@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/src/session-revocation-generator.ts

@@ -0,0 +1,177 @@
+/**
+ * `utils/auth/session-revocation.js`: the one check that ends a session once
+ * the account's credentials change, and that hands every server file the
+ * account's stored email and role. Emitted for every project with
+ * authentication.
+ *
+ * A session token carries a stamp of the account's password hash (and of its
+ * `session_version` column, when the `users` table has one), taken when it was
+ * issued. `liveSessionToken` reads the account by the token's id (the key every
+ * consumer acts on): a deleted account, a password reset or change, or a bumped
+ * `session_version` ("sign out everywhere") ends every token stamped before,
+ * and a live token comes back with the row's email and role, so a demotion
+ * counts on the next request. A store that cannot be read (an error, or no
+ * lookup by id) answers no session: the check fails closed. The shared session
+ * reader (`__tqSessionToken`) runs it for every server file; the NextAuth `jwt`
+ * callback compares the same stamp on each `/api/auth/session`.
+ */
+
+import { FileType, ProjectPluginStructure } from '@teleporthq/teleport-types'
+import { SessionCookieResolver } from '@teleporthq/teleport-shared'
+
+/**
+ * The token claim that carries the stamp. Never copied onto `session.user`.
+ * One value with the shared session reader (`__tqSessionToken`), which runs
+ * this module's check for every consumer.
+ */
+export const SESSION_STAMP_KEY = SessionCookieResolver.SESSION_STAMP_KEY
+
+export const SESSION_REVOCATION_FILE_NAME = 'session-revocation'
+
+/**
+ * How long one server instance trusts its last look at an account: a password
+ * change, a deletion or a demotion counts on every instance within this.
+ */
+export const SESSION_CHECK_INTERVAL_MS = 10000
+
+/**
+ * Writes `utils/auth/session-revocation.js` for every project with
+ * authentication: the shared session reader requires it from every server
+ * file (an OAuth-only project's sessions are never stamped, so its check
+ * always passes).
+ */
+export const ensureSessionRevocationModule = (structure: ProjectPluginStructure): void => {
+  if (structure.files.has('auth-session-revocation')) {
+    return
+  }
+  structure.files.set('auth-session-revocation', {
+    path: ['utils', 'auth'],
+    files: [
+      {
+        name: SESSION_REVOCATION_FILE_NAME,
+        fileType: FileType.JS,
+        content: generateSessionRevocationFile(),
+      },
+    ],
+  })
+}
+
+export const generateSessionRevocationFile = (): string => `'use strict';
+
+// GENERATED — see generateSessionRevocationFile in
+// @teleporthq/teleport-plugin-next-workflows/src/session-revocation-generator.ts.
+//
+// A session ends when the account's password changes (a reset, a change), its
+// session_version column, when the users table has one, moves ("sign out
+// everywhere"), or the account is gone. The token carries a stamp of both from
+// when it was issued; the account, read by the token's id, is compared with it
+// here. The shared session reader (__tqSessionToken) runs this for every server
+// file, and hands out the token with the account's stored email and role, so a
+// demotion counts at once.
+
+var crypto = require('crypto');
+var __security = require('../security-runtime');
+
+var SESSION_STAMP_KEY = '${SESSION_STAMP_KEY}';
+// How long one server instance trusts its last look at an account.
+var CHECK_INTERVAL_MS = ${SESSION_CHECK_INTERVAL_MS};
