@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/dist/cjs/webhook-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-generator.js","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":";;;AAAA,+DAKmC;AAE5B,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,YAAY,GAAG,CAAC,CAAC,iBAAiB,CAAA;IACxC,MAAM,qBAAqB,GAAG,YAAY,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAElF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsEU,mBAAmB;QACjB,CAAC,CAAC,iFAAiF;QACnF,CAAC,CAAC,yDACN;UACE,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE;UACxF,qBAAqB,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE;;;;;;UAO/E,mBAAmB;QACjB,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,6DACN;;;;;;;;;;;;;;;;;;UAmBE,mBAAmB;QACjB,CAAC,CAAC,6DAA6D;QAC/D,CAAC,CAAC,8DACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuEN,mBAAmB,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE;EACvD,YAAY,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAC,EAAE;EACtD,qBAAqB,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpE,CAAA;AACD,CAAC,CAAA;AA5MY,QAAA,yBAAyB,6BA4MrC;AAED,SAAS,gCAAgC;IACvC,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,OAAO;;;;;;;;;;;;;;;;;;;;;;CAsBR,CAAA;AACD,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;CAsBR,CAAA;AACD,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2MR,CAAA;AACD,CAAC;AAEM,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,qBAAqB,GAAG,CAAC,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAEzF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkEU,mBAAmB;QACjB,CAAC,CAAC,8FAA8F;QAChG,CAAC,CAAC,wDACN;UAEE,qBAAqB;QACnB,CAAC,CAAC;;;;;;;;;;;;;;;qGAeuF;QACzF,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgFN,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBL;QACG,CAAC,CAAC,EACN;;EAGE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2KL;QACG,CAAC,CAAC,EACN;CACC,CAAA;AACD,CAAC,CAAA;AAzYY,QAAA,yBAAyB,6BAyYrC;AAUM,MAAM,oBAAoB,GAAG,CAClC,SAAiC,EACjC,eAAgD,EAChD,UAAuC,EAAE,EACnC,EAAE;;IACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,GAAG,KAAI,EAAE,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAChD,MAAM,kBAAkB,GAAG,CAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,KAAI,EAAE,CAAA;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAuB,CAAA;IAE7E,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC9E,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEvC,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC5E,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEvC,IAAI,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAC7C,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;IAED,IAAI,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAC7C,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;AACH,CAAC,CAAA;AA/CY,QAAA,oBAAoB,wBA+ChC"}
+{"version":3,"file":"webhook-generator.js","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":";;;AAAA,+DAKmC;AACnC,yCAAqF;AACrF,4EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,CAAA;AAEK,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,YAAY,GAAG,CAAC,CAAC,iBAAiB,CAAA;IACxC,MAAM,qBAAqB,GAAG,YAAY,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAElF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAYE,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;CAML;QACG,CAAC,CAAC,EACN;EACE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAoDb,mBAAmB;QACjB,CAAC,CAAC,iFAAiF;QACnF,CAAC,CAAC,yDACN;UACE,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE;UACxF,qBAAqB,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;UAe/E,mBAAmB;QACjB,CAAC,CAAC;;;;;;UAMJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,6DACN;;;;;;;;;;;;;;;;;;UAmBE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;oEAOsD;QACxD,CAAC,CAAC,8DACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BN,mBAAmB,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE;EACvD,YAAY,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAC,EAAE;EACtD,qBAAqB,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpE,CAAA;AACD,CAAC,CAAA;AAjMY,QAAA,yBAAyB,6BAiMrC;AAED,SAAS,gCAAgC;IACvC,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAA;AACD,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAA;AACD,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgQR,CAAA;AACD,CAAC;AAEM,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,qBAAqB,GAAG,CAAC,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAEzF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAWE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAmDb,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;UAIJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,wDACN;UAEE,qBAAqB;QACnB,CAAC,CAAC;;;;;;;;;;;;;;;;qGAgBuF;QACzF,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CN,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuFL;QACG,CAAC,CAAC,EACN;;EAGE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuIL;QACG,CAAC,CAAC,EACN;CACC,CAAA;AACD,CAAC,CAAA;AAzYY,QAAA,yBAAyB,6BAyYrC;AAUM,MAAM,oBAAoB,GAAG,CAClC,SAAiC,EACjC,eAAgD,EAChD,UAAuC,EAAE,EACnC,EAAE;;IACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,GAAG,KAAI,EAAE,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAChD,MAAM,kBAAkB,GAAG,CAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,KAAI,EAAE,CAAA;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAU,CAAA;IAEhE,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC9E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC5E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE;QAC9B,OAAM;KACP;IACD,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,cAAc,GAAG,IAAA,uCAA4B,EAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAA,qCAA0B,EACxB,SAAS,EACT,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kDAA0B,CACxE,CAAA;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;AACH,CAAC,CAAA;AA/DY,QAAA,oBAAoB,wBA+DhC"}

