@teleporthq/teleport-plugin-next-workflows 0.44.10 → 0.44.17

package/dist/cjs/visitor-step-limits.d.ts

@@ -0,0 +1,66 @@
+import { WorkflowSegment } from './types';
+/**
+ * A step any visitor may run, but not without end: a guest booking (which
+ * takes a place in the calendar and emails a confirmation), a newsletter
+ * signup (which adds an address to the merchant's audience). The feature that
+ * builds such a step declares how often one visitor may run it, on the step:
+ *
+ *   config.visitorLimit = { limit: 10, windowSeconds: 3600 }                   // 429 past the limit
+ *   config.visitorLimit = { limit: 5, windowSeconds: 3600, onLimit: 'skip' }   // the step quietly does nothing
+ *   config.visitorLimit = { …, scope: 'newsletter-signup' }                    // one budget for every such step
+ *
+ * Without `scope` the budget is the step's own (`workflow-step:<node id>`).
+ * With one, every step that names the same scope shares one budget per
+ * visitor (`visitor-limit:<scope>`): two signup blocks, or two booking pages,
+ * do not give a visitor twice the signups or bookings.
+ *
+ * The segment route that runs the step counts every request it answers for
+ * the visitor (IPv6 by its /64), in the app's database through the shared
+ * security runtime, BEFORE any step of the segment runs — so the count cannot
+ * be dodged by calling the route directly or by marking the step skipped.
+ * This deployment's own server code (the internal-call token) is not counted.
+ *
+ * ⛔ So a declared limit holds only in a route a BROWSER calls: a limited step
+ * inside a custom node that another server segment runs with the internal
+ * token is not counted there. Declare the limit on the step the visitor's
+ * request reaches (the feature builders do).
+ *
+ * `onLimit: 'skip'` is for a step whose visitor must see the same answer either
+ * way (a signup thanks a bot and a person alike): past the limit the step, and
+ * every step after it in the segment, is skipped and the route answers as it
+ * would for a request that changed nothing. A step marked `continueOnError`
+ * is optional: past its limit only that step is skipped, and what follows it
+ * (a booking's checkout after its newsletter tick) still runs. The skip is logged server-side
+ * (the scope only — never the visitor's address or input), so an owner can
+ * tell lost signups from no signups: at most one line per scope per minute
+ * and per instance, the line saying how many more were skipped since the
+ * last one — a bot past its limit does not flood the log.
+ *
+ * A declaration that cannot be read limits at the defaults (10 per hour): a
+ * step that asked for a limit never runs without one.
+ */
+export declare const VISITOR_LIMIT_CONFIG_KEY = "visitorLimit";
+export interface VisitorStepLimit {
+    nodeId: string;
+    /** The shared budget the step names, if any. */
+    scope?: string;
+    limit: number;
+    windowSeconds: number;
+    onLimit: 'refuse' | 'skip';
+    /** What a refused visitor is told (the 429's public `error`), when the step names one. */
+    message?: string;
+    /** The step and every step after it in the same segment (only the step when it is `continueOnError`). */
+    skipIds: string[];
+}
+/** The limit a step's config declares, or null when it declares none. */
+export declare const readVisitorStepLimit: (config: Record<string, unknown> | undefined) => Omit<VisitorStepLimit, 'nodeId' | 'skipIds'> | null;
+/** Every declared limit of a segment's steps (or its type's default), in step order. */
+export declare const collectVisitorStepLimits: (segment: WorkflowSegment) => VisitorStepLimit[];
+/**
+ * The route code that counts a segment's declared limits: '' for a segment
+ * without one, so every other route is byte-identical. Placed after the
+ * request context is claimed and the auth guard has run, before any step.
+ * `relativePrefix` leads from the route's folder to the project root.
+ */
+export declare const buildVisitorStepLimitGuard: (segment: WorkflowSegment, relativePrefix?: string) => string;
+//# sourceMappingURL=visitor-step-limits.d.ts.map

package/dist/cjs/visitor-step-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor-step-limits.d.ts","sourceRoot":"","sources":["../../src/visitor-step-limits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAGzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,eAAO,MAAM,wBAAwB,iBAAiB,CAAA;AAOtD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC1B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yGAAyG;IACzG,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAQD,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,WACvB,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAC1C,KAAK,gBAAgB,EAAE,QAAQ,GAAG,SAAS,CAAC,GAAG,IAejD,CAAA;AAoCD,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,YAAa,eAAe,KAAG,gBAAgB,EA0B1E,CAAA;AAmBV;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,YAC5B,eAAe,8BAEvB,MA+CF,CAAA"}