+var CACHE_MAX_ENTRIES = 5000;
+// What the token takes from the stored account.
+var ACCOUNT_FIELDS = ['email', 'role', 'roleName', 'roles'];
+var __checked = new Map();
+
+// A keyed digest of what the session depends on: the password hash and the
+// optional session_version. null without the app secret (no token can be
+// issued or decoded without it either).
+function credentialStamp(row) {
+  var secret = process.env.NEXTAUTH_SECRET;
+  if (!row || typeof row !== 'object' || !secret) {
+    return null;
+  }
+  var material =
+    'session-stamp|v1|' +
+    String(row.password == null ? '' : row.password) +
+    '|' +
+    String(row.session_version == null ? '' : row.session_version);
+  return crypto.createHmac('sha256', String(secret)).update(material).digest('hex').slice(0, 32);
+}
+
+// 'unstamped' (a token issued before stamps, or with no account of its own),
+// 'current', or 'revoked' — for the token's account as stored now (null: the
+// account is gone, which ends the session too).
+function stampVerdict(token, row) {
+  if (!token || typeof token !== 'object' || typeof token[SESSION_STAMP_KEY] !== 'string') {
+    return 'unstamped';
+  }
+  if (!row) {
+    return 'revoked';
+  }
+  var stamp = credentialStamp(row);
+  if (!stamp) {
+    return 'current';
+  }
+  return __security.safeEqual(stamp, token[SESSION_STAMP_KEY]) ? 'current' : 'revoked';
+}
+
+function accountOf(row) {
+  var account = {};
+  for (var i = 0; i < ACCOUNT_FIELDS.length; i++) {
+    if (row[ACCOUNT_FIELDS[i]] !== undefined) {
+      account[ACCOUNT_FIELDS[i]] = row[ACCOUNT_FIELDS[i]];
+    }
+  }
+  return account;
+}
+
+function withAccount(token, account) {
+  var live = Object.assign({}, token);
+  var keys = Object.keys(account);
+  for (var i = 0; i < keys.length; i++) {
+    live[keys[i]] = account[keys[i]];
+  }
+  return live;
+}
+
+function remember(key, account, now) {
+  if (__checked.size >= CACHE_MAX_ENTRIES) {
+    __checked.delete(__checked.keys().next().value);
+  }
+  __checked.set(key, { account: account, at: now });
+}
+
+// The token as it still counts — carrying the account's stored email and role —
+// or null when its account changed its credentials since the token was
+// stamped, or is gone. An unstamped token is returned as it is. A store that
+// cannot be read REJECTS (and nothing is cached): the reader then counts no
+// session, never the stale one.
+async function liveSessionToken(token) {
+  if (!token || typeof token !== 'object' || typeof token[SESSION_STAMP_KEY] !== 'string') {
+    return token || null;
+  }
+  var id = token.id != null ? token.id : token.sub;
+  if (id == null || String(id) === '') {
+    return null;
+  }
+  var key = String(id) + '|' + token[SESSION_STAMP_KEY];
+  var now = Date.now();
+  var seen = __checked.get(key);
+  if (seen && now - seen.at >= 0 && now - seen.at < CHECK_INTERVAL_MS) {
+    return seen.account ? withAccount(token, seen.account) : null;
+  }
+  var authOptions = require('./auth-options');
+  if (!authOptions || typeof authOptions.findUserById !== 'function') {
+    throw new Error('The account store cannot be read by id');
+  }
+  var row = await authOptions.findUserById(String(id));
+  var account = stampVerdict(token, row || null) === 'current' ? accountOf(row) : null;
+  remember(key, account, now);
+  return account ? withAccount(token, account) : null;
+}
+
+module.exports = {
+  SESSION_STAMP_KEY: SESSION_STAMP_KEY,
+  credentialStamp: credentialStamp,
+  stampVerdict: stampVerdict,
+  liveSessionToken: liveSessionToken,
+};
+`