package/dist/cjs/webhook-signature-verification.d.ts

@@ -1,7 +1,23 @@
-export declare const generateGetRawBodyCode: () => string;
+/** The raw request body, and the object it stands for (JSON or form-encoded). */
+export declare const generateWebhookBodyCode: () => string;
 export declare const generateStripeSignatureVerificationCode: () => string;
 export declare const generatePaypalSignatureVerificationCode: () => string;
 export declare const generateHmacSignatureVerificationCode: (algorithm?: 'sha256' | 'sha1') => string;
 export declare const generateSignatureDispatcherCode: () => string;
+/**
+ * A PAYMENT webhook is verified by the store's driver for its provider (see
+ * `src/payments`): a signature, or the event read back from the provider
+ * with the store's own key. The answer carries the AUTHORITATIVE body — the
+ * copy the provider gave back, where there is one — and whether the provider
+ * should try again (an outage) rather than drop the delivery.
+ *
+ * The store's own server may also ask the route to SETTLE a payment it just
+ * confirmed with the provider (a PayPal buyer's return): a body naming
+ * `teleportReconcile`, accepted only with the runtime's internal-call token.
+ * The driver reads the payment from the provider and answers the event the
+ * provider sends for it; nothing but the provider's id is taken from the
+ * request, and any other caller is refused outright.
+ */
+export declare const generatePaymentWebhookVerificationCode: () => string;
 export declare const generateAllSignatureVerificationCode: () => string;
 //# sourceMappingURL=webhook-signature-verification.d.ts.map

package/dist/cjs/webhook-signature-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature-verification.d.ts","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,QAAO,MAczC,CAAA;AAED,eAAO,MAAM,uCAAuC,QAAO,MA4C1D,CAAA;AAED,eAAO,MAAM,uCAAuC,QAAO,MA8C1D,CAAA;AAED,eAAO,MAAM,qCAAqC,eACrC,QAAQ,GAAG,MAAM,KAC3B,MA2BF,CAAA;AAED,eAAO,MAAM,+BAA+B,QAAO,MA6BlD,CAAA;AAED,eAAO,MAAM,oCAAoC,QAAO,MAQvD,CAAA"}
+{"version":3,"file":"webhook-signature-verification.d.ts","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAO,MAqC1C,CAAA;AAED,eAAO,MAAM,uCAAuC,QAAO,MA4C1D,CAAA;AASD,eAAO,MAAM,uCAAuC,QAAO,MAgF1D,CAAA;AAED,eAAO,MAAM,qCAAqC,eACrC,QAAQ,GAAG,MAAM,KAC3B,MA2BF,CAAA;AAOD,eAAO,MAAM,+BAA+B,QAAO,MAuClD,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sCAAsC,QAAO,MA2DzD,CAAA;AAED,eAAO,MAAM,oCAAoC,QAAO,MAQvD,CAAA"}

package/dist/cjs/webhook-signature-verification.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateAllSignatureVerificationCode = exports.generateSignatureDispatcherCode = exports.generateHmacSignatureVerificationCode = exports.generatePaypalSignatureVerificationCode = exports.generateStripeSignatureVerificationCode = exports.generateGetRawBodyCode = void 0;
-const generateGetRawBodyCode = () => {
+exports.generateAllSignatureVerificationCode = exports.generatePaymentWebhookVerificationCode = exports.generateSignatureDispatcherCode = exports.generateHmacSignatureVerificationCode = exports.generatePaypalSignatureVerificationCode = exports.generateStripeSignatureVerificationCode = exports.generateWebhookBodyCode = void 0;
+/** The raw request body, and the object it stands for (JSON or form-encoded). */
+const generateWebhookBodyCode = () => {
     return `
 function getRawBody(req) {
   return new Promise(function(resolve, reject) {
@@ -14,9 +15,32 @@ function getRawBody(req) {
     req.on('end', function() { resolve(Buffer.concat(chunks)); });
     req.on('error', function(err) { reject(err); });
   });
+}
+
+// Some providers (Mollie, CoinGate) post \`application/x-www-form-urlencoded\`.
+function parseWebhookBody(req, rawBody) {
+  var text = rawBody.toString('utf-8');
+  var contentType = String(req.headers['content-type'] || '').toLowerCase();
+  if (contentType.indexOf('application/x-www-form-urlencoded') === -1) {
+    try { return JSON.parse(text); } catch (_e) { return {}; }
+  }
+  var result = {};
+  var pairs = text ? text.split('&') : [];
+  for (var i = 0; i < pairs.length; i++) {
+    if (!pairs[i]) continue;
+    var eq = pairs[i].indexOf('=');
+    var key = eq >= 0 ? pairs[i].slice(0, eq) : pairs[i];
+    var value = eq >= 0 ? pairs[i].slice(eq + 1) : '';
+    try {
+      result[decodeURIComponent(key.replace(/\\+/g, ' '))] = decodeURIComponent(value.replace(/\\+/g, ' '));
+    } catch (_e) {
+      result[key] = value;
+    }
+  }
+  return result;
 }`;
 };
-exports.generateGetRawBodyCode = generateGetRawBodyCode;
+exports.generateWebhookBodyCode = generateWebhookBodyCode;
 const generateStripeSignatureVerificationCode = () => {
     return `
 function verifyStripeSignature(rawBody, sigHeader, secret) {
@@ -63,16 +87,47 @@ function verifyStripeSignature(rawBody, sigHeader, secret) {
 }`;
 };
 exports.generateStripeSignatureVerificationCode = generateStripeSignatureVerificationCode;
+// The credentials are read through the same fallback chain the payment nodes
+// use: the canonical name the deploy writes, then the CONFIGURATION_* name the
+// provider panel stores locally (a standalone run has only that one). The
+// environment to verify against is the one that signed the event — PayPal
+// names it in the cert URL. Both environments issue client ids starting with
+// "A", so the id says nothing; the earlier "sb-" prefix check sent every
+// sandbox verification to the live API, which rejected it.
 const generatePaypalSignatureVerificationCode = () => {
     return `
+function resolvePaypalEnv(candidates, prefix) {
+  var env = process.env;
+  for (var i = 0; i < candidates.length; i++) {
+    var value = candidates[i] ? env[candidates[i]] : '';
+    if (value && String(value).length > 0) return String(value);
+  }
+  var keys = Object.keys(env);
+  for (var k = 0; k < keys.length; k++) {
+    if (keys[k].indexOf(prefix) === 0 && env[keys[k]] && String(env[keys[k]]).length > 0) {
+      return String(env[keys[k]]);
+    }
+  }
+  return '';
+}
+
 async function verifyPaypalSignature(req, rawBody, webhookConfig) {
   try {
-    var clientId = process.env.PAYPAL_CLIENT_ID || '';
-    var clientSecret = process.env.PAYPAL_CLIENT_SECRET || '';
-    if (!clientId || !clientSecret) return false;
+    var clientId = resolvePaypalEnv(['PAYPAL_CLIENT_ID', 'CONFIGURATION_PAYPAL_CLIENT_ID'], 'CONFIGURATION_PAYPAL_CLIENT_ID');
+    var clientSecret = resolvePaypalEnv(['PAYPAL_CLIENT_SECRET', 'CONFIGURATION_PAYPAL_CLIENT_SECRET'], 'CONFIGURATION_PAYPAL_CLIENT_SECRET');
+    var webhookId = resolvePaypalEnv([webhookConfig.signatureSecret || '', 'PAYPAL_WEBHOOK_ID', 'CONFIGURATION_PAYPAL_WEBHOOK_ID'], 'CONFIGURATION_PAYPAL_WEBHOOK_ID');
+    if (!clientId || !clientSecret) {
+      console.error('PayPal webhook rejected: PAYPAL_CLIENT_ID / PAYPAL_CLIENT_SECRET are not configured');
+      return false;
+    }
+    if (!webhookId) {
+      console.error('PayPal webhook rejected: the webhook id (PAYPAL_WEBHOOK_ID) is not configured');
+      return false;
+    }
 
