@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.68

package/dist/cjs/workflow-project-plugin.js

@@ -1,24 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveAuthEnvValue = exports.collectOAuthCredentialEnvKeys = exports.NextWorkflowProjectPlugin = exports.stripEventHandlerAttrs = void 0;
+exports.resolveAuthEnvValue = exports.collectOAuthCredentialEnvKeys = exports.NextWorkflowProjectPlugin = exports.stripEventHandlerAttrs = exports.resolveAuthUsersTableName = void 0;
 const teleport_types_1 = require("@teleporthq/teleport-types");
 const teleport_shared_1 = require("@teleporthq/teleport-shared");
 const segment_splitter_1 = require("./segment-splitter");
 const await_result_1 = require("./await-result");
+const segment_context_needs_1 = require("./segment-context-needs");
+const custom_node_modules_1 = require("./custom-node-modules");
 const api_route_generator_1 = require("./api-route-generator");
 const workflow_auth_generator_1 = require("./workflow-auth-generator");
+const subscriber_access_route_generator_1 = require("./subscriber-access-route-generator");
 const secret_collector_1 = require("./secret-collector");
 const graph_utils_1 = require("./graph-utils");
 const nodes_1 = require("./nodes");
 const types_1 = require("./nodes/types");
 const executor_generator_1 = require("./executor-generator");
+const server_runtime_code_1 = require("./server-runtime-code");
+const segment_trust_1 = require("./segment-trust");
 const realtime_generator_1 = require("./realtime-generator");
 const auth_generator_1 = require("./auth-generator");
 const invoice_1 = require("./invoice");
 const sent_email_log_1 = require("./sent-email-log");
+const webhook_delivery_lease_1 = require("./webhook-delivery-lease");
 const email_locale_1 = require("./email-locale");
 const workflow_utils_alias_1 = require("./workflow-utils-alias");
 const webhook_generator_1 = require("./webhook-generator");
+const payments_1 = require("./payments");
 const data_api_route_generator_1 = require("./data-api-route-generator");
 const account_delete_route_generator_1 = require("./account-delete-route-generator");
 const transactional_email_code_1 = require("./transactional-email-code");
@@ -32,10 +39,13 @@ const raw_sql_param_binding_1 = require("./raw-sql-param-binding");
 // password column), then a conventionally-named users table, then the first
 // non-auxiliary table.
 const resolveAuthUsersTableName = (authentication) => {
-    if (!(authentication === null || authentication === void 0 ? void 0 : authentication.enabled) || !(authentication === null || authentication === void 0 ? void 0 : authentication.tables)) {
+    if (!(authentication === null || authentication === void 0 ? void 0 : authentication.enabled)) {
         return undefined;
     }
-    const tables = authentication.tables;
+    // No declared tables still means the auth options' own `users` table, which
+    // is where the session's role is read from — leaving it unguarded would let
+    // a browser write that role.
+    const tables = authentication.tables || {};
     const names = Object.keys(tables);
     if (names.length === 0) {
         return 'users';
@@ -55,6 +65,7 @@ const resolveAuthUsersTableName = (authentication) => {
     const nonAux = names.find((n) => !AUX.test(n));
     return nonAux || names[0];
 };
+exports.resolveAuthUsersTableName = resolveAuthUsersTableName;
 // The first node of the given type's config across all workflows + custom nodes
 // (there is one per project in practice — e.g. the profile page's delete
 // workflow, or the sign-up workflow). Used to bake a node's email
@@ -205,6 +216,19 @@ class NextWorkflowProjectPlugin {
                 }
             }
         }
+        // Every app with server routes carries an app secret, with authentication
+        // or without: it keys the signatures on server results relayed between
+        // workflow steps and the internal-call token, and it is the credential
+        // server code presents to its own data, invoice and notification routes.
+        // Keyed from '' those are values anyone can compute, so the runtime
+        // refuses them all without one. The deploy worker replaces this default
+        // with the project's own secret.
