an auth request, and for no other. Every other instance
- * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
- * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
- * `getToken` looks for `next-auth.session-token`, the browser is holding
- * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
- * reported as anonymous.
- *
- * Hence the coin-flip: it depends on whether the instance that served your
- * request had previously served an auth request. Nothing about the session, the
- * secret or the cookie is wrong.
- *
- * The same defect is why the generated middleware carries a `hasSessionCookie`
- * fallback and a round trip to `/api/auth/session`, attributed there to an
- * "Edge runtime quirk" — the Edge process holds that same localhost value.
- *
- * ## The rule
- *
- * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
- * env var that describes the deployment.** So this resolver reads which session
- * cookie the caller actually sent, and tells `getToken` exactly that — falling
- * back to the request's own protocol when the cookie header is unavailable.
- *
- * Emitted as plain ES5 text and inlined into each generated route: a route that
- * carries its own copy cannot be broken by a missing sibling module or an
- * untraced dependency, and every call site gets the identical implementation
- * from this one definition.
+ * The session-cookie resolver lives in teleport-shared so the per-table data
+ * routes (teleport-plugin-next-data-source) decode a session exactly the way
+ * the workflow routes do. This module keeps the plugin's public export path.
  */
-/** The `__tq`-prefixed globals the emitted snippet declares. */
-export const SESSION_TOKEN_RESOLVER_FN = '__tqResolveSessionToken';
-/**
- * Session-cookie names next-auth/Auth.js writes, with the `secureCookie` flag
- * that produces each. Order within a protocol is irrelevant — only ONE of these
- * is ever present — but the https/http split decides which pair is tried first.
- *
- * `__Host-` is deliberately absent: next-auth uses it only for the CSRF and
- * callback cookies, never for the session token.
- */
-const KNOWN_SESSION_COOKIES = [
-    { name: '__Secure-next-auth.session-token', secure: true },
-    { name: 'next-auth.session-token', secure: false },
-    { name: '__Secure-authjs.session-token', secure: true },
-    { name: 'authjs.session-token', secure: false },
-];
-/**
- * ES5 source for the shared session-token resolver, safe to inline into any
- * generated CommonJS route or ESM middleware.
- *
- * Declares:
- *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
- *    parsed properly (a substring test would see `next-auth.session-token`
- *    inside `__Secure-next-auth.session-token` and pick the wrong one).
- *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
- *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
- *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
- *
- * `getToken` is passed IN rather than required here, so the same body serves a
- * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
- * (static `import`). Pure, total, never throws, no env reads.
- */
-export const generateSessionTokenResolverCode = () => {
-    return `// GENERATED — see generateSessionTokenResolverCode in
-// @teleporthq/teleport-plugin-next-workflows/src/session-cookie-resolver.ts.
-//
-// next-auth's getToken() picks the session cookie name from
-// process.env.NEXTAUTH_URL, which a generated project ships as a localhost
-// default — so on a published https domain it looks for the non-secure cookie
-// and reports a signed-in user as anonymous. These helpers read the cookie the
-// request actually carries and tell getToken exactly which one it is.
-var __TQ_SESSION_COOKIES = ${JSON.stringify(KNOWN_SESSION_COOKIES.map((c) => [c.name, c.secure]))};
-
-// Every cookie NAME on the request. Parsed on the "; " separator rather than
-// matched as a substring: "next-auth.session-token" occurs inside
-// "__Secure-next-auth.session-token", so a substring test reports the plain
-// cookie as present whenever the secure one is, and getToken then decodes the
-// wrong (missing) cookie.
-function __tqCookieNamesPresent(req) {
-  var present = {};
-  var raw = '';
-  try {
-    var headers = req && req.headers;
-    if (headers && typeof headers.get === 'function') {
-      // Edge / fetch Headers.
-      raw = headers.get('cookie') || '';
-    } else if (headers) {
-      var value = headers.cookie || headers.Cookie;
-      raw = Array.isArray(value) ? value.join('; ') : value || '';
-    }
-  } catch (e) {
-    raw = '';
-  }
-  var parts = String(raw).split(';');
-  for (var i = 0; i < parts.length; i++) {
-    var eq = parts[i].indexOf('=');
-    if (eq > 0) {
-      present[parts[i].slice(0, eq).trim()] = true;
-    }
-  }
-  // Second source: the runtime's own parsed cookies. A Next.js API route hands
-  // over a plain object; the Edge RequestCookies exposes getAll().
-  try {
-    var cookies = req && req.cookies;
-    if (cookies && typeof cookies.getAll === 'function') {
-      var all = cookies.getAll() || [];
-      for (var a = 0; a < all.length; a++) {
-        if (all[a] && all[a].name) {
-          present[all[a].name] = true;
-        }
-      }
-    } else if (cookies && typeof cookies === 'object') {
-      for (var key in cookies) {
-        if (Object.prototype.hasOwnProperty.call(cookies, key)) {
-          present[key] = true;
-        }
-      }
-    }
-  } catch (e) {
-    /* the header pass above is enough */
-  }
-  return present;
-}
-
-// Is this request https? Read from the proxy header the platform sets, then the
-// socket, then the URL — never from an env var describing the deployment.
