@teleporthq/teleport-plugin-next-workflows 0.44.10 → 0.44.17

package/dist/esm/server-custom-node-call.js

@@ -0,0 +1,278 @@
+/**
+ * The shared "Record Event" writer answers only this deployment's own server
+ * code (its protection is `serverOnly`): its route refuses anything without
+ * the internal-call token. The editor therefore marks every call of the writer
+ * `executionEnv: 'server'` (teleport-gui
+ * `mappers/domain-to-uidl/workflows/protection`), the segment splitter keeps
+ * that call in a server segment of its caller, and that segment's route runs
+ * it — the writer's own segment is then called with the route's internal
+ * credentials (`context.__internalHeaders`), as a webhook or cron route calls
+ * a custom node.
+ *
+ * Only those calls: each is baked into its route by node id and custom-node
+ * id. Any other custom-node call a server segment holds (a loop that also
+ * reads the database pulls its whole body onto the server) stays the inert
+ * marker it always was there, so it never borrows the internal-call token
+ * past its own login, role, subscription or cost gates.
+ *
+ * And only from what the server did: every parameter of such a call must be a
+ * literal of the route's own config or the result of a node that ran on the
+ * server (in this segment, or a signed result of an earlier one). A value the
+ * visitor's browser supplied — a browser step's result, the trigger, the page
+ * state, the clicked element — refuses the export with the owner's reason,
+ * so the next builder cannot record an event a visitor makes up. Two kinds of
+ * route are not asked: one only server code calls (`serverOnly`: its
+ * "browser" steps run on the server), and one every role of which is a staff
+ * role (`TableAccess.resolveStaffRoles`: the generated admin — whoever runs it
+ * can do what the event says anyway). A role a visitor can hold (`user`, a
+ * customer role) is asked.
+ *
+ * The marked node runs with the route's internal credentials. A custom-node
+ * call nested inside it runs as the visitor would run it — without the
+ * internal-call token — so it keeps its own login, role and subscription
+ * gates; inside a server job (a webhook, cron or automation run, whose context
+ * carries the server-job flag) it keeps the token, and the run stays the
+ * job's end to end.
+ */
+/**
+ * What this code generator does with the calls the editor marks. The editor
+ * imports it where it marks them: an editor built against a code generator
+ * without this behaviour fails to build instead of shipping calls the writer's
+ * route refuses.
+ */
+export const SERVER_CUSTOM_NODE_CALLS_VERSION = 1;
+/** A call the editor marked to run in its caller's server segment. */
+const isServerRunCall = (node) => {
+    var _a;
+    const customNodeId = (_a = node.config) === null || _a === void 0 ? void 0 : _a.customNodeId;
+    return (node.type === 'general-custom-node' &&
+        node.executionEnv === 'server' &&
+        typeof customNodeId === 'string' &&
+        customNodeId.length > 0);
+};
+export const serverRunCustomNodeCalls = (segment) => segment.nodes.filter(isServerRunCall);
+const WHOLE_TEMPLATE_TOKEN = /^\s*\{\{[\s\S]*\}\}\s*$/;
+const CONTEXT_CHIP_CLASS = 'context-value-inline';
+// A quoted attribute of an opening tag, read as the runtime reads it
+// (extractHtmlAttr in executor-generator).
+const htmlAttribute = (tag, name) => {
+    const key = `${name}=`;
+    const at = tag.indexOf(key);
+    if (at === -1) {
+        return '';
+    }
+    const quote = tag.charAt(at + key.length);
+    if (quote !== '"' && quote !== "'") {
+        return '';
+    }
+    const start = at + key.length + 1;
+    const end = tag.indexOf(quote, start);
+    return end === -1 ? '' : tag.slice(start, end);
+};
+/**
+ * The nodes the context chips of a rich text read, by the runtime's own rule
+ * (richTextChipRef in executor-generator): a chip's node id, else the first
+ * segment of its path — so a chip with no node id, or an empty one, is read
+ * from where the runtime would read it.
