@teleporthq/teleport-shared 0.43.67 → 0.43.68

package/dist/cjs/utils/table-access.js

@@ -0,0 +1,238 @@
+"use strict";
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateTableAccessHelperCode = exports.resolveTrustedReaderRoles = exports.PUBLIC_FEED_TABLES = exports.AUTH_CREDENTIAL_TABLES = exports.AUTH_CREDENTIAL_COLUMNS = exports.WRITE_PROTECTED_TABLES = exports.PROTECTED_TABLES = exports.CUSTOMER_RECORD_TABLES = exports.MONEY_TABLES = void 0;
+/**
+ * Which store tables a browser may touch through the generated data routes.
+ *
+ * Every generated Next store exposes two families of data routes: the
+ * workflow data API (`/api/data/<source>/<op>`, called by workflow data nodes)
+ * and one read route per bound table (`/api/teleport-<table>-<source>`, called
+ * by the pages' data providers, with a `rawQuery` escape hatch). Both accept
+ * a browser's request. For most tables that is the product: a catalogue is
+ * public. For the tables below it is theft.
+ *
+ * `MONEY_TABLES` are money and the keys to it: a gift card's code and
+ * balance, its ledger, every voucher code (a generated batch is a list of
+ * single-use coupons) and the redemption ledger. A browser reads or writes
+ * them only as a signed-in member of a trusted role (the generated admin) —
+ * the server-side workflow segments that look a card up, debit it or redeem a
+ * code identify themselves with the app secret instead.
+ *
+ * `CUSTOMER_RECORD_TABLES` are the customers' own records: who ordered what
+ * and where it ships, their invoices, parcels, returns, carts and reviews,
+ * and the accounts themselves. A buyer is served their own order through the
+ * page-load workflow (a server segment), the merchant every order through
+ * the admin's session — nothing in a generated storefront lists them from
+ * the browser, so a browser that asks for the list is not the store.
+ *
+ * `PROTECTED_TABLES` is both, spliced into both route families and the
+ * restricted-caller SQL check, so no reader can disagree about what is
+ * private.
+ *
+ * `WRITE_PROTECTED_TABLES` decide how much is given away but must stay readable:
+ * the storefront provider loads the active automatic rules to price the order
+ * summary. A browser that could update `usage_count` or `discount_value` could
+ * discount forever, so writes need the same trust.
+ */
+exports.MONEY_TABLES = [
+    'teleport_gift_cards',
+    'teleport_gift_card_transactions',
+    'teleport_vouchers',
+    'teleport_voucher_redemptions',
+    // The sent-email log keeps the RENDERED message, and a gift-card email
+    // carries the full code — protecting the card table while serving its
+    // codes from the email log would be no protection at all.
+    'teleport_sent_emails',
+    // A live reset token IS the account: whoever reads one sets the password.
+    // Only the server-side reset workflows ever read or write the table.
+    'password_reset_tokens',
+    // A digital product's files and license keys ARE the product: the order
+    // page's server segment mints a download link per paid line, and the
+    // download route assigns a key; nothing else reads them.
+    'teleport_product_files',
+    'teleport_license_keys',
+];
+exports.CUSTOMER_RECORD_TABLES = [
+    'users',
+    'teleport_orders',
+    'teleport_order_items',
+    'teleport_invoices',
+    'teleport_invoice_items',
+    'teleport_events',
+    'teleport_shipments',
+    'teleport_shipment_items',
+    'teleport_withdrawal_requests',
+    'teleport_withdrawal_request_items',
+    'teleport_abandoned_carts',
+    'teleport_cart',
+    'teleport_cart_items',
+    'teleport_favourites',
+    // Who subscribed to what and what they downloaded: the buyer's own page reads
+    // them through a server segment, the admin through its session.
+    'teleport_subscriptions',
+    'teleport_downloads',
+    // A review is public once approved, but the row carries the reviewer's
+    // email and the ones still in moderation; the product page reads the
+    // approved ones server-side.
+    'teleport_product_reviews',
+    // A push subscription is a capability: whoever holds the endpoint and its
+    // keys can notify that device. Only the app's push routes read the table.
+    'teleport_push_subscriptions',
+    // A comment is public once approved, but the row carries the commenter's
+    // email and the comments still waiting for approval; the post page reads
+    // the approved ones server-side, public columns only.
+    'teleport_blog_comments',
+    // What visitors told the AI assistant, and the merchant's private knowledge
+    // base it answers from: the assistant reads them in its own server
+    // segments, the admin lists them with its session.
+    'teleport_ai_chat_knowledge_sources',
+    'teleport_ai_chat_documents',
+    'teleport_ai_chat_conversations',
+    'teleport_ai_chat_messages',
+];
+exports.PROTECTED_TABLES = __spreadArray(__spreadArray([], exports.MONEY_TABLES, true), exports.CUSTOMER_RECORD_TABLES, true);
+exports.WRITE_PROTECTED_TABLES = ['teleport_discounts'];
+/**
+ * The auth users table's CREDENTIALS — the password hash and the OAuth
+ * provider's tokens (an access or refresh token IS the user's account at the
+ * provider). Profile columns stay readable; these never leave the server in a
+ * row, whoever asks: the generated admin's users list shows no password either.
