@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/paypal-webhook-signature-verification.test.ts

@@ -0,0 +1,205 @@
+import { generatePaypalSignatureVerificationCode } from '../src/webhook-signature-verification'
+
+/**
+ * The PayPal verifier emitted into every workflow webhook route (the
+ * `paypal-payment` route the store's payments, refunds and subscriptions all
+ * arrive through). Executed, not pattern-matched: what matters is which
+ * PayPal environment it calls and where it finds its credentials.
+ *
+ * Both PayPal environments issue client ids starting with "A", so the earlier
+ * `startsWith('sb-')` check sent every sandbox verification to the live API,
+ * which rejected the sandbox certificate — no sandbox webhook ever reached a
+ * workflow. And a standalone run has only the `CONFIGURATION_*` names the
+ * provider panel stores, which the verifier never read.
+ */
+
+type Verify = (
+  req: { headers: Record<string, string> },
+  rawBody: Buffer,
+  webhookConfig: { signatureSecret?: string }
+) => Promise<boolean>
+
+interface Call {
+  url: string
+  body: string
+}
+
+const ENV_KEYS = [
+  'PAYPAL_CLIENT_ID',
+  'PAYPAL_CLIENT_SECRET',
+  'PAYPAL_WEBHOOK_ID',
+  'CONFIGURATION_PAYPAL_CLIENT_ID',
+  'CONFIGURATION_PAYPAL_CLIENT_SECRET',
+  'CONFIGURATION_PAYPAL_WEBHOOK_ID',
+  'CONFIGURATION_PAYPAL_WEBHOOK_ID_5F2A',
+]
+
+function load(): Verify {
+  // eslint-disable-next-line no-new-func
+  return new Function(
+    `${generatePaypalSignatureVerificationCode()}; return verifyPaypalSignature;`
+  )() as Verify
+}
+
+function installFetch(verificationStatus: string, calls: Call[]): void {
+  ;(globalThis as any).fetch = async (url: string, init: { body: string }) => {
+    calls.push({ url, body: init.body })
+    if (url.endsWith('/v1/oauth2/token')) {
+      return { json: async () => ({ access_token: 'tok' }) }
+    }
+    return { json: async () => ({ verification_status: verificationStatus }) }
+  }
+}
+
+const event = { event_type: 'PAYMENT.SALE.COMPLETED', resource: { id: 'SALE1' } }
+const headersFor = (certHost: string) => ({
+  'paypal-auth-algo': 'SHA256withRSA',
+  'paypal-cert-url': `https://${certHost}/cert/cert-1`,
+  'paypal-transmission-id': 'tid',
+  'paypal-transmission-sig': 'sig',
+  'paypal-transmission-time': '2026-09-24T10:00:00Z',
+})
+
+describe('generated PayPal webhook verifier', () => {
+  const savedEnv: Record<string, string | undefined> = {}
+  const savedFetch = (globalThis as any).fetch
+  let errors: jest.SpyInstance
+
+  beforeEach(() => {
+    for (const key of ENV_KEYS) {
+      savedEnv[key] = process.env[key]
+      delete process.env[key]
+    }
+    errors = jest.spyOn(console, 'error').mockImplementation(() => undefined)
+  })
+
+  afterEach(() => {
+    for (const key of ENV_KEYS) {
+      if (savedEnv[key] === undefined) {
+        delete process.env[key]
+      } else {
+        process.env[key] = savedEnv[key]
+      }
+    }
+    ;(globalThis as any).fetch = savedFetch
+    errors.mockRestore()
+  })
+
+  it('verifies a sandbox event against the sandbox API, whatever the client id looks like', async () => {
+    process.env.PAYPAL_CLIENT_ID = 'AbCsandboxLooksLikeLive'
+    process.env.PAYPAL_CLIENT_SECRET = 'secret'
+    process.env.PAYPAL_WEBHOOK_ID = 'WH-1'
+    const calls: Call[] = []
+    installFetch('SUCCESS', calls)
+    const verify = load()
+    const ok = await verify(
+      { headers: headersFor('api.sandbox.paypal.com') },
+      Buffer.from(JSON.stringify(event)),
+      { signatureSecret: 'PAYPAL_WEBHOOK_ID' }
+    )
+    expect(ok).toBe(true)
+    expect(calls.map((c) => c.url)).toEqual([
+      'https://api-m.sandbox.paypal.com/v1/oauth2/token',
+      'https://api-m.sandbox.paypal.com/v1/notifications/verify-webhook-signature',
+    ])
+    const sent = JSON.parse(calls[1].body)
+    expect(sent.webhook_id).toBe('WH-1')
+    expect(sent.cert_url).toBe('https://api.sandbox.paypal.com/cert/cert-1')
+    expect(sent.webhook_event).toEqual(event)
+  })
+
+  // PayPal signs the bytes it sent: parsed and serialised again, `1.50` comes
+  // back `1.5` and an escaped character comes back unescaped.
