@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/dist/cjs/session-cookie-resolver.js

@@ -1,282 +1,13 @@
 "use strict";
-/**
- * Resolving the NextAuth session token in a generated route, WITHOUT asking
- * `process.env.NEXTAUTH_URL` what the session cookie is called.
- *
- * ## ⛔ THE REPORTED DEFECT
- *
- * A published project showed "Failed to load dashboard data. Please refresh."
- * on the home page, "Failed to load meeting data." on the list page and "could
- * not fetch the templates" on a third — for a user who was signed in, on a page
- * whose own `/api/auth/session` returned that user. The failing call was the
- * page-load workflow's server segment, answering **401 `Unauthenticated`** from
- * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
- * requests at the same route returned **33 × 401 and 17 × 200**, while 40
- * concurrent `/api/auth/session` calls resolved the user 40/40.
- *
- * ## The mechanism
- *
- * next-auth v4's `getToken()` derives the cookie it reads from an env var:
- *
- * ```js
- * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
- * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
- * ```
- *
- * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
- * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
- * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
- * repair is process-local: it fixes the value for whichever serverless instance
- * happened to serve an auth request, and for no other. Every other instance
- * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
- * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
- * `getToken` looks for `next-auth.session-token`, the browser is holding
- * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
- * reported as anonymous.
- *
- * Hence the coin-flip: it depends on whether the instance that served your
- * request had previously served an auth request. Nothing about the session, the
- * secret or the cookie is wrong.
- *
- * The same defect is why the generated middleware carries a `hasSessionCookie`
- * fallback and a round trip to `/api/auth/session`, attributed there to an
- * "Edge runtime quirk" — the Edge process holds that same localhost value.
- *
- * ## The rule
- *
- * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
- * env var that describes the deployment.** So this resolver reads which session
- * cookie the caller actually sent, and tells `getToken` exactly that — falling
- * back to the request's own protocol when the cookie header is unavailable.
- *
- * Emitted as plain ES5 text and inlined into each generated route: a route that
- * carries its own copy cannot be broken by a missing sibling module or an
- * untraced dependency, and every call site gets the identical implementation
- * from this one definition.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateCommonJsSessionTokenResolverCode = exports.generateSessionTokenResolverCode = exports.SESSION_TOKEN_RESOLVER_FN = void 0;
-/** The `__tq`-prefixed globals the emitted snippet declares. */
-exports.SESSION_TOKEN_RESOLVER_FN = '__tqResolveSessionToken';
-/**
- * Session-cookie names next-auth/Auth.js writes, with the `secureCookie` flag
- * that produces each. Order within a protocol is irrelevant — only ONE of these
- * is ever present — but the https/http split decides which pair is tried first.
- *
- * `__Host-` is deliberately absent: next-auth uses it only for the CSRF and
- * callback cookies, never for the session token.
- */
-const KNOWN_SESSION_COOKIES = [
-    { name: '__Secure-next-auth.session-token', secure: true },
-    { name: 'next-auth.session-token', secure: false },
-    { name: '__Secure-authjs.session-token', secure: true },
-    { name: 'authjs.session-token', secure: false },
-];
-/**
- * ES5 source for the shared session-token resolver, safe to inline into any
- * generated CommonJS route or ESM middleware.
- *
- * Declares:
- *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
- *    parsed properly (a substring test would see `next-auth.session-token`
- *    inside `__Secure-next-auth.session-token` and pick the wrong one).
- *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
- *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
- *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
- *
- * `getToken` is passed IN rather than required here, so the same body serves a
- * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
- * (static `import`). Pure, total, never throws, no env reads.
- */
-const generateSessionTokenResolverCode = () => {
-    return `// GENERATED — see generateSessionTokenResolverCode in
-// @teleporthq/teleport-plugin-next-workflows/src/session-cookie-resolver.ts.
-//
-// next-auth's getToken() picks the session cookie name from
-// process.env.NEXTAUTH_URL, which a generated project ships as a localhost
-// default — so on a published https domain it looks for the non-secure cookie
-// and reports a signed-in user as anonymous. These helpers read the cookie the
-// request actually carries and tell getToken exactly which one it is.