+ */
+exports.AUTH_CREDENTIAL_COLUMNS = [
+    'password',
+    'access_token',
+    'refresh_token',
+    'id_token',
+    'session_state',
+    'token_type',
+    'scope',
+    'expires_at',
+];
+/** The table the generated auth reads and writes those credentials in. */
+exports.AUTH_CREDENTIAL_TABLES = ['users'];
+/**
+ * The credential names no other table has a reason to use: dropped from the
+ * rows of a raw statement too, where a column cannot be traced to its table
+ * (`scope` and `expires_at` are ordinary columns elsewhere — a gift card
+ * expires).
+ */
+var UNAMBIGUOUS_CREDENTIAL_COLUMNS = exports.AUTH_CREDENTIAL_COLUMNS.filter(function (column) { return column !== 'scope' && column !== 'expires_at'; });
+/**
+ * A table a browser may read ONLY as a fixed projection of the rows the
+ * DATABASE considers live — never whole, never through raw SQL, and never
+ * filtered or sorted by a column outside the projection (a filter is an
+ * oracle: `usage_count > 100` answers for a column that is never returned).
+ *
+ * `teleport_discounts` is the merchant's campaign plan: drafts, paused rules,
+ * launches scheduled for next month, how often each has been used. The
+ * storefront needs none of that; it prices the order summary from the rules
+ * that apply right now. Serving exactly those rows is what keeps an
+ * unannounced campaign unannounced, and it makes the WINDOW the database's
+ * judgement, the same clock that re-prices the order at submit: the storefront
+ * prices every row it is served and re-derives nothing from the browser clock,
+ * so a disagreement with the server's re-pricing is resolved by re-reading the
+ * feed.
+ */
+exports.PUBLIC_FEED_TABLES = {
+    teleport_discounts: {
+        // Exactly what the shared engine normalises a rule from (`__deNormalizeRule`),
+        // plus `status`, which the storefront still checks. The window bounds,
+        // `description` and `usage_count` are the merchant's, and stay with the
+        // merchant.
+        columns: [
+            'id',
+            'name',
+            'status',
+            'priority',
+            'discount_type',
+            'discount_value',
+            'applies_to_all_products',
+            'product_ids',
+            'category_ids',
+            'min_order_value',
+            'min_quantity',
+            'first_order_only',
+            'buy_quantity',
+            'get_quantity',
+            'stackable',
+        ],
+        predicate: "status = 'active' AND (starts_at IS NULL OR starts_at <= NOW()) AND (ends_at IS NULL OR ends_at > NOW())",
+    },
+};
+/** The generated back office: its folder in the pages tree and its route prefix. */
+var ADMIN_FOLDER_NAME = 'admin-panel';
+var ADMIN_ROUTE_PREFIX = '/admin';
+/**
+ * The roles allowed to read a protected table from a browser: whoever may open
+ * the generated admin panel, read off the protection the UIDL records for its
+ * folder and pages. A project without an admin panel has no page that binds a
+ * money table, so the empty list (server-side callers only) is the right answer.
+ */
+var resolveTrustedReaderRoles = function (auth) {
+    var roles = new Set();
+    if (!auth) {
+        return [];
+    }
+    Object.values(auth.folderProtection || {}).forEach(function (folder) {
+        if (folder && folder.folderName === ADMIN_FOLDER_NAME) {
+            ;
+            (folder.allowedRoles || []).forEach(function (role) { return roles.add(role); });
+        }
+    });
+    Object.values(auth.pageProtection || {}).forEach(function (page) {
+        var route = page && typeof page.route === 'string' ? page.route : '';
+        if (route === ADMIN_ROUTE_PREFIX || route.startsWith("".concat(ADMIN_ROUTE_PREFIX, "/"))) {
+            ;
+            (page.allowedRoles || []).forEach(function (role) { return roles.add(role); });
+        }
+    });
+    return Array.from(roles).sort();
+};
+exports.resolveTrustedReaderRoles = resolveTrustedReaderRoles;
+/**
+ * ES5 source of the guard, inlined into a generated route. Declares:
+ *  - `__taIsInternalRequest(req)` — the caller presented the app secret, or
+ *    is the module's own server-side `fetchData` (`req.__tqServerCall`).
+ *  - `__taIsRestrictedRequest(req)` — a server-side node that presents the app
+ *    secret but runs SQL it did not write (the AI data-query node): trusted to
+ *    run raw SQL, never trusted with the protected tables.
+ *  - `__taBrowserIsReadOnly(req)` — true for a browser in an app that has an
+ *    app secret: every server-side caller identifies itself there, so a browser
+ *    reads through the structured routes only — no raw SQL, no writes.
+ *  - `__taNormalizeTable(name)` — the bare table a spelling names.
+ *  - `__taSqlMentionsTable(sql, table)` — the statement names the table as an
+ *    identifier (bare, double-quoted or schema-qualified; comments and string
+ *    literals cannot hide or fake a mention).
+ *  - `__taAssertSqlTextAllowed(sql)` — throws a 403 error when an untrusted
+ *    caller's raw statement touches a protected table or a feed table, or
+ *    writes a write-protected one.
+ *  - `__taPublicFeed(req, tableName)` — the projection an untrusted caller is
+ *    served of a feed table (`{ columns, predicate }`), or `null` when the
+ *    caller may read the table as asked (a server-side one) or the table has
+ *    no feed.
+ *  - `__taAssertFeedFields(tableName, feed, fields)` — throws a 403 error when
+ *    a filter or sort field is not one of the feed's columns.
+ *  - `__taWithoutCredentials(rows, tableName)` — the rows with the auth users
+ *    table's credential columns removed: all of them for that table's rows,
+ *    the unambiguous ones for a raw statement's (`tableName` null).
+ *  - `__taIsCredentialTable(tableName)` — the table holds those credentials.