+  it('posts the event back exactly as it arrived', async () => {
+    process.env.PAYPAL_CLIENT_ID = 'AbC'
+    process.env.PAYPAL_CLIENT_SECRET = 'secret'
+    process.env.PAYPAL_WEBHOOK_ID = 'WH-1'
+    const escaped = '\\' + 'u00e9'
+    const raw =
+      '{ "event_type": "PAYMENT.SALE.COMPLETED", "resource": { "id": "SALE1", "total": 1.50, ' +
+      '"note": "caf' +
+      escaped +
+      ' $& $$ $\'" } }\n'
+    const calls: Call[] = []
+    installFetch('SUCCESS', calls)
+    const ok = await load()({ headers: headersFor('api.paypal.com') }, Buffer.from(raw), {
+      signatureSecret: 'PAYPAL_WEBHOOK_ID',
+    })
+    expect(ok).toBe(true)
+    expect(calls[1].body.endsWith(',"webhook_event":' + raw + '}')).toBe(true)
+    const sent = JSON.parse(calls[1].body)
+    expect(sent.webhook_id).toBe('WH-1')
+    expect(sent.transmission_sig).toBe('sig')
+    expect(sent.webhook_event.resource.note).toBe("café $& $$ $'")
+  })
+
+  it('verifies a live event against the live API', async () => {
+    process.env.PAYPAL_CLIENT_ID = 'AbC'
+    process.env.PAYPAL_CLIENT_SECRET = 'secret'
+    process.env.PAYPAL_WEBHOOK_ID = 'WH-1'
+    const calls: Call[] = []
+    installFetch('SUCCESS', calls)
+    const ok = await load()(
+      { headers: headersFor('api.paypal.com') },
+      Buffer.from(JSON.stringify(event)),
+      { signatureSecret: 'PAYPAL_WEBHOOK_ID' }
+    )
+    expect(ok).toBe(true)
+    expect(calls[0].url).toBe('https://api-m.paypal.com/v1/oauth2/token')
+    expect(calls[1].url).toBe('https://api-m.paypal.com/v1/notifications/verify-webhook-signature')
+  })
+
+  it('reads the CONFIGURATION_* names a standalone run has, and the webhook id under the stored secret name', async () => {
+    process.env.PAYPAL_CLIENT_ID = ''
+    process.env.CONFIGURATION_PAYPAL_CLIENT_ID = 'AbC'
+    process.env.CONFIGURATION_PAYPAL_CLIENT_SECRET = 'secret'
+    process.env.CONFIGURATION_PAYPAL_WEBHOOK_ID_5F2A = 'WH-stored'
+    const calls: Call[] = []
+    installFetch('SUCCESS', calls)
+    const ok = await load()(
+      { headers: headersFor('api.sandbox.paypal.com') },
+      Buffer.from(JSON.stringify(event)),
+      { signatureSecret: 'CONFIGURATION_PAYPAL_WEBHOOK_ID_5F2A' }
+    )
+    expect(ok).toBe(true)
+    expect(JSON.parse(calls[1].body).webhook_id).toBe('WH-stored')
+    expect(calls[0].url).toBe('https://api-m.sandbox.paypal.com/v1/oauth2/token')
+  })
+
+  it('refuses without calling PayPal when the credentials or the webhook id are missing, and says which', async () => {
+    const calls: Call[] = []
+    installFetch('SUCCESS', calls)
+    expect(
+      await load()({ headers: headersFor('api.paypal.com') }, Buffer.from('{}'), {
+        signatureSecret: 'PAYPAL_WEBHOOK_ID',
+      })
+    ).toBe(false)
+    expect(errors.mock.calls[0][0]).toContain('PAYPAL_CLIENT_ID')
+
+    process.env.PAYPAL_CLIENT_ID = 'AbC'
+    process.env.PAYPAL_CLIENT_SECRET = 'secret'
+    expect(
+      await load()({ headers: headersFor('api.paypal.com') }, Buffer.from('{}'), {
+        signatureSecret: 'PAYPAL_WEBHOOK_ID',
+      })
+    ).toBe(false)
+    expect(errors.mock.calls[1][0]).toContain('PAYPAL_WEBHOOK_ID')
+    expect(calls).toEqual([])
+  })
+
+  it('reports a rejection with the environment it asked', async () => {
+    process.env.PAYPAL_CLIENT_ID = 'AbC'