package/src/slack-message-values.ts

@@ -0,0 +1,84 @@
+import type { UIDLWorkflowNode, UIDLWorkflows } from '@teleporthq/teleport-types'
+
+/**
+ * A Slack step's message is mrkdwn, where `<…>` is a link, a mention or
+ * `<!channel>`, and the values an automation puts in it come from the event —
+ * what a customer typed among them. Each value must reach Slack escaped
+ * (`&`, `<`, `>`: the only characters Slack decodes). A value embedded in the
+ * message (a context chip) is escaped by the runtime as it is filled in
+ * (`resolveRichTextContext`); a message that IS one value (the whole field
+ * bound to it) is written here as that same chip, so it is escaped the same
+ * way. Every other step is left as it is — in an automation, a page workflow,
+ * a webhook or a custom node alike.
+ */
+const SLACK_NODE_TYPE = 'integration-slack'
+const SLACK_MESSAGE_KEYS = ['text']
+
+interface ContextReference {
+  type: 'workflowContext'
+  nodeId: string
+  path: string[]
+}
+
+const isContextReference = (value: unknown): value is ContextReference => {
+  const candidate = value as ContextReference | null
+  return (
+    !!candidate &&
+    typeof candidate === 'object' &&
+    candidate.type === 'workflowContext' &&
+    typeof candidate.nodeId === 'string' &&
+    candidate.nodeId.length > 0 &&
+    Array.isArray(candidate.path)
+  )
+}
+
+// The chip the editor writes for a value, read back by resolveRichTextContext:
+// the path as JSON in a double-quoted attribute (`&quot;`), with `<`, `>` and
+// `&` written as JSON escapes so nothing in it can end the tag or the entity.
+const asContextChip = (reference: ContextReference): string => {
+  const path = JSON.stringify(reference.path)
+    .replace(/[<>&]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`)
+    .replace(/"/g, '&quot;')
+  const nodeId = reference.nodeId.replace(/[^A-Za-z0-9_-]/g, '')
+  return `<span class="context-value-inline" data-ctx-node-id="${nodeId}" data-ctx-path="${path}">value</span>`
+}
+
+const withSlackMessageValuesEscaped = (node: UIDLWorkflowNode): UIDLWorkflowNode => {
+  if (node.type !== SLACK_NODE_TYPE || !node.config) {
+    return node
+  }
+  const config = node.config as Record<string, unknown>
+  const bound = SLACK_MESSAGE_KEYS.filter((key) => isContextReference(config[key]))
+  if (bound.length === 0) {
+    return node
+  }
+  const escaped: Record<string, unknown> = { ...config }
+  for (const key of bound) {
+    escaped[key] = asContextChip(config[key] as ContextReference)
+  }
+  return { ...node, config: escaped }
+}
+
+/** The nodes with every whole-field Slack message written as a chip; the same array when none is. */
+export const escapeSlackMessageBindings = (nodes: UIDLWorkflowNode[]): UIDLWorkflowNode[] => {
+  const escaped = nodes.map(withSlackMessageValuesEscaped)
+  return escaped.some((node, index) => node !== nodes[index]) ? escaped : nodes
+}
+
+/** Every workflow's and custom node's Slack messages, in place, before any route is written. */
+export const escapeSlackMessageBindingsInWorkflows = (
+  workflows: UIDLWorkflows | undefined
+): void => {
+  if (!workflows) {
+    return
+  }
+  const graphs = [
+    ...Object.values(workflows.workflows || {}),
+    ...Object.values(workflows.customNodes || {}),
+  ]
+  for (const graph of graphs) {
+    if (Array.isArray(graph.nodes)) {
+      graph.nodes = escapeSlackMessageBindings(graph.nodes)
+    }
+  }
+}

package/src/transactional-email-code.ts

@@ -8,6 +8,7 @@ import { UIDLLocalizedEmailTemplates } from '@teleporthq/teleport-types'
 import { EmailSender } from '@teleporthq/teleport-shared'
 import { getEmailProviderDependencies } from './invoice/email-sender-code'
 import { EMAIL_LOCALE_FILE_NAME, EMAIL_LOCALE_PATH } from './email-locale/email-locale-scope'
+import { escapeHtmlValueJs } from './nodes/email/html-escape-code'
 
 export const SUPPORTED_EMAIL_PROVIDERS = new Set([
   'resend',
@@ -47,6 +48,19 @@ export interface TransactionalEmailLedger {
   withoutRecipientDetails?: boolean
 }
 