+        if (uidl.globals && hasServerRoutes(uidl)) {
+            uidl.globals.env = uidl.globals.env || {};
+            if (!uidl.globals.env.NEXTAUTH_SECRET) {
+                uidl.globals.env.NEXTAUTH_SECRET = randomSecretHex();
+            }
+        }
         if ((_c = uidl.globals) === null || _c === void 0 ? void 0 : _c.env) {
             const oauthCredentialKeys = collectOAuthCredentialEnvKeys(uidl.authentication);
             for (const key of Object.keys(uidl.globals.env)) {
@@ -221,7 +245,7 @@ class NextWorkflowProjectPlugin {
         return structure;
     }
     async runAfter(structure) {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         const { uidl, files, dependencies } = structure;
         const hasAuthentication = uidl.authentication && uidl.authentication.enabled;
         if (hasAuthentication) {
@@ -248,6 +272,7 @@ class NextWorkflowProjectPlugin {
                     uidl.globals.env.RUNTIME_STORAGE_PROJECT_ID = '';
                 }
             }
+            (0, payments_1.ensurePaymentDriversModule)(structure, (0, payments_1.resolveStorePaymentDriverIds)(uidl, []));
             (0, webhook_generator_1.generateWebhookFiles)(structure, uidl.invoiceSettings);
             if (hasAuthentication) {
                 this.injectSessionProviderIntoApp(structure);
@@ -262,6 +287,9 @@ class NextWorkflowProjectPlugin {
         if ((0, sent_email_log_1.hasEmailSendingNodeType)(usedNodeTypes)) {
             (0, sent_email_log_1.ensureSentEmailLogModule)(structure);
         }
+        // Routes that run a payment node or verify a payment webhook require the
+        // store's payment drivers (see generatePaymentDriversPreamble).
+        (0, payments_1.ensurePaymentDriversModule)(structure, (0, payments_1.resolveStorePaymentDriverIds)(uidl, usedNodeTypes));
         files.set('workflow-runtime-utils', {
             path: ['utils', 'workflows'],
             files: [
@@ -299,7 +327,7 @@ class NextWorkflowProjectPlugin {
         }
         // Set true the moment we emit ANY route that bakes an auth policy, so the
         // shared guard file is emitted iff at least one route actually imports it.
-        const routeHasPolicy = (p) => !!p && (p.requiresAuth || p.userScoped);
+        const routeHasPolicy = (p) => !!p && (p.requiresAuth || p.userScoped || p.serverOnly);
         let anyGuardedRouteEmitted = false;
         // Build server segment info for custom nodes so they can call server-side API routes
         const customNodeServerUrls = {};
@@ -314,14 +342,21 @@ class NextWorkflowProjectPlugin {
                 const cnServerSegments = cnSegments.filter((s) => s.env === 'server');
                 if (cnServerSegments.length > 0) {
                     customNodeServerUrls[cnId] = {};
+                    // The same list, in the same order, the custom node's runner hands its
+                    // inner custom-js nodes as `params`.
+                    const cnGraph = { nodes: cn.nodes || [], edges: cn.edges || [], segments: cnSegments };
                     for (const seg of cnServerSegments) {
+                        const routeOptions = {
+                            customNodeIds: (cn.nodes || []).map((n) => n.id),
+                            trust: (0, segment_trust_1.buildSegmentTrust)(seg, cnGraph),
+                        };
                         const isStreaming = (0, api_route_generator_1.hasStreamingAINode)(seg);
                         if (routeHasPolicy(cn.protection)) {
                             anyGuardedRouteEmitted = true;
                         }
                         const apiContent = isStreaming
-                            ? (0, api_route_generator_1.generateStreamingServerSegmentAPIRoute)(seg, cn.name || cnId, cn.protection)
-                            : (0, api_route_generator_1.generateServerSegmentAPIRoute)(seg, cn.name || cnId, cn.protection);
+                            ? (0, api_route_generator_1.generateStreamingServerSegmentAPIRoute)(seg, cn.name || cnId, cn.protection, routeOptions)
+                            : (0, api_route_generator_1.generateServerSegmentAPIRoute)(seg, cn.name || cnId, cn.protection, routeOptions);
                         const fileName = (0, api_route_generator_1.getAPIRouteFileName)(cnId, seg.id, cn.name || cnId);
                         customNodeServerUrls[cnId][seg.id] = `/api/workflows/${fileName}`;
                         files.set(`workflow-api-cn-${cnId}-${seg.id}`, {
@@ -337,7 +372,14 @@ class NextWorkflowProjectPlugin {
                     }
                 }
             }
-            const customNodeCode = this.generateCustomNodesFile(customNodes, customNodeServerUrls);
+            // Nodes only the admin pages call get their own module, which only the
+            // pages that call them import (see custom-node-modules.ts).