package/dist/cjs/visitor-step-limits.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildVisitorStepLimitGuard = exports.collectVisitorStepLimits = exports.readVisitorStepLimit = exports.VISITOR_LIMIT_CONFIG_KEY = void 0;
+const security_runtime_1 = require("./security-runtime");
+const newsletter_scope_1 = require("./newsletter/newsletter-scope");
+/**
+ * A step any visitor may run, but not without end: a guest booking (which
+ * takes a place in the calendar and emails a confirmation), a newsletter
+ * signup (which adds an address to the merchant's audience). The feature that
+ * builds such a step declares how often one visitor may run it, on the step:
+ *
+ *   config.visitorLimit = { limit: 10, windowSeconds: 3600 }                   // 429 past the limit
+ *   config.visitorLimit = { limit: 5, windowSeconds: 3600, onLimit: 'skip' }   // the step quietly does nothing
+ *   config.visitorLimit = { …, scope: 'newsletter-signup' }                    // one budget for every such step
+ *
+ * Without `scope` the budget is the step's own (`workflow-step:<node id>`).
+ * With one, every step that names the same scope shares one budget per
+ * visitor (`visitor-limit:<scope>`): two signup blocks, or two booking pages,
+ * do not give a visitor twice the signups or bookings.
+ *
+ * The segment route that runs the step counts every request it answers for
+ * the visitor (IPv6 by its /64), in the app's database through the shared
+ * security runtime, BEFORE any step of the segment runs — so the count cannot
+ * be dodged by calling the route directly or by marking the step skipped.
+ * This deployment's own server code (the internal-call token) is not counted.
+ *
+ * ⛔ So a declared limit holds only in a route a BROWSER calls: a limited step
+ * inside a custom node that another server segment runs with the internal
+ * token is not counted there. Declare the limit on the step the visitor's
+ * request reaches (the feature builders do).
+ *
+ * `onLimit: 'skip'` is for a step whose visitor must see the same answer either
+ * way (a signup thanks a bot and a person alike): past the limit the step, and
+ * every step after it in the segment, is skipped and the route answers as it
+ * would for a request that changed nothing. A step marked `continueOnError`
+ * is optional: past its limit only that step is skipped, and what follows it
+ * (a booking's checkout after its newsletter tick) still runs. The skip is logged server-side
+ * (the scope only — never the visitor's address or input), so an owner can
+ * tell lost signups from no signups: at most one line per scope per minute
+ * and per instance, the line saying how many more were skipped since the
+ * last one — a bot past its limit does not flood the log.
+ *
+ * A declaration that cannot be read limits at the defaults (10 per hour): a
+ * step that asked for a limit never runs without one.
+ */
+exports.VISITOR_LIMIT_CONFIG_KEY = 'visitorLimit';
+const DEFAULT_LIMIT = 10;
+const DEFAULT_WINDOW_SECONDS = 3600;
+const MAX_LIMIT = 10000;
+const MAX_WINDOW_SECONDS = 7 * 86400;
+const SCOPE_RE = /^[A-Za-z0-9_-]{1,60}$/;
+const MAX_MESSAGE_LENGTH = 200;
+const wholeInRange = (value, max) => typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= max ? value : null;
+/** The limit a step's config declares, or null when it declares none. */
+const readVisitorStepLimit = (config) => {
+    var _a, _b;
+    const declared = config ? config[exports.VISITOR_LIMIT_CONFIG_KEY] : undefined;
+    if (declared === undefined || declared === null || declared === false) {
+        return null;
+    }
+    const spec = typeof declared === 'object' ? declared : {};
+    return Object.assign(Object.assign({ limit: (_a = wholeInRange(spec.limit, MAX_LIMIT)) !== null && _a !== void 0 ? _a : DEFAULT_LIMIT, windowSeconds: (_b = wholeInRange(spec.windowSeconds, MAX_WINDOW_SECONDS)) !== null && _b !== void 0 ? _b : DEFAULT_WINDOW_SECONDS, onLimit: spec.onLimit === 'skip' ? 'skip' : 'refuse' }, (typeof spec.scope === 'string' && SCOPE_RE.test(spec.scope) ? { scope: spec.scope } : {})), (typeof spec.message === 'string' && spec.message.trim()
+        ? { message: spec.message.trim().slice(0, MAX_MESSAGE_LENGTH) }
+        : {}));
+};
+exports.readVisitorStepLimit = readVisitorStepLimit;
+const downstreamInSegment = (segment, startId) => {
+    const inSegment = new Set(segment.nodes.map((n) => n.id));
+    const seen = new Set();
+    const queue = [startId];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (seen.has(current) || !inSegment.has(current)) {
+            continue;
+        }
+        seen.add(current);
+        for (const edge of segment.edges || []) {
+            if (edge.source === current) {
+                queue.push(edge.target);
+            }
+        }
+    }
+    return Array.from(seen);
+};
+/**
+ * The limit a step of these types has when its config declares none: the
+ * newsletter sign-up mails through the site's provider for every address a
+ * visitor types, so a step from the add-node menu, the AI or an import is
+ * held to the public sign-up route's own budget.
+ */
+const DEFAULT_VISITOR_STEP_LIMITS = {
+    'newsletter-subscribe': {
+        limit: newsletter_scope_1.NEWSLETTER_VISITOR_LIMIT,
+        windowSeconds: 3600,
+        onLimit: 'skip',
+        scope: newsletter_scope_1.NEWSLETTER_VISITOR_SCOPE,
+    },
+};
+/** Every declared limit of a segment's steps (or its type's default), in step order. */
+const collectVisitorStepLimits = (segment) => segment.nodes
+    .slice()
+    .sort((a, b) => (a.stepNumber || 0) - (b.stepNumber || 0))
+    .reduce((limits, node) => {
+    var _a;
+    const declared = (0, exports.readVisitorStepLimit)(node.config) ||
+        DEFAULT_VISITOR_STEP_LIMITS[node.type] ||
+        null;
+    if (declared) {
+        // An optional step (continueOnError) past its limit never stops what
+        // follows it: only the step itself is skipped.
+        const optional = ((_a = node.config) === null || _a === void 0 ? void 0 : _a.continueOnError) === true;
+        limits.push(Object.assign(Object.assign({ nodeId: node.id }, declared), { skipIds: declared.onLimit !== 'skip'
+                ? []
+                : optional
+                    ? [node.id]
+                    : downstreamInSegment(segment, node.id) }));
+    }
+    return limits;
+}, []);
+exports.collectVisitorStepLimits = collectVisitorStepLimits;
+const SKIP_LOG_INTERVAL_MS = 60000;
+/** One log line per scope per minute (per instance); the rest are counted into the next line. */
+const SKIP_LOG_CODE = `
+      const __logStepLimitSkip = function (scope) {
+        var log = globalThis.__tqStepLimitSkipLog || (globalThis.__tqStepLimitSkipLog = {});
+        var now = Date.now();
+        var entry = log[scope];
+        if (entry && now - entry.since < ${SKIP_LOG_INTERVAL_MS}) {
+          entry.skipped += 1;
+          return;
+        }
+        var more = entry && entry.skipped > 0 ? ' (and ' + entry.skipped + ' more since the last line)' : '';
+        console.warn('[workflow-step-limit] skipped past its visitor limit: ' + scope + more);
+        log[scope] = { since: now, skipped: 0 };
+      };`;
+/**
+ * The route code that counts a segment's declared limits: '' for a segment
+ * without one, so every other route is byte-identical. Placed after the
+ * request context is claimed and the auth guard has run, before any step.
+ * `relativePrefix` leads from the route's folder to the project root.
+ */
+const buildVisitorStepLimitGuard = (segment, relativePrefix = '../../..') => {
+    const limits = (0, exports.collectVisitorStepLimits)(segment);
+    if (limits.length === 0) {
+        return '';
+    }
+    const checks = limits.map((step) => {
+        const scope = step.scope ? `visitor-limit:${step.scope}` : `workflow-step:${step.nodeId}`;
+        const options = JSON.stringify({
+            scope,
+            limit: step.limit,
+            windowSeconds: step.windowSeconds,
+        });
+        if (step.onLimit === 'skip') {
+            // No response object: past the limit the runtime answers nothing itself.
+            return `
+      if (!(await __stepLimiter.rateLimitRequest(req, null, ${options}))) {
+        __logStepLimitSkip(${JSON.stringify(scope)});
+        if (!context.__skippedNodes || typeof context.__skippedNodes !== 'object') context.__skippedNodes = {};
+        ${JSON.stringify(step.skipIds)}.forEach(function (id) { context.__skippedNodes[id] = true; });
+      }`;
+        }
+        if (step.message) {
+            // Counted like any refused step; the 429 carries the step's own words.
+            return `
+      if (!(await __stepLimiter.rateLimitRequest(req, null, ${options}))) {
+        var __stepRetry = typeof __stepLimiter.peekRateLimitRequest === 'function' ? await __stepLimiter.peekRateLimitRequest(req, ${options}) : null;
+        if (__stepRetry && __stepRetry.retryAfter) res.setHeader('Retry-After', String(__stepRetry.retryAfter));
+        return res.status(429).json({ error: ${JSON.stringify(step.message)} });
+      }`;
+        }
+        return `
+      if (!(await __stepLimiter.rateLimitRequest(req, res, ${options}))) {
+        return;
+      }`;
+    });
+    return `
+    // Steps that declare how often one visitor may run them (a guest booking,
+    // a newsletter signup — see visitor-step-limits.ts): counted per visitor in
+    // the app's database for every request this route answers, before any step
+    // runs. This deployment's own server code is not counted.
+    if (!require('${relativePrefix}/utils/workflows/server-runtime').isInternalCall(req)) {
+      const __stepLimiter = require('${(0, security_runtime_1.securityRuntimeSpecifier)(relativePrefix)}');${limits.some((step) => step.onLimit === 'skip') ? SKIP_LOG_CODE : ''}${checks.join('')}
+    }`;
+};
+exports.buildVisitorStepLimitGuard = buildVisitorStepLimitGuard;
+//# sourceMappingURL=visitor-step-limits.js.map

