@teleporthq/teleport-plugin-next-workflows 0.43.35 → 0.43.37

package/src/api-route-generator.ts

@@ -331,8 +331,8 @@ module.exports = async function handler(req, res) {
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }
-      if (result && (result.success === false || (typeof result.error === 'string' && result.error))) {
-        throw new Error(result.error || 'Node execution failed');
+      if (utils.isFatalNodeResult(result)) {
+        throw new Error(utils.fatalNodeResultMessage(result));
       }
       context[node.id] = result;
       if (result && result.__terminal) break;
@@ -680,6 +680,12 @@ module.exports = async function handler(req, res) {
             res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: sn.id, result: snResult }) + '\\n\\n');
           }
         });
+        // A provider/auth failure surfaces as { error: true, message, code }.
+        // Without this gate the on-end branch would run against a failed AI
+        // result (e.g. persist a NULL chat answer → NOT NULL 500 downstream).
+        if (utils.isFatalNodeResult(result)) {
+          throw new Error(utils.fatalNodeResultMessage(result));
+        }
         context[node.id] = result;
         res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: node.id, result: result }) + '\\n\\n');
 
@@ -712,8 +718,8 @@ module.exports = async function handler(req, res) {
           }
           return;
         }
-        if (result && (result.success === false || (typeof result.error === 'string' && result.error))) {
-          throw new Error(result.error || 'Node execution failed');
+        if (utils.isFatalNodeResult(result)) {
+          throw new Error(utils.fatalNodeResultMessage(result));
         }
         context[node.id] = result;
         if (streamStarted) {
@@ -925,8 +931,8 @@ module.exports = async function handler(req, res) {
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }
-      if (result && (result.success === false || (typeof result.error === 'string' && result.error))) {
-        throw new Error(result.error || 'Node execution failed');
+      if (utils.isFatalNodeResult(result)) {
+        throw new Error(utils.fatalNodeResultMessage(result));
       }
       context[node.id] = result;
       if (result && result.__terminal) break;
@@ -1225,8 +1231,8 @@ const generateNodeExecutionLoop = (
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }${customNodeBlock}
-      if (result && (result.success === false || (typeof result.error === 'string' && result.error))) {
-        throw new Error(result.error || 'Node execution failed');
+      if (utils.isFatalNodeResult(result)) {
+        throw new Error(utils.fatalNodeResultMessage(result));
       }
       context[node.id] = result;
       if (result && result.__terminal) break;

package/src/data-api-route-generator.ts

@@ -159,12 +159,23 @@ function validateFilters(filters) {
 // 22003 (numeric value out of range), 22023 (invalid parameter value).
 // We pass the original query / params back to the caller as a debug
 // label so log output stays diagnosable.
-var SAFE_COERCION_ERROR_CODES = { '22P02': 1, '22008': 1, '22003': 1, '22023': 1 };
+// Also covers 22007 (invalid_datetime_format — an empty "Filter by date" value
+// hitting a date column: invalid input syntax for type date). Beyond the code
+// list we ALSO suppress ANY "invalid input syntax for type" message: every one
+// means the bound value could never coerce to the column type, so no row can
+// match and an empty result is the correct semantics — never a 500 the user sees
+// as "Failed to update. Please try again".
+var SAFE_COERCION_ERROR_CODES = { '22P02': 1, '22007': 1, '22008': 1, '22003': 1, '22023': 1 };
+function isSafeCoercionError(err) {
+  if (!err) return false;
+  if (SAFE_COERCION_ERROR_CODES[err.code]) return true;
+  return typeof err.message === 'string' && /invalid input syntax for type/i.test(err.message);
+}
 async function safeQuery(client, sql, params, mode) {
   try {
     return await client.query(sql, params);
   } catch (err) {
-    if (err && SAFE_COERCION_ERROR_CODES[err.code]) {
+    if (isSafeCoercionError(err)) {
       console.warn('[data-api] suppressed Postgres coercion error (' + err.code + '): ' + (err.message || err) +
         ' — returning empty result for ' + (mode || 'query') + '. SQL=' + sql + ' params=' + JSON.stringify(params));
       if (mode === 'count') {