-var __TQ_SESSION_COOKIES = ${JSON.stringify(KNOWN_SESSION_COOKIES.map((c) => [c.name, c.secure]))};
-
-// Every cookie NAME on the request. Parsed on the "; " separator rather than
-// matched as a substring: "next-auth.session-token" occurs inside
-// "__Secure-next-auth.session-token", so a substring test reports the plain
-// cookie as present whenever the secure one is, and getToken then decodes the
-// wrong (missing) cookie.
-function __tqCookieNamesPresent(req) {
-  var present = {};
-  var raw = '';
-  try {
-    var headers = req && req.headers;
-    if (headers && typeof headers.get === 'function') {
-      // Edge / fetch Headers.
-      raw = headers.get('cookie') || '';
-    } else if (headers) {
-      var value = headers.cookie || headers.Cookie;
-      raw = Array.isArray(value) ? value.join('; ') : value || '';
-    }
-  } catch (e) {
-    raw = '';
-  }
-  var parts = String(raw).split(';');
-  for (var i = 0; i < parts.length; i++) {
-    var eq = parts[i].indexOf('=');
-    if (eq > 0) {
-      present[parts[i].slice(0, eq).trim()] = true;
-    }
-  }
-  // Second source: the runtime's own parsed cookies. A Next.js API route hands
-  // over a plain object; the Edge RequestCookies exposes getAll().
-  try {
-    var cookies = req && req.cookies;
-    if (cookies && typeof cookies.getAll === 'function') {
-      var all = cookies.getAll() || [];
-      for (var a = 0; a < all.length; a++) {
-        if (all[a] && all[a].name) {
-          present[all[a].name] = true;
-        }
-      }
-    } else if (cookies && typeof cookies === 'object') {
-      for (var key in cookies) {
-        if (Object.prototype.hasOwnProperty.call(cookies, key)) {
-          present[key] = true;
-        }
-      }
-    }
-  } catch (e) {
-    /* the header pass above is enough */
-  }
-  return present;
-}
-
-// Is this request https? Read from the proxy header the platform sets, then the
-// socket, then the URL — never from an env var describing the deployment.
-function __tqRequestIsSecure(req) {
-  try {
-    var headers = (req && req.headers) || {};
-    var proto =
-      typeof headers.get === 'function'
-        ? headers.get('x-forwarded-proto')
-        : headers['x-forwarded-proto'];
-    if (Array.isArray(proto)) {
-      proto = proto[0];
-    }
-    if (typeof proto === 'string' && proto) {
-      // A chain of proxies appends: "https,http" — the client-facing hop is first.
-      return proto.split(',')[0].trim().toLowerCase() === 'https';
-    }
-    if (req && req.nextUrl && req.nextUrl.protocol === 'https:') {
-      return true;
-    }
-    if (req && req.socket && req.socket.encrypted) {
-      return true;
-    }
-    if (req && req.connection && req.connection.encrypted) {
-      return true;
-    }
-    if (typeof (req && req.url) === 'string' && req.url.indexOf('https://') === 0) {
-      return true;
-    }
-  } catch (e) {
-    /* fall through to false */
-  }
-  return false;
-}
-
-// The { cookieName, secureCookie } pairs worth trying, most likely first.
-// Normally exactly one cookie is present and this returns a single entry; the
-// list only grows when a site has been reached over both http and https.
-function __tqSessionTokenCandidates(req) {
-  var present = __tqCookieNamesPresent(req);
-  var secure = __tqRequestIsSecure(req);
-  var candidates = [];
-  for (var i = 0; i < __TQ_SESSION_COOKIES.length; i++) {
-    var name = __TQ_SESSION_COOKIES[i][0];
-    var isSecureName = __TQ_SESSION_COOKIES[i][1];
-    if (present[name] || present[name + '.0']) {
-      candidates.push({ cookieName: name, secureCookie: isSecureName });
-    }
-  }
-  candidates.sort(function (a, b) {
-    if (a.secureCookie === b.secureCookie) {
-      return 0;
-    }
-    return a.secureCookie === secure ? -1 : 1;
-  });
-  if (candidates.length === 0) {
-    // No cookie we recognise. The project may configure a custom cookie name in
-    // authOptions, so hand getToken the request's own protocol and let it apply
-    // its defaults — same behaviour as before this resolver existed, minus the
-    // localhost env var.