+/**
+ * The sent-email purpose (`emailType`) of the link a sign-up mails to an
+ * address the site knows without a password (a newsletter subscriber, a
+ * checkout guest): "Set your password to finish creating your account".
+ */
+export const SET_PASSWORD_EMAIL = 'set-password'
+
+/**
+ * The sent-email purpose of the notice a sign-up mails to an address that
+ * already has an account: "You already have an account".
+ */
+export const EXISTING_ACCOUNT_EMAIL = 'existing-account'
+
 // Provider-specific `__sendProviderEmail({ from, fromName?, to, recordedTo?,
 // subject, html, apiKey, tokenValues?, userId? })`, preceded by the `__emailSender` helper that
 // names the sender. No attachment (unlike the invoice sender). When no provider
@@ -158,17 +172,29 @@ const generateRawProviderSendFunction = (provider?: string | null): string => {
   }
 }
 
-// Emits the `fillTemplate(str, values)` flat `{{key}}` replacer used to fill the
-// email subject/body tokens at send time.
-export const generateFillTemplateFn = (): string => `function fillTemplate(str, values) {
+// Emits the flat `{{key}}` replacers used to fill the email tokens at send
+// time: `fillTemplate(str, values)` for the HTML body, where every value is
+// escaped once (a name typed at signup, a Host header, …; an already escaped
+// value is not escaped again) and only the author's
+// template stays HTML; `fillSubjectTemplate(str, values)` for the subject, a
+// header, where a value loses its line breaks instead.
+export const generateFillTemplateFn = (): string => `function __fillTokens(str, values, encode) {
   if (!str) { return ''; }
   var out = String(str);
   var keys = Object.keys(values);
   for (var i = 0; i < keys.length; i++) {
     var v = values[keys[i]];
-    out = out.split('{{' + keys[i] + '}}').join(v == null ? '' : String(v));
+    out = out.split('{{' + keys[i] + '}}').join(v == null ? '' : encode(String(v)));
   }
   return out;
+}
+function fillTemplate(str, values) {
+  return __fillTokens(str, values, function (text) {
+    return ${escapeHtmlValueJs('text')};
+  });
+}
+function fillSubjectTemplate(str, values) {
+  return __fillTokens(str, values, function (text) { return text.replace(/[\\r\\n]+/g, ' '); });
 }`
 
 /**

package/src/trigger-generator.ts

@@ -84,8 +84,22 @@ export const generateTriggerCode = (workflow: UIDLWorkflow, workflowVarName: str
   }
 }
 
+// Every trigger hands the workflow the analytics ids of the visit (`__tpa`):
+// the session, visitor and page the tracker resolved, so a server segment that
+// reports an outcome can attribute it. Null when the tracker is absent — a
+// project without analytics, or a page it keeps out. A copy, not a mutation:
+// a trigger context may be a custom event's `detail`, which belongs to its
+// dispatcher.
+export const TRACKER_IDS_EXPRESSION =
+  "(typeof window !== 'undefined' && window.tpAnalytics && typeof window.tpAnalytics.ids === 'function' ? window.tpAnalytics.ids() : null)"
+
+// Reports a sent form to Growth analytics as a `lead` outcome, keyed by the
+// form's id. Guarded: the tracker is absent on a project without analytics.
+export const TRACK_LEAD_SOURCE = (formId: string): string =>
+  `if (typeof window !== 'undefined' && window.tpAnalytics && typeof window.tpAnalytics.track === 'function') { window.tpAnalytics.track('lead', { recordId: '${formId}' }); }`
+
 const generateExecutionCall = (workflowVarName: string): string => {
-  return `${workflowVarName}(triggerContext)`
+  return `${workflowVarName}(Object.assign({}, triggerContext, { __tpa: ${TRACKER_IDS_EXPRESSION} }))`
 }
 