+    process.env.PAYPAL_CLIENT_SECRET = 'secret'
+    process.env.PAYPAL_WEBHOOK_ID = 'WH-1'
+    const calls: Call[] = []
+    installFetch('FAILURE', calls)
+    const ok = await load()(
+      { headers: headersFor('api.sandbox.paypal.com') },
+      Buffer.from(JSON.stringify(event)),
+      { signatureSecret: 'PAYPAL_WEBHOOK_ID' }
+    )
+    expect(ok).toBe(false)
+    expect(errors.mock.calls[0][0]).toContain('https://api-m.sandbox.paypal.com')
+    expect(errors.mock.calls[0][0]).toContain('verification_status=FAILURE')
+  })
+})

package/__tests__/prune-context-oversized-leaf.test.ts

@@ -38,6 +38,7 @@ function loadPruneContext(): PruneFn {
       'domSerializationReplacer',
       'serializeForPrune',
       'prunedValue',
+      'pruneStateValues',
       'pruneContext',
     ].map((fn) => grab(new RegExp(`function ${fn}\\b[\\s\\S]*?\\n\\}`), fn)),
   ]

package/__tests__/prune-context-state-keys.test.ts

@@ -0,0 +1,89 @@
+import { generateClientRuntimeCode } from '../src/executor-generator'
+
+// A server segment receives the page state it can read and nothing more: the
+// segment descriptor names the state keys (`stateKeys`, see
+// segment-context-needs) and `pruneContext` keeps exactly those — at the top
+// level and inside the trigger context, which carries the page's own copy of
+// the bag. Every other page state stayed in the request before this: a
+// checkout page's country list, product grid and order history travelled with
+// every voucher check.
+
+type PruneFn = (ctx: Record<string, unknown>, stateKeys?: string[] | '*') => Record<string, any>
+
+function loadPruneContext(): PruneFn {
+  const src = generateClientRuntimeCode()
+  const grab = (pattern: RegExp, label: string): string => {
+    const match = src.match(pattern)
+    if (!match) {
+      throw new Error(`${label} not found in generated client runtime`)
+    }
+    return match[0]
+  }
+  const parts = [
+    grab(/const PRUNE_MAX_SERIALIZED_LENGTH = \d+;/, 'PRUNE_MAX_SERIALIZED_LENGTH'),
+    grab(/const PRUNE_MAX_DEPTH = \d+;/, 'PRUNE_MAX_DEPTH'),
+    ...[
+      'isDomNode',
+      'snapshotDomNode',
+      'domSerializationReplacer',
+      'serializeForPrune',
+      'prunedValue',
+      'pruneStateValues',
+      'pruneContext',
+    ].map((fn) => grab(new RegExp(`function ${fn}\\b[\\s\\S]*?\\n\\}`), fn)),
+  ]
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  return new Function(`${parts.join('\n')}\nreturn pruneContext;`)() as PruneFn
+}
+
+const pageState = {
+  countryCode: 'RO',
+  billingCountryInitialItems: [{ label: 'Romania', value: 'RO' }],
+  cartItems: [{ id: 'p1' }],
+}
+
+const context = () => ({
+  trigger: { formData: { code: 'SAVE10' }, __stateValues: { ...pageState } },
+  __stateValues: { ...pageState },
+  __locale: 'en',
+  earlier: { rows: [1, 2] },
+})
+
+describe('pruneContext keeps only the page state the segment reads', () => {
+  const pruneContext = loadPruneContext()
+
+  it('keeps the named keys, at the top level and inside the trigger context', () => {
+    const pruned = pruneContext(context(), ['countryCode'])
+    expect(pruned.__stateValues).toEqual({ countryCode: 'RO' })
+    expect(pruned.trigger.__stateValues).toEqual({ countryCode: 'RO' })
+    // Everything that is not the bag travels as before.
