@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/esm/security-scanner.d.ts

@@ -16,8 +16,13 @@
  * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
  *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
  *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ *   - the runtime shadow in nodes/general/general-custom-js.ts
+ * (`__tests__/security-lists-parity.test.ts` fails when they drift). Every
+ * secret TeleportHQ keeps for the site (`SYSTEM_MANAGED_SECRET_NAMES`, GUI and
+ * worker) is one of them: the app secret signs every session and is what the
+ * site's own server code presents to its routes.
  */
-export declare const PROTECTED_ENV_NAMES: readonly ["TELEPORT_DB_CONNECTION_STRING", "RUNTIME_STORAGE_API_KEY", "RUNTIME_STORAGE_PROJECT_ID", "TELEPORT_PROJECT_TOKEN", "REALTIME_SERVER_API_KEY", "REALTIME_SERVER_URL", "PDF_SERVICE_URL", "PDF_SERVICE_API_KEY", "TELEPORT_CRON_SECRET", "TELEPORT_CRON_SECRET_PREVIOUS", "TELEPORT_WALL_SECRET"];
+export declare const PROTECTED_ENV_NAMES: readonly ["TELEPORT_DB_CONNECTION_STRING", "RUNTIME_STORAGE_API_KEY", "RUNTIME_STORAGE_PROJECT_ID", "TELEPORT_PROJECT_TOKEN", "REALTIME_SERVER_API_KEY", "REALTIME_SERVER_URL", "PDF_SERVICE_URL", "PDF_SERVICE_API_KEY", "TELEPORT_CRON_SECRET", "TELEPORT_CRON_SECRET_PREVIOUS", "NEXTAUTH_SECRET", "AUTH_PEPPER_SECRET", "VERCEL_AUTOMATION_BYPASS_SECRET", "TQ_CACHE_SECRET", "NEWSLETTER_SERVICE_TOKEN", "NEWSLETTER_SERVICE_URL", "TELEPORT_WALL_SECRET"];
 /**
  * The merchant's payment-provider credentials, under the name a deploy writes
  * (`STRIPE_SECRET_KEY`) or the one the editor stores (`CONFIGURATION_STRIPE_…`,
@@ -27,6 +32,47 @@ export declare const PROTECTED_ENV_NAMES: readonly ["TELEPORT_DB_CONNECTION_STRI
  * `general-custom-js.ts` denies the same names.
  */
 export declare const PROTECTED_ENV_NAME_PATTERN: RegExp;
+/**
+ * Every `TELEPORT_DB_` name: the TeleportHQ database the platform provisions —
+ * `TELEPORT_DB_CONNECTION_STRING`, the HOST / PORT / USER / PASSWORD / NAME /
+ * SSL parts a self-hosted site may set instead, and whatever part a later one
+ * names. Platform secrets like the list above (the GUI refuses them in a node
+ * config too). Mirror of the GUI's `PLATFORM_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export declare const PLATFORM_ENV_NAME_PATTERN: RegExp;
+/**
+ * Every `__` name: what TeleportHQ's integrations keep for the editor
+ * (`__gsc_*`, `__google_merchant_*`, `__social_oauth_<platform>_*`, another
+ * member's sign-in). A build published before 2026-10-26 carries them in its
+ * environment. Mirror of the GUI's `INTEGRATION_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export declare const INTEGRATION_ENV_NAME_PATTERN: RegExp;
+/**
+ * Sandbox escapes the runtime's `process` shadow cannot stop: the Function
+ * constructor reached through any function's `constructor` runs in the real
+ * global scope (`(function(){}).constructor('return process')()`,
+ * `Function.prototype.constructor(...)`, an async or generator function's),
+ * `process.env` read through a property descriptor or `Reflect`, and a scan of
+ * the global object for something that looks like `process`. Matched against
+ * the code with comments stripped and escapes decoded.
+ *
+ * SAME ENTRIES, kept in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/sandbox-escape-patterns.ts
+ *   - teleport-services-worker/src/modules/vercel/security/sandbox-escape-patterns.ts
+ */
+export declare const SANDBOX_ESCAPE_PATTERNS: ReadonlyArray<{
+    ruleId: 'sandbox-escape-constructor' | 'indirect-process-access' | 'global-enumeration';
+    message: string;
+    pattern: RegExp;
+}>;
+/**
+ * Joins adjacent string literals (`'const' + 'ructor'` → `'constructor'`), so a
+ * name split to slip past the patterns is matched whole. The patterns are
+ * matched against the folded code. Same function in the two other copies.
+ */
+export declare const foldStringConcatenations: (code: string) => string;
 export interface CodegenSecurityViolation {
     workflowId: string;
     workflowName?: string;
@@ -51,15 +97,38 @@ interface WorkflowLike {
 }
 interface WorkflowsContainer {
     workflows?: Record<string, WorkflowLike>;
+    customNodes?: Record<string, WorkflowLike>;
 }
 /**
- * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
- * any `general-custom-js` body trips the scanner.
+ * Walks the UIDL workflow definitions and custom nodes and throws
+ * `CodegenSecurityError` if any `general-custom-js` body trips the scanner.
+ * A custom node's code runs on the server too (its own segment routes, and
+ * in process inside the cron, webhook and automation routes that call it):
+ * its violation names the custom node (`workflowId` is the custom node's id).
  *
  * Per `general-custom-js` the only place a user can write JS is the `code`
  * config field, so we look only there. Other node types use structured
  * configs we don't touch.
  */
 export declare function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer | undefined): void;
+interface ScannerFinding {
+    rule: string;
+    message: string;
+}
+/**
+ * Text the author wrote, which the runtime compiles as it is
+ * (`isAuthoredText` / `resolveNodeConfig` in executor-generator.ts): a string with no inserted
+ * value, not a whole `{{…}}` token, not a secret reference. Mirrors
+ * teleport-gui `workflow-schema/src/security/compiled-code.ts` and the worker's
+ * `security-precheck.ts` (`isAuthoredText`).