+            const adminModuleIds = (0, custom_node_modules_1.collectAdminModuleCustomNodeIds)(customNodes);
+            const customNodeCode = adminModuleIds.size > 0
+                ? this.generateCustomNodesFile(customNodes, customNodeServerUrls, {
+                    exclude: adminModuleIds,
+                })
+                : this.generateCustomNodesFile(customNodes, customNodeServerUrls);
             files.set('workflow-custom-nodes', {
                 path: ['utils', 'workflows'],
                 files: [
@@ -348,6 +390,20 @@ class NextWorkflowProjectPlugin {
                     },
                 ],
             });
+            if (adminModuleIds.size > 0) {
+                files.set('workflow-custom-nodes-admin', {
+                    path: ['utils', 'workflows'],
+                    files: [
+                        {
+                            name: custom_node_modules_1.ADMIN_CUSTOM_NODES_MODULE,
+                            fileType: teleport_types_1.FileType.JS,
+                            content: this.generateCustomNodesFile(customNodes, customNodeServerUrls, {
+                                only: adminModuleIds,
+                            }),
+                        },
+                    ],
+                });
+            }
         }
         let hasServerSegments = Object.keys(customNodeServerUrls).length > 0;
         // Track which payment providers are already handled by a workflow-driven
@@ -356,6 +412,18 @@ class NextWorkflowProjectPlugin {
         const webhookProvidersOwnedByWorkflows = new Set();
         for (const workflow of Object.values(allWorkflows)) {
             if (workflow.trigger.type === 'event-cron-triggered') {
+                // A cron route runs its whole graph on the server through the same
+                // runtime and handler file a server segment uses, so an app whose only
+                // server work is a cron still needs them.
+                hasServerSegments = true;
+                // The route refuses every request not signed with this key; the deploy
+                // fills it in (see cron-request-verification.ts).
+                if (!uidl.globals.env) {
+                    uidl.globals.env = {};
+                }
+                if (!uidl.globals.env.TELEPORT_CRON_SECRET) {
+                    uidl.globals.env.TELEPORT_CRON_SECRET = '';
+                }
                 const cronContent = (0, api_route_generator_1.generateCronAPIRoute)(workflow, customNodes);
                 const cronFileName = (0, api_route_generator_1.getCronRouteFileName)(workflow);
                 files.set(`workflow-cron-${workflow.id}`, {
@@ -385,18 +453,15 @@ class NextWorkflowProjectPlugin {
                         },
                     ],
                 });
-                // Detect which payment provider this webhook is handling so the
-                // legacy hard-coded emission (webhook-generator.ts) can be skipped
-                // for the same provider. Uses both the URL path and the trigger's
-                // signature algorithm as hints — the former is what the GUI emits,
-                // the latter is a defence in case the path convention changes.
-                const urlPath = (workflow.webhookConfig.urlPath || '').toLowerCase();
-                const sigAlgorithm = (workflow.webhookConfig.signatureAlgorithm || '').toLowerCase();
-                if (urlPath.includes('stripe') || sigAlgorithm.includes('stripe')) {
-                    webhookProvidersOwnedByWorkflows.add('stripe');
+                // The provider this webhook handles, so the legacy hard-coded emission
+                // (webhook-generator.ts) is skipped for it.
+                const ownedProvider = (0, payments_1.readWebhookPaymentProvider)(workflow.webhookConfig);
+                if (ownedProvider) {
+                    webhookProvidersOwnedByWorkflows.add(ownedProvider);
                 }
-                if (urlPath.includes('paypal') || sigAlgorithm.includes('paypal')) {
-                    webhookProvidersOwnedByWorkflows.add('paypal');
+                // A payment webhook runs one delivery at a time; its route requires the lease.
+                if ((0, payments_1.isPaymentWebhookConfig)(workflow.webhookConfig)) {
+                    (0, webhook_delivery_lease_1.ensureWebhookDeliveryLeaseModule)(structure);
                 }
                 // signatureSecret may arrive as either a bare env-var-name string or a
                 // DynamicNode {type:'dynamic', content:{referenceType:'secret', id:'NAME'}}.
