@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/cjs/workflow-project-plugin.js

@@ -9,6 +9,7 @@ const segment_context_needs_1 = require("./segment-context-needs");
 const custom_node_modules_1 = require("./custom-node-modules");
 const api_route_generator_1 = require("./api-route-generator");
 const workflow_auth_generator_1 = require("./workflow-auth-generator");
+const page_access_guard_generator_1 = require("./page-access-guard-generator");
 const subscriber_access_route_generator_1 = require("./subscriber-access-route-generator");
 const secret_collector_1 = require("./secret-collector");
 const graph_utils_1 = require("./graph-utils");
@@ -17,11 +18,17 @@ const types_1 = require("./nodes/types");
 const executor_generator_1 = require("./executor-generator");
 const server_runtime_code_1 = require("./server-runtime-code");
 const segment_trust_1 = require("./segment-trust");
+const publish_refusals_1 = require("./publish-refusals");
+const project_code_scanner_1 = require("./project-code-scanner");
+const slack_message_values_1 = require("./slack-message-values");
 const realtime_generator_1 = require("./realtime-generator");
 const auth_generator_1 = require("./auth-generator");
+const password_reset_route_generator_1 = require("./password-reset-route-generator");
+const session_revocation_generator_1 = require("./session-revocation-generator");
 const invoice_1 = require("./invoice");
 const sent_email_log_1 = require("./sent-email-log");
 const webhook_delivery_lease_1 = require("./webhook-delivery-lease");
+const security_runtime_1 = require("./security-runtime");
 const vercel_functions_1 = require("./vercel-functions");
 const email_locale_1 = require("./email-locale");
 const workflow_utils_alias_1 = require("./workflow-utils-alias");
@@ -32,9 +39,13 @@ const account_delete_route_generator_1 = require("./account-delete-route-generat
 const transactional_email_code_1 = require("./transactional-email-code");
 const runtime_storage_generator_1 = require("./runtime-storage-generator");
 const ecommerce_customhandler_rewriter_1 = require("./ecommerce-customhandler-rewriter");
-const security_scanner_1 = require("./security-scanner");
-const raw_sql_param_binding_1 = require("./raw-sql-param-binding");
 const booking_calendar_feed_route_generator_1 = require("./booking-calendar-feed-route-generator");
+const automations_scope_1 = require("./automations/automations-scope");
+const automations_project_plugin_1 = require("./automations/automations-project-plugin");
+const cron_request_verification_1 = require("./cron-request-verification");
+const app_events_source_1 = require("./automations/app-events-source");
+const order_details_route_1 = require("./ecommerce/order-details-route");
+const newsletter_scope_1 = require("./newsletter/newsletter-scope");
 // Resolves the auth IDENTITY (users) table from the UIDL auth tables. Getting
 // this wrong is a security hole (the /api/data guard only protects this table),
 // so it prefers the table that stores credentials (an email/login column AND a
@@ -143,25 +154,148 @@ const stripEventHandlerAttrs = (uidl) => {
     Object.values(uidl.components || {}).forEach(scrubComponent);
 };
 exports.stripEventHandlerAttrs = stripEventHandlerAttrs;
+const workflowContextRef = (nodeId, path) => ({
+    type: 'workflowContext',
+    nodeId,
+    path,
+});
+const NEWSLETTER_ACCOUNT_SWITCH_OFF = 'Newsletter · Switch Off From The Account';
+const NEWSLETTER_UNSUBSCRIBE_RECORD = 'Record The Unsubscribe';
+const NEWSLETTER_ACCOUNT_FETCH = 'Fetch The Signed-In Person';
+const NEWSLETTER_UNSUBSCRIBE_UPDATE = 'Unsubscribe The Signed-In Person';
+const NEWSLETTER_TIMESTAMP = 'Note The Time';
+const NEWSLETTER_SWITCH_OFF_STATE = 'Show The Switch Off';
+const NEWSLETTER_EVENT_INPUTS = 'Build The Unsubscribe Event';
+const NEWSLETTER_EVENT_INPUTS_CODE = [
+    'function customHandler(params) {',
+    '  var named = params && params.length ? params[params.length - 1] || {} : {};',
+    '  var id = named.id == null ? "" : String(named.id);',
+    '  var email = named.email == null ? "" : String(named.email);',
+    '  var stamp = named.timestamp == null ? "" : String(named.timestamp);',
+    '  var time = stamp ? new Date(stamp).getTime() : Date.now();',
+    '  if (!isFinite(time)) { time = Date.now(); }',
+    '  return {',
+    '    entityId: id,',
+    '    actor: email,',
+    '    dedupe: id + ":" + Math.floor(time / 60000),',
+    '    subscriber: { email: email, consent: false },',
+    '  };',
+    '}',
+].join('\n');
+const hasStepLabel = (node, label) => node.label === label || node.name === label || node.builderLabel === label;
+const edgeId = (source, target) => `${source}-${target}`;