package/dist/cjs/visitor-step-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor-step-limits.js","sourceRoot":"","sources":["../../src/visitor-step-limits.ts"],"names":[],"mappings":";;;AAAA,yDAA6D;AAE7D,oEAAkG;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEU,QAAA,wBAAwB,GAAG,cAAc,CAAA;AAEtD,MAAM,aAAa,GAAG,EAAE,CAAA;AACxB,MAAM,sBAAsB,GAAG,IAAI,CAAA;AACnC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK,CAAA;AAepC,MAAM,QAAQ,GAAG,uBAAuB,CAAA;AACxC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAE9B,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,GAAW,EAAiB,EAAE,CAClE,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAEnG,yEAAyE;AAClE,MAAM,oBAAoB,GAAG,CAClC,MAA2C,EACU,EAAE;;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,gCAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,EAAE;QACrE,OAAO,IAAI,CAAA;KACZ;IACD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAoC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,qCACE,KAAK,EAAE,MAAA,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,mCAAI,aAAa,EAC3D,aAAa,EAAE,MAAA,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,mCAAI,sBAAsB,EAC7F,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IACjD,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1F,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QACzD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC,EACR;AACH,CAAC,CAAA;AAjBY,QAAA,oBAAoB,wBAiBhC;AAED,MAAM,mBAAmB,GAAG,CAAC,OAAwB,EAAE,OAAe,EAAY,EAAE;IAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAChD,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE;YACtC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACxB;SACF;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAAiE;IAChG,sBAAsB,EAAE;QACtB,KAAK,EAAE,2CAAwB;QAC/B,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,2CAAwB;KAChC;CACF,CAAA;AAED,wFAAwF;AACjF,MAAM,wBAAwB,GAAG,CAAC,OAAwB,EAAsB,EAAE,CACvF,OAAO,CAAC,KAAK;KACV,KAAK,EAAE;KACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;KACzD,MAAM,CAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;;IAC3C,MAAM,QAAQ,GACZ,IAAA,4BAAoB,EAAC,IAAI,CAAC,MAA6C,CAAC;QACxE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,IAAI,CAAA;IACN,IAAI,QAAQ,EAAE;QACZ,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,QAAQ,GACZ,CAAA,MAAC,IAAI,CAAC,MAAoD,0CAAE,eAAe,MAAK,IAAI,CAAA;QACtF,MAAM,CAAC,IAAI,+BACT,MAAM,EAAE,IAAI,CAAC,EAAE,IACZ,QAAQ,KACX,OAAO,EACL,QAAQ,CAAC,OAAO,KAAK,MAAM;gBACzB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACX,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAC3C,CAAA;KACH;IACD,OAAO,MAAM,CAAA;AACf,CAAC,EAAE,EAAE,CAAC,CAAA;AA1BG,QAAA,wBAAwB,4BA0B3B;AAEV,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAElC,iGAAiG;AACjG,MAAM,aAAa,GAAG;;;;;2CAKqB,oBAAoB;;;;;;;SAOtD,CAAA;AAET;;;;;GAKG;AACI,MAAM,0BAA0B,GAAG,CACxC,OAAwB,EACxB,cAAc,GAAG,UAAU,EACnB,EAAE;IACV,MAAM,MAAM,GAAG,IAAA,gCAAwB,EAAC,OAAO,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;QACvB,OAAO,EAAE,CAAA;KACV;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAA;QACzF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE;YAC3B,yEAAyE;YACzE,OAAO;8DACiD,OAAO;6BACxC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;UAExC,IAAI,CAAC,SAAS,CACd,IAAI,CAAC,OAAO,CACb;QACD,CAAA;SACH;QACD,IAAI,IAAI,CAAC,OAAO,EAAE;YAChB,uEAAuE;YACvE,OAAO;8DACiD,OAAO;qIACgE,OAAO;;+CAE7F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QACnE,CAAA;SACH;QACD,OAAO;6DACkD,OAAO;;QAE5D,CAAA;IACN,CAAC,CAAC,CAAA;IACF,OAAO;;;;;oBAKW,cAAc;uCACK,IAAA,2CAAwB,EAAC,cAAc,CAAC,MAC3E,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EACnE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;MACd,CAAA;AACN,CAAC,CAAA;AAlDY,QAAA,0BAA0B,8BAkDtC"}