+ *  - `__taGuardRead(req, tableName, rawQuery)` — for the per-table read routes:
+ *    resolves to `null` when the request may proceed, else `{status, message}`.
+ *    A protected table is readable by an internal caller or by a session whose
+ *    role is in `trustedReaderRoles`; the session is decoded by the
+ *    `__tqSessionToken` resolver, which the host route must inline as well.
+ */
+var generateTableAccessHelperCode = function (params) {
+    return "// GENERATED \u2014 see generateTableAccessHelperCode in\n// @teleporthq/teleport-shared/src/utils/table-access.ts.\n//\n// Tables that ARE money, and tables that decide how much of it is given away.\n// A browser reads the first group only as a trusted role (the generated admin)\n// and writes the second group never; server-side workflow segments present the\n// app secret instead. One list for both data-route families.\nvar __TA_PROTECTED_TABLES = ".concat(JSON.stringify(exports.PROTECTED_TABLES), ";\nvar __TA_WRITE_PROTECTED_TABLES = ").concat(JSON.stringify(exports.WRITE_PROTECTED_TABLES), ";\n// Readable from a browser only as this projection of the rows the database\n// calls live \u2014 see PUBLIC_FEED_TABLES. The per-table routes serve a whole\n// table (and raw SQL), which cannot express a feed, so there they are refused\n// like a protected table.\nvar __TA_PUBLIC_FEED_TABLES = ").concat(JSON.stringify(exports.PUBLIC_FEED_TABLES), ";\nvar __TA_FEED_TABLES = Object.keys(__TA_PUBLIC_FEED_TABLES);\nvar __TA_TRUSTED_READER_ROLES = ").concat(JSON.stringify(params.trustedReaderRoles), ";\nvar __TA_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(exports.AUTH_CREDENTIAL_COLUMNS), ";\nvar __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(UNAMBIGUOUS_CREDENTIAL_COLUMNS), ";\nvar __TA_CREDENTIAL_TABLES = ").concat(JSON.stringify(exports.AUTH_CREDENTIAL_TABLES), ";\nvar __TA_SQL_WRITE_RE = /\\b(?:insert|update|delete|merge|truncate)\\b/i;\n// What a statement can reach without spelling a table's name where this scan\n// can see it: a Unicode-escaped identifier (U&\"\\0075sers\" is `users`), the\n// functions that run SQL text or dump whole tables, schemas or the database\n// (the table name then sits in a string, or is not named at all), and the\n// planner statistics, which hold sampled column values of every table.\nvar __TA_OPAQUE_SQL_RE = /u&\"|\\b(?:query|table|cursor|schema|database)_to_xml\\w*\\s*\\(|\\bts_(?:stat|rewrite)\\s*\\(|\\bdblink\\w*\\s*\\(|\\bpg_read_(?:binary_)?file\\s*\\(|\\blo_(?:import|export|get)\\s*\\(|\\bpg_stat(?:s|istic)\\w*/i;\n\n// Only server code can read NEXTAUTH_SECRET, so a browser cannot forge the\n// header a server segment sends. An in-process call (getStaticProps and the\n// page-load workflows call the handler directly with a synthetic request)\n// marks its request object instead \u2014 a property, never a header, so nothing\n// on the wire can claim it.\nfunction __taPresentsAppSecret(req) {\n  var secret = req && req.headers && req.headers['x-internal-data-secret'];\n  return !!(secret && process.env.NEXTAUTH_SECRET && secret === process.env.NEXTAUTH_SECRET);\n}\n\nfunction __taIsRestrictedRequest(req) {\n  return __taPresentsAppSecret(req) && !!(req.headers && req.headers['x-tq-restricted-sql'] === '1');\n}\n\nfunction __taIsInternalRequest(req) {\n  if (req && req.__tqServerCall === true) return true;\n  return __taPresentsAppSecret(req) && !__taIsRestrictedRequest(req);\n}\n\n// Generated browser code reads through the structured routes and never sends\n// SQL or a write of its own \u2014 every data node runs server-side and presents\n// the secret. So where a secret exists to tell the two apart, anything else a\n// browser sends is refused whole: no statement scan has to be right about it.\n// An app without one (no authentication, hence no store) keeps the scan.\nfunction __taBrowserIsReadOnly(req) {\n  return !!process.env.NEXTAUTH_SECRET && !__taIsInternalRequest(req) && !__taIsRestrictedRequest(req);\n}\n\n// Comments and string literals out, so a table name inside a string neither\n// hides a reference nor fakes one. Quoted identifiers stay, whole: in Postgres\n// they name tables, which is exactly what is being looked for.\n//\n// \u26D4 This is a lexer, not a search: a quote or comment marker inside a quoted\n// identifier (\"x'\", \"--\") is part of the name, a `$` or an `E` inside an\n// identifier (a$b$, ELSE'\u2026') starts neither a dollar quote nor an escape\n// string, and a dollar-quoted body is consumed by its own tag. An UNTERMINATED\n// literal, identifier, comment or dollar quote makes the whole scan fail closed\n// (ok:false): a statement this cleaner cannot read is one it cannot vouch for.