 const generateElementClickTrigger = (
@@ -279,7 +293,9 @@ const generateFormSubmittedTrigger = (
         // required" for a name that was filled in. The spread comes first so a
         // field named \`formData\`/\`formId\`/\`timestamp\` cannot shadow them.
         const triggerContext = Object.assign({}, formData, { fields: formData, formData: formData, formId: '${formId}', timestamp: Date.now() });
-        ${executionCall};
+        // Growth analytics: a form whose workflow finished is a lead. A run
+        // that threw never reaches the report.
+        Promise.resolve(${executionCall}).then(function() { ${TRACK_LEAD_SOURCE(formId)} });
       };
       form_${safeId}.addEventListener('submit', handler_${safeId});
       return function() { form_${safeId}.removeEventListener('submit', handler_${safeId}); };
@@ -557,7 +573,7 @@ const generateRealtimePresenceTrigger = (
             const pd = presenceMessage.data || {};
             const triggerContext = {
               channelName: '${channelName}',
-              userId: pd.userId || presenceMessage.clientId || '',
+              userId: presenceMessage.clientId || pd.userId || '',
               userName: pd.userName || '',
               userData: pd.userData || null,
               timestamp: presenceMessage.timestamp || Date.now()

package/src/visitor-step-limits.ts

@@ -0,0 +1,228 @@
+import { securityRuntimeSpecifier } from './security-runtime'
+import { WorkflowSegment } from './types'
+import { NEWSLETTER_VISITOR_LIMIT, NEWSLETTER_VISITOR_SCOPE } from './newsletter/newsletter-scope'
+
+/**
+ * A step any visitor may run, but not without end: a guest booking (which
+ * takes a place in the calendar and emails a confirmation), a newsletter
+ * signup (which adds an address to the merchant's audience). The feature that
+ * builds such a step declares how often one visitor may run it, on the step:
+ *
+ *   config.visitorLimit = { limit: 10, windowSeconds: 3600 }                   // 429 past the limit
+ *   config.visitorLimit = { limit: 5, windowSeconds: 3600, onLimit: 'skip' }   // the step quietly does nothing
+ *   config.visitorLimit = { …, scope: 'newsletter-signup' }                    // one budget for every such step
+ *
+ * Without `scope` the budget is the step's own (`workflow-step:<node id>`).
+ * With one, every step that names the same scope shares one budget per
+ * visitor (`visitor-limit:<scope>`): two signup blocks, or two booking pages,
+ * do not give a visitor twice the signups or bookings.
+ *
+ * The segment route that runs the step counts every request it answers for
+ * the visitor (IPv6 by its /64), in the app's database through the shared
+ * security runtime, BEFORE any step of the segment runs — so the count cannot
+ * be dodged by calling the route directly or by marking the step skipped.
+ * This deployment's own server code (the internal-call token) is not counted.
+ *
+ * ⛔ So a declared limit holds only in a route a BROWSER calls: a limited step
+ * inside a custom node that another server segment runs with the internal
+ * token is not counted there. Declare the limit on the step the visitor's
+ * request reaches (the feature builders do).
+ *
+ * `onLimit: 'skip'` is for a step whose visitor must see the same answer either
+ * way (a signup thanks a bot and a person alike): past the limit the step, and
+ * every step after it in the segment, is skipped and the route answers as it
+ * would for a request that changed nothing. A step marked `continueOnError`
+ * is optional: past its limit only that step is skipped, and what follows it
+ * (a booking's checkout after its newsletter tick) still runs. The skip is logged server-side
+ * (the scope only — never the visitor's address or input), so an owner can
+ * tell lost signups from no signups: at most one line per scope per minute