package/dist/cjs/webhook-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-generator.d.ts","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAEtB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AAyCnC,eAAO,MAAM,yBAAyB,oBACnB,mBAAmB,GAAG,SAAS,sBAC5B,qBAAqB,KACxC,MA8LF,CAAA;AAgUD,eAAO,MAAM,yBAAyB,oBACnB,mBAAmB,GAAG,SAAS,sBAC5B,qBAAqB,KACxC,MAsYF,CAAA;AAED,MAAM,WAAW,2BAA2B;IAK1C,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED,eAAO,MAAM,oBAAoB,cACpB,sBAAsB,mBAChB,mBAAmB,GAAG,SAAS,YACvC,2BAA2B,KACnC,IA2DF,CAAA"}
+{"version":3,"file":"webhook-generator.d.ts","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAEtB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AA8CnC,eAAO,MAAM,yBAAyB,oBACnB,mBAAmB,GAAG,SAAS,sBAC5B,qBAAqB,KACxC,MA+MF,CAAA;AA0XD,eAAO,MAAM,yBAAyB,oBACnB,mBAAmB,GAAG,SAAS,sBAC5B,qBAAqB,KACxC,MAsYF,CAAA;AAED,MAAM,WAAW,2BAA2B;IAK1C,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED,eAAO,MAAM,oBAAoB,cACpB,sBAAsB,mBAChB,mBAAmB,GAAG,SAAS,YACvC,2BAA2B,KACnC,IA2DF,CAAA"}

package/dist/cjs/webhook-generator.js

@@ -4,6 +4,8 @@ exports.generateWebhookFiles = exports.generatePaypalWebhookCode = exports.gener
 const teleport_types_1 = require("@teleporthq/teleport-types");
 const payments_1 = require("./payments");
 const payment_drivers_scope_1 = require("./payments/payment-drivers-scope");
+const configured_nextauth_url_1 = require("./configured-nextauth-url");
+const self_call_headers_1 = require("./self-call-headers");
 /**
  * The origin a legacy webhook route calls this deployment's own routes on
  * (`/api/invoices/generate`, `/api/ecommerce/order-notification`). Those
@@ -15,7 +17,8 @@ const payment_drivers_scope_1 = require("./payments/payment-drivers-scope");
  * NEXTAUTH_URL's origin when it is set — except that a local server on another
  * port than a local NEXTAUTH_URL keeps its own loopback address (NEXTAUTH_URL
  * stuck at :3000 while `next dev` runs on :3001). With no Host header at all,
- * the configured URLs as before.
+ * the configured URLs as before. NEXTAUTH_URL is read as configured, never as
+ * the auth route rewrote it from a request (configured-nextauth-url.ts).
  */
 const WEBHOOK_BASE_URL_CODE = `function __isLoopbackHost(host) {
   var name = String(host || '').replace(/:[0-9]+$/, '').toLowerCase();
@@ -26,20 +29,22 @@ function __webhookBaseUrl(req) {
   var headers = (req && req.headers) || {};
   var host = headers.host || '';
   if (!host) {
-    var envBaseUrl = process.env.NEXTAUTH_URL || process.env.VERCEL_URL || '';
+    var envBaseUrl = ${configured_nextauth_url_1.CONFIGURED_NEXTAUTH_URL_EXPRESSION} || process.env.VERCEL_URL || '';
     if (envBaseUrl && !envBaseUrl.startsWith('http')) envBaseUrl = 'https://' + envBaseUrl;
     return envBaseUrl || 'http://localhost:3000';
   }
   var proto = headers['x-forwarded-proto'] || (__isLoopbackHost(host) ? 'http' : 'https');
   var requestOrigin = String(proto).split(',')[0].trim() + '://' + host;
   if (process.env.VERCEL) return requestOrigin;
-  var configured = String(process.env.NEXTAUTH_URL || '').trim();
+  var configured = String(${configured_nextauth_url_1.CONFIGURED_NEXTAUTH_URL_EXPRESSION} || '').trim();
   if (!configured) return requestOrigin;
   var origin;
   try { origin = new URL(configured).origin; } catch (e) { return requestOrigin; }
   if (__isLoopbackHost(host) && __isLoopbackHost(new URL(origin).host)) return requestOrigin;
   return origin;
-}`;
+}
+
+${(0, self_call_headers_1.generateSelfCallHeadersCode)()}`;
 const generateStripeWebhookCode = (invoiceSettings, ecommerceSettings) => {
     const autoGenerateInvoice = (invoiceSettings === null || invoiceSettings === void 0 ? void 0 : invoiceSettings.enabled) && (invoiceSettings === null || invoiceSettings === void 0 ? void 0 : invoiceSettings.autoGenerateOnPayment);
     const hasEcommerce = !!ecommerceSettings;
@@ -67,7 +72,7 @@ try { __paymentDrivers = require('../../../utils/payments'); } catch (e) { __pay
 function __stripeSecretKey() {
   return __paymentDrivers.core.credential('stripe', 'secretKey', ['STRIPE_TEST_KEY']);
 }
-${autoGenerateInvoice || hasOrderNotifications
+${autoGenerateInvoice || hasEcommerce
         ? `
 // Stripe reports money in the currency's smallest unit (JPY has none, KWD a
 // thousandth); the store keeps the major one, converted as its drivers do.
@@ -126,7 +131,22 @@ module.exports = async function handler(req, res) {
         if (session.payment_status !== 'paid' && session.payment_status !== 'no_payment_required') {
           console.log('Checkout session completed, payment not received yet:', session.id);
           break;
-        }
+        }${hasEcommerce
+        ? `
+        // A session that took less than its order is due, or another
+        // currency, pays nothing: no paid mark, no invoice, no order email.
+        var sessionCheck = await __checkStripeSession(session);
+        if (!sessionCheck.ok) {
+          console.error('Stripe webhook: checkout ' + session.id + ' does not pay its order: ' + sessionCheck.reason);
+          // The order could not be read: Stripe retries a 500, so a database
+          // blip delays the paid mark instead of losing it.
+          if (sessionCheck.retry) {
+            res.status(500).json({ error: 'Webhook processing failed' });
+            return;
+          }
+          break;
+        }`
+        : ''}
         ${autoGenerateInvoice
         ? `await handleInvoiceGeneration(session, 'checkout', __baseUrl, stripeSecretKey);`
         : `console.log('Checkout session completed:', session.id);`}
@@ -220,11 +240,69 @@ ${hasOrderNotifications ? generateOrderNotificationWebhookCode() : ''}
 };
 exports.generateStripeWebhookCode = generateStripeWebhookCode;
 function generateEcommerceOrderUpdateCode() {
-    // Used ONLY when invoice auto-generation is OFF — when invoices are on,
-    // handleInvoiceGeneration calls __linkInvoiceToOrder which does the same
-    // mark-paid update plus invoice linkage, so this function is skipped to
-    // avoid two writes that race for the row.
+    // handleEcommerceOrderUpdate is used ONLY when invoice auto-generation is
+    // OFF — when invoices are on, handleInvoiceGeneration calls
+    // __linkInvoiceToOrder which does the same mark-paid update plus invoice
+    // linkage, so it is skipped to avoid two writes that race for the row.
+    // __checkStripeSession runs before either, the way the PayPal route's
+    // __checkPaypalCapture does, with the rule the workflow-driven "Process
+    // Payment Webhook" applies (a payment may not take less than is due).
     return `
+// Whether a paid checkout session may pay the store order it names: the order
+// exists and the session took, in the order's currency, at least what the
+// order is due — its total less what a gift card covered. A session that names
+// no store order has nothing to check.
+async function __checkStripeSession(session) {
+  var orderId = session && session.metadata && session.metadata.orderId;
+  if (!orderId) {
+    return { ok: true };
+  }
+  var connStr = process.env.TELEPORT_DB_CONNECTION_STRING || process.env.DATABASE_URL || '';
+  if (!connStr) {
+    return { ok: false, retry: true, reason: 'no database connection to check order ' + orderId + ' against' };
+  }
+  var pg;
+  try {
+    pg = require('pg');
+  } catch (e) {
+    return { ok: false, retry: true, reason: 'the pg module is unavailable to check order ' + orderId };
+  }
+  var client = new pg.Client({ connectionString: connStr, ssl: connStr.indexOf('sslmode=require') !== -1 ? { rejectUnauthorized: false } : undefined });
+  var order = null;
+  try {
+    await client.connect();
+    // gift_card_amount and currency are read through the row's JSON: a store
+    // provisioned before them has no such column.
+    var found = await client.query(
+      "SELECT o.total_amount, COALESCE(to_jsonb(o) ->> 'gift_card_amount', '0') AS gift_card_amount, COALESCE(to_jsonb(o) ->> 'currency', '') AS currency FROM teleport_orders o WHERE o.id::text = $1",
+      [String(orderId)]
+    );
+    order = found && found.rows && found.rows[0] ? found.rows[0] : null;
+  } catch (err) {
+    return { ok: false, retry: true, reason: 'order ' + orderId + ' could not be read (' + (err && err.message) + ')' };
+  } finally {
+    try { await client.end(); } catch (_e) {}
+  }
+  if (!order) {
+    return { ok: false, reason: 'the store has no order ' + orderId };
+  }
+  var paidCurrency = String(session.currency || '').toUpperCase();
+  var orderCurrency = String(order.currency || '').toUpperCase();
+  if (orderCurrency && paidCurrency !== orderCurrency) {
+    return { ok: false, reason: 'the session is in ' + (paidCurrency || 'no currency') + ' and order ' + orderId + ' in ' + orderCurrency };
+  }
+  // Whole cents, so 12.30 - 4.10 compares as 820 and never 8.199999999999999.
+  var due = Math.max(0, Math.round((Number(order.total_amount) - Number(order.gift_card_amount || 0)) * 100));
+  var paid = session.amount_total == null ? NaN : Math.round(__stripeMajor(session.amount_total, session.currency) * 100);
+  if (!isFinite(due) || !isFinite(paid) || paid < due) {
+    return {
+      ok: false,
+      reason: 'the session took ' + (isFinite(paid) ? (paid / 100).toFixed(2) : 'an unknown amount') + ' ' + paidCurrency + ' and order ' + orderId + ' is due ' + (due / 100).toFixed(2),
+    };
+  }
+  return { ok: true };
+}
+
 async function handleEcommerceOrderUpdate(session) {
   try {
     var orderId = session.metadata && session.metadata.orderId;
@@ -260,7 +338,7 @@ async function sendOrderNotification(session, baseUrl) {
     await fetch(resolvedBaseUrl + '/api/ecommerce/order-notification', {
       method: 'POST',
       // The route emails the merchant only for the store's own server code.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({
         orderId: orderId || session.id,
         customerEmail: session.customer_email || (session.customer_details && session.customer_details.email) || '',
@@ -380,7 +458,7 @@ async function handleInvoiceGeneration(paymentObj, source, baseUrl, stripeSecret
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 
@@ -520,7 +598,7 @@ async function handleStripeInvoicePayment(stripeInvoice, baseUrl) {
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 
@@ -625,7 +703,7 @@ module.exports = async function handler(req, res) {
           await fetch(__baseUrl + '/api/ecommerce/order-notification', {
             method: 'POST',
             // The route emails the merchant only for the store's own server code.
-            headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+            headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
             body: JSON.stringify({
               // The internal order id, so the route can load the order's own
               // lines and the rates they were charged at; the capture id is
@@ -833,7 +911,7 @@ async function handlePaypalInvoiceGeneration(resource, baseUrl) {
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 

