@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/cjs/segment-trust.js

@@ -1,7 +1,129 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildSegmentTrust = exports.SWITCH_CASE_PREFIX = void 0;
+exports.buildSegmentTrust = exports.SWITCH_CASE_PREFIX = exports.IDENTITY_NODE_TYPES = void 0;
 const await_result_1 = require("./await-result");
+const message_trust_1 = require("./nodes/email/message-trust");
+const visitor_request_1 = require("./nodes/general/visitor-request");
+/** The nodes whose result is the signed-in visitor (see `session` above). */
+exports.IDENTITY_NODE_TYPES = new Set([
+    'account-get-current',
+    'account-refresh-session',
+    'account-login',
+]);
+const IDENTITY_READ_NODE_TYPES = new Set(['data-select', 'data-count']);
+/** A `{{Current User.<field>}}` / `{{currentUser.<field>}}` / `{{state.currentUser…}}` token. */
+const CURRENT_USER_TOKEN = /\{\{\s*(?:Current User|currentUser|state\.currentUser)\b/;
+/** Any mention of the visitor's identity or of the page state that carries it. */
+const READS_IDENTITY = /Current User|currentUser|__stateValues/;
+const asContextRef = (value) => {
+    const ref = value;
+    return ref && typeof ref === 'object' && ref.type === 'workflowContext'
+        ? {
+            nodeId: typeof ref.nodeId === 'string' ? ref.nodeId : '',
+            path: Array.isArray(ref.path) ? ref.path : [],
+        }
+        : null;
+};
+/** Whether a filter value names the visitor: a current-user token or a reader's result. */
+/** The node ids the inline context chips of a rich-text value point at. */
+const chipNodeIds = (value) => {
+    const ids = [];
+    const chip = /data-ctx-node-id=(["'])([^"']*)\1/g;
+    let match = chip.exec(value);
+    while (match) {
+        ids.push(match[2]);
+        match = chip.exec(value);
+    }
+    return ids;
+};
+const isIdentityValue = (value, identityNodes) => {
+    if (typeof value === 'string') {
+        return (CURRENT_USER_TOKEN.test(value) ||
+            chipNodeIds(value).some((id) => Object.prototype.hasOwnProperty.call(identityNodes, id)));
+    }
+    if (Array.isArray(value)) {
+        return value.some((part) => isIdentityValue(part, identityNodes));
+    }
+    const ref = asContextRef(value);
+    if (!ref) {
+        return false;
+    }
+    if (Object.prototype.hasOwnProperty.call(identityNodes, ref.nodeId)) {
+        return true;
+    }
+    // A read of the page state's `currentUser`, wherever the bag is reached from.
+    const walk = [ref.nodeId, ...ref.path];
+    for (let i = 0; i < walk.length - 1; i++) {
+        if (walk[i] === '__stateValues' && walk[i + 1] === 'currentUser') {
+            return true;
+        }
+    }
+    return false;
+};
+const identityColumnsOf = (node, identityNodes) => {
+    var _a;
+    const filters = (_a = node.config) === null || _a === void 0 ? void 0 : _a.filters;
+    if (!Array.isArray(filters)) {
+        return [];
+    }
+    const columns = [];
+    for (const filter of filters) {
+        const f = (filter || {});
+        // Read as data-select reads a filter: `destination` before `value`.
+        const column = f.column || f.source || f.field;
+        const value = f.destination !== undefined ? f.destination : f.value;
+        if (typeof column === 'string' && column && isIdentityValue(value, identityNodes)) {
+            if (columns.indexOf(column) === -1) {
+                columns.push(column);
+            }
+        }
+    }
+    return columns;
+};
+const buildSessionNeeds = (segment, graph) => {
+    const identityNodes = {};
+    for (const node of graph.nodes) {
+        if (exports.IDENTITY_NODE_TYPES.has(node.type)) {
+            identityNodes[node.id] = node.type;
+        }
+    }
+    const identityReads = {};
+    let readsIdentity = Object.keys(identityNodes).length > 0;
+    for (const node of segment.nodes) {
+        if (IDENTITY_READ_NODE_TYPES.has(node.type)) {
+            const columns = identityColumnsOf(node, identityNodes);
+            if (columns.length > 0) {
+                identityReads[node.id] = columns;
+            }
+        }
+        if (!readsIdentity && READS_IDENTITY.test(JSON.stringify(node.config || {}))) {
+            readsIdentity = true;
+        }
+    }
+    return readsIdentity || Object.keys(identityReads).length > 0
+        ? { identityNodes, identityReads }
+        : undefined;
+};
+/**
+ * The graph's id when the caller names it; otherwise one derived from its
+ * node ids, so two different graphs never share signatures.
+ */
+const graphIdOf = (graph) => {
+    if (typeof graph.id === 'string' && graph.id) {
+        return graph.id;
+    }
+    const text = graph.nodes
+        .map((n) => n.id)
+        .sort()
+        .join('|');
+    let hash = 5381;
+    for (let i = 0; i < text.length; i++) {
+        // tslint:disable-next-line:no-bitwise
+        hash = ((hash << 5) + hash + text.charCodeAt(i)) | 0;
+    }
+    // tslint:disable-next-line:no-bitwise
+    return `graph-${(hash >>> 0).toString(16)}-${graph.nodes.length}`;
+};
 /** A switch branch is taken by a case id; this prefix keeps it apart from 'default'. */
 exports.SWITCH_CASE_PREFIX = 'case:';
 const collectBranch = (startId, edges, parentId) => {
@@ -64,12 +186,20 @@ const lastNodeByStep = (segment) => segment.nodes
 const buildSegmentTrust = (segment, graph) => {
     const inSegment = new Set(segment.nodes.map((n) => n.id));
     const serverNodeIds = new Set();
+    const producedBy = {};
     for (const seg of graph.segments) {
         if (seg.env === 'server') {
-            seg.nodes.forEach((n) => serverNodeIds.add(n.id));
+            seg.nodes.forEach((n) => {
+                serverNodeIds.add(n.id);
+                producedBy[n.id] = seg.id;
+            });
         }
     }
     const signedNodeIds = Array.from(serverNodeIds).filter((id) => !inSegment.has(id));
+    const signedBy = {};
+    for (const id of signedNodeIds) {
+        signedBy[id] = producedBy[id];
+    }
     const branchGates = [];
     for (const node of graph.nodes) {
         const kind = node.type === 'general-if-statement' ? 'if' : node.type === 'general-switch' ? 'switch' : null;
@@ -109,7 +239,21 @@ const buildSegmentTrust = (segment, graph) => {
             fireAndForget: (0, await_result_1.isFireAndForgetSegment)(before),
         }
         : null;
-    return { signedNodeIds, branchGates, loopBodies, previousFrom };
+    const firstServer = graph.segments.find((s) => s.env === 'server');
+    const session = buildSessionNeeds(segment, graph);
+    return Object.assign(Object.assign({ signedNodeIds,
+        signedBy,
+        branchGates,
+        loopBodies,
+        previousFrom, workflowId: graphIdOf(graph), segmentId: segment.id, opensRun: !firstServer || firstServer.id === segment.id }, (session ? { session } : {})), (segment.nodes.some((n) => (0, visitor_request_1.isOutboundMessageNodeType)(n.type))
+        ? {
+            messageTrust: (0, message_trust_1.collectMessageTrust)({
+                nodes: graph.nodes,
+                edges: graph.edges,
+                serverNodeIds,
+            }),
+        }
+        : {}));
 };
 exports.buildSegmentTrust = buildSegmentTrust;
 //# sourceMappingURL=segment-trust.js.map