-    var isLive = !clientId.startsWith('sb-');
-    var baseUrl = isLive ? 'https://api-m.paypal.com' : 'https://api-m.sandbox.paypal.com';
+    var certUrl = String(req.headers['paypal-cert-url'] || '');
+    var isSandbox = certUrl.indexOf('sandbox.paypal.com') !== -1;
+    var baseUrl = isSandbox ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
 
     var authResponse = await fetch(baseUrl + '/v1/oauth2/token', {
       method: 'POST',
@@ -83,29 +138,39 @@ async function verifyPaypalSignature(req, rawBody, webhookConfig) {
       body: 'grant_type=client_credentials',
     });
     var authData = await authResponse.json();
-    if (!authData.access_token) return false;
-
-    var webhookId = process.env[webhookConfig.signatureSecret] || '';
+    if (!authData.access_token) {
+      console.error('PayPal webhook rejected: authentication against ' + baseUrl + ' failed — ' + (authData.error_description || authData.error || 'no token'));
+      return false;
+    }
 
+    // PayPal checks the signature over the event EXACTLY as it was sent, so
+    // the raw text is spliced in by position before the closing brace: parsed
+    // and serialised again, a number or a character escape can come back
+    // spelled differently and the signature no longer matches.
+    var fields = JSON.stringify({
+      auth_algo: req.headers['paypal-auth-algo'] || '',
+      cert_url: req.headers['paypal-cert-url'] || '',
+      transmission_id: req.headers['paypal-transmission-id'] || '',
+      transmission_sig: req.headers['paypal-transmission-sig'] || '',
+      transmission_time: req.headers['paypal-transmission-time'] || '',
+      webhook_id: webhookId,
+    });
     var verifyResponse = await fetch(baseUrl + '/v1/notifications/verify-webhook-signature', {
       method: 'POST',
       headers: {
         'Authorization': 'Bearer ' + authData.access_token,
         'Content-Type': 'application/json',
       },
-      body: JSON.stringify({
-        auth_algo: req.headers['paypal-auth-algo'] || '',
-        cert_url: req.headers['paypal-cert-url'] || '',
-        transmission_id: req.headers['paypal-transmission-id'] || '',
-        transmission_sig: req.headers['paypal-transmission-sig'] || '',
-        transmission_time: req.headers['paypal-transmission-time'] || '',
-        webhook_id: webhookId,
-        webhook_event: JSON.parse(rawBody.toString('utf-8')),
-      }),
+      body: fields.slice(0, -1) + ',"webhook_event":' + rawBody.toString('utf-8') + '}',
     });
     var verifyData = await verifyResponse.json();
-    return verifyData.verification_status === 'SUCCESS';
-  } catch (_e) {
+    var ok = verifyData.verification_status === 'SUCCESS';
+    if (!ok) {
+      console.error('PayPal webhook rejected by ' + baseUrl + ': verification_status=' + (verifyData.verification_status || '(missing)') + ', name=' + (verifyData.name || '(none)') + ', message=' + (verifyData.message || '(none)'));
+    }
+    return ok;
+  } catch (e) {
+    console.error('PayPal webhook verification failed:', e && e.message);
     return false;
   }
 }`;
@@ -138,23 +203,37 @@ function verifyHmac${algorithm === 'sha1' ? 'Sha1' : ''}Signature(rawBody, signa
 }`;
 };
 exports.generateHmacSignatureVerificationCode = generateHmacSignatureVerificationCode;
+// Fails CLOSED: a scheme it does not know, or a shared-secret scheme whose
+// secret is not configured, is a refusal — an HMAC keyed with an empty string
+// is one anybody can compute. `custom` is the author verifying the request in
+// the workflow itself (headers and body are on the trigger context); payment
+// webhooks never use it (see `generatePaymentWebhookVerificationCode`).
 const generateSignatureDispatcherCode = () => {
     return `
 async function verifyWebhookSignature(req, rawBody, webhookConfig) {
   var algorithm = webhookConfig.signatureAlgorithm || 'hmac-sha256';
   var sigHeader = webhookConfig.signatureHeader || '';
   var sigSecret = webhookConfig.signatureSecret || '';
-  var secret = process.env[sigSecret] || '';
+  var secret = sigSecret ? process.env[sigSecret] || '' : '';
 