+    expect(pruned.trigger.formData).toEqual({ code: 'SAVE10' })
+    expect(pruned.earlier).toEqual({ rows: [1, 2] })
+    expect(pruned.__locale).toBe('en')
+  })
+
+  it('drops the bag altogether when the segment reads no state', () => {
+    const pruned = pruneContext(context(), [])
+    expect(pruned).not.toHaveProperty('__stateValues')
+    expect(pruned.trigger).not.toHaveProperty('__stateValues')
+    expect(pruned.trigger.formData).toEqual({ code: 'SAVE10' })
+  })
+
+  it('names a key the page does not hold without inventing it', () => {
+    const pruned = pruneContext(context(), ['missing', 'cartItems'])
+    expect(pruned.__stateValues).toEqual({ cartItems: [{ id: 'p1' }] })
+  })
+
+  it('sends the whole bag for "*" and for a caller that names nothing', () => {
+    expect(pruneContext(context(), '*').__stateValues).toEqual(pageState)
+    expect(pruneContext(context()).__stateValues).toEqual(pageState)
+    expect(pruneContext(context()).trigger.__stateValues).toEqual(pageState)
+  })
+
+  it('never touches the live context it prunes from', () => {
+    const live = context()
+    pruneContext(live, ['countryCode'])
+    expect(live.__stateValues).toEqual(pageState)
+    expect(live.trigger.__stateValues).toEqual(pageState)
+  })
+})

package/__tests__/push-node-handlers.test.ts

@@ -0,0 +1,291 @@
+import crypto from 'crypto'
+import { loadHandler } from './_helpers/load-handler'
+
+/**
+ * The push and notification nodes are thin adapters over the page-side API the
+ * generated service-worker module publishes on `window`, plus the server node
+ * that calls the app's internal send route. Every handler here runs for real.
+ */
+
+type Globals = Record<string, unknown>
+const globalScope = globalThis as unknown as Globals
+const GLOBAL_KEYS = ['window', 'Notification', 'fetch', '__non_webpack_require__']
+
+let saved: Globals = {}
+beforeEach(() => {
+  saved = {}
+  GLOBAL_KEYS.forEach((key) => {
+    saved[key] = globalScope[key]
+  })
+})
+afterEach(() => {
+  GLOBAL_KEYS.forEach((key) => {
+    if (saved[key] === undefined) {
+      delete globalScope[key]
+    } else {
+      globalScope[key] = saved[key]
+    }
+  })
+  delete process.env.WEB_PUSH_VAPID_PRIVATE_KEY
+})
+
+const withNotification = (permission: string, answer = permission) => {
+  const shown: Array<{ title: string; options: Record<string, unknown> }> = []
+  const NotificationFake = function (
+    this: unknown,
+    title: string,
+    options: Record<string, unknown>
+  ) {
+    shown.push({ title, options })
+  } as unknown as { permission: string; requestPermission: () => Promise<string> }
+  NotificationFake.permission = permission
+  NotificationFake.requestPermission = async () => {
+    NotificationFake.permission = answer
+    return answer
+  }
+  globalScope.Notification = NotificationFake
+  return shown
+}
+
+describe('push nodes on a site without push', () => {
+  it('subscribe and unsubscribe report that push is not set up; the status is simply unsupported', async () => {
+    globalScope.window = {}
+    withNotification('default')
+
+    expect(await loadHandler('browser-subscribe-to-push')({}, {})).toEqual({
+      success: false,
+      subscribed: false,
+      permission: 'default',
+      error: 'Push notifications are not set up for this site.',
+    })
+    expect(await loadHandler('browser-unsubscribe-from-push')({}, {})).toEqual({
+      success: false,
+      unsubscribed: false,
+      error: 'Push notifications are not set up for this site.',
+    })
+    expect(await loadHandler('browser-get-push-subscription')({}, {})).toEqual({
+      success: true,
+      supported: false,
+      permission: 'default',
+      subscribed: false,
+      endpoint: '',
+    })
+  })
+})
+
+describe('push nodes on a site with push', () => {
+  it('delegate to the service-worker module', async () => {
+    const calls: string[] = []
+    globalScope.window = {
+      __teleportServiceWorker: {
+        push: {
+          subscribe: async () => {
+            calls.push('subscribe')
+            return { success: true, subscribed: true }
+          },
+          unsubscribe: async () => {
+            calls.push('unsubscribe')
+            return { success: true, unsubscribed: true }
+          },
+          getSubscription: async () => {
+            calls.push('status')
+            return { success: true, supported: true, subscribed: true }