package/dist/cjs/segment-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"segment-trust.js","sourceRoot":"","sources":["../../src/segment-trust.ts"],"names":[],"mappings":";;;AACA,iDAAuD;AA4CvD,wFAAwF;AAC3E,QAAA,kBAAkB,GAAG,OAAO,CAAA;AAEzC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,KAAyB,EAAE,QAAgB,EAAY,EAAE;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;YAC7C,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE;gBACvD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACxB;SACF;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,KAAyB,EAAY,EAAE;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAA;IACpF,IAAI,CAAC,QAAQ,EAAE;QACb,OAAO,EAAE,CAAA;KACV;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE;YAC3C,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,IACE,IAAI,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,IAAI,CAAC,YAAY,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC7D,IAAI,CAAC,MAAM,KAAK,MAAM,EACtB;gBACA,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACxB;SACF;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAsB,EAAE,IAAqB,EAAiB,EAAE;;IACjF,IAAI,IAAI,KAAK,IAAI,EAAE;QACjB,OAAO,IAAI,CAAC,YAAY,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;KAChG;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE;QACnC,OAAO,SAAS,CAAA;KACjB;IACD,MAAM,MAAM,GAAG,MAAC,IAAI,CAAC,IAAyC,0CAAE,MAAM,CAAA;IACtE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QACjE,CAAC,CAAC,0BAAkB,GAAG,MAAM;QAC7B,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAwB,EAAgC,EAAE,CAChF,OAAO,CAAC,KAAK;KACV,KAAK,EAAE;KACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;KACzD,GAAG,EAAE,CAAA;AAEH,MAAM,iBAAiB,GAAG,CAAC,OAAwB,EAAE,KAAmB,EAAgB,EAAE;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE;QAChC,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;SAClD;KACF;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAElF,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAChG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAClE,SAAQ;SACT;QACD,MAAM,QAAQ,GAAkC,EAAE,CAAA;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE;gBAC3B,SAAQ;aACT;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,IAAI,EAAE;gBACT,SAAQ;aACT;YACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC7E,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAClB,CAAA;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;gBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;aACjC;SACF;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;SAClD;KACF;IAED,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE;YAChC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;SAC5D;KACF;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzF,MAAM,YAAY,GAChB,MAAM,IAAI,UAAU;QAClB,CAAC,CAAC;YACE,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,aAAa,EAAE,IAAA,qCAAsB,EAAC,MAAM,CAAC;SAC9C;QACH,CAAC,CAAC,IAAI,CAAA;IAEV,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;AACjE,CAAC,CAAA;AA1DY,QAAA,iBAAiB,qBA0D7B"}
+{"version":3,"file":"segment-trust.js","sourceRoot":"","sources":["../../src/segment-trust.ts"],"names":[],"mappings":";;;AACA,iDAAuD;AAEvD,+DAA+E;AAC/E,qEAA2E;AA6E3E,6EAA6E;AAChE,QAAA,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,qBAAqB;IACrB,yBAAyB;IACzB,eAAe;CAChB,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA;AAE5F,iGAAiG;AACjG,MAAM,kBAAkB,GAAG,0DAA0D,CAAA;AAErF,kFAAkF;AAClF,MAAM,cAAc,GAAG,wCAAwC,CAAA;AAE/D,MAAM,YAAY,GAAG,CAAC,KAAc,EAA8C,EAAE;IAClF,MAAM,GAAG,GAAG,KAAoE,CAAA;IAChF,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;QACrE,CAAC,CAAC;YACE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACxD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;SAC9C;QACH,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA;AAED,2FAA2F;AAC3F,2EAA2E;AAC3E,MAAM,WAAW,GAAG,CAAC,KAAa,EAAY,EAAE;IAC9C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,oCAAoC,CAAA;IACjD,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,KAAK,EAAE;QACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;KACzB;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,KAAc,EAAE,aAAqC,EAAW,EAAE;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QAC7B,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9B,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CACzF,CAAA;KACF;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;KAClE;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG,EAAE;QACR,OAAO,KAAK,CAAA;KACb;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACnE,OAAO,IAAI,CAAA;KACZ;IACD,8EAA8E;IAC9E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE;YAChE,OAAO,IAAI,CAAA;SACZ;KACF;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CACxB,IAAsB,EACtB,aAAqC,EAC3B,EAAE;;IACZ,MAAM,OAAO,GAAG,MAAC,IAAI,CAAC,MAA4C,0CAAE,OAAO,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,OAAO,EAAE,CAAA;KACV;IACD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAA;QACnD,oEAAoE;QACpE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAA;QAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE;YACjF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;gBAClC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACrB;SACF;KACF;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CACxB,OAAwB,EACxB,KAAmB,EACc,EAAE;IACnC,MAAM,aAAa,GAA2B,EAAE,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9B,IAAI,2BAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAA;SACnC;KACF;IACD,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE;QAChC,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;gBACtB,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,OAAO,CAAA;aACjC;SACF;QACD,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE;YAC5E,aAAa,GAAG,IAAI,CAAA;SACrB;KACF;IACD,OAAO,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;QAClC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAU,EAAE;IAChD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,EAAE;QAC5C,OAAO,KAAK,CAAC,EAAE,CAAA;KAChB;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChB,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,IAAI,IAAI,GAAG,IAAI,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACpC,sCAAsC;QACtC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;KACrD;IACD,sCAAsC;IACtC,OAAO,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;AACnE,CAAC,CAAA;AAED,wFAAwF;AAC3E,QAAA,kBAAkB,GAAG,OAAO,CAAA;AAEzC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,KAAyB,EAAE,QAAgB,EAAY,EAAE;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;YAC7C,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE;gBACvD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACxB;SACF;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,KAAyB,EAAY,EAAE;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAA;IACpF,IAAI,CAAC,QAAQ,EAAE;QACb,OAAO,EAAE,CAAA;KACV;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE;YAC3C,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YACxB,IACE,IAAI,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,IAAI,CAAC,YAAY,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC7D,IAAI,CAAC,MAAM,KAAK,MAAM,EACtB;gBACA,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;aACxB;SACF;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAsB,EAAE,IAAqB,EAAiB,EAAE;;IACjF,IAAI,IAAI,KAAK,IAAI,EAAE;QACjB,OAAO,IAAI,CAAC,YAAY,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;KAChG;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE;QACnC,OAAO,SAAS,CAAA;KACjB;IACD,MAAM,MAAM,GAAG,MAAC,IAAI,CAAC,IAAyC,0CAAE,MAAM,CAAA;IACtE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QACjE,CAAC,CAAC,0BAAkB,GAAG,MAAM;QAC7B,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAwB,EAAgC,EAAE,CAChF,OAAO,CAAC,KAAK;KACV,KAAK,EAAE;KACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;KACzD,GAAG,EAAE,CAAA;AAEH,MAAM,iBAAiB,GAAG,CAAC,OAAwB,EAAE,KAAmB,EAAgB,EAAE;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE;QAChC,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACvB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;SACH;KACF;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE;QAC9B,QAAQ,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;KAC9B;IAED,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9B,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAChG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAClE,SAAQ;SACT;QACD,MAAM,QAAQ,GAAkC,EAAE,CAAA;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE;gBAC3B,SAAQ;aACT;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,IAAI,EAAE;gBACT,SAAQ;aACT;YACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC7E,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAClB,CAAA;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;gBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;aACjC;SACF;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;SAClD;KACF;IAED,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE;YAChC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;SAC5D;KACF;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzF,MAAM,YAAY,GAChB,MAAM,IAAI,UAAU;QAClB,CAAC,CAAC;YACE,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,aAAa,EAAE,IAAA,qCAAsB,EAAC,MAAM,CAAC;SAC9C;QACH,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEjD,qCACE,aAAa;QACb,QAAQ;QACR,WAAW;QACX,UAAU;QACV,YAAY,EACZ,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,EAC5B,SAAS,EAAE,OAAO,CAAC,EAAE,EACrB,QAAQ,EAAE,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IACpD,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5B,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2CAAyB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC;YACE,YAAY,EAAE,IAAA,mCAAmB,EAAC;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa;aACd,CAAC;SACH;QACH,CAAC,CAAC,EAAE,CAAC,EACR;AACH,CAAC,CAAA;AAxFY,QAAA,iBAAiB,qBAwF7B"}