+const ensureEdge = (edges, source, target) => {
+    if (edges.some((edge) => edge.source === source && edge.target === target)) {
+        return;
+    }
+    edges.push({ id: edgeId(source, target), source, target });
+};
+const setRecordParam = (record, key, value) => {
+    const params = record.config.parameters;
+    if (!Array.isArray(params)) {
+        return;
+    }
+    const entry = params.find((item) => item && typeof item === 'object' && item.key === key);
+    if (entry) {
+        entry.value = value;
+    }
+    else {
+        params.push({ key, value });
+    }
+};
+const repairNewsletterAccountUnsubscribeEvents = (uidl) => {
+    var _a;
+    const workflows = ((_a = uidl.workflows) === null || _a === void 0 ? void 0 : _a.workflows) || {};
+    Object.values(workflows).forEach((workflow) => {
+        if (!workflow || workflow.name !== NEWSLETTER_ACCOUNT_SWITCH_OFF) {
+            return;
+        }
+        const nodes = workflow.nodes || [];
+        const edges = workflow.edges || [];
+        const findNode = (type, label) => nodes.find((node) => node.type === type && hasStepLabel(node, label));
+        const account = findNode('account-get-current', NEWSLETTER_ACCOUNT_FETCH);
+        const update = findNode('data-update-item', NEWSLETTER_UNSUBSCRIBE_UPDATE);
+        const record = findNode('general-custom-node', NEWSLETTER_UNSUBSCRIBE_RECORD);
+        if (!account || !update || !record || !Array.isArray(record.config.parameters)) {
+            return;
+        }
+        const eventType = record.config.parameters.find((param) => param && typeof param === 'object' && param.key === 'eventType');
+        if ((eventType === null || eventType === void 0 ? void 0 : eventType.value) !== 'newsletter-unsubscribed') {
+            return;
+        }
+        const timestamp = findNode('general-custom-js', NEWSLETTER_TIMESTAMP);
+        if (timestamp) {
+            timestamp.config.params = {};
+        }
+        let eventInputs = findNode('general-custom-js', NEWSLETTER_EVENT_INPUTS);
+        if (!eventInputs) {
+            eventInputs = {
+                id: `${record.id}-event-inputs`,
+                type: 'general-custom-js',
+                label: NEWSLETTER_EVENT_INPUTS,
+                config: {},
+                executionEnv: 'server',
+                stepNumber: record.stepNumber,
+            };
+            const recordIndex = nodes.indexOf(record);
+            if (recordIndex >= 0) {
+                nodes.splice(recordIndex, 0, eventInputs);
+            }
+            else {
+                nodes.push(eventInputs);
+            }
+        }
+        eventInputs.config = {
+            code: NEWSLETTER_EVENT_INPUTS_CODE,
+            context: 'server',
+            params: {
+                id: workflowContextRef(update.id, ['id']),
+                email: workflowContextRef(update.id, ['email']),
+                timestamp: timestamp ? workflowContextRef(timestamp.id, ['value']) : '',
+            },
+        };
+        const off = findNode('state-update-local-state', NEWSLETTER_SWITCH_OFF_STATE);
+        const redirected = edges.filter((edge) => edge.target === record.id &&
+            edge.source !== eventInputs.id &&
+            (!off || edge.source === off.id));
+        redirected.forEach((edge) => {
+            edge.target = eventInputs.id;
+        });
+        if (!edges.some((edge) => edge.target === eventInputs.id) && off) {
+            ensureEdge(edges, off.id, eventInputs.id);
+        }
+        ensureEdge(edges, eventInputs.id, record.id);
+        setRecordParam(record, 'entityId', workflowContextRef(eventInputs.id, ['entityId']));
+        setRecordParam(record, 'dedupeSubject', workflowContextRef(eventInputs.id, ['dedupe']));
+        setRecordParam(record, 'actor', workflowContextRef(eventInputs.id, ['actor']));
+        setRecordParam(record, 'subscriber', workflowContextRef(eventInputs.id, ['subscriber']));
+    });
+};
 class NextWorkflowProjectPlugin {
     async runBefore(structure) {
         var _a, _b, _c;
         const { uidl, strategy } = structure;
         (0, exports.stripEventHandlerAttrs)(uidl);
-        // SECURITY NET — parameterize raw-SQL interpolations before ANY config is
-        // emitted. Rewrites each `{{ name }}` value token in a data-node's `query` /
-        // `rawQueryUserPart` into a positional `$N` placeholder and moves the bound
-        // value into the sibling params array, so the value binds via
-        // `client.query(sql, params)` and never reaches the SQL text. Throws (aborts
-        // generation) on an interpolation that cannot be safely bound — refusing to
-        // ship injectable SQL. Runs FIRST so the security gate below sees final SQL.