+          },
+        },
+      },
+    }
+
+    expect(await loadHandler('browser-subscribe-to-push')({}, {})).toEqual({
+      success: true,
+      subscribed: true,
+    })
+    expect(await loadHandler('browser-unsubscribe-from-push')({}, {})).toEqual({
+      success: true,
+      unsubscribed: true,
+    })
+    expect(await loadHandler('browser-get-push-subscription')({}, {})).toMatchObject({
+      subscribed: true,
+    })
+    expect(calls).toEqual(['subscribe', 'unsubscribe', 'status'])
+  })
+})
+
+describe('browser-show-notification', () => {
+  const config = {
+    title: 'Saved',
+    body: 'Your list was saved',
+    tag: 'list',
+    requireInteraction: 'true',
+  }
+
+  it('reports a browser without notifications', async () => {
+    globalScope.window = {}
+    delete globalScope.Notification
+    expect(await loadHandler('browser-show-notification')(config, {})).toEqual({
+      success: false,
+      permission: 'default',
+      error: 'This browser cannot show notifications.',
+    })
+  })
+
+  it('asks for permission once, and reports a refusal', async () => {
+    globalScope.window = {}
+    withNotification('default', 'denied')
+    expect(await loadHandler('browser-show-notification')(config, {})).toEqual({
+      success: false,
+      permission: 'denied',
+      error: 'Notifications are blocked for this site.',
+    })
+  })
+
+  it('shows the notification through the service worker when the site has one', async () => {
+    const viaWorker: Array<{ title: string; options: Record<string, unknown> }> = []
+    globalScope.window = {
+      __teleportServiceWorker: {
+        showNotification: async (title: string, options: Record<string, unknown>) => {
+          viaWorker.push({ title, options })
+        },
+      },
+    }
+    const onPage = withNotification('granted')
+
+    expect(await loadHandler('browser-show-notification')(config, {})).toEqual({
+      success: true,
+      permission: 'granted',
+    })
+    expect(viaWorker).toEqual([
+      {
+        title: 'Saved',
+        options: { body: 'Your list was saved', tag: 'list', requireInteraction: true },
+      },
+    ])
+    expect(onPage).toEqual([])
+  })
+
+  it('falls back to the page when the worker is unavailable, and reports a page that refuses too', async () => {
+    globalScope.window = {
+      __teleportServiceWorker: {
+        showNotification: async () => {
+          throw new Error('Service workers are not available on this page.')
+        },
+      },
+    }
+    const onPage = withNotification('granted')
+    expect((await loadHandler('browser-show-notification')(config, {})).success).toBe(true)
+    expect(onPage).toHaveLength(1)
+
+    globalScope.window = {}
+    globalScope.Notification = Object.assign(
+      function () {
+        throw new TypeError(
+          'Illegal constructor. Use ServiceWorkerRegistration.showNotification() instead.'
+        )
+      },
+      { permission: 'granted', requestPermission: async () => 'granted' }
+    )
+    expect(await loadHandler('browser-show-notification')(config, {})).toEqual({
+      success: false,
+      permission: 'granted',
+      error: 'Illegal constructor. Use ServiceWorkerRegistration.showNotification() instead.',
+    })
+  })
+})
+
+describe('push-send-notification', () => {
+  const PRIVATE_KEY = 'vapid-private-key'
+  const context = {
+    __baseUrl: 'https://shop.test',
+    __internalHeaders: { cookie: 'session=abc', 'x-vercel-protection-bypass': 'bypass' },
+  }
+  const config = {
+    title: 'Order shipped',
+    body: 'On its way',
+    url: '/orders/1',
+    audience: 'user',
+    userId: 'user-1',
+    ttl: '3600',
+    urgency: 'high',
+    requireInteraction: 'true',
+  }
+
+  const respondWith = (status: number, body: unknown) => {
+    const requests: Array<{ url: string; init: Record<string, unknown> }> = []
+    globalScope.fetch = async (url: string, init: Record<string, unknown>) => {
+      requests.push({ url, init })
+      return { ok: status < 400, status, json: async () => body }
+    }
+    globalScope.__non_webpack_require__ = require
+    return requests
+  }
+
+  it('refuses to run before the push keys reach the environment', async () => {
+    respondWith(200, {})
+    const missing = await loadHandler('push-send-notification')(config, context)
+    process.env.WEB_PUSH_VAPID_PRIVATE_KEY = 'teleporthq.secrets.WEB_PUSH_VAPID_PRIVATE_KEY'
