@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/webpack-safe-handlers.test.ts

@@ -1,4 +1,5 @@
 import { nodeRegistry } from '../src'
+import { generateSecurityRuntimeVar } from '../src/nodes/general/visitor-request'
 
 // PERMANENT guard against a class of corruption that has bitten generated
 // projects: workflow node handlers are shipped into the user's project as
@@ -38,6 +39,26 @@ const stripComments = (code: string): string => {
   return out
 }
 
+/**
+ * The one `require(` a handler may emit: the shared security runtime, read by
+ * `generateSecurityRuntimeVar` (src/nodes/general/visitor-request.ts) in
+ * exactly this try-IIFE. It is a template STRING the code generator writes,
+ * not part of a compiled function body, so the editor's browser webpack never
+ * sees it to rewrite; and the static relative path is what lets Next's SERVER
+ * build bundle `utils/security-runtime` (a dynamic require would leave it
+ * out). Only that emitted form is removed before the scan: any other path, or
+ * the same path outside the IIFE, is still an offence.
+ */
+const SECURITY_RUNTIME_REQUIRE =
+  /\(function \(\) \{ try \{ return require\('(?:\.\.\/)+utils\/security-runtime'\); \} catch \(_e\) \{ return null; \} \}\)\(\)/g
+
+/**
+ * The same try-IIFE form for the newsletter helper (`utils/newsletter/newsletter`),
+ * which the `newsletter-subscribe` server handler reads (a template string too).
+ */
+const NEWSLETTER_HELPER_REQUIRE =
+  /\(function \(\) \{ try \{ return require\('(?:\.\.\/)+utils\/newsletter\/newsletter'\); \} catch \(_e\) \{ return null; \} \}\)\(\)/g
+
 // [label, regex] — matches the bare/fragile form of each token.
 const CHECKS: Array<[string, RegExp]> = [
   // require ONLY when used as a call: `require(`. The guarded bare-value form
@@ -62,6 +83,21 @@ interface Offense {
   tokens: Record<string, number>
 }
 
+/** The fragile tokens an emitted handler holds, by label (comments and the allowed require aside). */
+const fragileTokens = (code: string): Record<string, number> => {
+  const clean = stripComments(code)
+    .replace(SECURITY_RUNTIME_REQUIRE, 'null')
+    .replace(NEWSLETTER_HELPER_REQUIRE, 'null')
+  const tokens: Record<string, number> = {}
+  for (const [label, regex] of CHECKS) {
+    const matches = clean.match(regex)
+    if (matches && matches.length) {
+      tokens[label] = matches.length
+    }
+  }
+  return tokens
+}
+
 const scanRegistry = (): { offenses: Offense[]; emitErrors: string[]; typeCount: number } => {
   const types = Object.keys(nodeRegistry).sort()
   const offenses: Offense[] = []
@@ -82,14 +118,7 @@ const scanRegistry = (): { offenses: Offense[]; emitErrors: string[]; typeCount:
       continue
     }
 
-    const clean = stripComments(emitted)
-    const tokens: Record<string, number> = {}
-    for (const [label, regex] of CHECKS) {
-      const matches = clean.match(regex)
-      if (matches && matches.length) {
-        tokens[label] = matches.length
-      }
-    }
+    const tokens = fragileTokens(emitted)
     if (Object.keys(tokens).length) {
       offenses.push({ type, tokens })
     }
@@ -105,6 +134,26 @@ describe('webpack-safe handler emission', () => {
     expect(emitErrors).toEqual([])
   })
 