\nfunction __taCleanSql(sql) {\n  var text = String(sql || '');\n  var out = '';\n  var i = 0;\n  function inIdentifier(at) { return at > 0 && /[A-Za-z0-9_$]/.test(text[at - 1]); }\n  while (i < text.length) {\n    var ch = text[i];\n    var next = text[i + 1];\n    if (ch === '-' && next === '-') {\n      while (i < text.length && text[i] !== '\\n') i++;\n      continue;\n    }\n    if (ch === '/' && next === '*') {\n      i += 2;\n      var depth = 1;\n      while (i < text.length && depth > 0) {\n        if (text[i] === '/' && text[i + 1] === '*') { depth++; i += 2; continue; }\n        if (text[i] === '*' && text[i + 1] === '/') { depth--; i += 2; continue; }\n        i++;\n      }\n      if (depth > 0) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    // \"\u2026\" is one identifier token; \"\" inside it is an escaped quote.\n    if (ch === '\"') {\n      var end = i + 1;\n      var closedIdentifier = false;\n      while (end < text.length) {\n        if (text[end] === '\"' && text[end + 1] === '\"') { end += 2; continue; }\n        if (text[end] === '\"') { closedIdentifier = true; break; }\n        end++;\n      }\n      if (!closedIdentifier) return { ok: false, text: out };\n      out += text.slice(i, end + 1);\n      i = end + 1;\n      continue;\n    }\n    // $tag$ \u2026 $tag$ \u2014 the body is data whatever it holds.\n    if (ch === '$' && !inIdentifier(i)) {\n      var tagMatch = /^\\$[A-Za-z_][A-Za-z0-9_]*\\$|^\\$\\$/.exec(text.slice(i));\n      if (tagMatch) {\n        var tag = tagMatch[0];\n        var close = text.indexOf(tag, i + tag.length);\n        if (close === -1) return { ok: false, text: out };\n        i = close + tag.length;\n        out += ' ';\n        continue;\n      }\n    }\n    // E'\u2026' understands backslash escapes; a plain '\u2026' doubles the quote.\n    if (ch === \"'\" || ((ch === 'E' || ch === 'e') && next === \"'\" && !inIdentifier(i))) {\n      var escapes = ch !== \"'\";\n      if (escapes) i++;\n      i++;\n      var closed = false;\n      while (i < text.length) {\n        if (escapes && text[i] === '\\\\') { i += 2; continue; }\n        if (text[i] === \"'\" && text[i + 1] === \"'\") { i += 2; continue; }\n        if (text[i] === \"'\") { i++; closed = true; break; }\n        i++;\n      }\n      if (!closed) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    out += ch;\n    i++;\n  }\n  return { ok: true, text: out };\n}\n\nfunction __taNormalizeTable(tableName) {\n  var name = String(tableName || '').trim().toLowerCase();\n  var parts = name.split('.');\n  return parts[parts.length - 1].replace(/\"/g, '');\n}\n\n// An unreadable statement, or one that can reach a table without naming it,\n// counts as mentioning EVERY protected table: fail closed rather than let a\n// spelling this scan cannot see decide it is harmless.\nfunction __taSqlMentionsTable(sql, table) {\n  var cleaned = __taCleanSql(sql);\n  if (!cleaned.ok || __TA_OPAQUE_SQL_RE.test(cleaned.text)) return true;\n  var pattern = new RegExp('(?:^|[^A-Za-z0-9_])\"?' + table + '\"?(?![A-Za-z0-9_])', 'i');\n  return pattern.test(cleaned.text);\n}\n\nfunction __taIsCredentialTable(tableName) {\n  return __TA_CREDENTIAL_TABLES.indexOf(__taNormalizeTable(tableName)) !== -1;\n}\n\n// Credentials never travel in a row: a column is dropped by name, however the\n// caller spelled it in its projection.\nfunction __taWithoutCredentials(rows, tableName) {\n  if (!Array.isArray(rows)) return rows;\n  var dropped = tableName && __taIsCredentialTable(tableName)\n    ? __TA_CREDENTIAL_COLUMNS\n    : tableName ? [] : __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS;\n  if (dropped.length === 0) return rows;\n  return rows.map(function(row) {\n    if (!row || typeof row !== 'object') return row;\n    var copy = {};\n    Object.keys(row).forEach(function(key) {\n      if (dropped.indexOf(String(key).toLowerCase()) === -1) copy[key] = row[key];\n    });\n    return copy;\n  });\n}\n\nfunction __taForbid(table) {\n  var err = new Error('Forbidden: ' + table + ' is only accessible to server-side workflow nodes');\n  err.status = 403;\n  throw err;\n}\n\nfunction __taAssertSqlTextAllowed(sql) {\n  var text = String(sql || '');\n  // A statement can hand back a whole row (`SELECT u FROM users u`,\n  // `row_to_json(u)`) without naming a credential column, so the table itself\n  // is out of reach of anything but the server's own calls.\n  for (var ci = 0; ci < __TA_CREDENTIAL_TABLES.length; ci++) {\n    if (__taSqlMentionsTable(text, __TA_CREDENTIAL_TABLES[ci])) __taForbid(__TA_CREDENTIAL_TABLES[ci]);\n  }\n  for (var pi = 0; pi < __TA_PROTECTED_TABLES.length; pi++) {\n    if (__taSqlMentionsTable(text, __TA_PROTECTED_TABLES[pi])) __taForbid(__TA_PROTECTED_TABLES[pi]);\n  }\n  // A feed table has exactly one browser-readable shape, and a statement the\n  // caller wrote is not it.