-        (0, raw_sql_param_binding_1.parameterizeAllWorkflowRawSql)(uidl.workflows);
-        // Codegen-time security gate. Throws CodegenSecurityError if any
-        // `general-custom-js` body references a protected platform secret
-        // or uses an obvious sandbox-escape primitive. Backstop for the GUI
-        // and services-worker static checks; surfaces the failure before
-        // any code is emitted.
-        (0, security_scanner_1.assertWorkflowsAreSecure)(uidl.workflows);
+        repairNewsletterAccountUnsubscribeEvents(uidl);
+        // The workflow gates, before any code is emitted (publish-refusals.ts, the
+        // one list the editor's AI tools check against too), in order:
+        // - SECURITY NET — parameterize raw-SQL interpolations before ANY config is
+        //   emitted. Rewrites each `{{ name }}` value token in a data-node's `query` /
+        //   `rawQueryUserPart` into a positional `$N` placeholder and moves the bound
+        //   value into the sibling params array, so the value binds via
+        //   `client.query(sql, params)` and never reaches the SQL text. Throws (aborts
+        //   generation) on an interpolation that cannot be safely bound — refusing to
+        //   ship injectable SQL. Runs FIRST so the security gate below sees final SQL.
+        // - Codegen-time security gate. Throws CodegenSecurityError if any
+        //   `general-custom-js` body references a protected platform secret
+        //   or uses an obvious sandbox-escape primitive. Backstop for the GUI
+        //   and services-worker static checks.
+        // - A push to every subscriber, or a step on any stored file, never sits on
+        //   a route any visitor can call (see public-step-guards.ts).
+        (0, publish_refusals_1.assertWorkflowPublishGates)(uidl.workflows, uidl.authentication);
+        // The author code a page runs on the server beside its workflows: state
+        // mapping functions and the expressions Next prerenders (project-code-scanner.ts).
+        (0, project_code_scanner_1.assertProjectCodeIsSecure)(uidl);
         if (uidl.workflows) {
             const pageRouteMap = this.buildPageRouteMap(uidl, strategy);
             // CUSTOM NODES are walked alongside workflows. They used to be skipped,
@@ -247,11 +381,25 @@ class NextWorkflowProjectPlugin {
         return structure;
     }
     async runAfter(structure) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
         const { uidl, files, dependencies } = structure;
+        // Every app with server routes carries the shared security runtime its
+        // routes require (`utils/security-runtime.js`): the visitor's address,
+        // constant-time compare, durable rate limits, generic client errors.
+        if (hasServerRoutes(uidl)) {
+            (0, security_runtime_1.ensureSecurityRuntimeModule)(structure);
+        }
+        // Automations (workflows started by a business event), and whether the
+        // in-app event bus is generated for them: the routes that record or wake
+        // business events (signup, account deletion, the data API, a server-side
+        // signup) carry that code only then.
+        const automationWorkflows = (0, automations_scope_1.collectAutomationWorkflows)(uidl.workflows);
+        // Only with a database the queue runs on: without one no bus is generated
+        // (generateAutomationFiles says why).
+        const withAutomations = (0, automations_scope_1.hasAutomationsBus)(uidl);
         const hasAuthentication = uidl.authentication && uidl.authentication.enabled;
         if (hasAuthentication) {
-            this.generateAuthFiles(uidl.authentication, structure);
+            this.generateAuthFiles(uidl.authentication, structure, withAutomations);
         }
         // The bookings' calendar feeds do not depend on any workflow, so they are
         // emitted before the early return for a project without workflows.
@@ -285,9 +433,23 @@ class NextWorkflowProjectPlugin {
             (0, vercel_functions_1.declareVercelFunctionsWhereRequired)(files, dependencies);
             return structure;
         }
+        // A Slack message bound whole to a value is escaped like a chip (slack-message-values.ts).