+ * and per instance, the line saying how many more were skipped since the
+ * last one — a bot past its limit does not flood the log.
+ *
+ * A declaration that cannot be read limits at the defaults (10 per hour): a
+ * step that asked for a limit never runs without one.
+ */
+
+export const VISITOR_LIMIT_CONFIG_KEY = 'visitorLimit'
+
+const DEFAULT_LIMIT = 10
+const DEFAULT_WINDOW_SECONDS = 3600
+const MAX_LIMIT = 10000
+const MAX_WINDOW_SECONDS = 7 * 86400
+
+export interface VisitorStepLimit {
+  nodeId: string
+  /** The shared budget the step names, if any. */
+  scope?: string
+  limit: number
+  windowSeconds: number
+  onLimit: 'refuse' | 'skip'
+  /** What a refused visitor is told (the 429's public `error`), when the step names one. */
+  message?: string
+  /** The step and every step after it in the same segment (only the step when it is `continueOnError`). */
+  skipIds: string[]
+}
+
+const SCOPE_RE = /^[A-Za-z0-9_-]{1,60}$/
+const MAX_MESSAGE_LENGTH = 200
+
+const wholeInRange = (value: unknown, max: number): number | null =>
+  typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= max ? value : null
+
+/** The limit a step's config declares, or null when it declares none. */
+export const readVisitorStepLimit = (
+  config: Record<string, unknown> | undefined
+): Omit<VisitorStepLimit, 'nodeId' | 'skipIds'> | null => {
+  const declared = config ? config[VISITOR_LIMIT_CONFIG_KEY] : undefined
+  if (declared === undefined || declared === null || declared === false) {
+    return null
+  }
+  const spec = typeof declared === 'object' ? (declared as Record<string, unknown>) : {}
+  return {
+    limit: wholeInRange(spec.limit, MAX_LIMIT) ?? DEFAULT_LIMIT,
+    windowSeconds: wholeInRange(spec.windowSeconds, MAX_WINDOW_SECONDS) ?? DEFAULT_WINDOW_SECONDS,
+    onLimit: spec.onLimit === 'skip' ? 'skip' : 'refuse',
+    ...(typeof spec.scope === 'string' && SCOPE_RE.test(spec.scope) ? { scope: spec.scope } : {}),
+    ...(typeof spec.message === 'string' && spec.message.trim()
+      ? { message: spec.message.trim().slice(0, MAX_MESSAGE_LENGTH) }
+      : {}),
+  }
+}
+
+const downstreamInSegment = (segment: WorkflowSegment, startId: string): string[] => {
+  const inSegment = new Set(segment.nodes.map((n) => n.id))
+  const seen = new Set<string>()
+  const queue = [startId]
+  while (queue.length > 0) {
+    const current = queue.shift() as string
+    if (seen.has(current) || !inSegment.has(current)) {
+      continue
+    }
+    seen.add(current)
+    for (const edge of segment.edges || []) {
+      if (edge.source === current) {
+        queue.push(edge.target)
+      }
+    }
+  }
+  return Array.from(seen)
+}
+
+/**
+ * The limit a step of these types has when its config declares none: the
+ * newsletter sign-up mails through the site's provider for every address a
+ * visitor types, so a step from the add-node menu, the AI or an import is
+ * held to the public sign-up route's own budget.
+ */
+const DEFAULT_VISITOR_STEP_LIMITS: Record<string, Omit<VisitorStepLimit, 'nodeId' | 'skipIds'>> = {
+  'newsletter-subscribe': {
+    limit: NEWSLETTER_VISITOR_LIMIT,
+    windowSeconds: 3600,
+    onLimit: 'skip',
+    scope: NEWSLETTER_VISITOR_SCOPE,
+  },
+}
+
+/** Every declared limit of a segment's steps (or its type's default), in step order. */
+export const collectVisitorStepLimits = (segment: WorkflowSegment): VisitorStepLimit[] =>
+  segment.nodes
+    .slice()
+    .sort((a, b) => (a.stepNumber || 0) - (b.stepNumber || 0))
+    .reduce<VisitorStepLimit[]>((limits, node) => {
+      const declared =
+        readVisitorStepLimit(node.config as Record<string, unknown> | undefined) ||
+        DEFAULT_VISITOR_STEP_LIMITS[node.type] ||
+        null
+      if (declared) {
+        // An optional step (continueOnError) past its limit never stops what