-    candidates.push({ secureCookie: secure });
-  }
-  return candidates;
-}
-
-// The decoded session token, or null. Tries each candidate cookie in turn so a
-// project that renamed its cookie, or one reached over both protocols, still
-// resolves. Never throws.
-function ${exports.SESSION_TOKEN_RESOLVER_FN}(getToken, req, secret) {
-  if (!secret || typeof getToken !== 'function') {
-    return Promise.resolve(null);
-  }
-  var candidates = __tqSessionTokenCandidates(req);
-  var attempt = function (index) {
-    if (index >= candidates.length) {
-      return Promise.resolve(null);
-    }
-    var candidate = candidates[index];
-    var params = { req: req, secret: secret, secureCookie: candidate.secureCookie };
-    if (candidate.cookieName) {
-      params.cookieName = candidate.cookieName;
-    }
-    return Promise.resolve()
-      .then(function () {
-        return getToken(params);
-      })
-      .catch(function () {
-        return null;
-      })
-      .then(function (token) {
-        return token || attempt(index + 1);
-      });
-  };
-  return attempt(0);
-}
-`;
-};
-exports.generateSessionTokenResolverCode = generateSessionTokenResolverCode;
+const teleport_shared_1 = require("@teleporthq/teleport-shared");
 /**
- * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
- *
- * The require is lazy and guarded because a project generated WITHOUT
- * authentication does not ship `next-auth`; such a project also has no session
- * to read, so resolving to `null` there is the correct answer rather than a
- * module-load crash.
+ * The session-cookie resolver lives in teleport-shared so the per-table data
+ * routes (teleport-plugin-next-data-source) decode a session exactly the way
+ * the workflow routes do. This module keeps the plugin's public export path.
  */
-const generateCommonJsSessionTokenResolverCode = () => {
-    return `${(0, exports.generateSessionTokenResolverCode)()}
-// Lazy + guarded: a project generated without authentication has no next-auth
-// installed, and no session to read either — null is the right answer there.
-function __tqGetTokenFn() {
-  try {
-    var jwt = require('next-auth/jwt');
-    return jwt && typeof jwt.getToken === 'function' ? jwt.getToken : null;
-  } catch (e) {
-    return null;
-  }
-}
-
-// The session token for this request, or null. Reads NEXTAUTH_SECRET itself.
-function __tqSessionToken(req) {
-  var secret = process.env.NEXTAUTH_SECRET;
-  if (!secret) {
-    return Promise.resolve(null);
-  }
-  return ${exports.SESSION_TOKEN_RESOLVER_FN}(__tqGetTokenFn(), req, secret);
-}
-`;
-};
-exports.generateCommonJsSessionTokenResolverCode = generateCommonJsSessionTokenResolverCode;
+exports.SESSION_TOKEN_RESOLVER_FN = teleport_shared_1.SessionCookieResolver.SESSION_TOKEN_RESOLVER_FN;
+exports.generateSessionTokenResolverCode = teleport_shared_1.SessionCookieResolver.generateSessionTokenResolverCode;
+exports.generateCommonJsSessionTokenResolverCode = teleport_shared_1.SessionCookieResolver.generateCommonJsSessionTokenResolverCode;
 //# sourceMappingURL=session-cookie-resolver.js.map

package/dist/cjs/session-cookie-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-resolver.js","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAEH,gEAAgE;AACnD,QAAA,yBAAyB,GAAG,yBAAyB,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAqD;IAC9E,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC1D,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,EAAE;IAClD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE;CAChD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACI,MAAM,gCAAgC,GAAG,GAAW,EAAE;IAC3D,OAAO;;;;;;;;6BAQoB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAwHtF,iCAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BnC,CAAA;AACD,CAAC,CAAA;AA7JY,QAAA,gCAAgC,oCA6J5C;AAED;;;;;;;GAOG;AACI,MAAM,wCAAwC,GAAG,GAAW,EAAE;IACnE,OAAO,GAAG,IAAA,wCAAgC,GAAE;;;;;;;;;;;;;;;;;;WAkBnC,iCAAyB;;CAEnC,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,wCAAwC,4CAsBpD"}
+{"version":3,"file":"session-cookie-resolver.js","sourceRoot":"","sources":["../../src/session-cookie-resolver.ts"],"names":[],"mappings":";;;AAAA,iEAAmE;AAEnE;;;;GAIG;AACU,QAAA,yBAAyB,GAAG,uCAAqB,CAAC,yBAAyB,CAAA;AAC3E,QAAA,gCAAgC,GAC3C,uCAAqB,CAAC,gCAAgC,CAAA;AAC3C,QAAA,wCAAwC,GACnD,uCAAqB,CAAC,wCAAwC,CAAA"}

package/dist/cjs/subscriber-access-route-generator.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Subscriber-only pages: the entitlement check a generated store runs for a
+ * page whose protection carries `requiresSubscription`.