+        (0, slack_message_values_1.escapeSlackMessageBindingsInWorkflows)(uidl.workflows);
         const allWorkflows = uidl.workflows.workflows;
         const customNodes = uidl.workflows.customNodes || {};
         const usedNodeTypes = (0, graph_utils_1.collectUsedNodeTypes)(uidl.workflows);
+        // Automations run in their own handler modules, which carry their nodes'
+        // handlers: the shared client and server handler files leave them out.
+        let handlerFileNodeTypes = usedNodeTypes;
+        if (automationWorkflows.length > 0) {
+            const browserAndRouteWorkflows = {};
+            for (const [id, wf] of Object.entries(allWorkflows)) {
+                if (!(0, automations_scope_1.isAutomationWorkflow)(wf)) {
+                    browserAndRouteWorkflows[id] = wf;
+                }
+            }
+            handlerFileNodeTypes = (0, graph_utils_1.collectUsedNodeTypes)(Object.assign(Object.assign({}, uidl.workflows), { workflows: browserAndRouteWorkflows }));
+        }
         // Server routes that run a mail-sending node require the sent-email
         // ledger module (see generateNodeHandlersForSegment).
         if ((0, sent_email_log_1.hasEmailSendingNodeType)(usedNodeTypes)) {
@@ -318,7 +480,7 @@ class NextWorkflowProjectPlugin {
                 },
             ],
         });
-        const clientHandlerCode = this.generateNodeHandlerFile(usedNodeTypes, 'client');
+        const clientHandlerCode = this.generateNodeHandlerFile(handlerFileNodeTypes, 'client');
         if (clientHandlerCode) {
             files.set('workflow-client-handlers', {
                 path: ['utils', 'workflows'],
@@ -350,12 +512,24 @@ class NextWorkflowProjectPlugin {
                     customNodeServerUrls[cnId] = {};
                     // The same list, in the same order, the custom node's runner hands its
                     // inner custom-js nodes as `params`.
-                    const cnGraph = { nodes: cn.nodes || [], edges: cn.edges || [], segments: cnSegments };
+                    const cnGraph = {
+                        id: cnId,
+                        nodes: cn.nodes || [],
+                        edges: cn.edges || [],
+                        segments: cnSegments,
+                    };
                     for (const seg of cnServerSegments) {
                         const routeOptions = {
                             customNodeIds: (cn.nodes || []).map((n) => n.id),
                             trust: (0, segment_trust_1.buildSegmentTrust)(seg, cnGraph),
+                            customNodes,
                         };
+                        (0, publish_refusals_1.assertSegmentRouteGates)(seg, routeOptions.trust, {
+                            owner: cn.name || cnId,
+                            graphNodes: cn.nodes || [],
+                            protection: cn.protection,
+                            staffRoles: teleport_shared_1.TableAccess.resolveStaffRoles(uidl.authentication),
+                        });
                         const isStreaming = (0, api_route_generator_1.hasStreamingAINode)(seg);
                         if (routeHasPolicy(cn.protection)) {
                             anyGuardedRouteEmitted = true;
@@ -417,20 +591,23 @@ class NextWorkflowProjectPlugin {
         // legacy hard-coded webhook emission for those providers below.
         const webhookProvidersOwnedByWorkflows = new Set();
         for (const workflow of Object.values(allWorkflows)) {
+            // An automation runs in a handler module of the in-app event bus
+            // (generateAutomationFiles below), through the server runtime.
+            if ((0, automations_scope_1.isAutomationWorkflow)(workflow)) {
+                if (withAutomations) {
+                    hasServerSegments = true;
+                }
+                continue;
+            }
             if (workflow.trigger.type === 'event-cron-triggered') {
                 // A cron route runs its whole graph on the server through the same
                 // runtime and handler file a server segment uses, so an app whose only
                 // server work is a cron still needs them.
                 hasServerSegments = true;
-                // The route refuses every request not signed with this key; the deploy
-                // fills it in (see cron-request-verification.ts).
-                if (!uidl.globals.env) {
-                    uidl.globals.env = {};
-                }
-                if (!uidl.globals.env.TELEPORT_CRON_SECRET) {
-                    uidl.globals.env.TELEPORT_CRON_SECRET = '';
-                }
-                const cronContent = (0, api_route_generator_1.generateCronAPIRoute)(workflow, customNodes);
+                // The route refuses every request not signed with these keys; the
+                // deploy fills them in (see cron-request-verification.ts).