+ */
+const chipSourceNodeIds = (html) => {
+    if (html.indexOf(CONTEXT_CHIP_CLASS) === -1) {
+        return [];
+    }
+    const nodeIds = [];
+    let at = 0;
+    while (at < html.length) {
+        const spanStart = html.indexOf('<span', at);
+        if (spanStart === -1) {
+            break;
+        }
+        const openEnd = html.indexOf('>', spanStart);
+        if (openEnd === -1) {
+            break;
+        }
+        const openTag = html.slice(spanStart, openEnd + 1);
+        at = openEnd + 1;
+        if (openTag.indexOf(CONTEXT_CHIP_CLASS) === -1) {
+            continue;
+        }
+        let nodeId = htmlAttribute(openTag, 'data-ctx-node-id');
+        if (!nodeId) {
+            const pathRaw = htmlAttribute(openTag, 'data-ctx-path')
+                .replace(/&quot;/g, '"')
+                .replace(/&#34;/g, '"')
+                .replace(/&amp;/g, '&');
+            try {
+                const path = pathRaw ? JSON.parse(pathRaw) : null;
+                if (Array.isArray(path) && path.length > 0) {
+                    nodeId = String(path[0]);
+                }
+            }
+            catch (_a) {
+                nodeId = '';
+            }
+        }
+        if (nodeId) {
+            nodeIds.push(nodeId);
+        }
+    }
+    return nodeIds;
+};
+const collectSources = (value, into) => {
+    if (value === null || value === undefined) {
+        return;
+    }
+    if (typeof value === 'string') {
+        if (WHOLE_TEMPLATE_TOKEN.test(value)) {
+            into.pageValue = into.pageValue || value.trim();
+            return;
+        }
+        into.nodeIds.push(...chipSourceNodeIds(value));
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item) => collectSources(item, into));
+        return;
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        if (record.type === 'workflowContext' && typeof record.nodeId === 'string') {
+            into.nodeIds.push(record.nodeId);
+            return;
+        }
+        if (record.type === 'ctx') {
+            into.pageValue = into.pageValue || 'the element the visitor used';
+            return;
+        }
+        Object.keys(record).forEach((key) => collectSources(record[key], into));
+    }
+};
+const describeStep = (node, fallbackId) => {
+    const named = node && (node.name || node.label);
+    return named ? `"${named}" (${fallbackId})` : `the step ${fallbackId}`;
+};
+/**
+ * Every marked call of the segment that takes a value the browser supplied,
+ * naming the step and its source. `graphNodes` are the caller's nodes, for the
+ * names.
+ */
+export const findBrowserBoundCallParameters = (segment, trust, options) => {
+    const protection = options.protection;
+    const staff = new Set(options.staffRoles || ['admin']);
+    const roles = (protection && protection.allowedRoles) || [];
+    if (protection &&
+        (protection.serverOnly ||
+            (protection.requiresAuth && roles.length > 0 && roles.every((role) => staff.has(role))))) {
+        return [];
+    }
+    const fromServer = new Set([
+        ...segment.nodeIds,
+        ...((trust && trust.signedNodeIds) || []),
+    ]);
+    const byId = new Map();
+    for (const node of options.graphNodes || segment.nodes) {
+        byId.set(node.id, node);
+    }
+    const found = [];
+    for (const call of serverRunCustomNodeCalls(segment)) {
+        const sources = { nodeIds: [], pageValue: null };
+        collectSources(call.config.parameters, sources);
+        const fromBrowser = sources.nodeIds.find((nodeId) => !fromServer.has(nodeId));
+        if (!fromBrowser && !sources.pageValue) {
+            continue;
+        }
+        const source = fromBrowser
+            ? `the result of ${describeStep(byId.get(fromBrowser), fromBrowser)}, which runs in the visitor's browser`
+            : `${sources.pageValue}, a value the visitor's browser sends`;
+        found.push({
+            nodeId: call.id,
+            message: `The step ${describeStep(call, call.id)} in "${options.owner}" records an event with ${source}. An event can only be recorded from what the site's server did, or a visitor could record one that never happened. Run the setup of the feature that made this workflow again (or remove the step), then publish again.`,
+        });
+    }
+    return found;
+};
+/** Throws the first of `findBrowserBoundCallParameters`: the export stops there. */
+export const assertServerBoundCallParameters = (segment, trust, options) => {
+    const [first] = findBrowserBoundCallParameters(segment, trust, options);
+    if (first) {
+        throw new Error(first.message);
+    }
+};
+/**
+ * Emitted right after a server segment route's `nodeHandlers`, only when the
+ * segment holds a marked call (every other route is byte-identical): the
+ * `general-custom-node` handler — whose browser version only hands back a
+ * marker — then runs exactly the marked calls, in the route's main pass, its
+ * loop bodies and its parallel branches alike, and hands every other call
+ * back as the marker. A marked node this build does not have is an error,
+ * never a silent skip, with the reason the custom-node module did not load.