+  it('allows only the security runtime require, exactly as it is emitted', () => {
+    // What the handlers emit, from a segment route and from a shared handlers file.
+    const emitted = generateSecurityRuntimeVar('__security', '../../..')
+    expect(emitted).toContain("require('../../../utils/security-runtime')")
+    expect(fragileTokens(emitted)).toEqual({})
+    expect(fragileTokens(generateSecurityRuntimeVar('__security', '../..'))).toEqual({})
+    // Anything else is still an offence: another module, another file, the
+    // same path outside the IIFE, or a second require beside the allowed one.
+    expect(fragileTokens(emitted.replace('../../../utils/security-runtime', 'fs'))).toEqual({
+      'require(': 1,
+    })
+    expect(fragileTokens(emitted.replace('utils/security-runtime', 'utils/other'))).toEqual({
+      'require(': 1,
+    })
+    expect(fragileTokens("var s = require('../../utils/security-runtime');")).toEqual({
+      'require(': 1,
+    })
+    expect(fragileTokens(`${emitted}\nvar fs = require('fs');`)).toEqual({ 'require(': 1 })
+  })
+
   it('emits NO webpack-fragile bare tokens in any handler', () => {
     if (offenses.length === 0) {
       expect(offenses).toEqual([])

package/__tests__/workflow-auth-guard.test.ts

@@ -71,7 +71,15 @@ function bootGuard(secret: string | undefined, subscriberAccess?: SubscriberAcce
   return moduleObj.exports.guardWorkflowRequest as Guard
 }
 
-const reqWith = (extra: Record<string, unknown> = {}): any => ({ headers: {}, ...extra })
+// A local request carries the plain session cookie (the only name read on http;
+// see session-cookie-resolver); getToken then reads \`req.__token\`.
+const reqWith = (extra: Record<string, unknown> = {}): any => ({
+  ...extra,
+  headers: {
+    cookie: 'next-auth.session-token=signed',
+    ...((extra.headers as Record<string, string> | undefined) || {}),
+  },
+})
 
 describe("guardWorkflowRequest — calls from this deployment's own server code", () => {
   const serverOnly = { requiresAuth: false, allowedRoles: [], serverOnly: true }

package/dist/cjs/account-delete-route-generator.d.ts

@@ -36,6 +36,7 @@ export interface AccountDeleteRouteOptions {
     localizedTemplates?: UIDLLocalizedEmailTemplates;
     siteName?: string;
     deletedEmailPattern?: string;
+    withAutomations?: boolean;
 }
 export declare const accountDeleteRouteDependencies: (provider?: string) => Record<string, string>;
 export declare const generateAccountDeleteRoute: (options?: AccountDeleteRouteOptions) => string;

package/dist/cjs/account-delete-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-delete-route-generator.d.ts","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAaxE,MAAM,WAAW,yBAAyB;IAExC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAI3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAEhD,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAID,eAAO,MAAM,8BAA8B,+CAAiC,CAAA;AAE5E,eAAO,MAAM,0BAA0B,aAAa,yBAAyB,KAAQ,MAoapF,CAAA"}
+{"version":3,"file":"account-delete-route-generator.d.ts","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAcxE,MAAM,WAAW,yBAAyB;IAExC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAI3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,kBAAkB,CAAC,EAAE,2BAA2B,CAAA;IAEhD,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAG5B,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAID,eAAO,MAAM,8BAA8B,+CAAiC,CAAA;AAE5E,eAAO,MAAM,0BAA0B,aAAa,yBAAyB,KAAQ,MAwbpF,CAAA"}