+                (0, cron_request_verification_1.declareCronSecretEnv)(uidl);
+                const cronContent = (0, api_route_generator_1.generateCronAPIRoute)(workflow, customNodes, { withAutomations });
                 const cronFileName = (0, api_route_generator_1.getCronRouteFileName)(workflow);
                 files.set(`workflow-cron-${workflow.id}`, {
                     path: ['pages', 'api', 'workflows'],
@@ -446,7 +623,9 @@ class NextWorkflowProjectPlugin {
             }
             if (workflow.trigger.type === 'event-webhook-received' && workflow.webhookConfig) {
                 hasServerSegments = true;
-                const webhookContent = (0, api_route_generator_1.generateWebhookWorkflowAPIRoute)(workflow, customNodes);
+                const webhookContent = (0, api_route_generator_1.generateWebhookWorkflowAPIRoute)(workflow, customNodes, {
+                    withAutomations,
+                });
                 const webhookFileName = (0, api_route_generator_1.getWebhookRouteFileName)(workflow);
                 const webhookPath = (0, api_route_generator_1.getWebhookRoutePath)(workflow);
                 files.set(`workflow-webhook-${workflow.id}`, {
@@ -501,14 +680,25 @@ class NextWorkflowProjectPlugin {
             }
             const segments = (0, segment_splitter_1.splitIntoSegments)(workflow);
             const serverSegments = segments.filter((s) => s.env === 'server');
-            const workflowGraph = { nodes: workflow.nodes || [], edges: workflow.edges || [], segments };
+            const workflowGraph = {
+                id: workflow.id,
+                nodes: workflow.nodes || [],
+                edges: workflow.edges || [],
+                segments,
+            };
             for (const serverSeg of serverSegments) {
                 hasServerSegments = true;
                 const isStreaming = (0, api_route_generator_1.hasStreamingAINode)(serverSeg);
                 if (routeHasPolicy(workflow.protection)) {
                     anyGuardedRouteEmitted = true;
                 }
-                const routeOptions = { trust: (0, segment_trust_1.buildSegmentTrust)(serverSeg, workflowGraph) };
+                const routeOptions = { trust: (0, segment_trust_1.buildSegmentTrust)(serverSeg, workflowGraph), customNodes };
+                (0, publish_refusals_1.assertSegmentRouteGates)(serverSeg, routeOptions.trust, {
+                    owner: workflow.name || workflow.id,
+                    graphNodes: workflow.nodes || [],
+                    protection: workflow.protection,
+                    staffRoles: teleport_shared_1.TableAccess.resolveStaffRoles(uidl.authentication),
+                });
                 const apiContent = isStreaming
                     ? (0, api_route_generator_1.generateStreamingServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection, routeOptions)
                     : (0, api_route_generator_1.generateServerSegmentAPIRoute)(serverSeg, workflow.name, workflow.protection, routeOptions);
@@ -525,6 +715,15 @@ class NextWorkflowProjectPlugin {
                 });
             }
         }
+        if (automationWorkflows.length > 0) {
+            // The fallback prefix means the project has no order details page to link.
+            const orderPagePrefix = (0, order_details_route_1.resolveOrderDetailsRoutePrefix)(uidl);
+            (0, automations_project_plugin_1.generateAutomationFiles)(structure, automationWorkflows, {
+                customNodes,
+                usersTable: (0, exports.resolveAuthUsersTableName)(uidl.authentication) || 'users',
+                orderPagePrefix: orderPagePrefix === order_details_route_1.DEFAULT_ORDER_DETAILS_PREFIX ? null : orderPagePrefix,
+            });
+        }
         if (hasServerSegments) {
             files.set('workflow-server-runtime', {
                 path: ['utils', 'workflows'],
@@ -532,7 +731,9 @@ class NextWorkflowProjectPlugin {
                     {
                         name: 'server-runtime',
                         fileType: teleport_types_1.FileType.JS,
-                        content: (0, server_runtime_code_1.generateServerRuntimeCode)(),
+                        content: (0, server_runtime_code_1.generateServerRuntimeCode)({
+                            withSessionRevocation: ((_b = uidl.authentication) === null || _b === void 0 ? void 0 : _b.enabled) === true,
+                        }),
                     },
                 ],
             });
@@ -548,14 +749,16 @@ class NextWorkflowProjectPlugin {
                             name: 'workflow-auth',
                             fileType: teleport_types_1.FileType.JS,
                             content: (0, workflow_auth_generator_1.generateWorkflowAuthHelperFile)({
-                                withSubscriberAccess: ((_b = uidl.authentication) === null || _b === void 0 ? void 0 : _b.enabled) === true &&
+                                withSubscriberAccess: ((_c = uidl.authentication) === null || _c === void 0 ? void 0 : _c.enabled) === true &&
                                     (0, subscriber_access_route_generator_1.hasSubscriberOnlyPages)(uidl.authentication),
+                                // The session reader checks revocation only with authentication.