\n  for (var fi = 0; fi < __TA_FEED_TABLES.length; fi++) {\n    if (__taSqlMentionsTable(text, __TA_FEED_TABLES[fi])) __taForbid(__TA_FEED_TABLES[fi]);\n  }\n  var cleaned = __taCleanSql(text);\n  // Unreadable, or a write: either way the write-protected tables are refused.\n  if (cleaned.ok && !__TA_SQL_WRITE_RE.test(cleaned.text)) return;\n  for (var wi = 0; wi < __TA_WRITE_PROTECTED_TABLES.length; wi++) {\n    if (__taSqlMentionsTable(text, __TA_WRITE_PROTECTED_TABLES[wi])) __taForbid(__TA_WRITE_PROTECTED_TABLES[wi]);\n  }\n}\n\nfunction __taRoleOf(token) {\n  if (!token || typeof token !== 'object') return null;\n  if (typeof token.role === 'string') return token.role;\n  if (typeof token.roleName === 'string') return token.roleName;\n  if (Array.isArray(token.roles) && typeof token.roles[0] === 'string') return token.roles[0];\n  return null;\n}\n\n// The tables a read of `tableName` (or the raw statement) touches that this\n// route family may not serve to a browser: the protected ones, and the feed\n// tables, whose one browser-readable projection lives on the data API instead.\nvar __TA_ROUTE_PROTECTED_TABLES = __TA_PROTECTED_TABLES.concat(__TA_FEED_TABLES);\n\nfunction __taProtectedTablesRead(tableName, rawQuery) {\n  var touched = [];\n  var bare = __taNormalizeTable(tableName);\n  if (__TA_ROUTE_PROTECTED_TABLES.indexOf(bare) !== -1) touched.push(bare);\n  if (typeof rawQuery === 'string' && rawQuery.length > 0) {\n    for (var i = 0; i < __TA_ROUTE_PROTECTED_TABLES.length; i++) {\n      if (touched.indexOf(__TA_ROUTE_PROTECTED_TABLES[i]) === -1 && __taSqlMentionsTable(rawQuery, __TA_ROUTE_PROTECTED_TABLES[i])) {\n        touched.push(__TA_ROUTE_PROTECTED_TABLES[i]);\n      }\n    }\n  }\n  return touched;\n}\n\n// The projection an untrusted caller gets of a feed table, or null when the\n// table has no feed or the caller is a server-side one reading it whole.\nfunction __taPublicFeed(req, tableName) {\n  if (__taIsInternalRequest(req)) return null;\n  var feed = __TA_PUBLIC_FEED_TABLES[__taNormalizeTable(tableName)];\n  return feed || null;\n}\n\n// A feed is filtered and sorted only by the columns it serves: a condition on\n// any other column (or an expression over one) would answer for it.\nfunction __taAssertFeedFields(tableName, feed, fields) {\n  for (var i = 0; i < fields.length; i++) {\n    if (!fields[i]) continue;\n    var column = String(fields[i]).trim().replace(/\"/g, '').toLowerCase();\n    if (feed.columns.indexOf(column) === -1) __taForbid(__taNormalizeTable(tableName) + '.' + fields[i]);\n  }\n}\n\n// null when the read may proceed, else { status, message }.\nasync function __taGuardRead(req, tableName, rawQuery) {\n  if (typeof rawQuery === 'string' && rawQuery.length > 0 && __taBrowserIsReadOnly(req)) {\n    return { status: 403, message: 'Forbidden: raw queries are only available to server-side calls' };\n  }\n  var touched = __taProtectedTablesRead(tableName, rawQuery);\n  if (touched.length === 0) return null;\n  if (__taIsInternalRequest(req)) return null;\n  var token = null;\n  try {\n    token = await __tqSessionToken(req);\n  } catch (e) {\n    token = null;\n  }\n  if (!token) return { status: 401, message: 'Unauthenticated' };\n  var role = __taRoleOf(token);\n  if (!role || __TA_TRUSTED_READER_ROLES.indexOf(role) === -1) {\n    return { status: 403, message: 'Forbidden: ' + touched[0] + ' is only readable by the store administrators' };\n  }\n  return null;\n}\n");
+};
+exports.generateTableAccessHelperCode = generateTableAccessHelperCode;
+//# sourceMappingURL=table-access.js.map

package/dist/cjs/utils/table-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-access.js","sourceRoot":"","sources":["../../../src/utils/table-access.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACU,QAAA,YAAY,GAA0B;IACjD,qBAAqB;IACrB,iCAAiC;IACjC,mBAAmB;IACnB,8BAA8B;IAC9B,uEAAuE;IACvE,sEAAsE;IACtE,0DAA0D;IAC1D,sBAAsB;IACtB,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB;IACvB,wEAAwE;IACxE,qEAAqE;IACrE,yDAAyD;IACzD,wBAAwB;IACxB,uBAAuB;CACxB,CAAA;AAEY,QAAA,sBAAsB,GAA0B;IAC3D,OAAO;IACP,iBAAiB;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,yBAAyB;IACzB,8BAA8B;IAC9B,mCAAmC;IACnC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IACrB,qBAAqB;IACrB,8EAA8E;IAC9E,gEAAgE;IAChE,wBAAwB;IACxB,oBAAoB;IACpB,uEAAuE;IACvE,qEAAqE;IACrE,6BAA6B;IAC7B,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;IAC7B,yEAAyE;IACzE,yEAAyE;IACzE,sDAAsD;IACtD,wBAAwB;IACxB,4EAA4E;IAC5E,mEAAmE;IACnE,mDAAmD;IACnD,oCAAoC;IACpC,4BAA4B;IAC5B,gCAAgC;IAChC,2BAA2B;CAC5B,CAAA;AAEY,QAAA,gBAAgB,mCAA8B,oBAAY,SAAK,8BAAsB,QAAC;AAEtF,QAAA,sBAAsB,GAA0B,CAAC,oBAAoB,CAAC,CAAA;AAEnF;;;;;GAKG;AACU,QAAA,uBAAuB,GAA0B;IAC5D,UAAU;IACV,cAAc;IACd,eAAe;IACf,UAAU;IACV,eAAe;IACf,YAAY;IACZ,OAAO;IACP,YAAY;CACb,CAAA;AAED,0EAA0E;AAC7D,QAAA,sBAAsB,GAA0B,CAAC,OAAO,CAAC,CAAA;AAEtE;;;;;GAKG;AACH,IAAM,8BAA8B,GAAG,+BAAuB,CAAC,MAAM,CACnE,UAAC,MAAM,IAAK,OAAA,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,EAA7C,CAA6C,CAC1D,CAAA;AASD;;;;;;;;;;;;;;;GAeG;AACU,QAAA,kBAAkB,GAA8C;IAC3E,kBAAkB,EAAE;QAClB,+EAA+E;QAC/E,uEAAuE;QACvE,wEAAwE;QACxE,YAAY;QACZ,OAAO,EAAE;YACP,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,UAAU;YACV,eAAe;YACf,gBAAgB;YAChB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,cAAc;YACd,cAAc;YACd,WAAW;SACZ;QACD,SAAS,EACP,0GAA0G;KAC7G;CACF,CAAA;AAED,oFAAoF;AACpF,IAAM,iBAAiB,GAAG,aAAa,CAAA;AACvC,IAAM,kBAAkB,GAAG,QAAQ,CAAA;AAEnC;;;;;GAKG;AACI,IAAM,yBAAyB,GAAG,UAAC,IAAgC;IACxE,IAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,CAAA;KACV;IACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,MAAM;QACxD,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE;YACrD,CAAC;YAAA,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,IAAI,IAAK,OAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAf,CAAe,CAAC,CAAA;SAChE;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,IAAI;QACpD,IAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,CAAC,UAAG,kBAAkB,MAAG,CAAC,EAAE;YAC9E,CAAC;YAAA,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,IAAI,IAAK,OAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAf,CAAe,CAAC,CAAA;SAC9D;IACH,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AACjC,CAAC,CAAA;AAjBY,QAAA,yBAAyB,6BAiBrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACI,IAAM,6BAA6B,GAAG,UAAC,MAE7C;IACC,OAAO,gdAOqB,IAAI,CAAC,SAAS,CAAC,wBAAgB,CAAC,kDAC1B,IAAI,CAAC,SAAS,CAAC,8BAAsB,CAAC,wTAK1C,IAAI,CAAC,SAAS,CAAC,0BAAkB,CAAC,8GAEhC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,8CAC3C,IAAI,CAAC,SAAS,CAAC,+BAAuB,CAAC,0DAC3B,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,6CAC3D,IAAI,CAAC,SAAS,CAAC,8BAAsB,CAAC,29VA6PpE,CAAA;AACD,CAAC,CAAA;AAnRY,QAAA,6BAA6B,iCAmRzC"}

package/dist/cjs/utils/web-push.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The names the published app's service worker, its push routes and the
+ * workflow nodes that use them have to agree on. The node handlers are
+ * serialized into the generated app as source text, so they interpolate these
+ * values at generation time rather than importing them.
+ */
+/** The browsers that agreed to receive the app's push notifications, in the project database. */
+export declare const SUBSCRIPTIONS_TABLE = "teleport_push_subscriptions";
+/** Public: a browser saves (POST) or forgets (DELETE) its own subscription here. */
+export declare const SUBSCRIPTIONS_ROUTE = "/api/push/subscriptions";
+/** Internal: only the app's own server code may send a notification through it. */
+export declare const SEND_ROUTE = "/api/push/send";
+/** What a visitor-facing push step reports when the project has no push keys or no worker. */
+export declare const NOT_CONFIGURED_MESSAGE = "Push notifications are not set up for this site.";
+export declare const PUBLIC_KEY_ENV = "WEB_PUSH_VAPID_PUBLIC_KEY";
+/** Filled at deploy from the project secret of the same name. */
+export declare const PRIVATE_KEY_ENV = "WEB_PUSH_VAPID_PRIVATE_KEY";
+/**
+ * The send route accepts a request only when this header carries an HMAC of
+ * `SEND_TOKEN_PURPOSE` keyed with the VAPID private key — a value only the
+ * app's own server holds, so no extra secret has to be provisioned.
+ */
+export declare const SEND_TOKEN_HEADER = "x-teleport-push-token";
+export declare const SEND_TOKEN_PURPOSE = "teleport-web-push-send";
+/**
+ * The page-side API the generated service-worker module publishes on `window`.
+ * A workflow node handler has no module scope, so a global is the only way it
+ * can reach the worker registration.
+ */
+export declare const SERVICE_WORKER_GLOBAL = "__teleportServiceWorker";
+export declare const SUBSCRIBE_NODE_TYPE = "browser-subscribe-to-push";
+export declare const UNSUBSCRIBE_NODE_TYPE = "browser-unsubscribe-from-push";
+export declare const GET_SUBSCRIPTION_NODE_TYPE = "browser-get-push-subscription";
+export declare const SHOW_NOTIFICATION_NODE_TYPE = "browser-show-notification";
+export declare const SEND_NODE_TYPE = "push-send-notification";
+/** Nodes that manage the visitor's push subscription and therefore need the push routes. */
+export declare const PUSH_NODE_TYPES: ReadonlyArray<string>;
+/**
+ * Nodes that need a service worker on the page: push itself, and on-page
+ * notifications, which Chrome on Android only shows through a worker.