+ */
+export declare const isAuthoredText: (value: unknown) => value is string;
+/**
+ * Regex-based scan. Sufficient at the codegen layer because:
+ *   - the GUI's AST scanner has already vetted the code.
+ *   - the services-worker re-runs the full AST scan on the publish payload.
+ *   - the runtime `process` Proxy preamble denies even successful escapes.
+ */
+export declare function scanForObviousViolations(rawCode: string): ScannerFinding[];
 export {};
 //# sourceMappingURL=security-scanner.d.ts.map

package/dist/esm/security-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,mBAAmB,4SAYtB,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QACqD,CAAA;AAE5F,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,UAAU,EAAE,wBAAwB,EAAE;gBAAtC,UAAU,EAAE,wBAAwB,EAAE;CAWnE;AAED,UAAU,gBAAgB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3B;AAED,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CA2BjG"}
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,mBAAmB,icAqBtB,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,QACqD,CAAA;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAA6B,CAAA;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAAsB,CAAA;AAQ/D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC;IAClD,MAAM,EAAE,4BAA4B,GAAG,yBAAyB,GAAG,oBAAoB,CAAA;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB,CAuCA,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,SAAU,MAAM,KAAG,MAgBvD,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,UAAU,EAAE,wBAAwB,EAAE;gBAAtC,UAAU,EAAE,wBAAwB,EAAE;CAWnE;AAED,UAAU,gBAAgB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3B;AAED,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CAC3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAmCjG;AAED,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAmED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,UAAW,OAAO,oBAKD,CAAA;AAE5C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CA2G1E"}

package/dist/esm/security-scanner.js

@@ -16,6 +16,11 @@
  * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
  *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
  *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ *   - the runtime shadow in nodes/general/general-custom-js.ts
+ * (`__tests__/security-lists-parity.test.ts` fails when they drift). Every
+ * secret TeleportHQ keeps for the site (`SYSTEM_MANAGED_SECRET_NAMES`, GUI and
+ * worker) is one of them: the app secret signs every session and is what the
+ * site's own server code presents to its routes.
  */
 export const PROTECTED_ENV_NAMES = [
     'TELEPORT_DB_CONNECTION_STRING',
@@ -28,6 +33,15 @@ export const PROTECTED_ENV_NAMES = [
     'PDF_SERVICE_API_KEY',
     'TELEPORT_CRON_SECRET',
     'TELEPORT_CRON_SECRET_PREVIOUS',
+    'NEXTAUTH_SECRET',
+    'AUTH_PEPPER_SECRET',
+    'VERCEL_AUTOMATION_BYPASS_SECRET',
+    'TQ_CACHE_SECRET',
+    // The site's newsletter service key and the services worker's address: only
+    // the admin panel's newsletter route reads them.
+    'NEWSLETTER_SERVICE_TOKEN',
+    'NEWSLETTER_SERVICE_URL',
+    // The password wall's secret. Only the wall reads it.
     'TELEPORT_WALL_SECRET',
 ];
 /**
@@ -39,6 +53,97 @@ export const PROTECTED_ENV_NAMES = [
  * `general-custom-js.ts` denies the same names.
  */
 export const PROTECTED_ENV_NAME_PATTERN = /^(?:CONFIGURATION_)?(?:STRIPE|PAYPAL|MOLLIE|RAZORPAY|SQUARE|PADDLE|COINGATE)_[A-Z0-9_]+$/;
+/**
+ * Every `TELEPORT_DB_` name: the TeleportHQ database the platform provisions —
+ * `TELEPORT_DB_CONNECTION_STRING`, the HOST / PORT / USER / PASSWORD / NAME /
+ * SSL parts a self-hosted site may set instead, and whatever part a later one
+ * names. Platform secrets like the list above (the GUI refuses them in a node
+ * config too). Mirror of the GUI's `PLATFORM_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export const PLATFORM_ENV_NAME_PATTERN = /^TELEPORT_DB_[A-Z0-9_]+$/;
+/**
+ * Every `__` name: what TeleportHQ's integrations keep for the editor
+ * (`__gsc_*`, `__google_merchant_*`, `__social_oauth_<platform>_*`, another
+ * member's sign-in). A build published before 2026-10-26 carries them in its
+ * environment. Mirror of the GUI's `INTEGRATION_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export const INTEGRATION_ENV_NAME_PATTERN = /^__[A-Za-z0-9_]+$/;
+/**
+ * Such a name read from `env` (`env.__x`, `env['__x']`). Only in that
+ * position: `__proto__` or `__dirname` elsewhere in the code is not one.
+ */
+const INTEGRATION_ENV_READ = /\benv\s*(?:\.\s*|\[\s*["'`])(__[A-Za-z0-9_]+)/g;
+/**
+ * Sandbox escapes the runtime's `process` shadow cannot stop: the Function
+ * constructor reached through any function's `constructor` runs in the real
+ * global scope (`(function(){}).constructor('return process')()`,
+ * `Function.prototype.constructor(...)`, an async or generator function's),
+ * `process.env` read through a property descriptor or `Reflect`, and a scan of
+ * the global object for something that looks like `process`. Matched against
+ * the code with comments stripped and escapes decoded.