+    const placeholder = await loadHandler('push-send-notification')(config, context)
+
+    const failure = {
+      success: false,
+      sent: 0,
+      failed: 0,
+      removed: 0,
+      complete: false,
+      error: 'Push notifications are not set up for this site.',
+    }
+    expect(missing).toEqual(failure)
+    expect(placeholder).toEqual(failure)
+  })
+
+  it('calls the internal send route with the derived token and returns its counts', async () => {
+    process.env.WEB_PUSH_VAPID_PRIVATE_KEY = PRIVATE_KEY
+    const requests = respondWith(200, {
+      success: true,
+      sent: 2,
+      failed: 1,
+      removed: 1,
+      complete: true,
+    })
+
+    const result = await loadHandler('push-send-notification')(config, context)
+
+    expect(result).toEqual({ success: true, sent: 2, failed: 1, removed: 1, complete: true })
+    expect(requests[0].url).toBe('https://shop.test/api/push/send')
+    expect(requests[0].init.headers).toEqual({
+      'Content-Type': 'application/json',
+      cookie: 'session=abc',
+      'x-vercel-protection-bypass': 'bypass',
+      'x-teleport-push-token': crypto
+        .createHmac('sha256', PRIVATE_KEY)
+        .update('teleport-web-push-send')
+        .digest('hex'),
+    })
+    expect(JSON.parse(requests[0].init.body as string)).toEqual({
+      audience: 'user',
+      userId: 'user-1',
+      ttl: '3600',
+      urgency: 'high',
+      notification: {
+        title: 'Order shipped',
+        body: 'On its way',
+        url: '/orders/1',
+        requireInteraction: true,
+        silent: false,
+      },
+    })
+  })
+
+  it('reports what the route refused', async () => {
+    process.env.WEB_PUSH_VAPID_PRIVATE_KEY = PRIVATE_KEY
+    respondWith(400, { success: false, error: 'A push notification needs a title.' })
+    expect(await loadHandler('push-send-notification')({}, context)).toMatchObject({
+      success: false,
+      error: 'A push notification needs a title.',
+    })
+
+    respondWith(502, null)
+    expect(await loadHandler('push-send-notification')(config, context)).toMatchObject({
+      success: false,
+      error: 'The push notification could not be sent (HTTP 502).',
+    })
+  })
+})

package/__tests__/route-changed-trigger.test.ts

@@ -75,6 +75,46 @@ describe('event-route-changed — component scope', () => {
   })
 })
 
+describe('event-route-changed — page scope', () => {
+  // A page's component stays mounted between two routes of the same page
+  // (`/products/a` → `/products/b`); a route change bound to that page runs in
+  // its lifecycle effect, next to the page's own state setters.
+  const generatePage = async (pageId: string) => {
+    const workflow = routeChangedWorkflow('page', { pageId: 'page-product' })
+    const plugin = createNextWorkflowPlugin({ isPage: true })
+    const structure: any = {
+      uidl: {
+        name: 'ProductDetails',
+        outputOptions: { pageId },
+        node: { type: 'element', content: { elementType: 'container', name: 'Container' } },
+        stateDefinitions: { currentRoute: { type: 'string', defaultValue: '' } },
+      },
+      chunks: [jsxComponentChunk()],
+      options: {
+        workflows: { workflows: { [workflow.id]: workflow }, customNodes: {} },
+      },
+      dependencies: {},
+    }
+    await plugin(structure)
+    const moduleChunk = (structure.chunks as any[]).find((c: any) => c.name === 'workflow-module')
+    return { code: moduleChunk ? String(moduleChunk.content) : '', structure }
+  }
+
+  it('registers Router.events with an .off cleanup in its page lifecycle', async () => {
+    const { code, structure } = await generatePage('page-product')
+    const setup = code.slice(code.indexOf('const setupLifecycleTriggers'))
+    expect(setup).toContain("Router.events.on('routeChangeComplete'")
+    expect(setup).toContain("Router.events.off('routeChangeComplete'")
+    expect(setup).toContain('cleanups.push')
+    expect(structure.dependencies.Router).toMatchObject({ path: 'next/router' })
+  })
+
+  it('stays out of every other page', async () => {
+    const { code } = await generatePage('page-home')
+    expect(code).not.toContain("Router.events.on('routeChangeComplete'")
+  })
+})
+
 describe('event-route-changed — global scope', () => {
   const plugin = new NextWorkflowProjectPlugin()
   // generateGlobalWorkflowsHook is private; call it directly for a unit test.