package/dist/cjs/self-call-headers.d.ts

@@ -0,0 +1,31 @@
+/**
+ * How a generated site's server code calls its own API routes outside the
+ * workflow runtime (whose nodes get the same from `internalRequestHeaders`,
+ * executor-generator): the data API's low-stock alert, the legacy payment
+ * webhooks' invoice and order-notification calls, the invoice PDF upload, the
+ * automations' dispatch kick.
+ *
+ * Every such call presents the app secret (only server code can read
+ * NEXTAUTH_SECRET) and, on a deployment behind Vercel's password wall (a
+ * workspace not paying for hosting, or an owner's own password), the
+ * deployment's protection bypass — `VERCEL_AUTOMATION_BYPASS_SECRET`, which
+ * the services worker sets on such a deployment. Without it the site's own
+ * call meets the wall and answers 401, and nothing it should do happens.
+ *
+ * One emitted function, `__selfCallHeaders(headers)`: the headers given
+ * (`Content-Type`, for one), plus those. Inlined into each route that calls
+ * itself, so no route needs another module to exist.
+ */
+export declare const SELF_CALL_HEADERS_FUNCTION = "__selfCallHeaders";
+/**
+ * Emitted statements that add the deployment's protection bypass to the
+ * headers object named `target`, where the deployment has one — the one place
+ * the bypass header is built. `__selfCallHeaders` below, the workflow
+ * runtime's `internalRequestHeaders` (executor-generator.ts: the visitor's
+ * cookies and the bypass, never the app secret) and the push send route's
+ * relay (web-push/routes-source.ts in the Next project generator) all emit it.
+ * `indent` is the indentation of the `if`.
+ */
+export declare const generateProtectionBypassHeaderStatements: (target: string, indent?: string) => string;
+export declare const generateSelfCallHeadersCode: () => string;
+//# sourceMappingURL=self-call-headers.d.ts.map

package/dist/cjs/self-call-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-call-headers.d.ts","sourceRoot":"","sources":["../../src/self-call-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAA;AAE7D;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC,WAAY,MAAM,sBAAkB,MAK9E,CAAA;AAEX,eAAO,MAAM,2BAA2B,QAClC,MAQJ,CAAA"}