package/dist/cjs/webhook-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-generator.js","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":";;;AAAA,+DAKmC;AACnC,yCAAqF;AACrF,4EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,CAAA;AAEK,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,YAAY,GAAG,CAAC,CAAC,iBAAiB,CAAA;IACxC,MAAM,qBAAqB,GAAG,YAAY,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAElF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAYE,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;CAML;QACG,CAAC,CAAC,EACN;EACE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAoDb,mBAAmB;QACjB,CAAC,CAAC,iFAAiF;QACnF,CAAC,CAAC,yDACN;UACE,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE;UACxF,qBAAqB,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;UAe/E,mBAAmB;QACjB,CAAC,CAAC;;;;;;UAMJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,6DACN;;;;;;;;;;;;;;;;;;UAmBE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;oEAOsD;QACxD,CAAC,CAAC,8DACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BN,mBAAmB,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE;EACvD,YAAY,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAC,EAAE;EACtD,qBAAqB,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpE,CAAA;AACD,CAAC,CAAA;AAjMY,QAAA,yBAAyB,6BAiMrC;AAED,SAAS,gCAAgC;IACvC,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAA;AACD,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAA;AACD,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgQR,CAAA;AACD,CAAC;AAEM,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,qBAAqB,GAAG,CAAC,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAEzF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAWE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAmDb,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;UAIJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,wDACN;UAEE,qBAAqB;QACnB,CAAC,CAAC;;;;;;;;;;;;;;;;qGAgBuF;QACzF,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CN,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuFL;QACG,CAAC,CAAC,EACN;;EAGE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuIL;QACG,CAAC,CAAC,EACN;CACC,CAAA;AACD,CAAC,CAAA;AAzYY,QAAA,yBAAyB,6BAyYrC;AAUM,MAAM,oBAAoB,GAAG,CAClC,SAAiC,EACjC,eAAgD,EAChD,UAAuC,EAAE,EACnC,EAAE;;IACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,GAAG,KAAI,EAAE,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAChD,MAAM,kBAAkB,GAAG,CAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,KAAI,EAAE,CAAA;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAU,CAAA;IAEhE,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC9E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC5E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE;QAC9B,OAAM;KACP;IACD,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,cAAc,GAAG,IAAA,uCAA4B,EAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAA,qCAA0B,EACxB,SAAS,EACT,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kDAA0B,CACxE,CAAA;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;AACH,CAAC,CAAA;AA/DY,QAAA,oBAAoB,wBA+DhC"}
+{"version":3,"file":"webhook-generator.js","sourceRoot":"","sources":["../../src/webhook-generator.ts"],"names":[],"mappings":";;;AAAA,+DAKmC;AACnC,yCAAqF;AACrF,4EAA6E;AAC7E,uEAA8E;AAC9E,2DAAiE;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG;;;;;;;;;uBASP,4DAAkC;;;;;;;4BAO7B,4DAAkC;;;;;;;;EAQ5D,IAAA,+CAA2B,GAAE,EAAE,CAAA;AAE1B,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,YAAY,GAAG,CAAC,CAAC,iBAAiB,CAAA;IACxC,MAAM,qBAAqB,GAAG,YAAY,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAElF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAYE,mBAAmB,IAAI,YAAY;QACjC,CAAC,CAAC;;;;;;CAML;QACG,CAAC,CAAC,EACN;EACE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAmDb,YAAY;QACV,CAAC,CAAC;;;;;;;;;;;;;UAaJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,iFAAiF;QACnF,CAAC,CAAC,yDACN;UACE,CAAC,mBAAmB,IAAI,YAAY,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE;UACxF,qBAAqB,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;UAe/E,mBAAmB;QACjB,CAAC,CAAC;;;;;;UAMJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,6DACN;;;;;;;;;;;;;;;;;;UAmBE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;oEAOsD;QACxD,CAAC,CAAC,8DACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BN,mBAAmB,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE;EACvD,YAAY,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,CAAC,EAAE;EACtD,qBAAqB,CAAC,CAAC,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpE,CAAA;AACD,CAAC,CAAA;AAlNY,QAAA,yBAAyB,6BAkNrC;AAED,SAAS,gCAAgC;IACvC,0EAA0E;IAC1E,4DAA4D;IAC5D,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8ER,CAAA;AACD,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;CAuBR,CAAA;AACD,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgQR,CAAA;AACD,CAAC;AAEM,MAAM,yBAAyB,GAAG,CACvC,eAAgD,EAChD,iBAAyC,EACjC,EAAE;IACV,MAAM,mBAAmB,GAAG,CAAA,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,MAAI,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,qBAAqB,CAAA,CAAA;IAC9F,MAAM,qBAAqB,GAAG,CAAC,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,kBAAkB,CAAA;IAEzF,OAAO;;;;;;;;EASP,mBAAmB;QACjB,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAWE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAmDb,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;UAIJ;QACE,CAAC,CAAC,EACN;UAEE,mBAAmB;QACjB,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,wDACN;UAEE,qBAAqB;QACnB,CAAC,CAAC;;;;;;;;;;;;;;;;qGAgBuF;QACzF,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CN,mBAAmB,IAAI,qBAAqB;QAC1C,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuFL;QACG,CAAC,CAAC,EACN;;EAGE,mBAAmB;QACjB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuIL;QACG,CAAC,CAAC,EACN;CACC,CAAA;AACD,CAAC,CAAA;AAzYY,QAAA,yBAAyB,6BAyYrC;AAUM,MAAM,oBAAoB,GAAG,CAClC,SAAiC,EACjC,eAAgD,EAChD,UAAuC,EAAE,EACnC,EAAE;;IACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,GAAG,KAAI,EAAE,CAAA;IACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAChD,MAAM,kBAAkB,GAAG,CAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,gBAAgB,KAAI,EAAE,CAAA;IACpE,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAU,CAAA;IAEhE,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC9E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAC5E;QACC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE9B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE;QAC9B,OAAM;KACP;IACD,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,cAAc,GAAG,IAAA,uCAA4B,EAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAA,qCAA0B,EACxB,SAAS,EACT,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kDAA0B,CACxE,CAAA;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;IAED,IAAI,UAAU,EAAE;QACd,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAC1B,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC;YAClC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,yBAAQ,CAAC,EAAE;oBACrB,OAAO,EAAE,IAAA,iCAAyB,EAAC,eAAe,EAAE,iBAAiB,CAAC;iBACvE;aACF;SACF,CAAC,CAAA;KACH;AACH,CAAC,CAAA;AA/DY,QAAA,oBAAoB,wBA+DhC"}