+ */
+export const generateServerCustomNodeCallCode = (segment, relativePrefix) => {
+    const calls = serverRunCustomNodeCalls(segment);
+    if (calls.length === 0) {
+        return '';
+    }
+    const baked = {};
+    for (const call of calls) {
+        baked[call.id] = call.config.customNodeId;
+    }
+    return `
+// The calls the editor marked to run on the server (the event writer, which
+// answers this deployment's server code only): they run here, the node's own
+// segment called with this route's internal credentials. Any other custom-node
+// call stays the marker it is in a browser. One nested inside a marked node
+// runs as the visitor would run it, without the internal-call token — except
+// in a server job (the server-job flag), where it keeps the token. See
+// server-custom-node-call.ts.
+var __SERVER_RUN_CALLS = ${JSON.stringify(baked)};
+var __serverCustomNodes = null;
+var __serverCustomNodesError = null;
+try { __serverCustomNodes = require('${relativePrefix}/utils/workflows/custom-nodes'); } catch (error) { __serverCustomNodesError = error; }
+function __serverCustomNode(customNodeId) {
+  var run = __serverCustomNodes ? __serverCustomNodes[customNodeId] : null;
+  if (typeof run !== 'function') {
+    throw new Error(
+      'This site has no custom node ' + customNodeId +
+      (__serverCustomNodesError ? ' (the custom nodes did not load: ' + (__serverCustomNodesError.message || String(__serverCustomNodesError)) + ')' : '')
+    );
+  }
+  return run;
+}
+(function (handlers) {
+  var marker = handlers['general-custom-node'];
+  // What the marked node's own steps get: a visitor's nested custom-node call
+  // runs with the visitor's credentials only (the cookie, the deployment
+  // bypass), so its route asks for its own session, role and subscription; a
+  // server job's keeps the internal-call token (below).
+  var nested = Object.assign({}, handlers);
+  nested['general-custom-node'] = async function (config, context) {
+    var call = await marker(config, context);
+    if (!call || !call.__customNode) return call;
+    var asVisitor = Object.assign({}, context);
+    asVisitor.__internalHeaders = Object.assign({}, context && context.__internalHeaders);
+    // A server job's nested call (a webhook, cron or automation run, whose
+    // context alone carries the server-job flag) stays the job's end to end:
+    // it keeps the token, so its routes keep the flag. A visitor's runs with
+    // the visitor's credentials only.
