@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.44.17

package/__tests__/_helpers/fake-fetch.ts

@@ -1,3 +1,6 @@
+import { EventEmitter } from 'events'
+import { Readable } from 'stream'
+
 export interface FetchCall {
   url: string
   method: string
@@ -94,3 +97,75 @@ export const withEnv = async <T>(
     }
   }
 }
+
+/**
+ * `dns`, `http` and `https` for a generated route under test, answered by the
+ * fake `globalThis.fetch` the test installed (see `withFetch`).
+ *
+ * The general-http-request node never calls `fetch`: it connects through its
+ * own DNS lookup and `http(s).request`, so it can refuse private addresses on
+ * the address it actually connects to. A route `require`-shim that answers
+ * these three ids from here lets that node reach the test's fake fetch, with
+ * every name resolving to one public address.
+ */
+export const FETCH_BACKED_NETWORK: Record<string, unknown> = (() => {
+  const PUBLIC_ADDRESS = { address: '93.184.216.34', family: 4 }
+  const dns = {
+    lookup(_hostname: string, options: any, callback: any) {
+      if (options && options.all) {
+        callback(null, [PUBLIC_ADDRESS])
+      } else {
+        callback(null, PUBLIC_ADDRESS.address, PUBLIC_ADDRESS.family)
+      }
+    },
+  }
+  const transport = (protocol: string) => ({
+    request(options: any, onResponse: (res: any) => void) {
+      const req: any = new EventEmitter()
+      const chunks: Buffer[] = []
+      req.write = (chunk: unknown) => {
+        chunks.push(Buffer.from(chunk as string))
+        return true
+      }
+      req.destroy = (): void => undefined
+      req.end = () => {
+        options.lookup(options.hostname, { all: true }, async (err: unknown) => {
+          if (err) {
+            req.emit('error', err)
+            return
+          }
+          try {
+            const port = options.port ? ':' + options.port : ''
+            const headers: Record<string, string> = {}
+            Object.keys(options.headers || {}).forEach((key) => {
+              headers[key] = String(options.headers[key])
+            })
+            const answer = await (globalThis as any).fetch(
+              protocol + '//' + options.hostname + port + options.path,
+              {
+                method: options.method,
+                headers,
+                body: chunks.length > 0 ? Buffer.concat(chunks).toString('utf8') : undefined,
+              }
+            )
+            const text = answer && typeof answer.text === 'function' ? await answer.text() : ''
+            const res: any = Readable.from(text ? [Buffer.from(text)] : [])
+            res.statusCode = answer.status
+            res.statusMessage = ''
+            res.headers = {}
+            if (answer.headers && typeof answer.headers.forEach === 'function') {
+              answer.headers.forEach((value: string, key: string) => {
+                res.headers[String(key).toLowerCase()] = value
+              })
+            }
+            onResponse(res)
+          } catch (fetchError) {
+            req.emit('error', fetchError)
+          }
+        })
+      }
+      return req
+    },
+  })
+  return { dns, http: transport('http:'), https: transport('https:') }
+})()