+                                withSessionRevocation: ((_d = uidl.authentication) === null || _d === void 0 ? void 0 : _d.enabled) === true,
                             }),
                         },
                     ],
                 });
             }
-            const serverHandlerCode = this.generateNodeHandlerFile(usedNodeTypes, 'server');
+            const serverHandlerCode = this.generateNodeHandlerFile(handlerFileNodeTypes, 'server');
             if (serverHandlerCode) {
                 files.set('workflow-server-handlers', {
                     path: ['utils', 'workflows'],
@@ -586,22 +789,33 @@ class NextWorkflowProjectPlugin {
             const ecom = uidl.ecommerceSettings;
             const lowStockAlertsEnabled = !!(ecom &&
                 ecom.stockManagement &&
-                ((_c = ecom.stockManagementConfig) === null || _c === void 0 ? void 0 : _c.lowStockAlerts) &&
-                ((_e = (_d = ecom.stockManagementConfig) === null || _d === void 0 ? void 0 : _d.lowStockAlertConfig) === null || _e === void 0 ? void 0 : _e.provider));
-            const lowStockThreshold = typeof ((_f = ecom === null || ecom === void 0 ? void 0 : ecom.stockManagementConfig) === null || _f === void 0 ? void 0 : _f.lowStockThreshold) === 'number'
+                ((_e = ecom.stockManagementConfig) === null || _e === void 0 ? void 0 : _e.lowStockAlerts) &&
+                ((_g = (_f = ecom.stockManagementConfig) === null || _f === void 0 ? void 0 : _f.lowStockAlertConfig) === null || _g === void 0 ? void 0 : _g.provider));
+            const lowStockThreshold = typeof ((_h = ecom === null || ecom === void 0 ? void 0 : ecom.stockManagementConfig) === null || _h === void 0 ? void 0 : _h.lowStockThreshold) === 'number'
                 ? ecom.stockManagementConfig.lowStockThreshold
                 : 5;
+            const dataAPIRouteOptions = {
+                authUsersTableName,
+                lowStockAlertsEnabled,
+                lowStockThreshold,
+                withAutomations,
+                // Who reads and changes other customers' records (Task 1, owner scope).
+                staffRoles: teleport_shared_1.TableAccess.resolveStaffRoles(uidl.authentication),
+                // Who reads which table from a browser (Task 1, exposure).
+                dataExposure: teleport_shared_1.DataExposure.resolveDataExposure(uidl),
+                managedDataSourceIds: teleport_shared_1.DataExposure.managedDataSourceIds(uidl),
+            };
+            // The low-stock events are recorded through utils/app-events.js.
+            if ((0, data_api_route_generator_1.dataAPIRouteRecordsLowStock)(dataAPIRouteOptions)) {
+                (0, app_events_source_1.ensureAppEventsModule)(structure, withAutomations);
+            }
             files.set('workflow-data-api-route', {
                 path: ['pages', 'api', 'data'],
                 files: [
                     {
                         name: '[...params]',
                         fileType: teleport_types_1.FileType.JS,
-                        content: (0, data_api_route_generator_1.generateDataAPIRoute)({
-                            authUsersTableName,
-                            lowStockAlertsEnabled,
-                            lowStockThreshold,
-                        }),
+                        content: (0, data_api_route_generator_1.generateDataAPIRoute)(dataAPIRouteOptions),
                     },
                 ],
             });
@@ -611,7 +825,7 @@ class NextWorkflowProjectPlugin {
         // farewell email's provider/sender/body are baked from the node config (the
         // credential is read from env at runtime; its placeholder is registered by the
         // generic secret-reference walk above).