+    if (asVisitor.__internalHeaders['x-tq-server-job'] !== '1') {
+      delete asVisitor.__internalHeaders['x-teleport-internal'];
+    }
+    return __serverCustomNode(call.customNodeId)(asVisitor, call.parameters || {}, nested);
+  };
+  handlers['general-custom-node'] = async function (config, context) {
+    var call = await marker(config, context);
+    var nodeId = config && config.__nodeId;
+    if (
+      !call ||
+      !call.__customNode ||
+      typeof nodeId !== 'string' ||
+      !Object.prototype.hasOwnProperty.call(__SERVER_RUN_CALLS, nodeId) ||
+      __SERVER_RUN_CALLS[nodeId] !== call.customNodeId
+    ) {
+      return call;
+    }
+    return __serverCustomNode(call.customNodeId)(context, call.parameters || {}, nested);
+  };
+})(nodeHandlers);
+`;
+};
+//# sourceMappingURL=server-custom-node-call.js.map

package/dist/esm/server-custom-node-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-custom-node-call.js","sourceRoot":"","sources":["../../src/server-custom-node-call.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAA;AAEjD,sEAAsE;AACtE,MAAM,eAAe,GAAG,CAAC,IAAsB,EAAW,EAAE;;IAC1D,MAAM,YAAY,GAAG,MAAC,IAAI,CAAC,MAAiD,0CAAE,YAAY,CAAA;IAC1F,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,qBAAqB;QACnC,IAAI,CAAC,YAAY,KAAK,QAAQ;QAC9B,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,GAAG,CAAC,CACxB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAwB,EAAsB,EAAE,CACvF,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAEvC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AACtD,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD,qEAAqE;AACrE,2CAA2C;AAC3C,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,IAAY,EAAU,EAAE;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,CAAA;IACtB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE;QACb,OAAO,EAAE,CAAA;KACV;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE;QAClC,OAAO,EAAE,CAAA;KACV;IACD,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAChD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAY,EAAE;IACnD,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE;QAC3C,OAAO,EAAE,CAAA;KACV;IACD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE;YACpB,MAAK;SACN;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC5C,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE;YAClB,MAAK;SACN;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;QAClD,EAAE,GAAG,OAAO,GAAG,CAAC,CAAA;QAChB,IAAI,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE;YAC9C,SAAQ;SACT;QACD,IAAI,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC;iBACpD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;iBACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;iBACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACzB,IAAI;gBACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC1C,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;iBACzB;aACF;YAAC,WAAM;gBACN,MAAM,GAAG,EAAE,CAAA;aACZ;SACF;QACD,IAAI,MAAM,EAAE;YACV,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;SACrB;KACF;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAQD,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,IAAsB,EAAQ,EAAE;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE;QACzC,OAAM;KACP;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QAC7B,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;YAC/C,OAAM;SACP;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9C,OAAM;KACP;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACnD,OAAM;KACP;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QAC7B,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE;YAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAChC,OAAM;SACP;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE;YACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,8BAA8B,CAAA;YACjE,OAAM;SACP;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;KACxE;AACH,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,IAAkC,EAAE,UAAkB,EAAU,EAAE;IACtF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAE,IAA0B,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAA;AACxE,CAAC,CAAA;AAgBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAAwB,EACxB,KAA+B,EAC/B,OAA+B,EACX,EAAE;IACtB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAC3D,IACE,UAAU;QACV,CAAC,UAAU,CAAC,UAAU;YACpB,CAAC,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAC1F;QACA,OAAO,EAAE,CAAA;KACV;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;QACjC,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE;QACtD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;KACxB;IACD,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,OAAO,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAClE,cAAc,CAAE,IAAI,CAAC,MAAmC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;YACtC,SAAQ;SACT;QACD,MAAM,MAAM,GAAG,WAAW;YACxB,CAAC,CAAC,iBAAiB,YAAY,CAC3B,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EACrB,WAAW,CACZ,uCAAuC;YAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,uCAAuC,CAAA;QAC/D,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,YAAY,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,QAC9C,OAAO,CAAC,KACV,2BAA2B,MAAM,0NAA0N;SAC5P,CAAC,CAAA;KACH;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,OAAwB,EACxB,KAA+B,EAC/B,OAA+B,EACzB,EAAE;IACR,MAAM,CAAC,KAAK,CAAC,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACvE,IAAI,KAAK,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;KAC/B;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,OAAwB,EACxB,cAAsB,EACd,EAAE;IACV,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QACtB,OAAO,EAAE,CAAA;KACV;IACD,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAI,IAAI,CAAC,MAAmC,CAAC,YAAY,CAAA;KACxE;IACD,OAAO;;;;;;;;2BAQkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;uCAGT,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CpD,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/server-runtime-code.d.ts

@@ -1,8 +1,14 @@
+/** How long a signed step result stays good: older ones are refused. */
+export declare const SIGNED_RESULT_MAX_AGE_MS: number;
+/** How far ahead of a route's clock another instance's signature may be dated. */
+export declare const SIGNED_RESULT_CLOCK_SKEW_MS: number;
+/** What a visitor is told when the run a step continues has expired (409). */
+export declare const STEP_EXPIRED_MESSAGE = "This took too long. Please start again.";
 /**
  * `utils/workflows/server-runtime.js`: what every server route loads. It is the
  * shared runtime utilities plus the parts only a server may run — the signed
- * hand-off between server segments and the internal-call credential — so none
- * of it reaches the browser bundle.