package/src/executor-generator.ts

@@ -586,6 +586,24 @@ function topoSortNodes(nodes, edges) {
   return sorted;
 }
 
+// A node result signals failure either through the legacy string contract
+// ({ error: '...' } / { success: false }) or through the AI-node contract
+// ({ error: true, message, code } — provider/auth failures). Both must halt
+// the workflow; treating error:true as success used to let the pipeline limp
+// into downstream NOT NULL violations.
+function isFatalNodeResult(result) {
+  if (!result) return false;
+  return result.success === false ||
+    (typeof result.error === 'string' && result.error) ||
+    result.error === true;
+}
+
+function fatalNodeResultMessage(result) {
+  if (typeof result.error === 'string' && result.error) return result.error;
+  if (typeof result.message === 'string' && result.message) return result.message;
+  return 'Node execution failed';
+}
+
 async function executeNodes(nodes, edges, context, nodeHandlers, workflowConfig, callServerSegment, executionId) {
   const executed = {};
   const sortedNodes = topoSortNodes(nodes, edges);
@@ -684,6 +702,9 @@ async function executeNodes(nodes, edges, context, nodeHandlers, workflowConfig,
               await executeNodes(onStreamNodes, edges, context, nodeHandlers, workflowConfig, callServerSegment, executionId);
             }
           });
+          if (isFatalNodeResult(streamResult)) {
+            throw new Error(fatalNodeResultMessage(streamResult));
+          }
           context[node.id] = streamResult;
 
           if (onEndNodes.length > 0) {
@@ -726,8 +747,8 @@ async function executeNodes(nodes, edges, context, nodeHandlers, workflowConfig,
         throw earlyErr;
       }
 
-      if (result && (result.success === false || (typeof result.error === 'string' && result.error))) {
-        throw new Error(result.error || 'Node execution failed');
+      if (isFatalNodeResult(result)) {
+        throw new Error(fatalNodeResultMessage(result));
       }
 
       context[node.id] = result;
@@ -1006,7 +1027,9 @@ module.exports = {
   executeParallel,
   collectBranchNodes,
   markAllBranchNodes,
-  isStreamingAINode
+  isStreamingAINode,
+  isFatalNodeResult,
+  fatalNodeResultMessage
 };
 `
 }
@@ -1200,6 +1223,19 @@ function findStreamingAINodes(allNodes, allEdges) {
   return map;
 }
 
+// A streaming AI node's on-stream / on-end branches are collected from the
+// FULL workflow node list, so they may contain server nodes (e.g. the SQL
+// insert persisting a chat answer). Those already execute inside their own
+// server segments with full configs; the browser bundle only ships their
+// config redacted down to the client-safe whitelist (segment-splitter's
+// redactServerNodeConfig), so executing them here with CLIENT handlers both
+// double-executes them and crashes on the missing config. Emitted nodes carry
+// executionEnv for exactly this filter; nodes without the marker (older
+// bundles) keep executing client-side as before.
+function clientExecutableBranchNodes(branchNodes) {
+  return branchNodes.filter(function(n) { return !n || n.executionEnv !== 'server'; });
+}
+
 async function callStreamingServerSegment(segmentUrl, context, streamingInfo, allNodes, allEdges, clientHandlers, workflowConfig, executionId) {
   const prunedContext = pruneContext(context);
   const handledNodeIds = {};
@@ -1254,7 +1290,10 @@ async function callStreamingServerSegment(segmentUrl, context, streamingInfo, al
         context[data.nodeId] = { chunk: data.chunk, fullResponse: data.fullResponse, model: data.model };
         const info = streamingInfo[data.nodeId];
         if (info && info.onStreamNodes.length > 0) {
-          await utils.executeNodes(info.onStreamNodes, allEdges, context, clientHandlers, workflowConfig, null, executionId);
+          const runnableStreamNodes = clientExecutableBranchNodes(info.onStreamNodes);
+          if (runnableStreamNodes.length > 0) {
+            await utils.executeNodes(runnableStreamNodes, allEdges, context, clientHandlers, workflowConfig, null, executionId);
+          }
           for (let sni = 0; sni < info.onStreamNodes.length; sni++) {
             handledNodeIds[info.onStreamNodes[sni].id] = true;
           }
@@ -1269,7 +1308,10 @@ async function callStreamingServerSegment(segmentUrl, context, streamingInfo, al
         for (let sk = 0; sk < streamedKeys.length; sk++) {
           const endInfo = streamingInfo[streamedKeys[sk]];
           if (endInfo && endInfo.onEndNodes.length > 0) {
-            await utils.executeNodes(endInfo.onEndNodes, allEdges, context, clientHandlers, workflowConfig, null, executionId);
+            const runnableEndNodes = clientExecutableBranchNodes(endInfo.onEndNodes);
+            if (runnableEndNodes.length > 0) {
+              await utils.executeNodes(runnableEndNodes, allEdges, context, clientHandlers, workflowConfig, null, executionId);
+            }
             for (let eni = 0; eni < endInfo.onEndNodes.length; eni++) {
               handledNodeIds[endInfo.onEndNodes[eni].id] = true;
             }

package/src/nodes/general/general-custom-js.ts

@@ -23,6 +23,14 @@ import { NodeHandlerGenerator, handlerToString } from '../types'
 async function general_custom_js(config: any, context: Record<string, unknown>) {
   const code = config.code
 