+ *
+ * Two files, emitted together whenever at least one page is subscriber-only:
+ *
+ *  - `utils/auth/subscriber-access.js` — the ONE parameterised query that
+ *    decides entitlement (`SUBSCRIPTION_ENTITLEMENT_SQL` from teleport-shared,
+ *    statuses baked from `SUBSCRIPTION_ENTITLED_STATUSES`) plus the lookup of
+ *    the storefront page of the first product a page names. Shared by the
+ *    route below and by the workflow-route guard (`workflow-auth.js`), so the
+ *    middleware and a page's workflow routes can never disagree.
+ *  - `pages/api/auth/subscriber-access.js` — what the Edge middleware asks
+ *    (it has no database): `GET ?products=<comma ids>` with the visitor's
+ *    cookie forwarded → 401 without a session, else
+ *    `{ entitled: boolean, redirectTo?: string }`, never cached.
+ *
+ * The middleware itself lives in `auth-generator.ts` (`generateMiddlewareFile`).
+ */
+import { ProjectUIDL, UIDLAuthentication } from '@teleporthq/teleport-types';
+/** Where the storefront serves a single product from, read off the UIDL's route table. */
+export interface ProductDetailsRoute {
+    staticBase: string;
+    differentiatorColumn: string;
+}
+export declare const hasSubscriberOnlyPages: (auth: UIDLAuthentication | undefined) => boolean;
+/**
+ * The STANDARD product-details page. When the store has custom product pages
+ * the UIDL names it (`ecommerceSettings.productPages.standard`). Otherwise it is
+ * the route value whose `detailsPageInfo` reads the products table — a
+ * storefront product page first, since the write-a-review page reads that table
+ * too. Its `navLink` is `<base>/[<column>]`; the base is what the list page
+ * shares with it by platform convention.
+ */
+export declare const resolveProductDetailsRoute: (uidl: ProjectUIDL | undefined) => ProductDetailsRoute | null;
+/**
+ * Every custom product page by key (`ecommerceSettings.productPages.pages`),
+ * so a product that opens on one is sent there. Empty on a store without
+ * custom product pages.
+ */
+export declare const resolveCustomProductPageRoutes: (uidl: ProjectUIDL | undefined) => Record<string, ProductDetailsRoute>;
+/**
+ * Where the middleware sends a visitor who lacks the subscription when the
+ * route could name no product page: the products listing when the store has
+ * one (a page served at the details page's static base), else the home page.
+ */
+export declare const resolveSubscriptionFallbackRoute: (uidl: ProjectUIDL | undefined) => string;
+export interface SubscriberAccessHelperOptions {
+    productDetails: ProductDetailsRoute | null;
+    /** Custom product pages by key (`resolveCustomProductPageRoutes`); absent or empty = none. */
+    productPages?: Record<string, ProductDetailsRoute>;
+}
+/**
+ * `utils/auth/subscriber-access.js` (CommonJS). Exports:
+ *  - `normalizeProductIds(value)` — trimmed, de-duplicated ids from an array
+ *    or a comma-separated string, capped.