package/dist/cjs/webhook-signature-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature-verification.d.ts","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAO,MAqC1C,CAAA;AAED,eAAO,MAAM,uCAAuC,QAAO,MA4C1D,CAAA;AASD,eAAO,MAAM,uCAAuC,QAAO,MAgF1D,CAAA;AAED,eAAO,MAAM,qCAAqC,eACrC,QAAQ,GAAG,MAAM,KAC3B,MA2BF,CAAA;AAOD,eAAO,MAAM,+BAA+B,QAAO,MAuClD,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sCAAsC,QAAO,MA2DzD,CAAA;AAED,eAAO,MAAM,oCAAoC,QAAO,MAQvD,CAAA"}
+{"version":3,"file":"webhook-signature-verification.d.ts","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAO,MAqC1C,CAAA;AAED,eAAO,MAAM,uCAAuC,QAAO,MA4C1D,CAAA;AASD,eAAO,MAAM,uCAAuC,QAAO,MA0F1D,CAAA;AAED,eAAO,MAAM,qCAAqC,eACrC,QAAQ,GAAG,MAAM,KAC3B,MA2BF,CAAA;AAOD,eAAO,MAAM,+BAA+B,QAAO,MAuClD,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sCAAsC,QAAO,MA2DzD,CAAA;AAED,eAAO,MAAM,oCAAoC,QAAO,MAQvD,CAAA"}