-  if (algorithm === 'stripe-v1') {
-    var sig = req.headers[sigHeader || 'stripe-signature'] || '';
-    return verifyStripeSignature(rawBody, sig, secret);
+  if (algorithm === 'custom') {
+    return true;
   }
 
   if (algorithm === 'paypal-v1') {
     return await verifyPaypalSignature(req, rawBody, webhookConfig);
   }
 
+  if (!secret) {
+    console.error('Webhook rejected: the signing secret (' + (sigSecret || 'none named') + ') is not configured.');
+    return false;
+  }
+
+  if (algorithm === 'stripe-v1') {
+    var sig = req.headers[sigHeader || 'stripe-signature'] || '';
+    return verifyStripeSignature(rawBody, sig, secret);
+  }
+
   if (algorithm === 'hmac-sha256') {
     var hmacSig = req.headers[(sigHeader || '').toLowerCase()] || '';
     return verifyHmacSignature(rawBody, hmacSig, secret);
@@ -165,10 +244,86 @@ async function verifyWebhookSignature(req, rawBody, webhookConfig) {
     return verifyHmacSha1Signature(rawBody, hmacSha1Sig, secret);
   }
 
-  return true;
+  console.error('Webhook rejected: unknown signature algorithm "' + algorithm + '".');
+  return false;
 }`;
 };
 exports.generateSignatureDispatcherCode = generateSignatureDispatcherCode;
+/**
+ * A PAYMENT webhook is verified by the store's driver for its provider (see
+ * `src/payments`): a signature, or the event read back from the provider
+ * with the store's own key. The answer carries the AUTHORITATIVE body — the
+ * copy the provider gave back, where there is one — and whether the provider
+ * should try again (an outage) rather than drop the delivery.
+ *
+ * The store's own server may also ask the route to SETTLE a payment it just
+ * confirmed with the provider (a PayPal buyer's return): a body naming
+ * `teleportReconcile`, accepted only with the runtime's internal-call token.
+ * The driver reads the payment from the provider and answers the event the
+ * provider sends for it; nothing but the provider's id is taken from the
+ * request, and any other caller is refused outright.
+ */
+const generatePaymentWebhookVerificationCode = () => {
+    return `
+async function settlePaymentFromProvider(req, body, provider, driver) {
+  var internal = typeof utils !== 'undefined' && utils && typeof utils.isInternalCall === 'function' && utils.isInternalCall(req);
+  if (!internal || typeof driver.reconcile !== 'function') {
+    console.error('Payment webhook rejected (' + provider + '): a settlement request that did not come from this store.');
+    return { ok: false, retry: false };
+  }
+  try {
+    var settled = await driver.reconcile(body.teleportReconcile);
+    if (!settled || !settled.ok) {
+      console.error('Payment settlement skipped (' + provider + '): ' + ((settled && settled.reason) || 'not settled'));
+      return { ok: false, retry: !!(settled && settled.retry) };
+    }
+    return { ok: true, body: settled.body };
+  } catch (e) {
+    console.error('Payment settlement failed (' + provider + '):', e && e.message);
+    return { ok: false, retry: true };
+  }
+}
+
+async function verifyPaymentWebhook(req, rawBody, body, webhookConfig) {
+  var provider = webhookConfig.paymentProvider;
+  var driver = typeof __paymentDrivers !== 'undefined' && __paymentDrivers ? __paymentDrivers.get(provider) : null;
+  if (!driver || typeof driver.verifyWebhook !== 'function') {
+    console.error('Payment webhook rejected: this store has no ' + provider + ' payment driver.');
+    return { ok: false, retry: false };
+  }
+  if (body && typeof body === 'object' && body.teleportReconcile) {
+    return settlePaymentFromProvider(req, body, provider, driver);
+  }
+  var host = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim();
+  var proto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim() ||
+    (host.indexOf('localhost') === 0 || host.indexOf('127.0.0.1') === 0 ? 'http' : 'https');
+  var sigSecret = webhookConfig.signatureSecret || '';
+  var sigSecretValue = sigSecret ? String(process.env[sigSecret] || '') : '';
+  try {
+    var result = await driver.verifyWebhook({
+      headers: req.headers || {},
+      rawBody: rawBody,
+      body: body,
+      query: req.query || {},
+      // The whole URL the provider posted to, query string included: Square
+      // signs the notification URL exactly as it was registered.
+      url: host ? proto + '://' + host + String(req.url || '') : '',
+      // A placeholder the deploy never resolved (a local run) is no secret:
+      // the driver then reads the saved credential itself.
+      secret: sigSecretValue.indexOf('teleporthq.secrets.') === 0 ? '' : sigSecretValue,
+    });
+    if (!result || !result.ok) {
+      console.error('Payment webhook rejected (' + provider + '): ' + ((result && result.reason) || 'not verified'));
+      return { ok: false, retry: !!(result && result.retry) };
+    }
+    return { ok: true, body: result.body || body };
+  } catch (e) {
+    console.error('Payment webhook verification failed (' + provider + '):', e && e.message);
+    return { ok: false, retry: true };
+  }
+}`;
+};
+exports.generatePaymentWebhookVerificationCode = generatePaymentWebhookVerificationCode;
 const generateAllSignatureVerificationCode = () => {
     return [
         (0, exports.generateStripeSignatureVerificationCode)(),