package/dist/cjs/self-call-headers.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSelfCallHeadersCode = exports.generateProtectionBypassHeaderStatements = exports.SELF_CALL_HEADERS_FUNCTION = void 0;
+/**
+ * How a generated site's server code calls its own API routes outside the
+ * workflow runtime (whose nodes get the same from `internalRequestHeaders`,
+ * executor-generator): the data API's low-stock alert, the legacy payment
+ * webhooks' invoice and order-notification calls, the invoice PDF upload, the
+ * automations' dispatch kick.
+ *
+ * Every such call presents the app secret (only server code can read
+ * NEXTAUTH_SECRET) and, on a deployment behind Vercel's password wall (a
+ * workspace not paying for hosting, or an owner's own password), the
+ * deployment's protection bypass — `VERCEL_AUTOMATION_BYPASS_SECRET`, which
+ * the services worker sets on such a deployment. Without it the site's own
+ * call meets the wall and answers 401, and nothing it should do happens.
+ *
+ * One emitted function, `__selfCallHeaders(headers)`: the headers given
+ * (`Content-Type`, for one), plus those. Inlined into each route that calls
+ * itself, so no route needs another module to exist.
+ */
+exports.SELF_CALL_HEADERS_FUNCTION = '__selfCallHeaders';
+/**
+ * Emitted statements that add the deployment's protection bypass to the
+ * headers object named `target`, where the deployment has one — the one place
+ * the bypass header is built. `__selfCallHeaders` below, the workflow
+ * runtime's `internalRequestHeaders` (executor-generator.ts: the visitor's
+ * cookies and the bypass, never the app secret) and the push send route's
+ * relay (web-push/routes-source.ts in the Next project generator) all emit it.
+ * `indent` is the indentation of the `if`.
+ */
+const generateProtectionBypassHeaderStatements = (target, indent = '  ') => `${indent}if (process.env.VERCEL_AUTOMATION_BYPASS_SECRET) {
+${indent}  ${target}['x-vercel-protection-bypass'] = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+${indent}  // Vercel would otherwise hand the bypass back as a cookie.
+${indent}  ${target}['x-vercel-set-bypass-cookie'] = 'false';
+${indent}}`;
+exports.generateProtectionBypassHeaderStatements = generateProtectionBypassHeaderStatements;
+const generateSelfCallHeadersCode = () => `// The headers this deployment's server code calls its own routes with: the app
+// secret, and the password wall's bypass where the deployment has one (see
+// self-call-headers.ts in the code generators).
+function ${exports.SELF_CALL_HEADERS_FUNCTION}(headers) {
+  var out = Object.assign({}, headers || {});
+  out['x-internal-data-secret'] = process.env.NEXTAUTH_SECRET || '';
+${(0, exports.generateProtectionBypassHeaderStatements)('out')}
+  return out;
+}`;
+exports.generateSelfCallHeadersCode = generateSelfCallHeadersCode;
+//# sourceMappingURL=self-call-headers.js.map

package/dist/cjs/self-call-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-call-headers.js","sourceRoot":"","sources":["../../src/self-call-headers.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,0BAA0B,GAAG,mBAAmB,CAAA;AAE7D;;;;;;;;GAQG;AACI,MAAM,wCAAwC,GAAG,CAAC,MAAc,EAAE,MAAM,GAAG,IAAI,EAAU,EAAE,CAChG,GAAG,MAAM;EACT,MAAM,KAAK,MAAM;EACjB,MAAM;EACN,MAAM,KAAK,MAAM;EACjB,MAAM,GAAG,CAAA;AALE,QAAA,wCAAwC,4CAK1C;AAEJ,MAAM,2BAA2B,GACtC,GAAW,EAAE,CAAC;;;WAGL,kCAA0B;;;EAGnC,IAAA,gDAAwC,EAAC,KAAK,CAAC;;EAE/C,CAAA;AATW,QAAA,2BAA2B,+BAStC"}

package/dist/cjs/sent-email-log/index.d.ts

@@ -13,4 +13,11 @@ export { generateSentEmailLogCode } from './sent-email-log-code';
  * database is Postgres, through the same driver map auth and invoices use.
  */
 export declare const ensureSentEmailLogModule: (structure: ProjectPluginStructure) => void;
+/**
+ * In a project with automations, files a send made by an automation handler
+ * under the automation and the event's order (see the `attribution` option of
+ * `generateSentEmailLogCode`). Rewrites the module when something already
+ * required it; a project whose automations send no mail has none to rewrite.
+ */
+export declare const enableSentEmailAttribution: (structure: ProjectPluginStructure) => void;
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/sent-email-log/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sent-email-log/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAU7E,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,cAAe,sBAAsB,KAAG,IA4B5E,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sent-email-log/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAU7E,OAAO,EACL,oCAAoC,EACpC,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,cAAe,sBAAsB,KAAG,IA4B5E,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,cAAe,sBAAsB,KAAG,IAQ9E,CAAA"}

package/dist/cjs/sent-email-log/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureSentEmailLogModule = exports.generateSentEmailLogCode = exports.isEmailSendingNodeType = exports.hasEmailSendingNodeType = exports.EMAIL_CAPABLE_INTEGRATION_NODE_TYPES = void 0;
+exports.enableSentEmailAttribution = exports.ensureSentEmailLogModule = exports.generateSentEmailLogCode = exports.isEmailSendingNodeType = exports.hasEmailSendingNodeType = exports.EMAIL_CAPABLE_INTEGRATION_NODE_TYPES = void 0;
 const teleport_types_1 = require("@teleporthq/teleport-types");
 const auth_generator_1 = require("../auth-generator");
 const resolve_data_source_1 = require("../invoice/resolve-data-source");
@@ -50,4 +50,20 @@ const ensureSentEmailLogModule = (structure) => {
     }
 };
 exports.ensureSentEmailLogModule = ensureSentEmailLogModule;
+/**
+ * In a project with automations, files a send made by an automation handler
+ * under the automation and the event's order (see the `attribution` option of
+ * `generateSentEmailLogCode`). Rewrites the module when something already
+ * required it; a project whose automations send no mail has none to rewrite.
+ */
+const enableSentEmailAttribution = (structure) => {
+    const entry = structure.files.get(sent_email_log_scope_1.SENT_EMAIL_LOG_FILE_KEY);
+    if (!entry || !entry.files[0]) {
+        return;
+    }
+    const { dataSourceType } = (0, resolve_data_source_1.resolveInvoiceDataSource)(structure);
+    const pgSupported = 'pg' in (0, auth_generator_1.getDatabaseDriverDependencies)(dataSourceType);
+    entry.files[0].content = (0, sent_email_log_code_1.generateSentEmailLogCode)({ pgSupported, attribution: true });
+};
+exports.enableSentEmailAttribution = enableSentEmailAttribution;
 //# sourceMappingURL=index.js.map