package/__tests__/_helpers/gui-place-order-statements.ts

@@ -0,0 +1,17 @@
+// The place-order statements exactly as the editor bakes them
+// (apps/gui/.../builders/ecommerce/order-redemption-helper.ts,
+// order-side-effects-helper.ts and settle-unpaid-order-custom-node.ts, read out of the editor on 2026-10-25). The
+// export-time guards recognise these shapes, so a change to the editor's
+// statements must keep matching them (the editor carries the mirror spec).
+
+export const GUI_ORDER_REDEMPTION_QUERY =
+  "WITH locked_voucher AS (\n  SELECT v.id, v.code, v.usage_limit, v.usage_count, (to_jsonb(v) ->> 'per_customer_limit')::int AS per_customer_limit\n  FROM teleport_vouchers v\n  WHERE COALESCE($1::text, '') <> '' AND v.id::text = $1::text\n  FOR UPDATE\n),\nlocked_card AS (\n  SELECT g.id, g.balance, g.status, g.expires_at, g.currency\n  FROM teleport_gift_cards g\n  WHERE COALESCE($8::text, '') <> '' AND g.id::text = $8::text\n  FOR UPDATE\n),\nverdict AS (\n  SELECT\n    (COALESCE($1::text, '') = '' OR EXISTS (\n      SELECT 1 FROM locked_voucher lv\n      WHERE (lv.usage_limit IS NULL OR lv.usage_count < lv.usage_limit)\n        AND (lv.per_customer_limit IS NULL\n          OR (SELECT COUNT(*) FROM teleport_voucher_redemptions r\n  WHERE r.voucher_id = lv.id\n    AND (r.user_id::text = $3::text\n      OR ($4::text <> '' AND r.user_id::text = $4::text)\n      OR ($5::text <> '' AND LOWER(COALESCE(r.billing_email, '')) = LOWER($5::text)))) < lv.per_customer_limit)\n    )) AS voucher_ok,\n    (COALESCE($8::text, '') = '' OR EXISTS (\n      SELECT 1 FROM locked_card lc\n      WHERE lc.status = 'active'\n        AND (lc.expires_at IS NULL OR lc.expires_at > NOW())\n        AND $9::numeric > 0\n        AND lc.balance >= $9::numeric\n        AND UPPER(COALESCE(lc.currency, '')) = UPPER(COALESCE((SELECT oc.currency FROM teleport_orders oc WHERE oc.id::text = $2::text), ''))\n    )) AS gift_card_ok\n),\nok AS (SELECT voucher_ok AND gift_card_ok AS ok FROM verdict),\nbump AS (\n  UPDATE teleport_vouchers\n  SET usage_count = usage_count + 1, updated_at = NOW()\n  WHERE (SELECT ok FROM ok)\n    AND COALESCE($1::text, '') <> ''\n    AND id::text = $1::text\n    AND (usage_limit IS NULL OR usage_count < usage_limit)\n  RETURNING id, code\n),\nredemption AS (\n  INSERT INTO teleport_voucher_redemptions\n    (voucher_id, order_id, voucher_code, user_id, billing_email, discount_amount, item_product_ids)\n  SELECT\n    bump.id,\n    ($2::text)::uuid,\n    bump.code,\n    NULLIF($3::text, '')::uuid,\n    NULLIF($5::text, ''),\n    $6::numeric,\n    NULLIF($7::text, '')\n  FROM bump\n  RETURNING id\n),\ndebit AS (\n  UPDATE teleport_gift_cards g\n  SET balance = g.balance - $9::numeric, updated_at = NOW()\n  WHERE (SELECT ok FROM ok)\n    AND COALESCE($8::text, '') <> ''\n    AND g.id::text = $8::text\n    AND g.status = 'active'\n    AND (g.expires_at IS NULL OR g.expires_at > NOW())\n    AND $9::numeric > 0\n    AND g.balance >= $9::numeric\n    AND