package/dist/cjs/webhook-signature-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature-verification.js","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":";;;AAAO,MAAM,sBAAsB,GAAG,GAAW,EAAE;IACjD,OAAO;;;;;;;;;;;;EAYP,CAAA;AACF,CAAC,CAAA;AAdY,QAAA,sBAAsB,0BAclC;AAEM,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CP,CAAA;AACF,CAAC,CAAA;AA5CY,QAAA,uCAAuC,2CA4CnD;AAEM,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CP,CAAA;AACF,CAAC,CAAA;AA9CY,QAAA,uCAAuC,2CA8CnD;AAEM,MAAM,qCAAqC,GAAG,CACnD,YAA+B,QAAQ,EAC/B,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvD,OAAO;qBAEL,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAClC;;;;qBAImB,MAAM;;;;+CAIoB,MAAM;;;;;;;;;;;;;EAanD,CAAA;AACF,CAAC,CAAA;AA7BY,QAAA,qCAAqC,yCA6BjD;AAEM,MAAM,+BAA+B,GAAG,GAAW,EAAE;IAC1D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,CAAA;AACF,CAAC,CAAA;AA7BY,QAAA,+BAA+B,mCA6B3C;AAEM,MAAM,oCAAoC,GAAG,GAAW,EAAE;IAC/D,OAAO;QACL,IAAA,+CAAuC,GAAE;QACzC,IAAA,+CAAuC,GAAE;QACzC,IAAA,6CAAqC,EAAC,QAAQ,CAAC;QAC/C,IAAA,6CAAqC,EAAC,MAAM,CAAC;QAC7C,IAAA,uCAA+B,GAAE;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC,CAAA;AARY,QAAA,oCAAoC,wCAQhD"}
+{"version":3,"file":"webhook-signature-verification.js","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AAC1E,MAAM,uBAAuB,GAAG,GAAW,EAAE;IAClD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCP,CAAA;AACF,CAAC,CAAA;AArCY,QAAA,uBAAuB,2BAqCnC;AAEM,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CP,CAAA;AACF,CAAC,CAAA;AA5CY,QAAA,uCAAuC,2CA4CnD;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,2DAA2D;AACpD,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8EP,CAAA;AACF,CAAC,CAAA;AAhFY,QAAA,uCAAuC,2CAgFnD;AAEM,MAAM,qCAAqC,GAAG,CACnD,YAA+B,QAAQ,EAC/B,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvD,OAAO;qBAEL,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAClC;;;;qBAImB,MAAM;;;;+CAIoB,MAAM;;;;;;;;;;;;;EAanD,CAAA;AACF,CAAC,CAAA;AA7BY,QAAA,qCAAqC,yCA6BjD;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACjE,MAAM,+BAA+B,GAAG,GAAW,EAAE;IAC1D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCP,CAAA;AACF,CAAC,CAAA;AAvCY,QAAA,+BAA+B,mCAuC3C;AAED;;;;;;;;;;;;;GAaG;AACI,MAAM,sCAAsC,GAAG,GAAW,EAAE;IACjE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDP,CAAA;AACF,CAAC,CAAA;AA3DY,QAAA,sCAAsC,0CA2DlD;AAEM,MAAM,oCAAoC,GAAG,GAAW,EAAE;IAC/D,OAAO;QACL,IAAA,+CAAuC,GAAE;QACzC,IAAA,+CAAuC,GAAE;QACzC,IAAA,6CAAqC,EAAC,QAAQ,CAAC;QAC/C,IAAA,6CAAqC,EAAC,MAAM,CAAC;QAC7C,IAAA,uCAA+B,GAAE;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC,CAAA;AARY,QAAA,oCAAoC,wCAQhD"}