+ *  - `isSubscriberEntitled(userId, productIds)` — the entitlement query; an
+ *    empty list means any product. Throws on a database failure so a caller
+ *    can fail closed on its own terms.
+ *  - `resolveProductRedirect(productIds)` — the storefront page of the FIRST
+ *    product, or null (no product page, unknown product, database failure).
+ */
+export declare const generateSubscriberAccessHelperModule: (options: SubscriberAccessHelperOptions) => string;
+/**
+ * `pages/api/auth/subscriber-access.js`: GET only, the session read from the
+ * forwarded cookie exactly as the workflow routes read it, then the shared
+ * helper. A failed query answers 500 — the middleware treats anything but an
+ * `entitled: true` body as "not entitled", so the page fails closed.
+ */
+export declare const generateSubscriberAccessRoute: () => string;
+//# sourceMappingURL=subscriber-access-route-generator.d.ts.map

package/dist/cjs/subscriber-access-route-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriber-access-route-generator.d.ts","sourceRoot":"","sources":["../../src/subscriber-access-route-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAS5E,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAGlC,UAAU,EAAE,MAAM,CAAA;IAElB,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,kBAAkB,GAAG,SAAS,KAAG,OAO7E,CAAA;AAkBD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,SAC/B,WAAW,GAAG,SAAS,KAC5B,mBAAmB,GAAG,IAwBxB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,SACnC,WAAW,GAAG,SAAS,KAC5B,OAAO,MAAM,EAAE,mBAAmB,CAUpC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,SAAU,WAAW,GAAG,SAAS,KAAG,MAShF,CAAA;AA8DD,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC1C,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACnD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC,YACtC,6BAA6B,KACrC,MAiFF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAO,MAkDhD,CAAA"}

package/dist/cjs/subscriber-access-route-generator.js

@@ -0,0 +1,301 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSubscriberAccessRoute = exports.generateSubscriberAccessHelperModule = exports.resolveSubscriptionFallbackRoute = exports.resolveCustomProductPageRoutes = exports.resolveProductDetailsRoute = exports.hasSubscriberOnlyPages = void 0;
+const teleport_shared_1 = require("@teleporthq/teleport-shared");
+const pg_client_code_1 = require("./pg-client-code");
+const session_cookie_resolver_1 = require("./session-cookie-resolver");
+const PRODUCTS_TABLE = 'teleport_products';
+const MAX_PRODUCT_IDS = 50;
+const IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const hasSubscriberOnlyPages = (auth) => {
+    if (!auth || !auth.pageProtection) {
+        return false;
+    }
+    return Object.values(auth.pageProtection).some((protection) => !!protection && protection.requiresSubscription === true);
+};
+exports.hasSubscriberOnlyPages = hasSubscriberOnlyPages;
+const routeValuesOf = (uidl) => {
+    var _a, _b, _c;
+    const values = (_c = (_b = (_a = uidl === null || uidl === void 0 ? void 0 : uidl.root) === null || _a === void 0 ? void 0 : _a.stateDefinitions) === null || _b === void 0 ? void 0 : _b.route) === null || _c === void 0 ? void 0 : _c.values;
+    return Array.isArray(values) ? values : [];
+};
+/** The feature identifier every storefront product page exposes its product under. */
+const STOREFRONT_PRODUCT_FEATURE = 'ecommerceProduct';
+const toProductRoute = (route, attribute) => {
+    const staticBase = typeof route === 'string' && route.startsWith('/') ? route : '';
+    const column = typeof attribute === 'string' ? attribute : '';
+    return staticBase && IDENTIFIER_RE.test(column)
+        ? { staticBase, differentiatorColumn: column }
+        : null;
+};
+/**
+ * The STANDARD product-details page. When the store has custom product pages
+ * the UIDL names it (`ecommerceSettings.productPages.standard`). Otherwise it is
+ * the route value whose `detailsPageInfo` reads the products table — a
+ * storefront product page first, since the write-a-review page reads that table
+ * too. Its `navLink` is `<base>/[<column>]`; the base is what the list page
+ * shares with it by platform convention.