-function __tqRequestIsSecure(req) {
-  try {
-    var headers = (req && req.headers) || {};
-    var proto =
-      typeof headers.get === 'function'
-        ? headers.get('x-forwarded-proto')
-        : headers['x-forwarded-proto'];
-    if (Array.isArray(proto)) {
-      proto = proto[0];
-    }
-    if (typeof proto === 'string' && proto) {
-      // A chain of proxies appends: "https,http" — the client-facing hop is first.
-      return proto.split(',')[0].trim().toLowerCase() === 'https';
-    }
-    if (req && req.nextUrl && req.nextUrl.protocol === 'https:') {
-      return true;
-    }
-    if (req && req.socket && req.socket.encrypted) {
-      return true;
-    }
-    if (req && req.connection && req.connection.encrypted) {
-      return true;
-    }
-    if (typeof (req && req.url) === 'string' && req.url.indexOf('https://') === 0) {
-      return true;
-    }
-  } catch (e) {
-    /* fall through to false */
-  }
-  return false;
-}
-
-// The { cookieName, secureCookie } pairs worth trying, most likely first.
-// Normally exactly one cookie is present and this returns a single entry; the
-// list only grows when a site has been reached over both http and https.
-function __tqSessionTokenCandidates(req) {
-  var present = __tqCookieNamesPresent(req);
-  var secure = __tqRequestIsSecure(req);
-  var candidates = [];
-  for (var i = 0; i < __TQ_SESSION_COOKIES.length; i++) {
-    var name = __TQ_SESSION_COOKIES[i][0];
-    var isSecureName = __TQ_SESSION_COOKIES[i][1];
-    if (present[name] || present[name + '.0']) {
-      candidates.push({ cookieName: name, secureCookie: isSecureName });
-    }
-  }
-  candidates.sort(function (a, b) {
-    if (a.secureCookie === b.secureCookie) {
-      return 0;
-    }
-    return a.secureCookie === secure ? -1 : 1;
-  });
-  if (candidates.length === 0) {
-    // No cookie we recognise. The project may configure a custom cookie name in
-    // authOptions, so hand getToken the request's own protocol and let it apply
-    // its defaults — same behaviour as before this resolver existed, minus the
-    // localhost env var.
-    candidates.push({ secureCookie: secure });
-  }
-  return candidates;
-}
-
-// The decoded session token, or null. Tries each candidate cookie in turn so a
-// project that renamed its cookie, or one reached over both protocols, still
-// resolves. Never throws.
-function ${SESSION_TOKEN_RESOLVER_FN}(getToken, req, secret) {
-  if (!secret || typeof getToken !== 'function') {
-    return Promise.resolve(null);
-  }
-  var candidates = __tqSessionTokenCandidates(req);
-  var attempt = function (index) {
-    if (index >= candidates.length) {
-      return Promise.resolve(null);
-    }
-    var candidate = candidates[index];
-    var params = { req: req, secret: secret, secureCookie: candidate.secureCookie };
-    if (candidate.cookieName) {
-      params.cookieName = candidate.cookieName;
-    }
-    return Promise.resolve()
-      .then(function () {
-        return getToken(params);
-      })
-      .catch(function () {
-        return null;
-      })
-      .then(function (token) {
-        return token || attempt(index + 1);
-      });
-  };
-  return attempt(0);
-}
-`;
-};
-/**
- * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
- *
- * The require is lazy and guarded because a project generated WITHOUT
- * authentication does not ship `next-auth`; such a project also has no session
- * to read, so resolving to `null` there is the correct answer rather than a
- * module-load crash.
- */
-export const generateCommonJsSessionTokenResolverCode = () => {
-    return `${generateSessionTokenResolverCode()}
-// Lazy + guarded: a project generated without authentication has no next-auth
-// installed, and no session to read either — null is the right answer there.
-function __tqGetTokenFn() {
-  try {
-    var jwt = require('next-auth/jwt');
-    return jwt && typeof jwt.getToken === 'function' ? jwt.getToken : null;
-  } catch (e) {
-    return null;
-  }
-}
-
-// The session token for this request, or null. Reads NEXTAUTH_SECRET itself.
-function __tqSessionToken(req) {
-  var secret = process.env.NEXTAUTH_SECRET;
-  if (!secret) {
-    return Promise.resolve(null);
-  }
-  return ${SESSION_TOKEN_RESOLVER_FN}(__tqGetTokenFn(), req, secret);
-}
-`;
-};
+export const SESSION_TOKEN_RESOLVER_FN = SessionCookieResolver.SESSION_TOKEN_RESOLVER_FN;
+export const generateSessionTokenResolverCode = SessionCookieResolver.generateSessionTokenResolverCode;
+export const generateCommonJsSessionTokenResolverCode = SessionCookieResolver.generateCommonJsSessionTokenResolverCode;
 //# sourceMappingURL=session-cookie-resolver.js.map