package/dist/cjs/workflow-auth-generator.d.ts

@@ -1,4 +1,10 @@
 import { UIDLWorkflowProtection } from '@teleporthq/teleport-types';
+/**
+ * `roleOf(token)` — the role a decoded session token carries (`role`,
+ * `roleName`, or the first of `roles`), or null. Shared by every generated
+ * guard that authorises by role, so they can never read the claim differently.
+ */
+export declare const ROLE_OF_TOKEN_CODE = "function roleOf(token) {\n  if (!token || typeof token !== 'object') {\n    return null;\n  }\n  if (typeof token.role === 'string') {\n    return token.role;\n  }\n  if (typeof token.roleName === 'string') {\n    return token.roleName;\n  }\n  if (Array.isArray(token.roles) && token.roles.length > 0 && typeof token.roles[0] === 'string') {\n    return token.roles[0];\n  }\n  return null;\n}";
 /**
  * The shared, stateless auth guard for generated workflow API routes, emitted
  * once at `utils/workflows/workflow-auth.js`.
@@ -17,12 +23,9 @@ import { UIDLWorkflowProtection } from '@teleporthq/teleport-types';
  * serverless instance that had not yet served an auth request was reported
  * anonymous, and the page-load workflow answered 401.
  */
-export declare const generateWorkflowAuthHelperFile: () => string;
-/**
- * The route-side pieces that wire a workflow's protection policy into a
- * generated API-route handler. Empty strings when the workflow has no policy,
- * so an unprotected route is byte-identical to before.
- */
+export declare const generateWorkflowAuthHelperFile: (options?: {
+    withSubscriberAccess?: boolean;
+}) => string;
 export interface WorkflowAuthInjection {
     requireLine: string;
     policyConst: string;

package/dist/cjs/workflow-auth-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-auth-generator.d.ts","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAGnE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B,QAAO,MA6GjD,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAEpC,WAAW,EAAE,MAAM,CAAA;IAEnB,WAAW,EAAE,MAAM,CAAA;IAGnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,eAAO,MAAM,0BAA0B,eACzB,sBAAsB,GAAG,SAAS,KAC7C,qBA4BF,CAAA"}
+{"version":3,"file":"workflow-auth-generator.d.ts","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAGnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,+YAc7B,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B,aAChC;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC1C,MAgKF,CAAA;AA2BD,MAAM,WAAW,qBAAqB;IAEpC,WAAW,EAAE,MAAM,CAAA;IAEnB,WAAW,EAAE,MAAM,CAAA;IAGnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,eAAO,MAAM,0BAA0B,eACzB,sBAAsB,GAAG,SAAS,KAC7C,qBA2CF,CAAA"}

package/dist/cjs/workflow-auth-generator.js

@@ -1,7 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildWorkflowAuthInjection = exports.generateWorkflowAuthHelperFile = void 0;
+exports.buildWorkflowAuthInjection = exports.generateWorkflowAuthHelperFile = exports.ROLE_OF_TOKEN_CODE = void 0;
 const session_cookie_resolver_1 = require("./session-cookie-resolver");
+/**
+ * `roleOf(token)` — the role a decoded session token carries (`role`,
+ * `roleName`, or the first of `roles`), or null. Shared by every generated
+ * guard that authorises by role, so they can never read the claim differently.
+ */
+exports.ROLE_OF_TOKEN_CODE = `function roleOf(token) {
+  if (!token || typeof token !== 'object') {
+    return null;
+  }
+  if (typeof token.role === 'string') {
+    return token.role;
+  }
+  if (typeof token.roleName === 'string') {
+    return token.roleName;
+  }
+  if (Array.isArray(token.roles) && token.roles.length > 0 && typeof token.roles[0] === 'string') {
+    return token.roles[0];
+  }
+  return null;
+}`;
 /**
  * The shared, stateless auth guard for generated workflow API routes, emitted
  * once at `utils/workflows/workflow-auth.js`.
@@ -20,7 +40,7 @@ const session_cookie_resolver_1 = require("./session-cookie-resolver");
  * serverless instance that had not yet served an auth request was reported
  * anonymous, and the page-load workflow answered 401.
  */
-const generateWorkflowAuthHelperFile = () => {
+const generateWorkflowAuthHelperFile = (options = {}) => {
     return `'use strict';
 
 // GENERATED — see generateWorkflowAuthHelperFile in
@@ -43,20 +63,22 @@ function sessionUserId(token) {
   return token.id != null ? token.id : (token.sub != null ? token.sub : null);
 }
 
-function roleOf(token) {
-  if (!token || typeof token !== 'object') {
-    return null;
-  }
-  if (typeof token.role === 'string') {
-    return token.role;
-  }
-  if (typeof token.roleName === 'string') {
-    return token.roleName;
+${exports.ROLE_OF_TOKEN_CODE}
+
+${generateSubscriberAccessLoader(options.withSubscriberAccess === true)}
+
+// true only when the session user holds an entitled subscription to one of the
+// products (any product for an empty list). Every failure fails closed.
+async function isEntitledSubscriber(token, productIds) {
+  var userId = sessionUserId(token);
+  if (userId == null || String(userId) === '') {
+    return false;
   }
-  if (Array.isArray(token.roles) && token.roles.length > 0 && typeof token.roles[0] === 'string') {
-    return token.roles[0];
+  try {
+    return (await subscriberAccessModule().isSubscriberEntitled(String(userId), productIds || [])) === true;
+  } catch (e) {
+    return false;
   }
-  return null;
 }
 