-        if (((_g = uidl.authentication) === null || _g === void 0 ? void 0 : _g.enabled) && usedNodeTypes.has('account-delete-current')) {
+        if (((_j = uidl.authentication) === null || _j === void 0 ? void 0 : _j.enabled) && usedNodeTypes.has('account-delete-current')) {
             const deleteConfig = findWorkflowNodeConfigByType(uidl.workflows, 'account-delete-current') || {};
             const providerNodeType = typeof deleteConfig.emailProvider === 'string' ? deleteConfig.emailProvider : '';
             const emailProvider = providerNodeType.startsWith('email-')
@@ -638,6 +852,7 @@ class NextWorkflowProjectPlugin {
                             deletedEmailPattern: typeof deleteConfig.deletedEmailPattern === 'string'
                                 ? deleteConfig.deletedEmailPattern
                                 : undefined,
+                            withAutomations,
                         }),
                     },
                 ],
@@ -660,7 +875,9 @@ class NextWorkflowProjectPlugin {
                     {
                         name: 'upload',
                         fileType: teleport_types_1.FileType.JS,
-                        content: (0, runtime_storage_generator_1.generateRuntimeStorageUploadRoute)(),
+                        content: (0, runtime_storage_generator_1.generateRuntimeStorageUploadRoute)({
+                            withSessionRevocation: ((_k = uidl.authentication) === null || _k === void 0 ? void 0 : _k.enabled) === true,
+                        }),
                     },
                 ],
             });
@@ -672,7 +889,7 @@ class NextWorkflowProjectPlugin {
         //    the rendered PDF directly via uploadInvoicePdfToRuntimeStorage). The
         //    invoice path does NOT add a file-storage-upload node to the UIDL, so it
         //    would otherwise be missed by needsRuntimeStorageRoute.
-        const needsRuntimeStorageEnv = (0, runtime_storage_generator_1.needsRuntimeStorageRoute)(usedNodeTypes) || Boolean((_h = uidl.invoiceSettings) === null || _h === void 0 ? void 0 : _h.enabled);
+        const needsRuntimeStorageEnv = (0, runtime_storage_generator_1.needsRuntimeStorageRoute)(usedNodeTypes) || Boolean((_l = uidl.invoiceSettings) === null || _l === void 0 ? void 0 : _l.enabled);
         if (needsRuntimeStorageEnv) {
             if (!uidl.globals.env) {
                 uidl.globals.env = {};
@@ -760,7 +977,8 @@ class NextWorkflowProjectPlugin {
         });
         const globalWorkflows = Object.values(allWorkflows).filter((wf) => wf.trigger.scope === 'global' &&
             wf.trigger.type !== 'event-cron-triggered' &&
-            wf.trigger.type !== 'event-webhook-received');
+            wf.trigger.type !== 'event-webhook-received' &&
+            !(0, automations_scope_1.isAutomationWorkflow)(wf));
         if (globalWorkflows.length > 0) {
             const globalWorkflowCode = this.generateGlobalWorkflowsHook(globalWorkflows, customNodes);
             files.set('workflow-global-hook', {
@@ -780,7 +998,7 @@ class NextWorkflowProjectPlugin {
         if ((0, graph_utils_1.projectUsesRealtime)(uidl.workflows)) {
             this.generateRealtimeFiles(structure);
         }
-        if ((_j = uidl.invoiceSettings) === null || _j === void 0 ? void 0 : _j.enabled) {
+        if ((_m = uidl.invoiceSettings) === null || _m === void 0 ? void 0 : _m.enabled) {
             const { dataSourceType, dataSourceConfig } = (0, invoice_1.resolveInvoiceDataSource)(structure);
             (0, invoice_1.generateInvoiceFiles)(uidl.invoiceSettings, structure, dataSourceType, dataSourceConfig);
         }
@@ -836,6 +1054,7 @@ class NextWorkflowProjectPlugin {
         appFile.content = content;
     }
     generateRealtimeFiles(structure) {
+        var _a;
         const { uidl, files, dependencies } = structure;
         dependencies.ably = '^2.6.0';
         if (!uidl.globals.env) {
@@ -853,7 +1072,9 @@ class NextWorkflowProjectPlugin {
                 {
                     name: 'server',
                     fileType: teleport_types_1.FileType.JS,
-                    content: (0, realtime_generator_1.generateRealtimeServerHelperCode)(),
+                    content: (0, realtime_generator_1.generateRealtimeServerHelperCode)(uidl.workflows, {
+                        withSessionRevocation: ((_a = uidl.authentication) === null || _a === void 0 ? void 0 : _a.enabled) === true,
+                    }),
                 },
             ],
         });
@@ -898,7 +1119,7 @@ class NextWorkflowProjectPlugin {
             ],
         });
         const usedRealtimeActions = (0, graph_utils_1.collectUsedRealtimeActionTypes)(uidl.workflows);
-        if (usedRealtimeActions.has('realtime-send-channel-message')) {
+        if ((0, realtime_generator_1.projectCallsRealtimeRoute)(uidl.workflows, 'message')) {
             files.set('realtime-api-message', {
                 path: ['pages', 'api', 'realtime'],
                 files: [
@@ -910,7 +1131,7 @@ class NextWorkflowProjectPlugin {
                 ],
             });
         }
-        if (usedRealtimeActions.has('realtime-send-channel-event')) {
+        if ((0, realtime_generator_1.projectCallsRealtimeRoute)(uidl.workflows, 'event')) {
             files.set('realtime-api-event', {
                 path: ['pages', 'api', 'realtime'],
                 files: [
@@ -1015,7 +1236,8 @@ class NextWorkflowProjectPlugin {
                 return;
             }
             if (env === 'server' && generator.generateServerHandler) {
-                handlers.push(generator.generateServerHandler());
+                // utils/workflows/node-handlers-server.js: two levels below the project root.