package/dist/cjs/webhook-signature-verification.js

@@ -96,19 +96,29 @@ exports.generateStripeSignatureVerificationCode = generateStripeSignatureVerific
 // sandbox verification to the live API, which rejected it.
 const generatePaypalSignatureVerificationCode = () => {
     return `
+// The named variables first, then a NUMBERED copy of the stored name (the
+// editor numbers a re-typed secret: …_CLIENT_ID2), the highest number being
+// the newest. Never any other variable that merely starts with the name.
 function resolvePaypalEnv(candidates, prefix) {
   var env = process.env;
   for (var i = 0; i < candidates.length; i++) {
     var value = candidates[i] ? env[candidates[i]] : '';
     if (value && String(value).length > 0) return String(value);
   }
+  var best = '';
+  var bestNumber = -1;
   var keys = Object.keys(env);
   for (var k = 0; k < keys.length; k++) {
-    if (keys[k].indexOf(prefix) === 0 && env[keys[k]] && String(env[keys[k]]).length > 0) {
-      return String(env[keys[k]]);
+    if (keys[k].indexOf(prefix) !== 0) continue;
+    var suffix = keys[k].slice(prefix.length);
+    if (!/^[0-9]+$/.test(suffix)) continue;
+    var number = parseInt(suffix, 10);
+    if (env[keys[k]] && String(env[keys[k]]).length > 0 && number > bestNumber) {
+      best = String(env[keys[k]]);
+      bestNumber = number;
     }
   }
-  return '';
+  return best;
 }
 
 async function verifyPaypalSignature(req, rawBody, webhookConfig) {

package/dist/cjs/webhook-signature-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-signature-verification.js","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AAC1E,MAAM,uBAAuB,GAAG,GAAW,EAAE;IAClD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCP,CAAA;AACF,CAAC,CAAA;AArCY,QAAA,uBAAuB,2BAqCnC;AAEM,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CP,CAAA;AACF,CAAC,CAAA;AA5CY,QAAA,uCAAuC,2CA4CnD;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,2DAA2D;AACpD,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8EP,CAAA;AACF,CAAC,CAAA;AAhFY,QAAA,uCAAuC,2CAgFnD;AAEM,MAAM,qCAAqC,GAAG,CACnD,YAA+B,QAAQ,EAC/B,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvD,OAAO;qBAEL,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAClC;;;;qBAImB,MAAM;;;;+CAIoB,MAAM;;;;;;;;;;;;;EAanD,CAAA;AACF,CAAC,CAAA;AA7BY,QAAA,qCAAqC,yCA6BjD;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACjE,MAAM,+BAA+B,GAAG,GAAW,EAAE;IAC1D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCP,CAAA;AACF,CAAC,CAAA;AAvCY,QAAA,+BAA+B,mCAuC3C;AAED;;;;;;;;;;;;;GAaG;AACI,MAAM,sCAAsC,GAAG,GAAW,EAAE;IACjE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDP,CAAA;AACF,CAAC,CAAA;AA3DY,QAAA,sCAAsC,0CA2DlD;AAEM,MAAM,oCAAoC,GAAG,GAAW,EAAE;IAC/D,OAAO;QACL,IAAA,+CAAuC,GAAE;QACzC,IAAA,+CAAuC,GAAE;QACzC,IAAA,6CAAqC,EAAC,QAAQ,CAAC;QAC/C,IAAA,6CAAqC,EAAC,MAAM,CAAC;QAC7C,IAAA,uCAA+B,GAAE;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC,CAAA;AARY,QAAA,oCAAoC,wCAQhD"}
+{"version":3,"file":"webhook-signature-verification.js","sourceRoot":"","sources":["../../src/webhook-signature-verification.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AAC1E,MAAM,uBAAuB,GAAG,GAAW,EAAE;IAClD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCP,CAAA;AACF,CAAC,CAAA;AArCY,QAAA,uBAAuB,2BAqCnC;AAEM,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CP,CAAA;AACF,CAAC,CAAA;AA5CY,QAAA,uCAAuC,2CA4CnD;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,2DAA2D;AACpD,MAAM,uCAAuC,GAAG,GAAW,EAAE;IAClE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwFP,CAAA;AACF,CAAC,CAAA;AA1FY,QAAA,uCAAuC,2CA0FnD;AAEM,MAAM,qCAAqC,GAAG,CACnD,YAA+B,QAAQ,EAC/B,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IACvD,OAAO;qBAEL,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAClC;;;;qBAImB,MAAM;;;;+CAIoB,MAAM;;;;;;;;;;;;;EAanD,CAAA;AACF,CAAC,CAAA;AA7BY,QAAA,qCAAqC,yCA6BjD;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACjE,MAAM,+BAA+B,GAAG,GAAW,EAAE;IAC1D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCP,CAAA;AACF,CAAC,CAAA;AAvCY,QAAA,+BAA+B,mCAuC3C;AAED;;;;;;;;;;;;;GAaG;AACI,MAAM,sCAAsC,GAAG,GAAW,EAAE;IACjE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDP,CAAA;AACF,CAAC,CAAA;AA3DY,QAAA,sCAAsC,0CA2DlD;AAEM,MAAM,oCAAoC,GAAG,GAAW,EAAE;IAC/D,OAAO;QACL,IAAA,+CAAuC,GAAE;QACzC,IAAA,+CAAuC,GAAE;QACzC,IAAA,6CAAqC,EAAC,QAAQ,CAAC;QAC/C,IAAA,6CAAqC,EAAC,MAAM,CAAC;QAC7C,IAAA,uCAA+B,GAAE;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC,CAAA;AARY,QAAA,oCAAoC,wCAQhD"}

package/dist/cjs/workflow-auth-generator.d.ts

@@ -13,7 +13,9 @@ export declare const ROLE_OF_TOKEN_CODE = "function roleOf(token) {\n  if (!toke
  * protection + a scan of its graph for user-owned writes), so enforcement is a
  * single local JWT decode — `getToken` reads the session cookie the browser
  * already sends and verifies it with `NEXTAUTH_SECRET`. No DB, no network, no
- * round trip. `next-auth/jwt` is required LAZILY so a project generated without
+ * round trip — except the shared reader's session-stamp check, which reads a
+ * stamped session's account at most once a minute per instance
+ * (`session-revocation-generator.ts`). `next-auth/jwt` is required LAZILY so a project generated without
  * authentication (where the package is absent) never fails to load this file —
  * such projects also carry no protected workflows, so the guard no-ops.
  *
@@ -25,6 +27,7 @@ export declare const ROLE_OF_TOKEN_CODE = "function roleOf(token) {\n  if (!toke
  */
 export declare const generateWorkflowAuthHelperFile: (options?: {
     withSubscriberAccess?: boolean;
+    withSessionRevocation?: boolean;
 }) => string;
 export interface WorkflowAuthInjection {
     requireLine: string;