+ * hand-off between server segments, the visitor's session identity and the
+ * internal-call credential — so none of it reaches the browser bundle.
  *
  * WHY THE HAND-OFF IS SIGNED. A workflow runs as a chain of segments, and the
  * result of every server segment reaches the next one THROUGH the caller: the
@@ -11,17 +17,36 @@
  * earlier one — an order marked valid, a password-reset token marked checked
  * — and the later segment acted on it. So:
  *
+ * - Every result belongs to a RUN (`__sigRun`): one execution of the workflow.
+ *   The first server segment of the graph opens it with a random id signed for
+ *   this workflow; every later segment continues the run its request carries.
  * - `segmentReply` signs every result its segment produced (`__sig`, an HMAC
- *   keyed from NEXTAUTH_SECRET over the node id and the JSON value) and the
- *   order of the context's keys as the caller will hold them (`__sigOrder`),
- *   since `params` in custom JavaScript are read by position.
+ *   keyed from NEXTAUTH_SECRET over the workflow, the producing segment, the
+ *   run, the time of signing, the node id and the JSON value), and one link of
+ *   the run's chain (`__sigOrder`): the order of the context's keys as the
+ *   caller will hold them (`params` in custom JavaScript are read by
+ *   position), the call's number in the run, and the signature of every result
+ *   the caller may hand on, bound to the same workflow, run and time.
  * - `claimSegmentContext` puts the keys back in that signed order (a key the
- *   request left out keeps its slot, empty), empties every server result
- *   whose signature does not hold or that the signed order does not list,
- *   drops custom-node and loop bookkeeping a request cannot legitimately
- *   carry, skips every node a server if / switch upstream did not choose
- *   (or whose decision is missing), and takes `__previousNodeResult` from the
- *   signed result of the server node that ran just before.
+ *   request left out keeps its slot, empty), empties every server result whose
+ *   signature does not hold — another workflow's, another run's, one older
+ *   than ten minutes, one the link does not list with that very signature (a
+ *   result of another call of the same segment: a run is one chain) — drops
+ *   custom-node and loop bookkeeping a request cannot legitimately carry,
+ *   skips every node a server if / switch upstream did not choose (or whose
+ *   decision is missing), and takes `__previousNodeResult` from the signed
+ *   result of the server node that ran just before.
+ *
+ * WHO THE VISITOR IS comes from the session cookie, never from the request
+ * body. `claimSegmentContext` drops whatever the request says about it and
+ * leaves the reserved keys `__sessionUserId`, `__sessionRole` and
+ * `__sessionUser` empty (and the page state's `currentUser` with them); a route
+ * whose segment reads the visitor (SEGMENT_CONFIG.session) fills them from the
+ * session with `bindSessionIdentity`, rebuilds the result of the graph's
+ * current-user readers from them, binds the route's `userScoped` identity
+ * columns, and — through `bindSessionHandlers` — binds those columns again
+ * after the node that produces them runs inside the segment, and answers an
+ * identity-filtered read with no rows when there is no identity to filter by.
  *
  * What the BROWSER itself computes stays untrusted by design; a server segment
  * that needs a trustworthy figure (a price, an owner) reads it from the
@@ -38,5 +63,7 @@
  * The facts about the graph each route needs are baked into its
  * SEGMENT_CONFIG at generation time (see segment-trust.ts).
  */
-export declare const generateServerRuntimeCode: () => string;
+export declare const generateServerRuntimeCode: (options?: {
+    withSessionRevocation?: boolean;
+}) => string;
 //# sourceMappingURL=server-runtime-code.d.ts.map

package/dist/esm/server-runtime-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime-code.d.ts","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,yBAAyB,QAAO,MA+X5C,CAAA"}
+{"version":3,"file":"server-runtime-code.d.ts","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAMA,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,QAAiB,CAAA;AAEtD,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,QAAY,CAAA;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,4CAA4C,CAAA;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,eAAO,MAAM,yBAAyB,aAC3B;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC3C,MA6xBF,CAAA"}