UPPER(COALESCE(g.currency, '')) = UPPER(COALESCE((SELECT oc.currency FROM teleport_orders oc WHERE oc.id::text = $2::text), ''))\n  RETURNING g.id, right(g.code, 4) AS last4, g.balance\n),\nledger AS (\n  INSERT INTO teleport_gift_card_transactions\n    (gift_card_id, order_id, type, amount, balance_after, dedupe_key, note)\n  SELECT\n    debit.id,\n    ($2::text)::uuid,\n    'redeem',\n    -($9::numeric),\n    debit.balance,\n    'redeem:' || $2::text,\n    'Redeemed at checkout'\n  FROM debit\n  RETURNING id\n),\norder_update AS (\n  UPDATE teleport_orders o\n  SET gift_card_amount = $9::numeric, gift_card_id = debit.id, gift_card_last4 = debit.last4, updated_at = NOW()\n  FROM debit\n  WHERE o.id = ($2::text)::uuid\n  RETURNING o.id\n)\nSELECT\n  (SELECT ok FROM ok) AS ok,\n  (SELECT COUNT(*) FROM redemption) AS voucher_redeemed,\n  (SELECT COUNT(*) FROM ledger) AS gift_card_debited"
+
+export const GUI_SETTLE_ORDER_QUERY =
+  "WITH tender AS (\n  SELECT COALESCE(-SUM(t.amount), 0) AS debited\n  FROM teleport_gift_card_transactions t\n  WHERE t.dedupe_key = 'redeem:' || $1::text\n)\nUPDATE teleport_orders o\nSET status = 'confirmed',\n  payment_status = CASE WHEN (SELECT debited FROM tender) > 0 AND o.total_amount - (SELECT debited FROM tender) <= 0\n    THEN 'paid' ELSE 'pending' END,\n  payment_method = CASE WHEN (SELECT debited FROM tender) > 0 AND o.total_amount - (SELECT debited FROM tender) <= 0\n    THEN 'gift_card' ELSE 'cash_on_delivery' END,\n  payment_provider = '',\n  order_number = $2::text,\n  updated_at = NOW()\nWHERE o.id::text = $1::text\n  AND o.status = 'pending'\nRETURNING o.id, o.payment_status, o.payment_method"
+
+export const GUI_STOCK_DECREMENT_QUERY =
+  'WITH product_decrement AS ( UPDATE teleport_products AS p SET quantity = p.quantity - d.qty, updated_at = NOW() FROM unnest($1::text[], $2::int[]) AS d(id, qty) WHERE p.quantity IS NOT NULL AND p.id::text = d.id AND p.quantity >= d.qty ) UPDATE teleport_product_variants AS v SET quantity = v.quantity - d.qty, updated_at = NOW() FROM unnest($3::text[], $4::int[]) AS d(id, qty) WHERE v.quantity IS NOT NULL AND v.id::text = d.id AND v.quantity >= d.qty'
+
+export const GUI_SETTLE_UNPAID_ORDER_QUERY =
+  "WITH target AS (\n  SELECT o.id,\n    LOWER(COALESCE(o.payment_status, '')) AS payment_status,\n    LOWER(COALESCE(o.status, '')) AS status,\n    LOWER(COALESCE(o.payment_method, '')) AS payment_method,\n    (CASE WHEN COALESCE(to_jsonb(o) ->> 'payment_attempt_ref', '') <> ''\n      THEN NOT (split_part(to_jsonb(o) ->> 'payment_attempt_ref', ':', 1) = ANY(string_to_array(COALESCE(NULLIF($4::text, ''), $3::text), ',')))\n      ELSE COALESCE(o.payment_intent_id, '') <> '' AND NOT (o.payment_intent_id = ANY(string_to_array(COALESCE(NULLIF($4::text, ''), $3::text), ',')))\n    END) AS stale,\n    (COALESCE(to_jsonb(o) ->> 'provider_invoice_id', '') LIKE 'store:%') AS store_renewal\n  FROM teleport_orders o\n  WHERE $1::text <> '' AND o.id::text = $1::text\n  FOR UPDATE\n),\nawaiting AS (\n  UPDATE teleport_orders o\n  SET payment_status = 'awaiting_confirmation',\n    payment_intent_id = COALESCE(NULLIF($3::text, ''), o.payment_intent_id),\n    updated_at = NOW()\n  FROM target t\n  WHERE o.id = t.id AND $2::text = 'awaiting'\n    AND t.payment_status IN ('', 'unpaid', 'pending')\n    AND t.status IN ('', 'pending')\n    AND t.payment_method NOT IN ('cash_on_delivery', 'cod', 'cash', 'store_pickup', 'pickup')\n  RETURNING o.id\n),\nreleased AS (\n  UPDATE teleport_orders o\n  SET payment_status = 'failed', status = 'cancelled', updated_at = NOW()\n  FROM target t\n  WHERE o.id = t.id AND $2::text IN ('failed', 'expired', 'cancelled')\n    AND t.payment_status IN ('', 'unpaid', 'pending', 'awaiting_confirmation')\n    AND t.status IN ('', 'pending')\n    AND t.payment_method NOT IN ('cash_on_delivery', 'cod', 'cash', 'store_pickup', 'pickup')\n    AND NOT t.stale AND NOT t.store_renewal\n  RETURNING o.id, o.currency\n),\ndropped AS (\n  UPDATE teleport_orders o\n  SET payment_status = 'failed', updated_at = NOW()\n  FROM target t\n  WHERE o.id = t.id AND $2::text IN ('failed', 'expired', 'cancelled')\n    AND t.payment_status = 'awaiting_confirmation' AND t.status = 'cancelled'\n    AND t.payment_method NOT IN ('cash_on_delivery', 'cod', 'cash', 'store_pickup', 'pickup')\n    AND NOT t.stale AND NOT t.store_renewal\n  RETURNING o.id\n),\nreopened AS (\n  UPDATE teleport_orders o\n  SET payment_status = 'unpaid', updated_at = NOW()\n  FROM target t\n  WHERE o.id = t.id AND $2::text IN ('failed', 'expired', 'cancelled')\n    AND t.store_renewal AND NOT t.stale AND t.payment_status = 'awaiting_confirmation'\n    AND t.status IN ('', 'pending')\n  RETURNING o.id\n),\nlines AS (\n  SELECT oi.product_id::text AS product_id, NULLIF(COALESCE(oi.variant_id::text, ''), '') AS variant_id, oi.quantity\n  FROM teleport_order_items oi JOIN released r ON oi.order_id = r.id\n  WHERE oi.quantity > 0\n),\nproduct_restore AS (\n  UPDATE teleport_products p SET quantity = p.quantity + d.qty, updated_at = NOW()\n  FROM (SELECT product_id AS id, SUM(quantity)::int AS qty FROM lines\n        WHERE variant_id IS NULL AND product_id IS NOT NULL GROUP BY product_id) d\n  WHERE p.quantity IS NOT NULL AND p.id::text = d.id\n  RETURNING p.id\n),\nvariant_restore AS (\n  UPDATE teleport_product_variants v SET quantity = v.quantity + d.qty, updated_at = NOW()\n  FROM (SELECT variant_id AS id, SUM(quantity)::int AS qty FROM lines\n        WHERE variant_id IS NOT NULL GROUP BY variant_id) d\n  WHERE v.quantity IS NOT NULL AND v.id::text = d.id\n  RETURNING v.id\n)\nSELECT\n  (SELECT COUNT(*) FROM awaiting) AS awaiting,\n  (SELECT COUNT(*) FROM released) AS released,\n  (SELECT COUNT(*) FROM dropped) AS dropped,\n  (SELECT COUNT(*) FROM reopened) AS reopened,\n  (SELECT COALESCE(SUM(quantity), 0) FROM lines) AS units,\n  (SELECT COUNT(*) FROM product_restore) + (SELECT COUNT(*) FROM variant_restore) AS restocked_rows,\n  (SELECT currency FROM released) AS currency"