+ */
+const resolveProductDetailsRoute = (uidl) => {
+    var _a, _b;
+    const standard = (_b = (_a = uidl === null || uidl === void 0 ? void 0 : uidl.ecommerceSettings) === null || _a === void 0 ? void 0 : _a.productPages) === null || _b === void 0 ? void 0 : _b.standard;
+    if (standard) {
+        const route = toProductRoute(standard.route, standard.attribute);
+        if (route) {
+            return route;
+        }
+    }
+    const candidates = [];
+    for (const routeValue of routeValuesOf(uidl)) {
+        const pageOptions = routeValue === null || routeValue === void 0 ? void 0 : routeValue.pageOptions;
+        const info = pageOptions === null || pageOptions === void 0 ? void 0 : pageOptions.detailsPageInfo;
+        if (!info || String(info.tableName || '').toLowerCase() !== PRODUCTS_TABLE) {
+            continue;
+        }
+        const navLink = String(pageOptions.navLink || '');
+        const column = String(info.differentiatorColumn || pageOptions.dynamicRouteAttribute || '');
+        const route = toProductRoute(navLink.replace(/\/\[[^\]]*\]$/, '') || '/', column);
+        if (navLink.startsWith('/') && route) {
+            candidates.push({ route, storefront: info.featureIdentifier === STOREFRONT_PRODUCT_FEATURE });
+        }
+    }
+    const chosen = candidates.find((candidate) => candidate.storefront) || candidates[0];
+    return chosen ? chosen.route : null;
+};
+exports.resolveProductDetailsRoute = resolveProductDetailsRoute;
+/**
+ * Every custom product page by key (`ecommerceSettings.productPages.pages`),
+ * so a product that opens on one is sent there. Empty on a store without
+ * custom product pages.
+ */
+const resolveCustomProductPageRoutes = (uidl) => {
+    var _a, _b, _c, _d;
+    const pages = ((_b = (_a = uidl === null || uidl === void 0 ? void 0 : uidl.ecommerceSettings) === null || _a === void 0 ? void 0 : _a.productPages) === null || _b === void 0 ? void 0 : _b.pages) || {};
+    const routes = {};
+    for (const key of Object.keys(pages)) {
+        const route = toProductRoute((_c = pages[key]) === null || _c === void 0 ? void 0 : _c.route, (_d = pages[key]) === null || _d === void 0 ? void 0 : _d.attribute);
+        if (route) {
+            routes[key] = route;
+        }
+    }
+    return routes;
+};
+exports.resolveCustomProductPageRoutes = resolveCustomProductPageRoutes;
+/**
+ * Where the middleware sends a visitor who lacks the subscription when the
+ * route could name no product page: the products listing when the store has
+ * one (a page served at the details page's static base), else the home page.
+ */
+const resolveSubscriptionFallbackRoute = (uidl) => {
+    const details = (0, exports.resolveProductDetailsRoute)(uidl);
+    if (!details || details.staticBase === '/') {
+        return '/';
+    }
+    const hasListing = routeValuesOf(uidl).some((routeValue) => { var _a; return String(((_a = routeValue === null || routeValue === void 0 ? void 0 : routeValue.pageOptions) === null || _a === void 0 ? void 0 : _a.navLink) || '') === details.staticBase; });
+    return hasListing ? details.staticBase : '/';
+};
+exports.resolveSubscriptionFallbackRoute = resolveSubscriptionFallbackRoute;
+// The storefront page of the FIRST product a page names, on the standard page.
+const STANDARD_PAGE_REDIRECT = `async function resolveProductRedirect(productIds) {
+  var ids = normalizeProductIds(productIds);
+  if (!PRODUCT_DETAILS || ids.length === 0) {
+    return null;
+  }
+  try {
+    return await withClient(async function (client) {
+      var result = await client.query(
+        'SELECT "' + PRODUCT_DETAILS.differentiatorColumn + '" AS value FROM ' + PRODUCTS_TABLE + ' WHERE id::text = $1 LIMIT 1',
+        [ids[0]]
+      );
+      var value = result && result.rows && result.rows[0] ? result.rows[0].value : null;
+      if (value == null || String(value) === '') {
+        return null;
+      }
+      var base = PRODUCT_DETAILS.staticBase === '/' ? '' : PRODUCT_DETAILS.staticBase;
+      return base + '/' + encodeURIComponent(String(value));
+    });
+  } catch (e) {
+    return null;
+  }
+}`;
+// The same, on a store with custom product pages: the product's own page — the
+// custom one its product_page names while that page exists, else the standard
+// one. The row is read whole (to_jsonb) so a store whose table lacks one of the
+// columns still answers.