+ *
+ * SAME ENTRIES, kept in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/sandbox-escape-patterns.ts
+ *   - teleport-services-worker/src/modules/vercel/security/sandbox-escape-patterns.ts
+ */
+export const SANDBOX_ESCAPE_PATTERNS = [
+    {
+        ruleId: 'sandbox-escape-constructor',
+        message: 'reaches a function constructor through .constructor (compare it or read .name instead)',
+        pattern: /\.\s*constructor\b(?!\s*(?:[!=]==?|\.\s*name\b))/,
+    },
+    {
+        ruleId: 'sandbox-escape-constructor',
+        message: 'names "constructor" as a key',
+        pattern: /["'`]constructor["'`]/,
+    },
+    {
+        ruleId: 'sandbox-escape-constructor',
+        message: 'destructures constructor',
+        pattern: /[{,]\s*constructor\s*[:,}=]/,
+    },
+    {
+        ruleId: 'indirect-process-access',
+        message: 'reads process through a property descriptor or Reflect',
+        pattern: /\b(?:Object\s*\.\s*getOwnPropertyDescriptors?|Reflect\s*\.\s*(?:get|getOwnPropertyDescriptor|ownKeys|has))\s*\(\s*(?:(?:globalThis|global)\s*\.\s*)?process\b/,
+    },
+    {
+        ruleId: 'indirect-process-access',
+        message: 'returns this from a plain function (the global object outside strict mode)',
+        pattern: /\bfunction\b[^{}]*\{\s*return\s+this\s*;?\s*\}/,
+    },
+    {
+        ruleId: 'global-enumeration',
+        message: 'enumerates the global object',
+        pattern: /\b(?:Object\s*\.\s*(?:keys|values|entries|getOwnPropertyNames|getOwnPropertyDescriptors)|Reflect\s*\.\s*ownKeys)\s*\(\s*(?:globalThis|global)\s*\)/,
+    },
+    {
+        ruleId: 'global-enumeration',
+        message: 'iterates the global object',
+        pattern: /\bfor\s*\(\s*(?:var|let|const)?\s*\w+\s+(?:in|of)\s+(?:globalThis|global)\b/,
+    },
+];
+/**
+ * Joins adjacent string literals (`'const' + 'ructor'` → `'constructor'`), so a
+ * name split to slip past the patterns is matched whole. The patterns are
+ * matched against the folded code. Same function in the two other copies.
+ */
+export const foldStringConcatenations = (code) => {
+    const pair = /(["'])((?:(?!\1)[^\\\n])*)\1\s*\+\s*(["'])((?:(?!\3)[^\\\n])*)\3/g;
+    let previous = '';
+    let folded = code;
+    while (folded !== previous) {
+        previous = folded;
+        folded = folded.replace(pair, (whole, _open, left, _next, right) => {
+            const joined = left + right;
+            const quote = joined.indexOf("'") === -1 ? "'" : joined.indexOf('"') === -1 ? '"' : '';
+            return quote ? quote + joined + quote : whole;
+        });
+    }
+    return folded;
+};
 export class CodegenSecurityError extends Error {
     constructor(violations) {
         super(`Codegen blocked by ${violations.length} security violation${violations.length === 1 ? '' : 's'}`);
@@ -50,8 +155,11 @@ export class CodegenSecurityError extends Error {
     }
 }
 /**
- * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
- * any `general-custom-js` body trips the scanner.
+ * Walks the UIDL workflow definitions and custom nodes and throws
+ * `CodegenSecurityError` if any `general-custom-js` body trips the scanner.
+ * A custom node's code runs on the server too (its own segment routes, and
+ * in process inside the cron, webhook and automation routes that call it):
+ * its violation names the custom node (`workflowId` is the custom node's id).
  *
  * Per `general-custom-js` the only place a user can write JS is the `code`
  * config field, so we look only there. Other node types use structured
@@ -59,10 +167,14 @@ export class CodegenSecurityError extends Error {
  */
 export function assertWorkflowsAreSecure(workflowsContainer) {
     var _a, _b;
-    if (!(workflowsContainer === null || workflowsContainer === void 0 ? void 0 : workflowsContainer.workflows))
+    if (!workflowsContainer)
         return;
     const violations = [];
-    for (const [wfId, wf] of Object.entries(workflowsContainer.workflows)) {
+    const owners = [
+        ...Object.entries(workflowsContainer.workflows || {}),
+        ...Object.entries(workflowsContainer.customNodes || {}),
+    ];
+    for (const [wfId, wf] of owners) {
         if (!wf || !Array.isArray(wf.nodes))
             continue;
         for (const node of wf.nodes) {
@@ -70,9 +182,13 @@ export function assertWorkflowsAreSecure(workflowsContainer) {
             if ((nodeAsUnknown === null || nodeAsUnknown === void 0 ? void 0 : nodeAsUnknown.type) !== 'general-custom-js')
                 continue;
             const code = (_a = nodeAsUnknown.config) === null || _a === void 0 ? void 0 : _a.code;
-            if (typeof code !== 'string' || !code.trim())
+            if (code === undefined || code === null || code === '')
                 continue;
-            const findings = scanForObviousViolations(code);
+            // Code the runtime would resolve before compiling it (a token, a context
+            // value, a secret, an inserted value) is whatever it resolves to.
+            const findings = isAuthoredText(code)
+                ? scanForObviousViolations(code)
+                : [{ rule: 'unreadable-step-code', message: REFERENCE_CODE_MESSAGE }];
             for (const finding of findings) {
                 violations.push({
                     workflowId: wfId,
@@ -87,13 +203,79 @@ export function assertWorkflowsAreSecure(workflowsContainer) {
     if (violations.length > 0)
         throw new CodegenSecurityError(violations);
 }
+/**
+ * `process.env` read as a value — the whole environment — or with a key the
+ * code does not spell out: the editor's `process-without-property` and
+ * `dynamic-env-access` (teleport-gui `workflow-schema/src/security/scan-custom-js.ts`,
+ * and the worker's copy), read from the text. A `process.env` only tested for
+ * its truth (`!process.env`, `process.env ? … : …`, `process.env && …`), or
+ * named into a variable whose properties are read, is not one; a key written
+ * as a string, or as a variable the code sets to one, is spelled out.