+        // follows it: only the step itself is skipped.
+        const optional =
+          (node.config as { continueOnError?: unknown } | undefined)?.continueOnError === true
+        limits.push({
+          nodeId: node.id,
+          ...declared,
+          skipIds:
+            declared.onLimit !== 'skip'
+              ? []
+              : optional
+              ? [node.id]
+              : downstreamInSegment(segment, node.id),
+        })
+      }
+      return limits
+    }, [])
+
+const SKIP_LOG_INTERVAL_MS = 60000
+
+/** One log line per scope per minute (per instance); the rest are counted into the next line. */
+const SKIP_LOG_CODE = `
+      const __logStepLimitSkip = function (scope) {
+        var log = globalThis.__tqStepLimitSkipLog || (globalThis.__tqStepLimitSkipLog = {});
+        var now = Date.now();
+        var entry = log[scope];
+        if (entry && now - entry.since < ${SKIP_LOG_INTERVAL_MS}) {
+          entry.skipped += 1;
+          return;
+        }
+        var more = entry && entry.skipped > 0 ? ' (and ' + entry.skipped + ' more since the last line)' : '';
+        console.warn('[workflow-step-limit] skipped past its visitor limit: ' + scope + more);
+        log[scope] = { since: now, skipped: 0 };
+      };`
+
+/**
+ * The route code that counts a segment's declared limits: '' for a segment
+ * without one, so every other route is byte-identical. Placed after the
+ * request context is claimed and the auth guard has run, before any step.
+ * `relativePrefix` leads from the route's folder to the project root.
+ */
+export const buildVisitorStepLimitGuard = (
+  segment: WorkflowSegment,
+  relativePrefix = '../../..'
+): string => {
+  const limits = collectVisitorStepLimits(segment)
+  if (limits.length === 0) {
+    return ''
+  }
+  const checks = limits.map((step) => {
+    const scope = step.scope ? `visitor-limit:${step.scope}` : `workflow-step:${step.nodeId}`
+    const options = JSON.stringify({
+      scope,
+      limit: step.limit,
+      windowSeconds: step.windowSeconds,
+    })
+    if (step.onLimit === 'skip') {
+      // No response object: past the limit the runtime answers nothing itself.
+      return `
+      if (!(await __stepLimiter.rateLimitRequest(req, null, ${options}))) {
+        __logStepLimitSkip(${JSON.stringify(scope)});
+        if (!context.__skippedNodes || typeof context.__skippedNodes !== 'object') context.__skippedNodes = {};
+        ${JSON.stringify(
+          step.skipIds
+        )}.forEach(function (id) { context.__skippedNodes[id] = true; });
+      }`
+    }
+    if (step.message) {
+      // Counted like any refused step; the 429 carries the step's own words.
+      return `
+      if (!(await __stepLimiter.rateLimitRequest(req, null, ${options}))) {
+        var __stepRetry = typeof __stepLimiter.peekRateLimitRequest === 'function' ? await __stepLimiter.peekRateLimitRequest(req, ${options}) : null;
+        if (__stepRetry && __stepRetry.retryAfter) res.setHeader('Retry-After', String(__stepRetry.retryAfter));
+        return res.status(429).json({ error: ${JSON.stringify(step.message)} });
+      }`
+    }
+    return `
+      if (!(await __stepLimiter.rateLimitRequest(req, res, ${options}))) {
+        return;
+      }`
+  })
+  return `
+    // Steps that declare how often one visitor may run them (a guest booking,
+    // a newsletter signup — see visitor-step-limits.ts): counted per visitor in
+    // the app's database for every request this route answers, before any step
+    // runs. This deployment's own server code is not counted.
+    if (!require('${relativePrefix}/utils/workflows/server-runtime').isInternalCall(req)) {
+      const __stepLimiter = require('${securityRuntimeSpecifier(relativePrefix)}');${
+    limits.some((step) => step.onLimit === 'skip') ? SKIP_LOG_CODE : ''
+  }${checks.join('')}
+    }`
+}