package/__tests__/_helpers/inserted-lines.ts

@@ -0,0 +1,22 @@
+/**
+ * How `after` differs from `before`, line by line, when it may only ADD:
+ * `kept` is false when a line of `before` was removed or changed (it is not a
+ * subsequence of `after`), and `inserted` holds the lines `after` added.
+ */
+export const insertedLines = (
+  before: string,
+  after: string
+): { kept: boolean; inserted: string[] } => {
+  const original = before.split('\n')
+  const changed = after.split('\n')
+  const inserted: string[] = []
+  let next = 0
+  for (const line of changed) {
+    if (next < original.length && line === original[next]) {
+      next++
+    } else {
+      inserted.push(line)
+    }
+  }
+  return { kept: next === original.length, inserted }
+}

package/__tests__/_helpers/invoice-store.ts

@@ -180,6 +180,15 @@ export function openStore(options: { emailDelivery?: boolean } = {}): Store {
     if (id === 'next-auth/jwt') {
       return { getToken: async () => ({ id: 'admin-1', role: 'admin' }) }
     }
+    if (/(^|\/)security-runtime$/.test(id)) {
+      return {
+        safeEqual: (given: unknown, expected: unknown) =>
+          typeof given === 'string' &&
+          typeof expected === 'string' &&
+          given !== '' &&
+          given === expected,
+      }
+    }
     const name = id.split('/').pop() as string
     if (sources[name] !== undefined) {
       if (!(name in loaded)) {
@@ -224,7 +233,7 @@ export function openStore(options: { emailDelivery?: boolean } = {}): Store {
     'x-forwarded-proto': 'https',
     'x-teleport-locale': 'de',
     referer: 'https://shop.test/de/admin/invoices',
-    cookie: 'next-auth.session-token=abc; NEXT_LOCALE=de',
+    cookie: '__Host-next-auth.session-token=abc; NEXT_LOCALE=de',
   }
 
   const store: Store = {

package/__tests__/_helpers/load-security-runtime.ts

@@ -0,0 +1,45 @@
+import * as nodeCrypto from 'crypto'
+import * as net from 'net'
+import { generateSecurityRuntimeCode } from '../../src/security-runtime/security-runtime-code'
+
+/**
+ * A generated file's `require` of the shared security runtime
+ * (`utils/security-runtime.js`), from whatever folder it sits in.
+ */
+export const isSecurityRuntimeSpecifier = (name: string): boolean =>
+  /(^|\/)utils\/security-runtime$/.test(name)
+
+/**
+ * One app instance's `utils/security-runtime.js` with no database: it counts
+ * rate limits in memory and logs nothing. What a spec's `require` shim answers
+ * for `isSecurityRuntimeSpecifier` (the data routes compare the app secret
+ * with its `safeEqual`).
+ */
+export const loadSecurityRuntime = (): any => {
+  const module = { exports: {} as any }
+  const quiet = {
+    warn: (): void => undefined,
+    error: (): void => undefined,
+    log: (): void => undefined,
+  }
+  const requireShim = (id: string): unknown => {
+    if (id === 'crypto') {
+      return nodeCrypto
+    }
+    if (id === 'net') {
+      return net
+    }
+    throw new Error("Cannot find module '" + id + "'")
+  }
+  // eslint-disable-next-line no-new-func
+  new Function(
+    'module',
+    'exports',
+    'require',
+    'process',
+    'console',
+    'Buffer',
+    generateSecurityRuntimeCode()
+  )(module, module.exports, requireShim, { env: {} }, quiet, Buffer)
+  return module.exports
+}