@@ -430,15 +495,17 @@ class NextWorkflowProjectPlugin {
             }
             const segments = (0, segment_splitter_1.splitIntoSegments)(workflow);
             const serverSegments = segments.filter((s) => s.env === 'server');
+            const workflowGraph = { nodes: workflow.nodes || [], edges: workflow.edges || [], segments };
             for (const serverSeg of serverSegments) {
                 hasServerSegments = true;
                 const isStreaming = (0, api_route_generator_1.hasStreamingAINode)(serverSeg);
                 if (routeHasPolicy(workflow.protection)) {
                     anyGuardedRouteEmitted = true;
                 }
+                const routeOptions = { trust: (0, segment_trust_1.buildSegmentTrust)(serverSeg, workflowGraph) };
                 const apiContent = isStreaming
-                    ? (0, api_route_generator_1.generateStreamingServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection)
-                    : (0, api_route_generator_1.generateServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection);
+                    ? (0, api_route_generator_1.generateStreamingServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection, routeOptions)
+                    : (0, api_route_generator_1.generateServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection, routeOptions);
                 const fileName = (0, api_route_generator_1.getAPIRouteFileName)(workflow.id, serverSeg.id, workflow.name);
                 files.set(`workflow-api-${workflow.id}-${serverSeg.id}`, {
                     path: ['pages', 'api', 'workflows'],
@@ -459,7 +526,7 @@ class NextWorkflowProjectPlugin {
                     {
                         name: 'server-runtime',
                         fileType: teleport_types_1.FileType.JS,
-                        content: (0, executor_generator_1.generateServerRuntimeCode)(),
+                        content: (0, server_runtime_code_1.generateServerRuntimeCode)(),
                     },
                 ],
             });
@@ -474,7 +541,10 @@ class NextWorkflowProjectPlugin {
                         {
                             name: 'workflow-auth',
                             fileType: teleport_types_1.FileType.JS,
-                            content: (0, workflow_auth_generator_1.generateWorkflowAuthHelperFile)(),
+                            content: (0, workflow_auth_generator_1.generateWorkflowAuthHelperFile)({
+                                withSubscriberAccess: ((_b = uidl.authentication) === null || _b === void 0 ? void 0 : _b.enabled) === true &&
+                                    (0, subscriber_access_route_generator_1.hasSubscriberOnlyPages)(uidl.authentication),
+                            }),
                         },
                     ],
                 });
@@ -500,7 +570,7 @@ class NextWorkflowProjectPlugin {
             // `password_reset_tokens`, the real `users` table is left mutable
             // unauthenticated. The identity table is the one storing credentials
             // (an email/login column AND a password column).
-            const authUsersTableName = resolveAuthUsersTableName(uidl.authentication);
+            const authUsersTableName = (0, exports.resolveAuthUsersTableName)(uidl.authentication);
             // Low-stock auto-fire: the data-api wakes up the
             // /api/ecommerce/low-stock-alert endpoint on the place-order
             // workflow's stock-check SELECT. Both flags are sourced from
@@ -510,9 +580,9 @@ class NextWorkflowProjectPlugin {
             const ecom = uidl.ecommerceSettings;
             const lowStockAlertsEnabled = !!(ecom &&
                 ecom.stockManagement &&
-                ((_b = ecom.stockManagementConfig) === null || _b === void 0 ? void 0 : _b.lowStockAlerts) &&
-                ((_d = (_c = ecom.stockManagementConfig) === null || _c === void 0 ? void 0 : _c.lowStockAlertConfig) === null || _d === void 0 ? void 0 : _d.provider));
-            const lowStockThreshold = typeof ((_e = ecom === null || ecom === void 0 ? void 0 : ecom.stockManagementConfig) === null || _e === void 0 ? void 0 : _e.lowStockThreshold) === 'number'
+                ((_c = ecom.stockManagementConfig) === null || _c === void 0 ? void 0 : _c.lowStockAlerts) &&
+                ((_e = (_d = ecom.stockManagementConfig) === null || _d === void 0 ? void 0 : _d.lowStockAlertConfig) === null || _e === void 0 ? void 0 : _e.provider));
+            const lowStockThreshold = typeof ((_f = ecom === null || ecom === void 0 ? void 0 : ecom.stockManagementConfig) === null || _f === void 0 ? void 0 : _f.lowStockThreshold) === 'number'
                 ? ecom.stockManagementConfig.lowStockThreshold
                 : 5;
             files.set('workflow-data-api-route', {
@@ -535,7 +605,7 @@ class NextWorkflowProjectPlugin {
         // farewell email's provider/sender/body are baked from the node config (the
         // credential is read from env at runtime; its placeholder is registered by the
         // generic secret-reference walk above).