package/dist/cjs/sent-email-log/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sent-email-log/index.ts"],"names":[],"mappings":";;;AAAA,+DAA6E;AAC7E,sDAAiE;AACjE,wEAAyE;AACzE,+DAAgE;AAChE,iEAI+B;AAE/B,+DAI+B;AAH7B,4IAAA,oCAAoC,OAAA;AACpC,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,6DAAgE;AAAvD,+HAAA,wBAAwB,OAAA;AAEjC;;;;;;;;;;GAUG;AACI,MAAM,wBAAwB,GAAG,CAAC,SAAiC,EAAQ,EAAE;IAClF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IACzC,IAAI,KAAK,CAAC,GAAG,CAAC,8CAAuB,CAAC,EAAE;QACtC,OAAM;KACP;IAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,8CAAwB,EAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,IAAA,8CAA6B,EAAC,cAAc,CAAC,CAAA;IAChE,MAAM,WAAW,GAAG,IAAI,IAAI,UAAU,CAAA;IAEtC,KAAK,CAAC,GAAG,CAAC,8CAAuB,EAAE;QACjC,IAAI,EAAE,0CAAmB;QACzB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,+CAAwB;gBAC9B,QAAQ,EAAE,yBAAQ,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAA,8CAAwB,EAAC,EAAE,WAAW,EAAE,CAAC;aACnD;SACF;KACF,CAAC,CAAA;IAEF,IAAI,WAAW,EAAE;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBACtB,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;aAC5B;SACF;KACF;AACH,CAAC,CAAA;AA5BY,QAAA,wBAAwB,4BA4BpC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sent-email-log/index.ts"],"names":[],"mappings":";;;AAAA,+DAA6E;AAC7E,sDAAiE;AACjE,wEAAyE;AACzE,+DAAgE;AAChE,iEAI+B;AAE/B,+DAI+B;AAH7B,4IAAA,oCAAoC,OAAA;AACpC,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,6DAAgE;AAAvD,+HAAA,wBAAwB,OAAA;AAEjC;;;;;;;;;;GAUG;AACI,MAAM,wBAAwB,GAAG,CAAC,SAAiC,EAAQ,EAAE;IAClF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IACzC,IAAI,KAAK,CAAC,GAAG,CAAC,8CAAuB,CAAC,EAAE;QACtC,OAAM;KACP;IAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,8CAAwB,EAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,IAAA,8CAA6B,EAAC,cAAc,CAAC,CAAA;IAChE,MAAM,WAAW,GAAG,IAAI,IAAI,UAAU,CAAA;IAEtC,KAAK,CAAC,GAAG,CAAC,8CAAuB,EAAE;QACjC,IAAI,EAAE,0CAAmB;QACzB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,+CAAwB;gBAC9B,QAAQ,EAAE,yBAAQ,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAA,8CAAwB,EAAC,EAAE,WAAW,EAAE,CAAC;aACnD;SACF;KACF,CAAC,CAAA;IAEF,IAAI,WAAW,EAAE;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBACtB,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;aAC5B;SACF;KACF;AACH,CAAC,CAAA;AA5BY,QAAA,wBAAwB,4BA4BpC;AAED;;;;;GAKG;AACI,MAAM,0BAA0B,GAAG,CAAC,SAAiC,EAAQ,EAAE;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,8CAAuB,CAAC,CAAA;IAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC7B,OAAM;KACP;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,8CAAwB,EAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,IAAI,IAAI,IAAA,8CAA6B,EAAC,cAAc,CAAC,CAAA;IACzE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAA,8CAAwB,EAAC,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;AACvF,CAAC,CAAA;AARY,QAAA,0BAA0B,8BAQtC"}