package/__tests__/_helpers/load-server-runtime.ts

@@ -2,13 +2,33 @@ import * as crypto from 'crypto'
 import { generateSharedRuntimeUtilsCode } from '../../src/executor-generator'
 import { generateServerRuntimeCode } from '../../src/server-runtime-code'
 
+export interface ServerRuntimeOptions {
+  /**
+   * next-auth's `getToken`, for a runtime that decodes the visitor's session
+   * cookie. Without it `next-auth/jwt` is absent and every visitor is a guest.
+   */
+  getToken?: (params: { req: unknown }) => unknown
+  /**
+   * Packages a project may have installed (`@vercel/functions`). Any other
+   * require is missing. A plain module map (no `getToken`) is accepted as this.
+   */
+  modules?: Record<string, unknown>
+}
+
 /**
  * The generated `utils/workflows/server-runtime.js` exactly as a route loads
  * it: the shared runtime utilities plus the server-only signed hand-off,
- * internal-call token and trusted base URL. `modules` answers the packages a
- * project may have installed (`@vercel/functions`); any other is missing.
+ * session identity, internal-call token and trusted base URL.
  */
-export function loadServerRuntime(modules: Record<string, unknown> = {}): Record<string, any> {
+export function loadServerRuntime(
+  options: ServerRuntimeOptions | Record<string, unknown> = {}
+): Record<string, any> {
+  const asOptions = options as ServerRuntimeOptions
+  const named =
+    typeof asOptions.getToken === 'function' ||
+    (asOptions.modules != null && typeof asOptions.modules === 'object')
+  const getToken = named ? asOptions.getToken : undefined
+  const modules = named ? asOptions.modules || {} : (options as Record<string, unknown>)
   const shared: { exports: Record<string, unknown> } = { exports: {} }
   // eslint-disable-next-line @typescript-eslint/no-implied-eval
   new Function('module', 'exports', generateSharedRuntimeUtilsCode())(shared, shared.exports)
@@ -20,6 +40,9 @@ export function loadServerRuntime(modules: Record<string, unknown> = {}): Record
     if (id === './runtime-utils') {
       return shared.exports
     }
+    if (id === 'next-auth/jwt' && getToken) {
+      return { getToken }
+    }
     if (id in modules) {
       return modules[id]
     }

package/__tests__/_helpers/run-account-delete-route.ts

@@ -129,7 +129,9 @@ export const runAccountDeleteRoute = async (setup: DeleteRouteSetup): Promise<De
   await handler(
     {
       method: 'POST',
-      headers: {},
+      // No host: the request is local http, so the plain session cookie is the
+      // one the reader accepts. getToken is stubbed and ignores its value.
+      headers: { cookie: 'next-auth.session-token=signed' },
       ...(setup.requestBody === undefined ? {} : { body: setup.requestBody }),
     },
     res

package/__tests__/_helpers/run-generated-middleware.ts

@@ -140,7 +140,12 @@ export const compileGeneratedMiddleware = (
   ): Promise<MiddlewareResult> => {
     const origin = options.origin || 'https://shop.test'
     const sessionUser = options.sessionUser ?? null
-    const cookieHeader = sessionUser ? 'next-auth.session-token=stub' : ''
+    // The session cookie the site sets for the origin's protocol (see the auth options).
+    const sessionCookie =
+      origin.indexOf('https://') === 0
+        ? '__Host-next-auth.session-token'
+        : 'next-auth.session-token'
+    const cookieHeader = sessionUser ? `${sessionCookie}=stub` : ''
     const subscriberAccess: SubscriberAccessStub = options.subscriberAccess ?? { entitled: false }
 