+ */
+const ENV_READ = /\bprocess\s*(?:\?\.|\.)\s*env\b/g;
+function envReadFindings(code) {
+    let bare = false;
+    let dynamic = false;
+    ENV_READ.lastIndex = 0;
+    for (let match = ENV_READ.exec(code); match !== null; match = ENV_READ.exec(code)) {
+        const before = code.slice(0, match.index);
+        const after = code.slice(match.index + match[0].length);
+        const key = /^\s*(?:\?\.\s*)?\[\s*([^\]]*?)\s*\]/.exec(after);
+        if (key) {
+            const spelled = /^(["'`])[^"'`\\]*\1$/.test(key[1]) ||
+                (/^[A-Za-z_$][\w$]*$/.test(key[1]) &&
+                    new RegExp(`\\b(?:const|let|var)\\s+${key[1].replace(/\$/g, '\\$')}\\s*=\\s*(["'\`])[^"'\`]*\\1`).test(code));
+            if (!spelled) {
+                dynamic = true;
+            }
+            continue;
+        }
+        if (/^\s*(?:\?\.|\.|\[)/.test(after)) {
+            continue;
+        }
+        if (/^\s*(?:\?(?![.?])|&&|\|\||[!=]==?)/.test(after)) {
+            continue;
+        }
+        if (/(?:!|\btypeof|\bif\s*\(|\bwhile\s*\(|\bBoolean\s*\(|&&|\|\||\b(?:const|let|var)\s+[\w$]+\s*=)\s*$/.test(before)) {
+            continue;
+        }
+        bare = true;
+    }
+    const out = [];
+    if (bare) {
+        out.push({
+            rule: 'process-without-property',
+            message: 'uses process.env as a value, which exposes every variable',
+        });
+    }
+    if (dynamic) {
+        out.push({
+            rule: 'dynamic-env-access',
+            message: 'reads process.env with a key it does not spell out',
+        });
+    }
+    return out;
+}
+const REFERENCE_CODE_MESSAGE = 'uses a reference as its code (a {{…}} token, a context value, a secret or an inserted value): the server would compile whatever it resolves to';
+/**
+ * Text the author wrote, which the runtime compiles as it is
+ * (`isAuthoredText` / `resolveNodeConfig` in executor-generator.ts): a string with no inserted
+ * value, not a whole `{{…}}` token, not a secret reference. Mirrors
+ * teleport-gui `workflow-schema/src/security/compiled-code.ts` and the worker's
+ * `security-precheck.ts` (`isAuthoredText`).
+ */
+export const isAuthoredText = (value) => typeof value === 'string' &&
+    value.indexOf('context-value-inline') === -1 &&
+    !/^\s*\{\{[\s\S]*\}\}\s*$/.test(value) &&
+    value.indexOf('WORKFLOW_SECRET_') !== 0 &&
+    value.indexOf('teleporthq.secrets.') !== 0;
 /**
  * Regex-based scan. Sufficient at the codegen layer because:
  *   - the GUI's AST scanner has already vetted the code.
  *   - the services-worker re-runs the full AST scan on the publish payload.
  *   - the runtime `process` Proxy preamble denies even successful escapes.
  */
-function scanForObviousViolations(rawCode) {
+export function scanForObviousViolations(rawCode) {
     const out = [];
     const code = stripCommentsAndDecodeEscapes(rawCode);
     for (const name of PROTECTED_ENV_NAMES) {
@@ -104,13 +286,33 @@ function scanForObviousViolations(rawCode) {
             });
         }
     }
-    const credentialNames = (code.match(/\b[A-Z][A-Z0-9_]+\b/g) || []).filter((word) => PROTECTED_ENV_NAME_PATTERN.test(word));
+    const words = code.match(/\b[A-Z][A-Z0-9_]+\b/g) || [];
+    const platformNames = words.filter((word) => PLATFORM_ENV_NAME_PATTERN.test(word) &&
+        PROTECTED_ENV_NAMES.indexOf(word) === -1);
+    for (const name of Array.from(new Set(platformNames))) {
+        out.push({
+            rule: 'protected-env-access',
+            message: `references protected platform secret "${name}"`,
+        });
+    }
+    const credentialNames = words.filter((word) => PROTECTED_ENV_NAME_PATTERN.test(word));
     for (const name of Array.from(new Set(credentialNames))) {
         out.push({
             rule: 'protected-env-access',
             message: `references payment credential "${name}"`,
         });
     }
+    const integrationNames = [];
+    INTEGRATION_ENV_READ.lastIndex = 0;
+    for (let read = INTEGRATION_ENV_READ.exec(code); read !== null; read = INTEGRATION_ENV_READ.exec(code)) {
+        integrationNames.push(read[1]);
+    }
+    for (const name of Array.from(new Set(integrationNames))) {
+        out.push({
+            rule: 'protected-env-access',
+            message: `reads integration secret "${name}"`,
+        });
+    }
     if (/\beval\s*\(/.test(code)) {
         out.push({ rule: 'sandbox-escape-eval', message: 'calls eval(...)' });
     }
@@ -141,6 +343,13 @@ function scanForObviousViolations(rawCode) {
             message: 'reaches process via globalThis / global',
         });
     }
+    const folded = foldStringConcatenations(code);
+    for (const escape of SANDBOX_ESCAPE_PATTERNS) {
+        if (escape.pattern.test(folded)) {
+            out.push({ rule: escape.ruleId, message: escape.message });
+        }
+    }
+    out.push(...envReadFindings(code));
     // Mass enumeration of process.env
     if (/\bObject\.(?:keys|values|entries|assign|fromEntries|getOwnProperty(?:Names|Symbols|Descriptors))\s*\(\s*(?:[^)]*,\s*)?process\.env\b/.test(code) ||
         /\bJSON\.stringify\s*\(\s*process\.env\b/.test(code) ||

package/dist/esm/security-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,yBAAyB;IACzB,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,sBAAsB;IACtB,+BAA+B;IAC/B,sBAAsB;CACd,CAAA;AAEV;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,0FAA0F,CAAA;AAU5F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAA4B,UAAsC;QAChE,KAAK,CACH,sBAAsB,UAAU,CAAC,MAAM,sBACrC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,EAAE,CACH,CAAA;QALyB,eAAU,GAAV,UAAU,CAA4B;QAMhE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACF;AAiBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,kBAAkD;;IACzF,IAAI,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,SAAS,CAAA;QAAE,OAAM;IAC1C,MAAM,UAAU,GAA+B,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QACrE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE;YAC3B,MAAM,aAAa,GAAG,IAIrB,CAAA;YACD,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,MAAK,mBAAmB;gBAAE,SAAQ;YACzD,MAAM,IAAI,GAAG,MAAA,aAAa,CAAC,MAAM,0CAAE,IAAI,CAAA;YACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAQ;YACtD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,EAAE,CAAC,IAAI;oBACrB,MAAM,EAAE,MAAA,aAAa,CAAC,EAAE,mCAAI,GAAG;oBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;aACH;SACF;KACF;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;AACvE,CAAC;AAOD;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;IAEnD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE;QACtC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,yCAAyC,IAAI,GAAG;aAC1D,CAAC,CAAA;SACH;KACF;IACD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACjF,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CACtC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,kCAAkC,IAAI,GAAG;SACnD,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAA;KACtE;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;KAC5E;IACD,IACE,kIAAkI,CAAC,IAAI,CACrI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;KACH;IACD,IACE,iIAAiI,CAAC,IAAI,CACpI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;KACH;IACD,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnE,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,kCAAkC;IAClC,IACE,sIAAsI,CAAC,IAAI,CACzI,IAAI,CACL;QACD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QACrD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,oEAAoE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC/E;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;KACH;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAChF,QAAQ,GAAG,QAAQ;SAChB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACnF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpE,IAAI;QACF,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;KAClC;IAAC,WAAM;QACN,OAAO,EAAE,CAAA;KACV;AACH,CAAC"}