package/dist/cjs/account-delete-route-generator.js

@@ -5,6 +5,7 @@ const teleport_shared_1 = require("@teleporthq/teleport-shared");
 const pg_client_code_1 = require("./pg-client-code");
 const session_cookie_resolver_1 = require("./session-cookie-resolver");
 const transactional_email_code_1 = require("./transactional-email-code");
+const auth_generator_1 = require("./auth-generator");
 // Kept as a named alias (imported by workflow-project-plugin.ts) so the delete
 // route's dependency wiring stays stable while the impl lives in the shared module.
 exports.accountDeleteRouteDependencies = transactional_email_code_1.transactionalEmailDependencies;
@@ -14,6 +15,7 @@ const generateAccountDeleteRoute = (options = {}) => {
         ? options.emailProvider
         : null;
     const deletedEmailPattern = options.deletedEmailPattern || 'deleted-user-{{userId}}@deleted.invalid';
+    const recordsDeletion = options.withAutomations === true;
     return `${(0, pg_client_code_1.generatePgClientCode)()}
 ${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)()}
 const AUTH_USERS_TABLE = ${JSON.stringify(authUsersTable)};
@@ -36,6 +38,8 @@ const DELETE_TABLES = [
   'teleport_cart',
   'teleport_ai_chat_messages',
   'teleport_ai_chat_conversations',
+  // The account's password-reset links (user_id is text there).
+  '${auth_generator_1.PASSWORD_RESETS_TABLE}',
   // A push subscription is the capability to notify the user's device.
   'teleport_push_subscriptions',
 ];
@@ -314,11 +318,13 @@ async function sendFarewellEmail(toEmail, tokenValues, userId, locale) {
   var from = EMAIL_FROM || process.env.EMAIL_FROM || '';
   if (!from) { console.warn('[account-delete] farewell email skipped: sender not configured'); return; }
   var copy = resolveFarewellEmailCopy(locale);
-  var subject = fillTemplate(copy.subject, tokenValues);
+  var subject = fillSubjectTemplate(copy.subject, tokenValues);
   var html = fillTemplate(copy.body, tokenValues);
   await __sendProviderEmail({ from: from, fromName: EMAIL_FROM_NAME, to: toEmail, recordedTo: anonymisedEmailOf(userId), subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
 }
-
+${recordsDeletion
+        ? (0, auth_generator_1.generateAccountEventRecorder)({ relativePrefix: '../../..', logTag: '[account-delete]' })
+        : ''}
 module.exports = async function handler(req, res) {
   if (req.method !== 'POST') {
     return res.status(405).json({ error: 'Method not allowed' });
@@ -343,7 +349,11 @@ module.exports = async function handler(req, res) {
   var userFound = false;
   var passwordRefused = false;
   var failed = false;
-  // try/finally so the pg connection is ALWAYS closed — every early exit
+${recordsDeletion
+        ? `  // The account as it was, for the user-deleted event.
+  var deletedUser = null;
+`
+        : ''}  // try/finally so the pg connection is ALWAYS closed — every early exit
   // (not-found, error) leaves via the finally, never leaking a connection.
   try {
     await client.connect();
@@ -354,6 +364,7 @@ module.exports = async function handler(req, res) {
       userFound = true;
       userEmail = userRes.rows[0].email || '';
       userName = userRes.rows[0].name || '';
+${recordsDeletion ? '      deletedUser = userRes.rows[0];\n' : ''}
       passwordRefused =
         requestPassword !== null && !passwordMatches(requestPassword, userRes.rows[0].password);
     }
@@ -418,6 +429,10 @@ module.exports = async function handler(req, res) {
 ${provider
         ? `  // Land the farewell email's ledger row before replying.
   if (typeof __sentEmailLog !== 'undefined') { await __sentEmailLog.settleSentEmailLog(); }
+`
+        : ''}${recordsDeletion
+        ? `  // The deletion is committed: the last thing the route does is record it.
+  await recordAccountEvent('user-deleted', deletedUser, '', req);
 `
         : ''}
   return res.status(200).json({ success: true });