-        if (((_f = uidl.authentication) === null || _f === void 0 ? void 0 : _f.enabled) && usedNodeTypes.has('account-delete-current')) {
+        if (((_g = uidl.authentication) === null || _g === void 0 ? void 0 : _g.enabled) && usedNodeTypes.has('account-delete-current')) {
             const deleteConfig = findWorkflowNodeConfigByType(uidl.workflows, 'account-delete-current') || {};
             const providerNodeType = typeof deleteConfig.emailProvider === 'string' ? deleteConfig.emailProvider : '';
             const emailProvider = providerNodeType.startsWith('email-')
@@ -550,7 +620,7 @@ class NextWorkflowProjectPlugin {
                         name: 'delete-current',
                         fileType: teleport_types_1.FileType.JS,
                         content: (0, account_delete_route_generator_1.generateAccountDeleteRoute)({
-                            authUsersTableName: resolveAuthUsersTableName(uidl.authentication),
+                            authUsersTableName: (0, exports.resolveAuthUsersTableName)(uidl.authentication),
                             emailProvider,
                             fromEmail: typeof deleteConfig.from === 'string' ? deleteConfig.from : '',
                             emailSecretEnvName,
@@ -595,7 +665,7 @@ class NextWorkflowProjectPlugin {
         //    the rendered PDF directly via uploadInvoicePdfToRuntimeStorage). The
         //    invoice path does NOT add a file-storage-upload node to the UIDL, so it
         //    would otherwise be missed by needsRuntimeStorageRoute.
-        const needsRuntimeStorageEnv = (0, runtime_storage_generator_1.needsRuntimeStorageRoute)(usedNodeTypes) || Boolean((_g = uidl.invoiceSettings) === null || _g === void 0 ? void 0 : _g.enabled);
+        const needsRuntimeStorageEnv = (0, runtime_storage_generator_1.needsRuntimeStorageRoute)(usedNodeTypes) || Boolean((_h = uidl.invoiceSettings) === null || _h === void 0 ? void 0 : _h.enabled);
         if (needsRuntimeStorageEnv) {
             if (!uidl.globals.env) {
                 uidl.globals.env = {};
@@ -685,7 +755,7 @@ class NextWorkflowProjectPlugin {
             wf.trigger.type !== 'event-cron-triggered' &&
             wf.trigger.type !== 'event-webhook-received');
         if (globalWorkflows.length > 0) {
-            const globalWorkflowCode = this.generateGlobalWorkflowsHook(globalWorkflows);
+            const globalWorkflowCode = this.generateGlobalWorkflowsHook(globalWorkflows, customNodes);
             files.set('workflow-global-hook', {
                 path: ['utils', 'workflows'],
                 files: [
@@ -703,7 +773,7 @@ class NextWorkflowProjectPlugin {
         if ((0, graph_utils_1.projectUsesRealtime)(uidl.workflows)) {
             this.generateRealtimeFiles(structure);
         }
-        if ((_h = uidl.invoiceSettings) === null || _h === void 0 ? void 0 : _h.enabled) {
+        if ((_j = uidl.invoiceSettings) === null || _j === void 0 ? void 0 : _j.enabled) {
             const { dataSourceType, dataSourceConfig } = (0, invoice_1.resolveInvoiceDataSource)(structure);
             (0, invoice_1.generateInvoiceFiles)(uidl.invoiceSettings, structure, dataSourceType, dataSourceConfig);
         }
@@ -1061,9 +1131,18 @@ ${entries}
         }
         return map;
     }
-    generateCustomNodesFile(customNodes, customNodeServerUrls) {
+    /**
+     * `emit.only`: the nodes of `custom-nodes-admin.js`, whose registry starts
+     * from the shared module's so their nested calls still resolve.
+     * `emit.exclude`: the nodes left out of the shared module. Every node is
+     * emitted when `emit` is absent. `customNodes` is always the full set, so
+     * nested lookups (segment state keys) see every node.