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,yBAAyB;IACzB,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,sBAAsB;IACtB,+BAA+B;IAC/B,iBAAiB;IACjB,oBAAoB;IACpB,iCAAiC;IACjC,iBAAiB;IACjB,4EAA4E;IAC5E,iDAAiD;IACjD,0BAA0B;IAC1B,wBAAwB;IACxB,sDAAsD;IACtD,sBAAsB;CACd,CAAA;AAEV;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,0FAA0F,CAAA;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D;;;GAGG;AACH,MAAM,oBAAoB,GAAG,gDAAgD,CAAA;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAI/B;IACH;QACE,MAAM,EAAE,4BAA4B;QACpC,OAAO,EACL,wFAAwF;QAC1F,OAAO,EAAE,kDAAkD;KAC5D;IACD;QACE,MAAM,EAAE,4BAA4B;QACpC,OAAO,EAAE,8BAA8B;QACvC,OAAO,EAAE,uBAAuB;KACjC;IACD;QACE,MAAM,EAAE,4BAA4B;QACpC,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,6BAA6B;KACvC;IACD;QACE,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,wDAAwD;QACjE,OAAO,EACL,+JAA+J;KAClK;IACD;QACE,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,4EAA4E;QACrF,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,8BAA8B;QACvC,OAAO,EACL,oJAAoJ;KACvJ;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,4BAA4B;QACrC,OAAO,EAAE,6EAA6E;KACvF;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAAU,EAAE;IAC/D,MAAM,IAAI,GAAG,mEAAmE,CAAA;IAChF,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,OAAO,MAAM,KAAK,QAAQ,EAAE;QAC1B,QAAQ,GAAG,MAAM,CAAA;QACjB,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,IAAI,EACJ,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,CAAA;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACtF,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QAC/C,CAAC,CACF,CAAA;KACF;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAUD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAA4B,UAAsC;QAChE,KAAK,CACH,sBAAsB,UAAU,CAAC,MAAM,sBACrC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,EAAE,CACH,CAAA;QALyB,eAAU,GAAV,UAAU,CAA4B;QAMhE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACF;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,kBAAkD;;IACzF,IAAI,CAAC,kBAAkB;QAAE,OAAM;IAC/B,MAAM,UAAU,GAA+B,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG;QACb,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,IAAI,EAAE,CAAC;QACrD,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,IAAI,EAAE,CAAC;KACxD,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE;QAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE;YAC3B,MAAM,aAAa,GAAG,IAIrB,CAAA;YACD,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,MAAK,mBAAmB;gBAAE,SAAQ;YACzD,MAAM,IAAI,GAAG,MAAA,aAAa,CAAC,MAAM,0CAAE,IAAe,CAAA;YAClD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAQ;YAChE,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC;gBAChC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAA;YACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,EAAE,CAAC,IAAI;oBACrB,MAAM,EAAE,MAAA,aAAa,CAAC,EAAE,mCAAI,GAAG;oBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;aACH;SACF;KACF;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;AACvE,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AAEnD,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAA;IACtB,KAAK,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7D,IAAI,GAAG,EAAE;YACP,MAAM,OAAO,GACX,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,MAAM,CACR,2BAA2B,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,8BAA8B,CACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACjB,IAAI,CAAC,OAAO,EAAE;gBACZ,OAAO,GAAG,IAAI,CAAA;aACf;YACD,SAAQ;SACT;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACpC,SAAQ;SACT;QACD,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACpD,SAAQ;SACT;QACD,IACE,mGAAmG,CAAC,IAAI,CACtG,MAAM,CACP,EACD;YACA,SAAQ;SACT;QACD,IAAI,GAAG,IAAI,CAAA;KACZ;IACD,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,IAAI,IAAI,EAAE;QACR,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAA;KACH;IACD,IAAI,OAAO,EAAE;QACX,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAA;KACH;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,sBAAsB,GAC1B,gJAAgJ,CAAA;AAElJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAmB,EAAE,CAChE,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;IAEnD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE;QACtC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,yCAAyC,IAAI,GAAG;aAC1D,CAAC,CAAA;SACH;KACF;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,mBAA6C,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACtE,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,yCAAyC,IAAI,GAAG;SAC1D,CAAC,CAAA;KACH;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACrF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,kCAAkC,IAAI,GAAG;SACnD,CAAC,CAAA;KACH;IACD,MAAM,gBAAgB,GAAa,EAAE,CAAA;IACrC,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAA;IAClC,KACE,IAAI,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1C,IAAI,KAAK,IAAI,EACb,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EACtC;QACA,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;KAC/B;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6BAA6B,IAAI,GAAG;SAC9C,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAA;KACtE;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;KAC5E;IACD,IACE,kIAAkI,CAAC,IAAI,CACrI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;KACH;IACD,IACE,iIAAiI,CAAC,IAAI,CACpI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;KACH;IACD,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnE,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC7C,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE;QAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;SAC3D;KACF;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IAClC,kCAAkC;IAClC,IACE,sIAAsI,CAAC,IAAI,CACzI,IAAI,CACL;QACD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QACrD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,oEAAoE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC/E;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;KACH;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAChF,QAAQ,GAAG,QAAQ;SAChB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACnF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpE,IAAI;QACF,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;KAClC;IAAC,WAAM;QACN,OAAO,EAAE,CAAA;KACV;AACH,CAAC"}