package/dist/cjs/sent-email-log/sent-email-log-code.d.ts

@@ -19,5 +19,12 @@
  */
 export declare const generateSentEmailLogCode: (options: {
     pgSupported: boolean;
+    /**
+     * The project has automations: a send made by an automation handler is
+     * filed under the automation (`context.__emailAttribution`: `source`,
+     * `sourceRef`, the event's `orderId`), so the order's email trail lists it.
+     * Without it the module is byte for byte the one every other project gets.
+     */
+    attribution?: boolean;
 }) => string;
 //# sourceMappingURL=sent-email-log-code.d.ts.map

package/dist/cjs/sent-email-log/sent-email-log-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sent-email-log-code.d.ts","sourceRoot":"","sources":["../../../src/sent-email-log/sent-email-log-code.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,YAAa;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,KAAG,MA+X5E,CAAA"}
+{"version":3,"file":"sent-email-log-code.d.ts","sourceRoot":"","sources":["../../../src/sent-email-log/sent-email-log-code.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,YAAa;IAChD,WAAW,EAAE,OAAO,CAAA;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,KAAG,MAgZH,CAAA"}

package/dist/cjs/sent-email-log/sent-email-log-code.js

@@ -22,6 +22,20 @@ const pg_client_code_1 = require("../pg-client-code");
  * the same exports that records nothing, so consumers need no branching.
  */
 const generateSentEmailLogCode = (options) => {
+    const attributionCode = options.attribution
+        ? `// A send made by an automation is filed under it, and under the event's order.
+function __attribute(entry, context) {
+  var a = context && context.__emailAttribution;
+  if (!entry || !a || typeof a !== 'object') return entry;
+  if (a.source) entry.source = a.source;
+  if (a.sourceRef) entry.sourceRef = a.sourceRef;
+  if (a.orderId && !entry.orderId) entry.orderId = a.orderId;
+  return entry;
+}
+
+`
+        : '';
+    const attributed = (entryExpression) => options.attribution ? `__attribute(${entryExpression}, context)` : entryExpression;
     if (!options.pgSupported) {
         return `/**
  * Sent-email ledger — disabled: the project's data source is not Postgres.
@@ -379,18 +393,18 @@ function wrapEmailNodeHandler(nodeType, handler) {
     try {
       result = await handler.apply(this, arguments);
     } catch (err) {
-      __register(context, recordSentEmail(__entryFromNode(nodeType, config, null, err)));
+      __register(context, recordSentEmail(${attributed('__entryFromNode(nodeType, config, null, err)')}));
       throw err;
     }
     var entries = __entriesFromNode(nodeType, config, result);
     for (var i = 0; i < entries.length; i++) {
-      __register(context, recordSentEmail(entries[i]));
+      __register(context, recordSentEmail(${attributed('entries[i]')}));
     }
     return result;
   };
 }
 
-function __register(context, promise) {
+${attributionCode}function __register(context, promise) {
   if (!context || typeof context !== 'object') return;
   if (!Array.isArray(context.__pendingNodePromises)) context.__pendingNodePromises = [];
   context.__pendingNodePromises.push(promise);

package/dist/cjs/sent-email-log/sent-email-log-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"sent-email-log-code.js","sourceRoot":"","sources":["../../../src/sent-email-log/sent-email-log-code.ts"],"names":[],"mappings":";;;AAAA,sDAA4D;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACI,MAAM,wBAAwB,GAAG,CAAC,OAAiC,EAAU,EAAE;IACpF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;QACxB,OAAO;;;;;;;;CAQV,CAAA;KACE;IAED,OAAO;;;;;;;;;;;EAWP,IAAA,yCAAwB,GAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsW3B,CAAA;AACD,CAAC,CAAA;AA/XY,QAAA,wBAAwB,4BA+XpC"}
+{"version":3,"file":"sent-email-log-code.js","sourceRoot":"","sources":["../../../src/sent-email-log/sent-email-log-code.ts"],"names":[],"mappings":";;;AAAA,sDAA4D;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACI,MAAM,wBAAwB,GAAG,CAAC,OASxC,EAAU,EAAE;IACX,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW;QACzC,CAAC,CAAC;;;;;;;;;;CAUL;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,CAAC,eAAuB,EAAU,EAAE,CACrD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,eAAe,YAAY,CAAC,CAAC,CAAC,eAAe,CAAA;IACpF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;QACxB,OAAO;;;;;;;;CAQV,CAAA;KACE;IAED,OAAO;;;;;;;;;;;EAWP,IAAA,yCAAwB,GAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA+UgB,UAAU,CAC9C,8CAA8C,CAC/C;;;;;4CAKqC,UAAU,CAAC,YAAY,CAAC;;;;;;EAMlE,eAAe;;;;;;;;;;;;CAYhB,CAAA;AACD,CAAC,CAAA;AAzZY,QAAA,wBAAwB,4BAyZpC"}