     const fetchImpl = async (url: string, init?: { headers?: { cookie?: string } }) => {
@@ -168,7 +173,7 @@ export const compileGeneratedMiddleware = (
       url: `${origin}${localePrefix}${pathname}`,
       cookies: {
         get: (name: string) =>
-          sessionUser && name === 'next-auth.session-token' ? { name, value: 'stub' } : undefined,
+          sessionUser && name === sessionCookie ? { name, value: 'stub' } : undefined,
       },
       headers: { get: (name: string) => (name === 'cookie' ? cookieHeader : '') },
     })

package/__tests__/account-delete-owned-rows.test.ts

@@ -185,7 +185,9 @@ const runRoute = async (schema: FixtureSchema, refuse: Refuse = () => null): Pro
       return res
     },
   }
-  await handler({ method: 'POST', headers: {} }, res)
+  // No host: the request is local http, so the plain session cookie is the one
+  // the reader accepts. getToken is stubbed and ignores its value.
+  await handler({ method: 'POST', headers: { cookie: 'next-auth.session-token=signed' } }, res)
   return run
 }
 

package/__tests__/adopted-element-trigger-code.test.ts

@@ -0,0 +1,128 @@
+// The native-listener form of an element trigger (`generateTriggerCode`), as the
+// editor exports it for a navigation element the Instant search plugin adopted:
+// a click on a linked control, and the submit of a search form, both with
+// `preventDefault` + `stopPropagation`.
+//
+// `generateTriggerCode` has NO production caller: what a published site runs are
+// the React props `workflow-component-plugin.ts` puts on the element, proven in
+// `adopted-navigation-element-end2end.test.ts` (and, for a form whose submissions
+// the platform stores, `adopted-search-form-submission-end2end.test.ts`) in the
+// Next project generator. This file only pins the same contract on the exported
+// function, for whoever wires it again: the listener is attached to the element
+// found by its published html id (never the editor's internal node id), cancels
+// the default action and the bubbling BEFORE the workflow runs, and does so only
+// when the trigger asked.
+
+import type { UIDLWorkflow } from '@teleporthq/teleport-types'
+import { generateTriggerCode } from '../src/trigger-generator'
+
+const HTML_ID = 'nav-search-link'
+const INTERNAL_NODE_ID = 'TQ_internal_node_id'
+
+const workflowWith = (
+  type: 'event-element-clicked' | 'event-element-event',
+  config: Record<string, unknown>
+): UIDLWorkflow =>
+  ({
+    id: 'open-search',
+    name: 'Open the search',
+    trigger: {
+      nodeId: 'open-search-trigger',
+      type,
+      scope: 'element',
+      config: { nodeId: INTERNAL_NODE_ID, elementHtmlId: HTML_ID, ...config },
+    },
+    nodes: [],
+    edges: [],
+  } as unknown as UIDLWorkflow)
+
+/**
+ * Runs the generated statements against a fake document. Returns what the
+ * browser would have seen: which ids were looked up, which events got a
+ * listener, and the order of everything a dispatched event then did.
+ */
+const run = (workflow: UIDLWorkflow) => {
+  const listeners: Record<string, (event: unknown) => void> = {}
+  const lookups: string[] = []
+  const calls: string[] = []
+
+  const element = {
+    addEventListener: (type: string, handler: (event: unknown) => void) => {
+      listeners[type] = handler
+    },
+    removeEventListener: (): void => undefined,
+  }
+  const fakeDocument = {
+    getElementById: (id: string) => {
+      lookups.push(id)
+      return id === HTML_ID ? element : null
+    },
+  }
+  const runWorkflow = () => {
+    calls.push('workflow')
+  }
+
+  const code = generateTriggerCode(workflow, 'runWorkflow')
+  // The statements end in a `return` of the cleanup, as they do inside the
+  // effect they are placed in.
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  const attach = new Function('document', 'window', 'runWorkflow', code)
+  const cleanup = attach(fakeDocument, {}, runWorkflow)
+
+  const dispatch = (type: string) => {
+    const event = {
+      preventDefault: () => calls.push('preventDefault'),
+      stopPropagation: () => calls.push('stopPropagation'),
+      target: {},
+    }
+    listeners[type](event)
+  }
+  return { code, listeners, lookups, calls, dispatch, cleanup }
+}
+
+describe('generateTriggerCode for an adopted navigation element', () => {
+  it('looks the control up by its published html id, never the editor node id', () => {
+    const { lookups, code } = run(
+      workflowWith('event-element-clicked', { preventDefault: true, stopPropagation: true })
+    )
+    expect(lookups).toEqual([HTML_ID])
+    expect(code).toContain(`document.getElementById('${HTML_ID}')`)
+    expect(code).not.toContain(INTERNAL_NODE_ID)
+  })
+
+  it('cancels the link, stops the bubbling, then runs the workflow on a click', () => {
+    const { listeners, calls, dispatch, cleanup } = run(
+      workflowWith('event-element-clicked', { preventDefault: true, stopPropagation: true })
+    )
+    expect(Object.keys(listeners)).toEqual(['click'])
+
+    dispatch('click')
+    expect(calls).toEqual(['preventDefault', 'stopPropagation', 'workflow'])
+    // And it unregisters with the effect.
+    expect(typeof cleanup).toBe('function')
+  })
+
+  it('cancels the form submit, stops the bubbling, then runs the workflow on a submit', () => {
+    const { listeners, calls, dispatch } = run(
+      workflowWith('event-element-event', {
+        eventType: 'submit',
+        preventDefault: true,
+        stopPropagation: true,
+      })
+    )
+    expect(Object.keys(listeners)).toEqual(['submit'])
+
+    dispatch('submit')
+    expect(calls).toEqual(['preventDefault', 'stopPropagation', 'workflow'])
+  })
+
+  it('leaves the default action and the bubbling alone when the trigger did not ask', () => {
+    const click = run(workflowWith('event-element-clicked', {}))
+    click.dispatch('click')
+    expect(click.calls).toEqual(['workflow'])
+
+    const submit = run(workflowWith('event-element-event', { eventType: 'submit' }))
+    submit.dispatch('submit')
+    expect(submit.calls).toEqual(['workflow'])
+  })
+})