package/dist/esm/segment-splitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segment-splitter.d.ts","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAoB,MAAM,4BAA4B,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAyG/D,eAAO,MAAM,iBAAiB,aAAc,YAAY,KAAG,eAAe,EAqIzE,CAAA;AAuGD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,SAAU,gBAAgB,KAAG,oBAChC,CAAA;AAajC,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,MAAM,CAGhE,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,OAAO,CAAC,OAC1B,oBAAoB,aACd,MAAM,KAChB,OAAO,MAAM,EAAE,OAAO,CAgBxB,CAAA;AA0BD,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA"}
+{"version":3,"file":"segment-splitter.d.ts","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAoB,MAAM,4BAA4B,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AA4G/D,eAAO,MAAM,iBAAiB,aAAc,YAAY,KAAG,eAAe,EAqIzE,CAAA;AAuGD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,SAAU,gBAAgB,KAAG,oBAChC,CAAA;AAajC,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,MAAM,CAGhE,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,OAAO,CAAC,OAC1B,oBAAoB,aACd,MAAM,KAChB,OAAO,MAAM,EAAE,OAAO,CAgBxB,CAAA;AA+BD,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA"}

package/dist/esm/segment-splitter.js

@@ -18,8 +18,11 @@ const resolveExecutionEnv = (node, prevEnv) => {
     // function (which has its own client/server segments). The server handler is
     // a stub — if this node is placed in a server segment the nested workflow
     // never runs and downstream references to its output resolve to the marker.
+    // The exception is a call of a node only server code may run (`serverOnly`,
+    // which the editor marks `executionEnv: 'server'`): it stays in its caller's
+    // server segment, whose route runs it (server-custom-node-call.ts).
     if (node.type === 'general-custom-node') {
-        return 'client';
+        return node.executionEnv === 'server' ? 'server' : 'client';
     }
     const registered = nodeRegistry[node.type];
     if ((registered === null || registered === void 0 ? void 0 : registered.executionEnv) === 'client') {
@@ -330,8 +333,13 @@ const ROUTE_ONLY_ACCOUNT_CONFIG_KEYS = new Set([
     ...WELCOME_EMAIL_CONFIG_KEYS,
     'domain',
     'deletedEmailPattern',
+    'resetPagePath',
+]);
+const ROUTE_BACKED_ACCOUNT_NODE_TYPES = new Set([
+    'account-signup',
+    'account-delete-current',
+    'account-request-password-reset',
 ]);
-const ROUTE_BACKED_ACCOUNT_NODE_TYPES = new Set(['account-signup', 'account-delete-current']);
 const redactRouteOnlyAccountConfig = (config) => {
     const safe = {};
     for (const key of Object.keys(config)) {

package/dist/esm/segment-splitter.js.map

@@ -1 +1 @@
-{"version":3,"file":"segment-splitter.js","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAC1B,IAAsB,EACtB,OAAoC,EACd,EAAE;;IACxB,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE;QACvC,OAAO,QAAQ,CAAA;KAChB;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE;QACrC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,OAA6B,CAAA;QACtD,IAAI,GAAG,KAAK,QAAQ,EAAE;YACpB,OAAO,QAAQ,CAAA;SAChB;QACD,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE;QACzC,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,iBAAiB,IAAI,EAAE,KAAK,cAAc,EAAE;YACzE,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,kBAAkB,EAAE;YAC7B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;QACtE,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;YACnC,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,oBAAoB,EAAE;YAC/B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,OAAO,OAAO,IAAI,QAAQ,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,CAChC,kBAA0B,EAC1B,KAAyB,EACzB,KAAyB,EACZ,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,EAAE;YACnC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;SACrB;KACF;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAC1B,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACvC,SAAQ;SACT;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;aACrB;SACF;KACF;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAsB,EAAqB,EAAE;IAC7E,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC/B,OAAO,EAAE,CAAA;KACV;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,IAAI,QAAQ,CAAC,YAAY,EAAE;QACzB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CACxC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAC5B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,KAAK,CACf,EAAE;YACD,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;SACvB;KACF;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAA;QACvD,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,EAAE;YACpE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACxB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAChF,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;aACvB;SACF;KACF;IAED,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpB,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IAEpB,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,SAAS,EACT,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,MAAA,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA,EAAA,CAC3E,CAAA;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,IAAI,UAAU,GAAgC,IAAI,CAAA;IAClD,IAAI,cAAc,GAAa,EAAE,CAAA;IACjC,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC9C,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CACnF,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CACxF,CAAA;IACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtD,SAAS;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC;SACxC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;;QAClD,OAAA,oBAAoB,CAAC,GAAG,CACtB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,MAAA,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,QAAQ,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CACzE,CAAA;KAAA,CACF,CACF,CAAA;IACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,eAC5C,OAAA,MAAA,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAA,MAAA,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,0CAAE,UAAU,KAAI,CAAC,CAAC,CAAA,EAAA,CAAA;IACvF,MAAM,4BAA4B,GAAG,CAAC,IAAsB,EAAW,EAAE,CACvE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAC9F,CAAA;IAEH,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE;YACtD,OAAM;SACP;QACD,MAAM,EAAE,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAA;QAEhG,MAAM,KAAK,GAAG,cAAc;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAuB,CAAA;QAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACjC,CAAC,CAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5E,CAAA;QACD,mEAAmE;QACnE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;YACjF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAChF,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QAChG,cAAc,GAAG,EAAE,CAAA;IACrB,CAAC,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,EAAE;YACT,SAAQ;SACT;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAE/D,IACE,UAAU,KAAK,IAAI;YACnB,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EACxF;YACA,YAAY,EAAE,CAAA;SACf;QACD,UAAU,GAAG,OAAO,CAAA;QACpB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;KAC5B;IAED,YAAY,EAAE,CAAA;IACd,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,sBAAsB,GAAG,CAC7B,SAA6B,EAC7B,SAA6B,EACM,EAAE;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAA;IACjE,