 // Overwrites context[nodeId] drilled down \`path\` with the session user id.
@@ -77,16 +99,35 @@ function bindPath(root, path, value) {
 
 // Returns null when the request may proceed, or { status, message } to reject.
 // Mutates \`context\` in place to bind user-owned columns to the session user.
+function sameSecret(given, expected) {
+  if (typeof given !== 'string' || typeof expected !== 'string' || given.length !== expected.length) {
+    return false;
+  }
+  return require('crypto').timingSafeEqual(Buffer.from(given), Buffer.from(expected));
+}
+
 async function guardWorkflowRequest(req, context, policy) {
   if (!policy) {
     return null;
   }
 
+  // This deployment's own server code (a webhook or cron route running a
+  // custom node) carries the internal-call token and passes every gate. A route
+  // only such code may call (serverOnly) answers nothing to anyone else — not a
+  // browser, not a signed-in admin.
+  var internalCall = require('./server-runtime').isInternalCall(req);
+  if (policy.serverOnly) {
+    return internalCall ? null : { status: 401, message: 'Unauthenticated' };
+  }
+  if (internalCall) {
+    return null;
+  }
+
   // Trusted internal server-to-server calls (e.g. password reset, server jobs)
   // present the app secret in a header; only server code can read
   // NEXTAUTH_SECRET, so a browser cannot forge it. These bypass the check.
   var internal = req && req.headers && req.headers['x-internal-data-secret'];
-  if (internal && process.env.NEXTAUTH_SECRET && internal === process.env.NEXTAUTH_SECRET) {
+  if (internal && process.env.NEXTAUTH_SECRET && sameSecret(internal, process.env.NEXTAUTH_SECRET)) {
     return null;
   }
 
@@ -104,23 +145,53 @@ async function guardWorkflowRequest(req, context, policy) {
     }
   }
 
+  // Subscriber-only page: the route runs the same entitlement check the
+  // middleware asks the subscriber-access route for, after the session and the
+  // role are settled.
+  if (policy.requiresSubscription) {
+    if (!token) {
+      return { status: 401, message: 'Unauthenticated' };
+    }
+    if (!(await isEntitledSubscriber(token, policy.subscriptionProductIds || []))) {
+      return { status: 403, message: 'Subscription required' };
+    }
+  }
+
   // Identity binding: force every user-owned column to the AUTHENTICATED session
-  // id so a caller can never act on another user's rows. Only when a session is
-  // present — a guest keeps their (anonymous) client identity, which is why a
-  // guest-capable public write is not blocked here.
+  // id so a caller can never act on another user's rows.
+  //  - A plain user-id binding only applies when a session is present — a guest
+  //    keeps their (anonymous) client identity, which is why a guest-capable
+  //    public write is not blocked here.
+  //  - A \`claim: 'role'\` binding (a raw query's admin check) ALWAYS gets the
+  //    session's role, '' for a guest or a session without one, so a browser
+  //    can never claim a role it does not hold. Skipping it for a guest would
+  //    let a signed-out request post \`role: 'admin'\` and read every row.
+  //  - A \`claim: 'signedInUserId'\` binding always gets the session user id,
+  //    '' for a guest: a statement that must only ever touch the signed-in
+  //    caller's own row matches nothing for anybody else.
   if (policy.userScoped && context) {
     var sid = sessionUserId(token);
-    if (sid != null) {
-      var bindings = (policy.userScoped && policy.userScoped.bindings) || [];
-      for (var i = 0; i < bindings.length; i++) {
-        var b = bindings[i];
-        if (b && b.nodeId) {
-          if (context[b.nodeId] == null || typeof context[b.nodeId] !== 'object') {
-            context[b.nodeId] = {};
-          }
-          bindPath(context[b.nodeId], b.path || [], sid);
-        }
+    var sessionRole = roleOf(token) || '';
+    var bindings = (policy.userScoped && policy.userScoped.bindings) || [];
+    for (var i = 0; i < bindings.length; i++) {
+      var b = bindings[i];
+      if (!b || !b.nodeId) {
+        continue;
       }
+      var value;
+      if (b.claim === 'role') {
+        value = sessionRole;
+      } else if (b.claim === 'signedInUserId') {
+        value = sid != null ? sid : '';
+      } else if (sid != null) {
+        value = sid;
+      } else {
+        continue;
+      }
+      if (context[b.nodeId] == null || typeof context[b.nodeId] !== 'object') {
+        context[b.nodeId] = {};
+      }
+      bindPath(context[b.nodeId], b.path || [], value);
     }
   }
 