package/__tests__/analytics-track-outcome.test.ts

@@ -0,0 +1,145 @@
+import { nodeRegistry } from '../src/nodes'
+import { resolveHandlerEntryName } from '../src/nodes/types'
+import { assertHandlerHasNoModuleRefs } from '../src/nodes/analytics/commerce-tracking'
+import { TRACK_LEAD_SOURCE, TRACKER_IDS_EXPRESSION } from '../src/trigger-generator'
+
+/**
+ * `analytics-track-outcome` reports what a visit produced. One node, two
+ * bodies: the browser hands the outcome to the tracker, the server posts money
+ * outcomes with the server key. Both must stay free of module references (a
+ * handler is serialized) and must never throw into a checkout.
+ */
+const NODE_TYPE = 'analytics-track-outcome'
+
+type Handler = (
+  config: Record<string, unknown>,
+  context: Record<string, unknown>
+) => Promise<unknown>
+
+function evalHandler(source: string, globals: Record<string, unknown>): Handler {
+  const entry = resolveHandlerEntryName(source, NODE_TYPE)
+  const names = Object.keys(globals)
+  // tslint:disable-next-line:function-constructor
+  const factory = new Function(...names, `${source}\nreturn ${entry};`)
+  return factory(...names.map((name) => globals[name]))
+}
+
+describe('analytics-track-outcome node', () => {
+  const generator = nodeRegistry[NODE_TYPE]
+
+  it('is registered as universal with a client and a server body free of module refs', () => {
+    expect(generator).toBeDefined()
+    expect(generator.executionEnv).toBe('universal')
+    expect(() => assertHandlerHasNoModuleRefs(generator.generateHandler(), NODE_TYPE)).not.toThrow()
+    expect(() =>
+      assertHandlerHasNoModuleRefs(generator.generateServerHandler?.() ?? '', NODE_TYPE)
+    ).not.toThrow()
+    expect(resolveHandlerEntryName(generator.generateHandler(), NODE_TYPE)).toBe(
+      'analytics_track_outcome'
+    )
+  })
+
+  it('client: hands a browser outcome to the tracker and refuses money names', async () => {
+    const tracked: unknown[] = []
+    const handler = evalHandler(generator.generateHandler(), {
+      window: {
+        tpAnalytics: { track: (name: string, detail: unknown) => tracked.push([name, detail]) },
+      },
+    })
+    expect(await handler({ name: 'lead', recordId: 'form-1' }, {})).toEqual({ sent: true })
+    expect(tracked).toEqual([['lead', expect.objectContaining({ recordId: 'form-1' })]])
+    expect(await handler({ name: 'purchase', value: 10 }, {})).toEqual({
+      sent: false,
+      reason: 'server-only',
+    })
+    expect(tracked).toHaveLength(1)
+  })
+
+  it('client: is a silent no-op without the tracker', async () => {
+    const handler = evalHandler(generator.generateHandler(), { window: {} })
+    expect(await handler({ name: 'newsletter' }, {})).toEqual({
+      sent: false,
+      reason: 'tracker-unavailable',
+    })
+  })
+
+  it('server: posts the outcome with the server key and the ids the trigger stamped', async () => {
+    const calls: Array<{ url: string; init: { headers: Record<string, string>; body: string } }> =
+      []
+    const handler = evalHandler(generator.generateServerHandler?.() ?? '', {
+      globalThis: {
+        process: {
+          env: {
+            NEXT_PUBLIC_TELEPORT_ANALYTICS_URL: 'https://analytics.example/',
+            NEXT_PUBLIC_TELEPORT_ANALYTICS_KEY: 'tpa_key',
+            TELEPORT_ANALYTICS_SERVER_KEY: 'tpas_secret',
+          },
+        },
+      },
+      fetch: (url: string, init: { headers: Record<string, string>; body: string }) => {
+        calls.push({ url, init })
+        return Promise.resolve({ status: 202 })
+      },
+      AbortController: undefined,
+    })
+    const result = await handler(
+      {
+        name: 'purchase',
+        value: '49.90',
+        currency: 'EUR',
+        outcomeId: 'ord-1',
+        attribution: { utm_source: 'facebook', visitor_id: 'aid-1' },
+      },
+      { __tpa: { sessionId: 'sid-1', visitorId: null, path: '/checkout' } }
+    )
+    expect(result).toEqual({ sent: true, status: 202 })
+    expect(calls[0].url).toBe('https://analytics.example/events/tpa_key/server')
+    expect(calls[0].init.headers['x-tp-server-key']).toBe('tpas_secret')
+    const body = JSON.parse(calls[0].init.body)
+    expect(body.outcomes[0]).toMatchObject({
+      name: 'purchase',
+      value: 49.9,
+      currency: 'EUR',
+      outcomeId: 'ord-1',
+      sessionId: 'sid-1',
+      visitorId: 'aid-1',
+      path: '/checkout',
+      attribution: { utmSource: 'facebook' },
+    })
+  })
+
+  it('server: answers not-configured without the key and never throws on a network failure', async () => {
+    const unconfigured = evalHandler(generator.generateServerHandler?.() ?? '', {
+      globalThis: { process: { env: {} } },
+      fetch: () => Promise.reject(new Error('unreachable')),
+      AbortController: undefined,
+    })
+    expect(await unconfigured({ name: 'purchase', outcomeId: 'o' }, {})).toEqual({
+      sent: false,
+      reason: 'not-configured',
+    })
+    const offline = evalHandler(generator.generateServerHandler?.() ?? '', {
+      globalThis: {
+        process: {
+          env: {
+            NEXT_PUBLIC_TELEPORT_ANALYTICS_URL: 'https://analytics.example',
+            NEXT_PUBLIC_TELEPORT_ANALYTICS_KEY: 'k',
+            TELEPORT_ANALYTICS_SERVER_KEY: 's',
+          },
+        },
+      },
+      fetch: () => Promise.reject(new Error('unreachable')),
+      AbortController: undefined,
+    })
+    expect(await offline({ name: 'booking_made', outcomeId: 'b' }, {})).toEqual({
+      sent: false,
+      reason: 'network',
+    })
+  })
+
+  it('stamps the tracker ids on every trigger context and reports a sent form as a lead', () => {
+    expect(TRACKER_IDS_EXPRESSION).toContain('window.tpAnalytics.ids()')
+    expect(TRACK_LEAD_SOURCE('form-9')).toContain("track('lead', { recordId: 'form-9' })")
+    expect(TRACK_LEAD_SOURCE('form-9')).toContain("typeof window !== 'undefined'")
+  })
+})

package/__tests__/auth-password-change-ends-sessions.test.ts

@@ -68,7 +68,14 @@ const bootAuthOptions = () => {
       return crypto
     }
     if (name === './hash-password') {
-      return { verifyPassword: (password: string, hash: string) => hash === hashOf(password) }
+      return {
+        verifyPassword: (password: string, hash: string) => hash === hashOf(password),
+        checkPassword: (password: string, hash: string) => ({
+          ok: typeof hash === 'string' && hash !== '' && hash === hashOf(password),
+          needsRehash: false,
+        }),
+        hashPassword: (password: string) => hashOf(password),
+      }
     }
     if (name === './db-health') {
       return { classifyAuthInfrastructureError: () => 'unknown' }