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE;QACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,SAAQ;SACT;QACD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC;aACzC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,MAAM,UAAU,GAAyB,cAAc,CAAC,IAAI,CAC1D,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,QAAQ,CAC3D;YACC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;QACZ,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;YACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE;gBACjD,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;aAC7C;SACF;KACF;IACD,OAAO,iBAAiB,CAAA;AAC1B,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,CAAC,IAAsB,EAA+B,EAAE;IACvF,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC/C,OAAO,GAAG,KAAK,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,CACtB,KAAe,EACf,SAA6B,EAC7B,SAA6B,EACnB,EAAE;IACZ,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;QAC1B,OAAO,KAAK,CAAA;KACb;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAE1E,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,KAAK,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,SAAQ;SACT;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;QAExD,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,mBAAmB,GAAG,CAAC,EAAE;YAC3B,SAAQ;SACT;QACD,OAAO,GAAG;YACR,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC;YAChD,GAAG,WAAW;YACd,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;SAC9C,CAAA;KACF;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAsB,EAAwB,EAAE,CACtF,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAEjC,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,oEAAoE;AACpE,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAA0B;IACnE,WAAW;IACX,uBAAuB;CACxB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAA+B,EAC/B,GAAyB,EACzB,QAAiB,EACQ,EAAE;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,MAAM,CAAA;KACd;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE;QACpB,OAAO,QAAQ,IAAI,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,MAAM,CAAA;KACX;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,8BAA8B,EAAE;QAChD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;YAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;SACxB;KACF;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAS;IACrD,GAAG,yBAAyB;IAC5B,QAAQ;IACR,qBAAqB;CACtB,CAAC,CAAA;AAEF,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAA;AAE7F,MAAM,4BAA4B,GAAG,CAAC,MAA+B,EAA2B,EAAE;IAChG,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACrC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;SACxB;KACF;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA"}
+{"version":3,"file":"segment-splitter.js","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAC1B,IAAsB,EACtB,OAAoC,EACd,EAAE;;IACxB,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE;QACvC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;KAC5D;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE;QACrC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,OAA6B,CAAA;QACtD,IAAI,GAAG,KAAK,QAAQ,EAAE;YACpB,OAAO,QAAQ,CAAA;SAChB;QACD,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE;QACzC,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,iBAAiB,IAAI,EAAE,KAAK,cAAc,EAAE;YACzE,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,kBAAkB,EAAE;YAC7B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;QACtE,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;YACnC,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,oBAAoB,EAAE;YAC/B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,OAAO,OAAO,IAAI,QAAQ,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,CAChC,kBAA0B,EAC1B,KAAyB,EACzB,KAAyB,EACZ,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,EAAE;YACnC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;SACrB;KACF;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAC1B,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACvC,SAAQ;SACT;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;aACrB;SACF;KACF;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAsB,EAAqB,EAAE;IAC7E,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC/B,OAAO,EAAE,CAAA;KACV;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,IAAI,QAAQ,CAAC,YAAY,EAAE;QACzB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CACxC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAC5B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,KAAK,CACf,EAAE;YACD,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;SACvB;KACF;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAA;QACvD,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,EAAE;YACpE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACxB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAChF,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;aACvB;SACF;KACF;IAED,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpB,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IAEpB,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,SAAS,EACT,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,MAAA,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA,EAAA,CAC3E,CAAA;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,IAAI,UAAU,GAAgC,IAAI,CAAA;IAClD,IAAI,cAAc,GAAa,EAAE,CAAA;IACjC,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC9C,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CACnF,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CACxF,CAAA;IACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtD,SAAS;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC;SACxC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;;QAClD,OAAA,oBAAoB,CAAC,GAAG,CACtB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,MAAA,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,QAAQ,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CACzE,CAAA;KAAA,CACF,CACF,CAAA;IACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,eAC5C,OAAA,MAAA,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,CAAC,CAAA,MAAA,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,0CAAE,UAAU,KAAI,CAAC,CAAC,CAAA,EAAA,CAAA;IACvF,MAAM,4BAA4B,GAAG,CAAC,IAAsB,EAAW,EAAE,CACvE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAC9F,CAAA;IAEH,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE;YACtD,OAAM;SACP;QACD,MAAM,EAAE,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAA;QAEhG,MAAM,KAAK,GAAG,cAAc;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAuB,CAAA;QAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACjC,CAAC,CAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5E,CAAA;QACD,mEAAmE;QACnE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;YACjF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAChF,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QAChG,cAAc,GAAG,EAAE,CAAA;IACrB,CAAC,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,EAAE;YACT,SAAQ;SACT;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAE/D,IACE,UAAU,KAAK,IAAI;YACnB,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EACxF;YACA,YAAY,EAAE,CAAA;SACf;QACD,UAAU,GAAG,OAAO,CAAA;QACpB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;KAC5B;IAED,YAAY,EAAE,CAAA;IACd,