+     */
+    generateCustomNodesFile(customNodes, customNodeServerUrls, emit) {
         const functions = [];
-        for (const [id, cn] of Object.entries(customNodes)) {
+        const emitted = Object.keys(customNodes).filter((id) => (!(emit === null || emit === void 0 ? void 0 : emit.only) || emit.only.has(id)) && !((emit === null || emit === void 0 ? void 0 : emit.exclude) && emit.exclude.has(id)));
+        for (const id of emitted) {
+            const cn = customNodes[id];
             const safeId = id.replace(/[^a-zA-Z0-9]/g, '_');
             // SECURITY: the custom-nodes file ships to the browser (imported as
             // `utils/workflows/custom-nodes`). Redact each server node's config down
@@ -1097,29 +1176,25 @@ ${entries}
                     trigger: { type: 'manual' },
                 };
                 const cnSegments = (0, segment_splitter_1.splitIntoSegments)(pseudoWorkflow);
-                const segmentsJson = JSON.stringify(cnSegments.map((s) => ({
-                    id: s.id,
-                    env: s.env,
-                    hasStreamingAI: (0, api_route_generator_1.hasStreamingAINode)(s),
+                const segmentsJson = JSON.stringify(cnSegments.map((s) => (Object.assign(Object.assign({ id: s.id, env: s.env, hasStreamingAI: (0, api_route_generator_1.hasStreamingAINode)(s), 
                     // Every node in this segment runs fire-and-forget — dispatch it and
                     // carry on instead of waiting for the database round trip.
-                    fireAndForget: (0, await_result_1.isFireAndForgetSegment)(s),
-                    nodes: s.nodes.map((n) => ({
+                    fireAndForget: (0, await_result_1.isFireAndForgetSegment)(s) }, (s.env === 'server'
+                    ? { stateKeys: (0, segment_context_needs_1.collectSegmentStateKeys)(s.nodes, customNodes) }
+                    : {})), { nodes: s.nodes.map((n) => ({
                         id: n.id,
                         type: n.type,
                         config: (0, segment_splitter_1.redactServerNodeConfig)(n.config, s.env, n.type),
                         stepNumber: n.stepNumber,
                         label: n.label,
-                    })),
-                    edges: s.edges.map((e) => ({
+                    })), edges: s.edges.map((e) => ({
                         id: e.id,
                         source: e.source,
                         target: e.target,
                         sourceHandle: e.sourceHandle,
                         targetHandle: e.targetHandle,
                         data: e.data,
-                    })),
-                })));
+                    })) }))));
                 const serverUrlsJson = JSON.stringify(serverUrls);
                 functions.push(`
 // Custom workflow node: ${cn.name || id}
@@ -1201,7 +1276,7 @@ async function customNode_${safeId}(outerContext, parameters, nodeHandlers) {
           // already moved past this point.
           __utils.registerPendingNodePromise(
             context,
-            __runtime.callServerSegment(segUrl, context).catch(function(__ffErr) {
+            __runtime.callServerSegment(segUrl, context, seg.stateKeys).catch(function(__ffErr) {
               console.error('[workflow] Segment "' + seg.id + '" failed (not awaited):', __ffErr);
             })
           );
@@ -1215,10 +1290,10 @@ async function customNode_${safeId}(outerContext, parameters, nodeHandlers) {
           continue;
         }
         if (seg.hasStreamingAI) {
-          var streamHandled = await __runtime.callStreamingServerSegment(segUrl, context, streamingInfo, nodes, edges, nodeHandlers, wfConfig, executionId);
+          var streamHandled = await __runtime.callStreamingServerSegment(segUrl, context, streamingInfo, nodes, edges, nodeHandlers, wfConfig, executionId, seg.stateKeys);
           Object.assign(handledNodeIds, streamHandled);
         } else {
-          var serverResults = await __runtime.callServerSegment(segUrl, context);
+          var serverResults = await __runtime.callServerSegment(segUrl, context, seg.stateKeys);
           __runtime.mergeServerResults(context, serverResults);
           // Propagate non-taken if-statement branches from this server
           // segment into subsequent segments. Iterate every if-statement
@@ -1356,15 +1431,20 @@ async function customNode_${safeId}(outerContext, parameters, nodeHandlers) {
 }`);
             }
         }
-        const hasAnyServerSegments = Object.keys(customNodeServerUrls).length > 0;
-        const registryEntries = Object.keys(customNodes)
+        const hasAnyServerSegments = emitted.some((id) => !!customNodeServerUrls[id] && Object.keys(customNodeServerUrls[id]).length > 0);
+        const registryEntries = emitted
             .map((id) => `__customNodeRegistry['${id}'] = customNode_${id.replace(/[^a-zA-Z0-9]/g, '_')};`)
             .join('\n');
+        const registryStart = (emit === null || emit === void 0 ? void 0 : emit.only)
+            ? `// Loaded only by the pages that call these nodes. The registry starts from
+// the shared module's, so a nested call to a shared node still resolves.