package/dist/cjs/account-delete-route-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-delete-route-generator.js","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":";;;AA2BA,iEAA0D;AAC1D,qDAAuD;AACvD,uEAAoF;AACpF,yEAOmC;AAuBnC,+EAA+E;AAC/E,oFAAoF;AACvE,QAAA,8BAA8B,GAAG,yDAA8B,CAAA;AAErE,MAAM,0BAA0B,GAAG,CAAC,UAAqC,EAAE,EAAU,EAAE;IAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAA;IAC5D,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,IAAI,oDAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,yCAAyC,CAAA;IAE1E,OAAO,GAAG,IAAA,qCAAoB,GAAE;EAChC,IAAA,kEAAwC,GAAE;2BACjB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAC1B,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBAC1C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;qBAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;0BAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,+BAA+B,CAAC;0BACrE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;0BAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;EACxE,IAAA,qDAA0B,EAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkItC,8BAAY,CAAC,+BAA+B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkI9C,IAAA,iDAAsB,GAAE;;EAExB,IAAA,uDAA4B,EAAC;QAC7B,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,cAAc,EAAE,iBAAiB;KAClC,CAAC;;EAEA,IAAA,uDAA4B,EAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,4BAA4B;QACvC,cAAc,EAAE,UAAU;QAC1B,uBAAuB,EAAE,IAAI;KAC9B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmHA,QAAQ;QACN,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;CAGC,CAAA;AACD,CAAC,CAAA;AApaY,QAAA,0BAA0B,8BAoatC"}
+{"version":3,"file":"account-delete-route-generator.js","sourceRoot":"","sources":["../../src/account-delete-route-generator.ts"],"names":[],"mappings":";;;AA2BA,iEAA0D;AAC1D,qDAAuD;AACvD,uEAAoF;AACpF,yEAOmC;AACnC,qDAAsF;AA0BtF,+EAA+E;AAC/E,oFAAoF;AACvE,QAAA,8BAA8B,GAAG,yDAA8B,CAAA;AAErE,MAAM,0BAA0B,GAAG,CAAC,UAAqC,EAAE,EAAU,EAAE;IAC5F,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAA;IAC5D,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,IAAI,oDAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,yCAAyC,CAAA;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAA;IAExD,OAAO,GAAG,IAAA,qCAAoB,GAAE;EAChC,IAAA,kEAAwC,GAAE;2BACjB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAC1B,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBAC1C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;qBAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;0BAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gCAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,+BAA+B,CAAC;0BACrE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;0BAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;EACxE,IAAA,qDAA0B,EAAC,UAAU,CAAC;;;;;;;;;;;KAWnC,sCAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyHxB,8BAAY,CAAC,+BAA+B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkI9C,IAAA,iDAAsB,GAAE;;EAExB,IAAA,uDAA4B,EAAC;QAC7B,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,cAAc,EAAE,iBAAiB;KAClC,CAAC;;EAEA,IAAA,uDAA4B,EAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,4BAA4B;QACvC,cAAc,EAAE,UAAU;QAC1B,uBAAuB,EAAE,IAAI;KAC9B,CAAC;;;;;;;;;;;;;;;;;EAkBA,eAAe;QACb,CAAC,CAAC,IAAA,6CAA4B,EAAC,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC1F,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;EA0BE,eAAe;QACb,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;EAWE,eAAe,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+D/D,QAAQ;QACN,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EACN,GACI,eAAe;QACb,CAAC,CAAC;;CAEP;QACK,CAAC,CAAC,EACN;;;CAGD,CAAA;AACD,CAAC,CAAA;AAxbY,QAAA,0BAA0B,8BAwbtC"}