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,sBAAsB,GAAG,CAC7B,SAA6B,EAC7B,SAA6B,EACM,EAAE;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAA;IACjE,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE;QACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,SAAQ;SACT;QACD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC;aACzC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,MAAM,UAAU,GAAyB,cAAc,CAAC,IAAI,CAC1D,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,QAAQ,CAC3D;YACC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;QACZ,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;YACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,EAAE;gBACjD,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;aAC7C;SACF;KACF;IACD,OAAO,iBAAiB,CAAA;AAC1B,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,CAAC,IAAsB,EAA+B,EAAE;IACvF,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC/C,OAAO,GAAG,KAAK,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,CACtB,KAAe,EACf,SAA6B,EAC7B,SAA6B,EACnB,EAAE;IACZ,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;QAC1B,OAAO,KAAK,CAAA;KACb;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAE1E,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,KAAK,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,SAAQ;SACT;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;QAExD,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,mBAAmB,GAAG,CAAC,EAAE;YAC3B,SAAQ;SACT;QACD,OAAO,GAAG;YACR,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC;YAChD,GAAG,WAAW;YACd,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;SAC9C,CAAA;KACF;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAsB,EAAwB,EAAE,CACtF,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAEjC,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,oEAAoE;AACpE,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAA0B;IACnE,WAAW;IACX,uBAAuB;CACxB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAA+B,EAC/B,GAAyB,EACzB,QAAiB,EACQ,EAAE;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,MAAM,CAAA;KACd;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE;QACpB,OAAO,QAAQ,IAAI,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,MAAM,CAAA;KACX;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,8BAA8B,EAAE;QAChD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE;YAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;SACxB;KACF;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAS;IACrD,GAAG,yBAAyB;IAC5B,QAAQ;IACR,qBAAqB;IACrB,eAAe;CAChB,CAAC,CAAA;AAEF,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,gBAAgB;IAChB,wBAAwB;IACxB,gCAAgC;CACjC,CAAC,CAAA;AAEF,MAAM,4BAA4B,GAAG,CAAC,MAA+B,EAA2B,EAAE;IAChG,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACrC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;SACxB;KACF;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA"}

package/dist/esm/segment-trust.d.ts

@@ -1,5 +1,6 @@
 import { UIDLWorkflowEdge, UIDLWorkflowNode } from '@teleporthq/teleport-types';
 import { WorkflowSegment } from './types';
+import { MessageTrust } from './nodes/email/message-trust';
 /**
  * What a server segment route may believe about the context a request hands
  * it. A workflow runs as a chain of segments, and the results of every earlier
@@ -20,8 +21,26 @@ import { WorkflowSegment } from './types';
  * - `previousFrom`: when the segment right before this one runs on the
  *   server, the node whose result the caller must hand on as
  *   `__previousNodeResult` (the runtime sets it from that node's signed result).
+ *
+ * What a signature binds (see the server runtime): the workflow (`workflowId`),
+ * the segment that produced the result (`signedBy`, and `segmentId` for this
+ * route's own), the run it belongs to and when it was made. A run is opened by
+ * the first server segment of the graph (`opensRun`), which never adopts one a
+ * request names; every later segment continues the run its request carries.
+ *
+ * `session` says which of the visitor's identity this route reads, so it is
+ * taken from the session cookie on the server and never from the request:
+ * - `identityNodes`: the graph's current-user readers (`account-get-current`,
+ *   `account-refresh-session`). They run in the browser; the route rebuilds
+ *   their result from the session.
+ * - `identityReads`: the `data-select` / `data-count` nodes of this segment
+ *   filtered by the visitor's identity, with those columns. Without an
+ *   identity (a guest) such a read matches nothing, never the whole table.
+ * Absent when the segment reads no identity.
  */
 export interface SegmentGraph {
+    /** The workflow (or custom node) the graph belongs to. */
+    id?: string;
     nodes: UIDLWorkflowNode[];
     edges: UIDLWorkflowEdge[];
     /** Every segment of the graph, in the order the runtime executes them. */
@@ -35,15 +54,32 @@ export interface SegmentBranchGate {
         nodeIds: string[];
     }>;
 }
+export interface SegmentSessionNeeds {
+    identityNodes: Record<string, string>;
+    identityReads: Record<string, string[]>;
+}
 export interface SegmentTrust {
     signedNodeIds: string[];
+    signedBy: Record<string, string>;
     branchGates: SegmentBranchGate[];
     loopBodies: Record<string, string[]>;
     previousFrom: {
         nodeId: string;
         fireAndForget: boolean;
     } | null;
+    workflowId: string;
+    segmentId: string;
+    opensRun: boolean;
+    session?: SegmentSessionNeeds;
+    /**
+     * Only for a segment with an email/SMS node: the graph's node results the
+     * send guard may trust (owner recipients, trusted HTML; see
+     * nodes/email/message-trust).
+     */
+    messageTrust?: MessageTrust;
 }
+/** The nodes whose result is the signed-in visitor (see `session` above). */
+export declare const IDENTITY_NODE_TYPES: ReadonlySet<string>;
 /** A switch branch is taken by a case id; this prefix keeps it apart from 'default'. */
 export declare const SWITCH_CASE_PREFIX = "case:";
 export declare const buildSegmentTrust: (segment: WorkflowSegment, graph: SegmentGraph) => SegmentTrust;

package/dist/esm/segment-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segment-trust.d.ts","sourceRoot":"","sources":["../../src/segment-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAA;IACrB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACpC,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAChE;AAED,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,UAAU,CAAA;AAiEzC,eAAO,MAAM,iBAAiB,YAAa,eAAe,SAAS,YAAY,KAAG,YA0DjF,CAAA"}
+{"version":3,"file":"segment-trust.d.ts","sourceRoot":"","sources":["../../src/segment-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAuB,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAG/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAA;IACrB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,WAAW,EAAE,iBAAiB,EAAE,CAAA;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACpC,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAIlD,CAAA;AAoIF,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,UAAU,CAAA;AAiEzC,eAAO,MAAM,iBAAiB,YAAa,eAAe,SAAS,YAAY,KAAG,YAwFjF,CAAA"}