+var __customNodeRegistry = Object.assign({}, require('./custom-nodes'));`
+            : 'var __customNodeRegistry = {};';
         return `// Auto-generated custom workflow nodes
 var __utils = require('./runtime-utils');
 ${hasAnyServerSegments ? "var __runtime = require('./runtime');" : ''}
 
-var __customNodeRegistry = {};
+${registryStart}
 ${functions.join('\n')}
 
 ${registryEntries}
@@ -1476,10 +1556,40 @@ module.exports = __customNodeRegistry;
                 },
             ],
         });
+        // Subscriber-only pages: the entitlement query the middleware asks for
+        // through pages/api/auth/subscriber-access.js, and that the workflow-route
+        // guard requires directly. Emitted only when a page actually needs it.
+        if ((0, subscriber_access_route_generator_1.hasSubscriberOnlyPages)(auth)) {
+            files.set('auth-subscriber-access-helper', {
+                path: ['utils', 'auth'],
+                files: [
+                    {
+                        name: 'subscriber-access',
+                        fileType: teleport_types_1.FileType.JS,
+                        content: (0, subscriber_access_route_generator_1.generateSubscriberAccessHelperModule)({
+                            productDetails: (0, subscriber_access_route_generator_1.resolveProductDetailsRoute)(uidl),
+                            productPages: (0, subscriber_access_route_generator_1.resolveCustomProductPageRoutes)(uidl),
+                        }),
+                    },
+                ],
+            });
+            files.set('auth-subscriber-access-route', {
+                path: ['pages', 'api', 'auth'],
+                files: [
+                    {
+                        name: 'subscriber-access',
+                        fileType: teleport_types_1.FileType.JS,
+                        content: (0, subscriber_access_route_generator_1.generateSubscriberAccessRoute)(),
+                    },
+                ],
+            });
+        }
         const hasProtectedRoutes = (auth.pageProtection && Object.keys(auth.pageProtection).length > 0) ||
             (auth.folderProtection && Object.keys(auth.folderProtection).length > 0);
         if (hasProtectedRoutes) {
-            const middlewareCode = (0, auth_generator_1.generateMiddlewareFile)(auth);
+            const middlewareCode = (0, auth_generator_1.generateMiddlewareFile)(auth, {
+                subscriptionFallbackRoute: (0, subscriber_access_route_generator_1.resolveSubscriptionFallbackRoute)(uidl),
+            });
             files.set('auth-middleware', {
                 path: [],
                 files: [
@@ -1596,7 +1706,7 @@ module.exports = __customNodeRegistry;
         }
         appFile.content = content;
     }
-    generateGlobalWorkflowsHook(workflows) {
+    generateGlobalWorkflowsHook(workflows, customNodes) {
         const registrations = [];
         const handlerTypes = new Set();
         for (const wf of workflows) {
@@ -1697,7 +1807,7 @@ module.exports = __customNodeRegistry;
         // handler as a bare sibling statement inside `useGlobalWorkflows()`. Two
         // DIFFERENT node types are minified independently (each in its own
         // source file), so their real declared names can coincidentally collide —
-        // e.g. state-update-local-state and payment-cancel-plan can both
+        // e.g. state-update-local-state and payment-refund can both
         // legitimately mangle down to the same short name. Declared as siblings
         // in one shared function body, the second declaration would silently
         // shadow the first, so BOTH map entries end up pointing at the SAME
@@ -1744,18 +1854,14 @@ ${workflows
             return `  const executeWorkflow_${safeId} = async function(triggerContext) {
     const wfConfig = {
       triggerNodeId: '${wf.trigger.nodeId}',
-      segments: ${JSON.stringify(segments.map((s) => ({
-                id: s.id,
-                env: s.env,
-                hasStreamingAI: (0, api_route_generator_1.hasStreamingAINode)(s),
-                nodes: s.nodes.map((n) => ({
+      segments: ${JSON.stringify(segments.map((s) => (Object.assign(Object.assign({ id: s.id, env: s.env, hasStreamingAI: (0, api_route_generator_1.hasStreamingAINode)(s) }, (s.env === 'server'
+                ? { stateKeys: (0, segment_context_needs_1.collectSegmentStateKeys)(s.nodes, customNodes) }
+                : {})), { nodes: s.nodes.map((n) => ({
                     id: n.id,
                     type: n.type,
                     config: n.config,
                     stepNumber: n.stepNumber,
-                })),
-                edges: s.edges,
-            })))},
+                })), edges: s.edges }))))},
       ${wf.errorHandler ? `errorHandlerNodeId: '${wf.errorHandler.nodeId}',` : ''}
       nodes: ${JSON.stringify(wf.nodes.map((n) => ({
                 id: n.id,
@@ -1786,9 +1892,50 @@ NextWorkflowProjectPlugin.INLINE_HANDLED_NODE_TYPES = new Set([
     'general-loop',
     'general-parallel',
 ]);
+/**
+ * Whether the app has routes that must tell this deployment's own server code
+ * apart from a browser: workflow steps, data routes, invoices, payment
+ * webhooks, authentication.