package/dist/cjs/api-route-generator.d.ts

@@ -1,6 +1,7 @@
-import { UIDLWorkflow, UIDLWorkflows, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
+import { UIDLWorkflow, UIDLWorkflows, UIDLWebhookConfig, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
 import { WorkflowSegment } from './types';
 import { SegmentTrust } from './segment-trust';
+import { isCostBearingNodeType } from './nodes/cost-bearing-node-types';
 export interface ServerSegmentRouteOptions {
     /** A custom node's inner node ids, in the order its runner lists them. */
     customNodeIds?: string[];
@@ -10,14 +11,62 @@ export interface ServerSegmentRouteOptions {
      * emits carries it.
      */
     trust?: SegmentTrust;
+    /**
+     * The project's custom nodes: a custom node this segment runs itself (a
+     * server-only one, see server-custom-node-call.ts) is gated like the steps
+     * it runs.
+     */
+    customNodes?: Record<string, UIDLCustomWorkflowNode>;
 }
+export { isCostBearingNodeType };
+/** Per visitor address, per route: a minute's and a day's allowance. */
+export declare const COST_BEARING_STEP_LIMITS: {
+    perMinute: number;
+    perDay: number;
+};
+/** What a visitor sees when a step fails; the detail stays in the server log. */
+export declare const SEGMENT_PUBLIC_ERROR = "Something went wrong. Please try again.";
 export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection, options?: ServerSegmentRouteOptions) => string;
 export declare const hasStreamingAINode: (segment: WorkflowSegment) => boolean;
 export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection, options?: ServerSegmentRouteOptions) => string;
-export declare const generateCronAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
+/**
+ * The browser-only nodes a server route drops (and an automation refuses).
+ * The editor's copy is `CLIENT_ONLY_NODE_TYPES` in teleport-gui
+ * `packages/workflow-schema`; automations-catalog-drift.test.ts compares them.
+ */
+export declare const CLIENT_ONLY_NODES: Set<string>;
+/** What a cron or webhook route is generated for. */
+export interface ServerWorkflowRouteOptions {
+    /** The project has the in-app event bus (`hasAutomationsBus`). */
+    withAutomations?: boolean;
+}
+export declare const generateCronAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>, options?: ServerWorkflowRouteOptions) => string;
 export declare const getAPIRouteFileName: (workflowId: string, segmentId: string, workflowName?: string) => string;
 export declare const getCronRouteFileName: (workflow: UIDLWorkflow) => string;
-export declare const generateWebhookWorkflowAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
+/** A webhook whose payload a signature vouches for: a payment provider's, or a verified scheme other than `custom`. */
+export declare const isVerifiedWebhookConfig: (webhookConfig: UIDLWebhookConfig) => boolean;
+export declare const generateWebhookWorkflowAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>, options?: ServerWorkflowRouteOptions) => string;
+/**
+ * An automation's handler module (`lib/automations/handlers/<file>.js`, see
+ * automations/handler-module-generator.ts): the webhook route's node loop as
+ * an importable function, `module.exports.run = async (event, context,
+ * resumeFrom)`, which the in-app dispatcher awaits.
+ *
+ * - `event` is the event envelope (`{ event, actor, <entity> }`): the trigger
+ *   node's output. A resumed run passes it again, read afresh.
+ * - `context` is `{}` for a new run (plus `__baseUrl` when the dispatcher
+ *   knows the app's origin), or the context a Wait stored.
+ * - `resumeFrom` is the node to resume at; every node before it ran already.
+ *
+ * Every node runs as in a webhook route — server handlers, the same
+ * `__baseUrl` / internal headers, the error-handler branch — except the
+ * browser-only ones, which fail the run, and a Wait (`general-wait`), which
+ * stores the run and resolves `{ waiting: true }` (a test event's Wait stores
+ * nothing and resolves `{ waiting: true, wouldWait }`; a Wait with no step
+ * after it stores nothing and the run ends there). A run that fails rejects,
+ * after the error-handler branch ran, so the dispatcher records the failure.
+ */
+export declare const generateHandlerFunction: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
 export declare const getWebhookRouteFileName: (workflow: UIDLWorkflow) => string;
 /**
  * The address the store serves a provider's payment webhook at

package/dist/cjs/api-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EAIb,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAuD9C,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AA4BD,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,YAC1B,yBAAyB,KACjC,MAiXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,YAC1B,yBAAyB,KACjC,MAgcF,CAAA;AA4JD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAsHF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MA4BF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AA+RD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MA0OF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,cAC1B,aAAa,GAAG,SAAS,cACxB,MAAM,KACjB,MAAM,GAAG,IAYX,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}
+{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,aAAa,EAGb,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAkEvE,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CACrD;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,wEAAwE;AACxE,eAAO,MAAM,wBAAwB;;;CAAiC,CAAA;AAEtE,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,4CAA4C,CAAA;AA+O7E,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,YAC1B,yBAAyB,KACjC,MAyXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,YAC1B,yBAAyB,KACjC,MAycF,CAAA;AA6ID;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aA4D5B,CAAA;AAEF,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAqBD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,YAC3C,0BAA0B,KAClC,MA0HF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MA4BF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AAsTD,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,kBAAmB,iBAAiB,KAAG,OAES,CAAA;AAEpF,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,YAC3C,0BAA0B,KAClC,MAkOF,CAAA;AAuCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,aACxB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MA8JF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,cAC1B,aAAa,GAAG,SAAS,cACxB,MAAM,KACjB,MAAM,GAAG,IAYX,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}