package/dist/cjs/workflow-auth-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-auth-generator.d.ts","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAGnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,+YAc7B,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B,aAChC;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC1C,MAgKF,CAAA;AA2BD,MAAM,WAAW,qBAAqB;IAEpC,WAAW,EAAE,MAAM,CAAA;IAEnB,WAAW,EAAE,MAAM,CAAA;IAGnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,eAAO,MAAM,0BAA0B,eACzB,sBAAsB,GAAG,SAAS,KAC7C,qBA2CF,CAAA"}
+{"version":3,"file":"workflow-auth-generator.d.ts","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAGnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,+YAc7B,CAAA;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,8BAA8B,aAChC;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC3E,MAmKF,CAAA;AA2BD,MAAM,WAAW,qBAAqB;IAEpC,WAAW,EAAE,MAAM,CAAA;IAEnB,WAAW,EAAE,MAAM,CAAA;IAGnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,eAAO,MAAM,0BAA0B,eACzB,sBAAsB,GAAG,SAAS,KAC7C,qBA2CF,CAAA"}

package/dist/cjs/workflow-auth-generator.js

@@ -30,7 +30,9 @@ exports.ROLE_OF_TOKEN_CODE = `function roleOf(token) {
  * protection + a scan of its graph for user-owned writes), so enforcement is a
  * single local JWT decode — `getToken` reads the session cookie the browser
  * already sends and verifies it with `NEXTAUTH_SECRET`. No DB, no network, no
- * round trip. `next-auth/jwt` is required LAZILY so a project generated without
+ * round trip — except the shared reader's session-stamp check, which reads a
+ * stamped session's account at most once a minute per instance
+ * (`session-revocation-generator.ts`). `next-auth/jwt` is required LAZILY so a project generated without
  * authentication (where the package is absent) never fails to load this file —
  * such projects also carry no protected workflows, so the guard no-ops.
  *
@@ -50,9 +52,12 @@ const generateWorkflowAuthHelperFile = (options = {}) => {
 // (const __WF_AUTH) computed by the GUI mapper from the protection of the
 // page(s) that trigger the workflow plus a graph scan for user-owned writes.
 
-${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)()}
+${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)('../..', {
+        withRevocation: options.withSessionRevocation !== false,
+    })}
 function getSessionToken(req) {
-  // Local cookie decode — no DB, no network.
+  // Local cookie decode, then the shared session-stamp check of the reader
+  // (a session revoked by a password change is no session).
   return __tqSessionToken(req);
 }
 

package/dist/cjs/workflow-auth-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-auth-generator.js","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":";;;AACA,uEAAoF;AAEpF;;;;GAIG;AACU,QAAA,kBAAkB,GAAG;;;;;;;;;;;;;;EAchC,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,8BAA8B,GAAG,CAC5C,UAA8C,EAAE,EACxC,EAAE;IACV,OAAO;;;;;;;;;EASP,IAAA,kEAAwC,GAAE;;;;;;;;;;;;;EAa1C,0BAAkB;;EAElB,8BAA8B,CAAC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsItE,CAAA;AACD,CAAC,CAAA;AAlKY,QAAA,8BAA8B,kCAkK1C;AAED;;;;GAIG;AACH;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,CAAC,oBAA6B,EAAU,EAAE,CAC/E,oBAAoB;IAClB,CAAC,CAAC;;;EAGJ;IACE,CAAC,CAAC;;;;EAIJ,CAAA;AAYF,MAAM,eAAe,GAA0B,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AAE3F,MAAM,0BAA0B,GAAG,CACxC,UAA8C,EACvB,EAAE;IACzB,IACE,CAAC,UAAU;QACX,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAC9E;QACA,OAAO,eAAe,CAAA;KACvB;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAOR;QACF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;KAC5C,CAAA;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;KACzB;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;KAC1C;IACD,IAAI,UAAU,CAAC,oBAAoB,EAAE;QACnC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,MAAM,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC;aACtE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;KACjC;IAED,OAAO;QACL,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK;QAC7D,SAAS,EAAE;;;;;MAKT;KACH,CAAA;AACH,CAAC,CAAA;AA7CY,QAAA,0BAA0B,8BA6CtC"}
+{"version":3,"file":"workflow-auth-generator.js","sourceRoot":"","sources":["../../src/workflow-auth-generator.ts"],"names":[],"mappings":";;;AACA,uEAAoF;AAEpF;;;;GAIG;AACU,QAAA,kBAAkB,GAAG;;;;;;;;;;;;;;EAchC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACI,MAAM,8BAA8B,GAAG,CAC5C,UAA+E,EAAE,EACzE,EAAE;IACV,OAAO;;;;;;;;;EASP,IAAA,kEAAwC,EAAC,OAAO,EAAE;QAClD,cAAc,EAAE,OAAO,CAAC,qBAAqB,KAAK,KAAK;KACxD,CAAC;;;;;;;;;;;;;;EAcA,0BAAkB;;EAElB,8BAA8B,CAAC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsItE,CAAA;AACD,CAAC,CAAA;AArKY,QAAA,8BAA8B,kCAqK1C;AAED;;;;GAIG;AACH;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,CAAC,oBAA6B,EAAU,EAAE,CAC/E,oBAAoB;IAClB,CAAC,CAAC;;;EAGJ;IACE,CAAC,CAAC;;;;EAIJ,CAAA;AAYF,MAAM,eAAe,GAA0B,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AAE3F,MAAM,0BAA0B,GAAG,CACxC,UAA8C,EACvB,EAAE;IACzB,IACE,CAAC,UAAU;QACX,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAC9E;QACA,OAAO,eAAe,CAAA;KACvB;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAOR;QACF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;KAC5C,CAAA;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;KACzB;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;KAC1C;IACD,IAAI,UAAU,CAAC,oBAAoB,EAAE;QACnC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAA;QAClC,MAAM,CAAC,sBAAsB,GAAG,CAAC,UAAU,CAAC,sBAAsB,IAAI,EAAE,CAAC;aACtE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;KACjC;IAED,OAAO;QACL,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK;QAC7D,SAAS,EAAE;;;;;MAKT;KACH,CAAA;AACH,CAAC,CAAA;AA7CY,QAAA,0BAA0B,8BA6CtC"}