+ */
+export declare const SERVICE_WORKER_NODE_TYPES: ReadonlyArray<string>;
+//# sourceMappingURL=web-push.d.ts.map

package/dist/cjs/utils/web-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-push.d.ts","sourceRoot":"","sources":["../../../src/utils/web-push.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,gCAAgC,CAAA;AAEhE,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,4BAA4B,CAAA;AAE5D,mFAAmF;AACnF,eAAO,MAAM,UAAU,mBAAmB,CAAA;AAE1C,8FAA8F;AAC9F,eAAO,MAAM,sBAAsB,qDAAqD,CAAA;AAExF,eAAO,MAAM,cAAc,8BAA8B,CAAA;AAEzD,iEAAiE;AACjE,eAAO,MAAM,eAAe,+BAA+B,CAAA;AAE3D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAA;AACxD,eAAO,MAAM,kBAAkB,2BAA2B,CAAA;AAE1D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAA;AAE9D,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAC9D,eAAO,MAAM,qBAAqB,kCAAkC,CAAA;AACpE,eAAO,MAAM,0BAA0B,kCAAkC,CAAA;AACzE,eAAO,MAAM,2BAA2B,8BAA8B,CAAA;AACtE,eAAO,MAAM,cAAc,2BAA2B,CAAA;AAEtD,4FAA4F;AAC5F,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAKjD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG3D,CAAA"}

package/dist/cjs/utils/web-push.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * The names the published app's service worker, its push routes and the
+ * workflow nodes that use them have to agree on. The node handlers are
+ * serialized into the generated app as source text, so they interpolate these
+ * values at generation time rather than importing them.
+ */
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_WORKER_NODE_TYPES = exports.PUSH_NODE_TYPES = exports.SEND_NODE_TYPE = exports.SHOW_NOTIFICATION_NODE_TYPE = exports.GET_SUBSCRIPTION_NODE_TYPE = exports.UNSUBSCRIBE_NODE_TYPE = exports.SUBSCRIBE_NODE_TYPE = exports.SERVICE_WORKER_GLOBAL = exports.SEND_TOKEN_PURPOSE = exports.SEND_TOKEN_HEADER = exports.PRIVATE_KEY_ENV = exports.PUBLIC_KEY_ENV = exports.NOT_CONFIGURED_MESSAGE = exports.SEND_ROUTE = exports.SUBSCRIPTIONS_ROUTE = exports.SUBSCRIPTIONS_TABLE = void 0;
+/** The browsers that agreed to receive the app's push notifications, in the project database. */
+exports.SUBSCRIPTIONS_TABLE = 'teleport_push_subscriptions';
+/** Public: a browser saves (POST) or forgets (DELETE) its own subscription here. */
+exports.SUBSCRIPTIONS_ROUTE = '/api/push/subscriptions';
+/** Internal: only the app's own server code may send a notification through it. */
+exports.SEND_ROUTE = '/api/push/send';
+/** What a visitor-facing push step reports when the project has no push keys or no worker. */
+exports.NOT_CONFIGURED_MESSAGE = 'Push notifications are not set up for this site.';
+exports.PUBLIC_KEY_ENV = 'WEB_PUSH_VAPID_PUBLIC_KEY';
+/** Filled at deploy from the project secret of the same name. */
+exports.PRIVATE_KEY_ENV = 'WEB_PUSH_VAPID_PRIVATE_KEY';
+/**
+ * The send route accepts a request only when this header carries an HMAC of
+ * `SEND_TOKEN_PURPOSE` keyed with the VAPID private key — a value only the
+ * app's own server holds, so no extra secret has to be provisioned.
+ */
+exports.SEND_TOKEN_HEADER = 'x-teleport-push-token';
+exports.SEND_TOKEN_PURPOSE = 'teleport-web-push-send';
+/**
+ * The page-side API the generated service-worker module publishes on `window`.
+ * A workflow node handler has no module scope, so a global is the only way it
+ * can reach the worker registration.
+ */
+exports.SERVICE_WORKER_GLOBAL = '__teleportServiceWorker';
+exports.SUBSCRIBE_NODE_TYPE = 'browser-subscribe-to-push';
+exports.UNSUBSCRIBE_NODE_TYPE = 'browser-unsubscribe-from-push';
+exports.GET_SUBSCRIPTION_NODE_TYPE = 'browser-get-push-subscription';
+exports.SHOW_NOTIFICATION_NODE_TYPE = 'browser-show-notification';
+exports.SEND_NODE_TYPE = 'push-send-notification';
+/** Nodes that manage the visitor's push subscription and therefore need the push routes. */
+exports.PUSH_NODE_TYPES = [
+    exports.SUBSCRIBE_NODE_TYPE,
+    exports.UNSUBSCRIBE_NODE_TYPE,
+    exports.GET_SUBSCRIPTION_NODE_TYPE,
+    exports.SEND_NODE_TYPE,
+];
+/**
+ * Nodes that need a service worker on the page: push itself, and on-page
+ * notifications, which Chrome on Android only shows through a worker.