+const PRODUCT_PAGE_AWARE_REDIRECT = `async function resolveProductRedirect(productIds) {
+  var ids = normalizeProductIds(productIds);
+  if (!PRODUCT_DETAILS || ids.length === 0) {
+    return null;
+  }
+  try {
+    return await withClient(async function (client) {
+      var result = await client.query(
+        'SELECT to_jsonb(p) AS row FROM ' + PRODUCTS_TABLE + ' p WHERE p.id::text = $1 LIMIT 1',
+        [ids[0]]
+      );
+      var row = result && result.rows && result.rows[0] ? result.rows[0].row : null;
+      if (!row) {
+        return null;
+      }
+      var key = typeof row.product_page === 'string' ? row.product_page.trim() : '';
+      var page =
+        key !== '' && Object.prototype.hasOwnProperty.call(PRODUCT_PAGES, key)
+          ? PRODUCT_PAGES[key]
+          : PRODUCT_DETAILS;
+      var value = row[page.differentiatorColumn];
+      if (value == null || String(value) === '') {
+        return null;
+      }
+      var base = page.staticBase === '/' ? '' : page.staticBase;
+      return base + '/' + encodeURIComponent(String(value));
+    });
+  } catch (e) {
+    return null;
+  }
+}`;
+/**
+ * `utils/auth/subscriber-access.js` (CommonJS). Exports:
+ *  - `normalizeProductIds(value)` — trimmed, de-duplicated ids from an array
+ *    or a comma-separated string, capped.
+ *  - `isSubscriberEntitled(userId, productIds)` — the entitlement query; an
+ *    empty list means any product. Throws on a database failure so a caller
+ *    can fail closed on its own terms.
+ *  - `resolveProductRedirect(productIds)` — the storefront page of the FIRST
+ *    product, or null (no product page, unknown product, database failure).
+ */
+const generateSubscriberAccessHelperModule = (options) => {
+    const details = options.productDetails && IDENTIFIER_RE.test(options.productDetails.differentiatorColumn)
+        ? options.productDetails
+        : null;
+    const productPages = options.productPages || {};
+    const hasProductPages = !!details && Object.keys(productPages).length > 0;
+    return `'use strict';
+
+// GENERATED — see generateSubscriberAccessHelperModule in
+// @teleporthq/teleport-plugin-next-workflows/src/subscriber-access-route-generator.ts.
+//
+// Whether a signed-in visitor holds an entitled subscription: the one query the
+// subscriber-access route (for the middleware) and the workflow-route guard
+// share, so a page and its workflows can never disagree about who may read.
+${(0, pg_client_code_1.generatePgClientCode)()}
+
+var SUBSCRIPTION_ENTITLED_STATUSES = ${JSON.stringify(teleport_shared_1.SubscriptionAccess.SUBSCRIPTION_ENTITLED_STATUSES)};
+var ENTITLEMENT_SQL = ${JSON.stringify(teleport_shared_1.SubscriptionAccess.SUBSCRIPTION_ENTITLEMENT_SQL)};
+var MAX_PRODUCT_IDS = ${MAX_PRODUCT_IDS};
+// The product-details page, when the store has one: its static base and the
+// product column its dynamic segment carries.
+var PRODUCT_DETAILS = ${JSON.stringify(details)};
+var PRODUCTS_TABLE = ${JSON.stringify(PRODUCTS_TABLE)};${hasProductPages
+        ? `
+// The custom product pages by key: a product whose product_page names one
+// opens there instead of on the standard product page.