+                handlers.push(generator.generateServerHandler({ relativePrefix: '../..' }));
             }
             else {
                 handlers.push(generator.generateHandler());
@@ -1466,7 +1688,7 @@ ${registryEntries}
 module.exports = __customNodeRegistry;
 `;
     }
-    generateAuthFiles(auth, structure) {
+    generateAuthFiles(auth, structure, withAutomations) {
         var _a, _b;
         const { files, dependencies, uidl } = structure;
         const dataSourceConfig = (auth.dataSourceId && ((_b = (_a = uidl.dataSources) === null || _a === void 0 ? void 0 : _a[auth.dataSourceId]) === null || _b === void 0 ? void 0 : _b.config)) || null;
@@ -1538,7 +1760,11 @@ module.exports = __customNodeRegistry;
                 emailBodyHtml: typeof signupConfig.body === 'string' ? signupConfig.body : '',
                 localizedTemplates: (0, transactional_email_code_1.readLocalizedEmailTemplates)(signupConfig.localizedTemplates),
                 siteName: uidl.name || '',
-            });
+            }, { withAutomations }, Object.assign(Object.assign({ fields: (0, auth_generator_1.resolveSignupFields)(auth, (0, password_reset_route_generator_1.collectWorkflowNodeConfigs)(uidl.workflows, 'account-signup')) }, (0, password_reset_route_generator_1.resetLinkOf)(uidl)), { 
+                // Without a sign-up email sender, the known-address emails use the reset one.
+                noticeEmail: (0, password_reset_route_generator_1.resetEmailSenderOf)(uidl), 
+                // The ticked consent box also joins the newsletter (R-N15).
+                newsletter: (0, newsletter_scope_1.newsletterSignupSubscribes)(uidl) }));
             files.set('auth-signup-route', {
                 path: ['pages', 'api', 'auth'],
                 files: [
@@ -1559,8 +1785,16 @@ module.exports = __customNodeRegistry;
             if (Object.keys(welcomeProviderDeps).length > 0) {
                 (0, sent_email_log_1.ensureSentEmailLogModule)(structure);
             }
+            // Forgot / reset password routes, the session revocation check and the
+            // AUTH_PEPPER_SECRET declaration (password-reset-route-generator.ts).
+            (0, password_reset_route_generator_1.emitPasswordAuthFiles)(structure, auth);
         }
-        const nextAuthRouteCode = (0, auth_generator_1.generateNextAuthRouteFile)();
+        // The shared session reader's revocation check (every server file reads
+        // the session through it).
+        (0, session_revocation_generator_1.ensureSessionRevocationModule)(structure);
+        const nextAuthRouteCode = (0, auth_generator_1.generateNextAuthRouteFile)({
+            passwordAuthEnabled: auth.passwordAuthEnabled === true,
+        });
         files.set('auth-nextauth-route', {
             path: ['pages', 'api', 'auth'],
             files: [
@@ -1615,6 +1849,18 @@ module.exports = __customNodeRegistry;
                     },
                 ],
             });
+            // The server half of the same protection: every page the middleware
+            // gates checks the session again in its getServerSideProps.
+            files.set('auth-page-access', {
+                path: ['utils', 'auth'],
+                files: [
+                    {
+                        name: 'page-access',
+                        fileType: teleport_types_1.FileType.JS,
+                        content: (0, page_access_guard_generator_1.generatePageAccessGuardModule)(auth),
+                    },
+                ],
+            });
         }
         // Emitted BEFORE session-provider so its file lands next to it. session-provider
         // imports it first (`import './nextauth-url-guard'`) to strip an empty
@@ -1642,7 +1888,7 @@ module.exports = __customNodeRegistry;
                 },
             ],
         });
-        dependencies['next-auth'] = '^4.24.0';
+        dependencies['next-auth'] = '4.24.15';
         dependencies.bcryptjs = '^2.4.3';
         const driverDeps = (0, auth_generator_1.getDatabaseDriverDependencies)(auth.dataSourceType);
         for (const [pkg, version] of Object.entries(driverDeps)) {