@@ -131,9 +202,33 @@ module.exports = { guardWorkflowRequest: guardWorkflowRequest };
 `;
 };
 exports.generateWorkflowAuthHelperFile = generateWorkflowAuthHelperFile;
+/**
+ * The route-side pieces that wire a workflow's protection policy into a
+ * generated API-route handler. Empty strings when the workflow has no policy,
+ * so an unprotected route is byte-identical to before.
+ */
+/**
+ * The entitlement query lives in `utils/auth/subscriber-access.js`, which the
+ * auth plugin emits only when a page is subscriber-only. A `require` of it is a
+ * static import to the bundler even inside a function, so it may only appear
+ * when that file exists — otherwise every project without such a page fails
+ * its build with "Module not found". Without the file the loader throws, and
+ * `isEntitledSubscriber` reads that as "not entitled" (fail closed).
+ */
+const generateSubscriberAccessLoader = (withSubscriberAccess) => withSubscriberAccess
+    ? `// Entitlement query emitted with the subscriber-access route.
+function subscriberAccessModule() {
+  return require('../auth/subscriber-access');
+}`
+    : `// No page is subscriber-only, so no entitlement query was emitted: a policy
+// that still asks for a subscription fails closed.
+function subscriberAccessModule() {
+  throw new Error('No subscriber-only pages in this project');
+}`;
 const EMPTY_INJECTION = { requireLine: '', policyConst: '', guardCall: '' };
 const buildWorkflowAuthInjection = (protection) => {
-    if (!protection || (!protection.requiresAuth && !protection.userScoped)) {
+    if (!protection ||
+        (!protection.requiresAuth && !protection.userScoped && !protection.serverOnly)) {
         return EMPTY_INJECTION;
     }
     // Only the fields the runtime guard reads — `derivedFrom` is build-time only.
@@ -141,9 +236,18 @@ const buildWorkflowAuthInjection = (protection) => {
         requiresAuth: !!protection.requiresAuth,
         allowedRoles: protection.allowedRoles || [],
     };
+    if (protection.serverOnly) {
+        policy.serverOnly = true;
+    }
     if (protection.userScoped) {
         policy.userScoped = protection.userScoped;
     }
+    if (protection.requiresSubscription) {
+        policy.requiresSubscription = true;
+        policy.subscriptionProductIds = (protection.subscriptionProductIds || [])
+            .map((id) => String(id).trim())
+            .filter((id) => id.length > 0);
+    }
     return {
         requireLine: `const __wfAuth = require('../../../utils/workflows/workflow-auth');\n`,
         policyConst: `const __WF_AUTH = ${JSON.stringify(policy)};\n`,

package/dist/cjs/workflow-auth-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-auth-generator.js","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":";;;AACA,uEAAoF;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,8BAA8B,GAAG,GAAW,EAAE;IACzD,OAAO;;;;;;;;;EASP,IAAA,kEAAwC,GAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkG3C,CAAA;AACD,CAAC,CAAA;AA7GY,QAAA,8BAA8B,kCA6G1C;AAiBD,MAAM,eAAe,GAA0B,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AAE3F,MAAM,0BAA0B,GAAG,CACxC,UAA8C,EACvB,EAAE;IACzB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QACvE,OAAO,eAAe,CAAA;KACvB;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAIR;QACF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;KAC5C,CAAA;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;KAC1C;IAED,OAAO;QACL,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK;QAC7D,SAAS,EAAE;;;;;MAKT;KACH,CAAA;AACH,CAAC,CAAA;AA9BY,QAAA,0BAA0B,8BA8BtC"}
+{"version":3,"file":"workflow-auth-generator.js","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":";;;AACA,uEAAoF;AAEpF;;;;GAIG;AACU,QAAA,kBAAkB,GAAG;;;;;;;;;;;;;;EAchC,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,8BAA8B,GAAG,CAC5C,UAA8C,EAAE,EACxC,EAAE;IACV,OAAO;;;;;;;;;EASP,IAAA,kEAAwC,GAAE;;;;;;;;;;;;;EAa1C,0BAAkB;;EAElB,8BAA8B,CAAC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsItE,CAAA;AACD,CAAC,CAAA;AAlKY,QAAA,8BAA8B,kCAkK1C;AAED;;;;GAIG;AACH;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,CAAC,oBAA6B,EAAU,EAAE,CAC/E,oBAAoB;IAClB,CAAC,CAAC;;;EAGJ;IACE,CAAC,CAAC;;;;EAIJ,CAAA;AAYF,MAAM,eAAe,GAA0B,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AAE3F,MAAM,0BAA0B,GAAG,CACxC,UAA8C,EACvB,EAAE;IACzB,IACE,CAAC,UAAU;QACX,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAC9E;QACA,OAAO,eAAe,CAAA;KACvB;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAOR;QACF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;KAC5C,CAAA;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;KACzB;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;KAC1C;IACD,IAAI,UAAU,CAAC,oBAAoB,EAAE;QACnC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,MAAM,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC;aACtE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;KACjC;IAED,OAAO;QACL,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK;QAC7D,SAAS,EAAE;;;;;MAKT;KACH,CAAA;AACH,CAAC,CAAA;AA7CY,QAAA,0BAA0B,8BA6CtC"}

package/dist/cjs/workflow-component-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-component-plugin.d.ts","sourceRoot":"","sources":["../../src/workflow-component-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAUvB,MAAM,4BAA4B,CAAA;AAgBnC,UAAU,oBAAoB;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAiLD,eAAO,MAAM,wBAAwB,EAAE,sBAAsB,CAAC,oBAAoB,CAsejF,CAAA"}
+{"version":3,"file":"workflow-component-plugin.d.ts","sourceRoot":"","sources":["../../src/workflow-component-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAUvB,MAAM,4BAA4B,CAAA;AAuBnC,UAAU,oBAAoB;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAiLD,eAAO,MAAM,wBAAwB,EAAE,sBAAsB,CAAC,oBAAoB,CA8ejF,CAAA"}