+var PRODUCT_PAGES = ${JSON.stringify(productPages)};`
+        : ''}
+
+function normalizeProductIds(value) {
+  var raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : [];
+  var ids = [];
+  for (var i = 0; i < raw.length && ids.length < MAX_PRODUCT_IDS; i++) {
+    var id = String(raw[i] == null ? '' : raw[i]).trim();
+    if (id && ids.indexOf(id) === -1) {
+      ids.push(id);
+    }
+  }
+  return ids;
+}
+
+async function withClient(run) {
+  var client = getClient();
+  try {
+    await client.connect();
+    return await run(client);
+  } finally {
+    try { await client.end(); } catch (e) {}
+  }
+}
+
+// true when the user holds a subscription in an entitled status to one of the
+// products — to any product when the list is empty.
+async function isSubscriberEntitled(userId, productIds) {
+  var id = String(userId == null ? '' : userId).trim();
+  if (!id) {
+    return false;
+  }
+  var ids = normalizeProductIds(productIds);
+  return withClient(async function (client) {
+    var result = await client.query(ENTITLEMENT_SQL, [id, SUBSCRIPTION_ENTITLED_STATUSES, ids]);
+    return !!(result && result.rows && result.rows.length > 0);
+  });
+}
+
+// The storefront page of the first product a page names, or null.
+${hasProductPages ? PRODUCT_PAGE_AWARE_REDIRECT : STANDARD_PAGE_REDIRECT}
+
+module.exports = {
+  SUBSCRIPTION_ENTITLED_STATUSES: SUBSCRIPTION_ENTITLED_STATUSES,
+  normalizeProductIds: normalizeProductIds,
+  isSubscriberEntitled: isSubscriberEntitled,
+  resolveProductRedirect: resolveProductRedirect,
+};
+`;
+};
+exports.generateSubscriberAccessHelperModule = generateSubscriberAccessHelperModule;
+/**
+ * `pages/api/auth/subscriber-access.js`: GET only, the session read from the
+ * forwarded cookie exactly as the workflow routes read it, then the shared
+ * helper. A failed query answers 500 — the middleware treats anything but an
+ * `entitled: true` body as "not entitled", so the page fails closed.
+ */
+const generateSubscriberAccessRoute = () => {
+    return `'use strict';
+
+// GENERATED — see generateSubscriberAccessRoute in
+// @teleporthq/teleport-plugin-next-workflows/src/subscriber-access-route-generator.ts.
+//
+// Asked by the middleware for a subscriber-only page: does the visitor behind
+// this cookie hold an entitled subscription to one of ?products (any, when
+// none are named)? Never cached — a subscription can end between two requests.
+${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)()}
+var __subscriberAccess = require('../../../utils/auth/subscriber-access');
+
+module.exports = async function handler(req, res) {
+  res.setHeader('Cache-Control', 'no-store');
+  if (req.method !== 'GET') {
+    res.setHeader('Allow', 'GET');
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+
+  var token = null;
+  try {
+    token = await __tqSessionToken(req);
+  } catch (e) {
+    token = null;
+  }
+  var userId = token && (token.id != null ? token.id : token.sub);
+  if (userId == null || String(userId) === '') {
+    return res.status(401).json({ error: 'Unauthenticated' });
+  }
+
+  var productIds = __subscriberAccess.normalizeProductIds(req.query && req.query.products);
+  var entitled = false;
+  try {
+    entitled = await __subscriberAccess.isSubscriberEntitled(String(userId), productIds);
+  } catch (e) {
+    console.error('[subscriber-access] entitlement check failed:', e && e.message ? e.message : e);
+    return res.status(500).json({ error: 'Subscription check failed' });
+  }
+  if (entitled) {
+    return res.status(200).json({ entitled: true });
+  }
+
+  var body = { entitled: false };
+  var redirectTo = await __subscriberAccess.resolveProductRedirect(productIds);
+  if (redirectTo) {
+    body.redirectTo = redirectTo;
+  }
+  return res.status(200).json(body);
+};
+`;
+};
+exports.generateSubscriberAccessRoute = generateSubscriberAccessRoute;
+//# sourceMappingURL=subscriber-access-route-generator.js.map