+ */
+exports.SERVICE_WORKER_NODE_TYPES = __spreadArray(__spreadArray([], exports.PUSH_NODE_TYPES, true), [
+    exports.SHOW_NOTIFICATION_NODE_TYPE,
+], false);
+//# sourceMappingURL=web-push.js.map

package/dist/cjs/utils/web-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-push.js","sourceRoot":"","sources":["../../../src/utils/web-push.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;AAEH,iGAAiG;AACpF,QAAA,mBAAmB,GAAG,6BAA6B,CAAA;AAEhE,oFAAoF;AACvE,QAAA,mBAAmB,GAAG,yBAAyB,CAAA;AAE5D,mFAAmF;AACtE,QAAA,UAAU,GAAG,gBAAgB,CAAA;AAE1C,8FAA8F;AACjF,QAAA,sBAAsB,GAAG,kDAAkD,CAAA;AAE3E,QAAA,cAAc,GAAG,2BAA2B,CAAA;AAEzD,iEAAiE;AACpD,QAAA,eAAe,GAAG,4BAA4B,CAAA;AAE3D;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,uBAAuB,CAAA;AAC3C,QAAA,kBAAkB,GAAG,wBAAwB,CAAA;AAE1D;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,yBAAyB,CAAA;AAEjD,QAAA,mBAAmB,GAAG,2BAA2B,CAAA;AACjD,QAAA,qBAAqB,GAAG,+BAA+B,CAAA;AACvD,QAAA,0BAA0B,GAAG,+BAA+B,CAAA;AAC5D,QAAA,2BAA2B,GAAG,2BAA2B,CAAA;AACzD,QAAA,cAAc,GAAG,wBAAwB,CAAA;AAEtD,4FAA4F;AAC/E,QAAA,eAAe,GAA0B;IACpD,2BAAmB;IACnB,6BAAqB;IACrB,kCAA0B;IAC1B,sBAAc;CACf,CAAA;AAED;;;GAGG;AACU,QAAA,yBAAyB,mCACjC,uBAAe;IAClB,mCAA2B;UAC5B"}

package/dist/esm/index.d.ts

@@ -15,11 +15,19 @@ import * as StorefrontTax from './utils/storefront-tax';
 import * as ProductDiscounts from './utils/product-discounts';
 import * as ProductRatings from './utils/product-ratings';
 import * as RegionalPricing from './utils/regional-pricing';
+import * as DiscountEngine from './utils/discount-engine';
+import * as ProductOptions from './utils/product-options';
+import * as CartLinePricing from './utils/cart-line-pricing';
+import * as CartCurrency from './utils/cart-currency';
+import * as TableAccess from './utils/table-access';
+import * as SessionCookieResolver from './utils/session-cookie-resolver';
+import * as SubscriptionAccess from './utils/subscription-access';
 import * as FontPreconnect from './utils/font-preconnect';
 import * as EmailDate from './utils/email-date';
 import * as RichTextEmbeds from './utils/rich-text-embeds';
 import * as RichTextEmbedsCodegen from './utils/rich-text-embeds-codegen';
 import * as DataCache from './cache';
 import * as PageRevalidate from './page-revalidate';
-export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, ProductRatings, RegionalPricing, FontPreconnect, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, PageRevalidate, };
+import * as WebPush from './utils/web-push';
+export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, ProductRatings, RegionalPricing, DiscountEngine, ProductOptions, CartLinePricing, CartCurrency, TableAccess, SessionCookieResolver, SubscriptionAccess, FontPreconnect, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, PageRevalidate, WebPush, };
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,cAAc,GACf,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,qBAAqB,MAAM,iCAAiC,CAAA;AACxE,OAAO,KAAK,kBAAkB,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,OAAO,GACR,CAAA"}

package/dist/esm/index.js

@@ -15,11 +15,19 @@ import * as StorefrontTax from './utils/storefront-tax';
 import * as ProductDiscounts from './utils/product-discounts';
 import * as ProductRatings from './utils/product-ratings';
 import * as RegionalPricing from './utils/regional-pricing';
+import * as DiscountEngine from './utils/discount-engine';
+import * as ProductOptions from './utils/product-options';
+import * as CartLinePricing from './utils/cart-line-pricing';
+import * as CartCurrency from './utils/cart-currency';
+import * as TableAccess from './utils/table-access';
+import * as SessionCookieResolver from './utils/session-cookie-resolver';
+import * as SubscriptionAccess from './utils/subscription-access';
 import * as FontPreconnect from './utils/font-preconnect';
 import * as EmailDate from './utils/email-date';
 import * as RichTextEmbeds from './utils/rich-text-embeds';
 import * as RichTextEmbedsCodegen from './utils/rich-text-embeds-codegen';
 import * as DataCache from './cache';
 import * as PageRevalidate from './page-revalidate';
-export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, ProductRatings, RegionalPricing, FontPreconnect, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, PageRevalidate, };
+import * as WebPush from './utils/web-push';
+export { Constants, StringUtils, UIDLUtils, GenericUtils, LocalImports, JSIdentifiers, ASTScope, ASTStatementOrder, ASTEffectCleanup, RoutePaths, LayoutTopology, HtmlContentModel, StyleDeclarations, StorefrontTax, ProductDiscounts, ProductRatings, RegionalPricing, DiscountEngine, ProductOptions, CartLinePricing, CartCurrency, TableAccess, SessionCookieResolver, SubscriptionAccess, FontPreconnect, EmailDate, RichTextEmbeds, RichTextEmbedsCodegen, DataCache, PageRevalidate, WebPush, };
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,cAAc,GACf,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAA;AAC7C,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,iBAAiB,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,aAAa,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,eAAe,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,WAAW,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,qBAAqB,MAAM,iCAAiC,CAAA;AACxE,OAAO,KAAK,kBAAkB,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,cAAc,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,qBAAqB,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,SAAS,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,cAAc,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,OAAO,GACR,CAAA"}