package/dist/cjs/server-custom-node-call.d.ts

@@ -0,0 +1,79 @@
+import type { UIDLWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
+import { WorkflowSegment } from './types';
+import { SegmentTrust } from './segment-trust';
+/**
+ * The shared "Record Event" writer answers only this deployment's own server
+ * code (its protection is `serverOnly`): its route refuses anything without
+ * the internal-call token. The editor therefore marks every call of the writer
+ * `executionEnv: 'server'` (teleport-gui
+ * `mappers/domain-to-uidl/workflows/protection`), the segment splitter keeps
+ * that call in a server segment of its caller, and that segment's route runs
+ * it — the writer's own segment is then called with the route's internal
+ * credentials (`context.__internalHeaders`), as a webhook or cron route calls
+ * a custom node.
+ *
+ * Only those calls: each is baked into its route by node id and custom-node
+ * id. Any other custom-node call a server segment holds (a loop that also
+ * reads the database pulls its whole body onto the server) stays the inert
+ * marker it always was there, so it never borrows the internal-call token
+ * past its own login, role, subscription or cost gates.
+ *
+ * And only from what the server did: every parameter of such a call must be a
+ * literal of the route's own config or the result of a node that ran on the
+ * server (in this segment, or a signed result of an earlier one). A value the
+ * visitor's browser supplied — a browser step's result, the trigger, the page
+ * state, the clicked element — refuses the export with the owner's reason,
+ * so the next builder cannot record an event a visitor makes up. Two kinds of
+ * route are not asked: one only server code calls (`serverOnly`: its
+ * "browser" steps run on the server), and one every role of which is a staff
+ * role (`TableAccess.resolveStaffRoles`: the generated admin — whoever runs it
+ * can do what the event says anyway). A role a visitor can hold (`user`, a
+ * customer role) is asked.
+ *
+ * The marked node runs with the route's internal credentials. A custom-node
+ * call nested inside it runs as the visitor would run it — without the
+ * internal-call token — so it keeps its own login, role and subscription
+ * gates; inside a server job (a webhook, cron or automation run, whose context
+ * carries the server-job flag) it keeps the token, and the run stays the
+ * job's end to end.
+ */
+/**
+ * What this code generator does with the calls the editor marks. The editor
+ * imports it where it marks them: an editor built against a code generator
+ * without this behaviour fails to build instead of shipping calls the writer's
+ * route refuses.
+ */
+export declare const SERVER_CUSTOM_NODE_CALLS_VERSION = 1;
+export declare const serverRunCustomNodeCalls: (segment: WorkflowSegment) => UIDLWorkflowNode[];
+interface ServerBoundCallOptions {
+    owner: string;
+    graphNodes?: UIDLWorkflowNode[];
+    protection?: UIDLWorkflowProtection;
+    /** The roles only the business's staff hold (`TableAccess.resolveStaffRoles`). */
+    staffRoles?: string[];
+}
+/** A marked call that takes a value the browser supplied, with the refusal's sentence. */
+export interface BrowserBoundCall {
+    nodeId: string;
+    message: string;
+}
+/**
+ * Every marked call of the segment that takes a value the browser supplied,
+ * naming the step and its source. `graphNodes` are the caller's nodes, for the
+ * names.
+ */
+export declare const findBrowserBoundCallParameters: (segment: WorkflowSegment, trust: SegmentTrust | undefined, options: ServerBoundCallOptions) => BrowserBoundCall[];
+/** Throws the first of `findBrowserBoundCallParameters`: the export stops there. */
+export declare const assertServerBoundCallParameters: (segment: WorkflowSegment, trust: SegmentTrust | undefined, options: ServerBoundCallOptions) => void;
+/**
+ * Emitted right after a server segment route's `nodeHandlers`, only when the
+ * segment holds a marked call (every other route is byte-identical): the
+ * `general-custom-node` handler — whose browser version only hands back a
+ * marker — then runs exactly the marked calls, in the route's main pass, its
+ * loop bodies and its parallel branches alike, and hands every other call
+ * back as the marker. A marked node this build does not have is an error,
+ * never a silent skip, with the reason the custom-node module did not load.
+ */
+export declare const generateServerCustomNodeCallCode: (segment: WorkflowSegment, relativePrefix: string) => string;
+export {};
+//# sourceMappingURL=server-custom-node-call.d.ts.map

package/dist/cjs/server-custom-node-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-custom-node-call.d.ts","sourceRoot":"","sources":["../../src/server-custom-node-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAA;AAajD,eAAO,MAAM,wBAAwB,YAAa,eAAe,KAAG,gBAAgB,EAC7C,CAAA;AA+GvC,UAAU,sBAAsB;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,YAChC,eAAe,SACjB,YAAY,GAAG,SAAS,WACtB,sBAAsB,KAC9B,gBAAgB,EAyClB,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,+BAA+B,YACjC,eAAe,SACjB,YAAY,GAAG,SAAS,WACtB,sBAAsB,KAC9B,IAKF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,YAClC,eAAe,kBACR,MAAM,KACrB,MAoEF,CAAA"}