+ */
+const hasServerRoutes = (uidl) => {
+    var _a, _b, _c, _d;
+    return Boolean(((_a = uidl.authentication) === null || _a === void 0 ? void 0 : _a.enabled) ||
+        Object.keys(((_b = uidl.workflows) === null || _b === void 0 ? void 0 : _b.workflows) || {}).length > 0 ||
+        Object.keys(((_c = uidl.workflows) === null || _c === void 0 ? void 0 : _c.customNodes) || {}).length > 0 ||
+        Object.keys(uidl.dataSources || {}).length > 0 ||
+        ((_d = uidl.invoiceSettings) === null || _d === void 0 ? void 0 : _d.enabled) ||
+        uidl.ecommerceSettings);
+};
+/**
+ * 32 random bytes as hex. NEXTAUTH_SECRET signs every session and is the app
+ * secret server code presents to its own routes, so its default must never be
+ * a value anyone can read in this file: a published constant let anyone mint
+ * an admin session, or pass as the store's own server, on any project that
+ * shipped it. The deploy worker still replaces the line with the project's
+ * persisted secret (it upserts `NEXTAUTH_SECRET=` whatever its value); this
+ * only decides what an exported or locally generated project starts with.
+ * Web Crypto where the generator runs in a browser (the editor), Node's crypto
+ * module otherwise.
+ */
+const randomSecretHex = () => {
+    const webCrypto = globalThis
+        .crypto;
+    if (webCrypto && typeof webCrypto.getRandomValues === 'function') {
+        const bytes = webCrypto.getRandomValues(new Uint8Array(32));
+        let hex = '';
+        for (let i = 0; i < bytes.length; i++) {
+            hex += (bytes[i] < 16 ? '0' : '') + bytes[i].toString(16);
+        }
+        return hex;
+    }
+    // tslint:disable-next-line:no-var-requires
+    return require('crypto').randomBytes(32).toString('hex');
+};
+/** The literal default earlier generations wrote; the deploy worker treats it as unset. */
+const LEGACY_NEXTAUTH_SECRET = 'CHANGE_ME_TO_A_RANDOM_SECRET';
 const AUTH_ENV_DEFAULTS = {
-    NEXTAUTH_URL: 'http://localhost:3000',
-    NEXTAUTH_SECRET: 'CHANGE_ME_TO_A_RANDOM_SECRET',
+    NEXTAUTH_URL: () => 'http://localhost:3000',
+    NEXTAUTH_SECRET: randomSecretHex,
 };
 // The two stable CMS env keys (teleport-gui's CMS_ENV_URL / CMS_ENV_ACCESS_TOKEN).
 // Their `teleporthq.secrets.<name>` placeholder MUST survive to the deployed env
@@ -1847,9 +1994,12 @@ function resolveAuthEnvValue(key, value, preserveKeys) {
     // (or still-unresolved placeholder) auth key to its local default keeps the
     // value a valid origin; the deploy worker and the runtime request-derivation
     // (`absolutizeNextAuthUrl`) override it with the real one in production.
+    // The constant earlier generations shipped as the secret, carried over from an
+    // on-disk `.env` by the standalone harness, is no secret at all: replaced too.
+    const isPublishedSecret = key === 'NEXTAUTH_SECRET' && value === LEGACY_NEXTAUTH_SECRET;
     if (Object.prototype.hasOwnProperty.call(AUTH_ENV_DEFAULTS, key) &&
-        (isSecretPlaceholder || isBlank)) {
-        return AUTH_ENV_DEFAULTS[key];
+        (isSecretPlaceholder || isBlank || isPublishedSecret)) {
+        return AUTH_ENV_DEFAULTS[key]();
     }
     if (isSecretPlaceholder) {
         // OAuth provider credential refs are PRESERVED so the deploy worker resolves