+  // A server-classified custom-js node's config is redacted to the client-safe
+  // whitelist ({} here) before it ships to the browser. If such a node ever
+  // reaches a client handler (defense-in-depth — the runtime filters them),
+  // no-op cleanly instead of crashing the whole workflow on `code.length`.
+  if (typeof code !== 'string' || code.length === 0) {
+    return {}
+  }
+
   // Reserved context keys that must never leak into params / innerParams.
   // Anything starting with "__" is internal scaffolding; these named entries
   // are existing well-known runtime keys.

package/src/workflow-component-plugin.ts

@@ -1308,16 +1308,21 @@ function __normalizeAdminFormRow(row, defaults) {
       }))
     )
     const nodesJson = JSON.stringify(
-      wf.nodes.map((n: UIDLWorkflowNode) => ({
-        id: n.id,
-        type: n.type,
-        config: redactServerNodeConfig(
-          n.config,
-          nodeEnvById.get(n.id) ?? resolveNodeExecutionEnv(n)
-        ),
-        stepNumber: n.stepNumber,
-        label: n.label,
-      }))
+      wf.nodes.map((n: UIDLWorkflowNode) => {
+        // Runtime marker consumed by clientExecutableBranchNodes (client
+        // runtime): a streaming AI node's on-stream/on-end branches are
+        // collected from this full node list, and server nodes in them must
+        // never execute with client handlers (their config is redacted below).
+        const env = nodeEnvById.get(n.id) ?? resolveNodeExecutionEnv(n)
+        return {
+          id: n.id,
+          type: n.type,
+          config: redactServerNodeConfig(n.config, env),
+          stepNumber: n.stepNumber,
+          label: n.label,
+          executionEnv: env,
+        }
+      })
     )
     const edgesJson = JSON.stringify(
       wf.edges.map((e: UIDLWorkflowEdge) => ({

package/src/workflow-project-plugin.ts

@@ -887,18 +887,97 @@ export class NextWorkflowProjectPlugin implements ProjectPlugin {
       return ''
     }
 
-    const exports = exportNames.map((t) => `  '${t}': ${t.replace(/-/g, '_')}`).join(',\n')
+    // Inline each handler as its `module.exports` map value inside a
+    // self-invoking function that returns the handler's entry-point, rather
+    // than emitting separate top-level `async function <name>` declarations
+    // plus a map that references them by name. `handlers` and `exportNames`
+    // are populated together in the loop above, so `handlers[index]` is
+    // exactly the handler for `exportNames[index]`.
+    //
+    // Why the IIFE (not a bare inline expression): a handler is NOT always a
+    // single function expression. AI nodes emit shared provider utils
+    // (`var __ai_… = …`) BEFORE their entry function, and payment/rate-limiter
+    // nodes append helper functions AFTER it. Splicing such a multi-statement
+    // string directly as an object-literal value (`'ai-custom-prompt': var … `)
+    // is a SyntaxError. Wrapping in `(function () { <handler>; return <fn>; })()`
+    // runs every statement in an isolated scope and yields the entry function as
+    // the value — so single- AND multi-statement handlers are both valid.
+    //
+    // Why not top-level declarations + a name reference: that forward-reference
+    // shape is fragile in production. If a bundler/minifier drops a single-use
+    // declaration (or a handler's emitted name ever drifts from its
+    // `nodeType`-derived key), the map is left referencing an undefined
+    // identifier — `ReferenceError: <name> is not defined` at MODULE-EVAL time,
+    // which fails the Next.js/Vercel build during "Collecting page data". The
+    // returned identifier is derived from the same `t` that keys the map and is
+    // defined by the handler string right above the `return`, so there is no
+    // cross-statement forward reference to dangle. The entry-function naming
+    // contract (`handlerToString(fn)` preserves `fn.name`, and every handler
+    // names its entry `nodeType.replace(/-/g, '_')`) is enforced by
+    // node-handler-file-inline-map.test.ts across the whole node registry.
+    //
+    // That contract holds for the handler's OWN source (checked below via
+    // resolveHandlerEntryName), but not necessarily for the RUNTIME name a
+    // caller's bundler assigns it. Handlers built from `handlerToString(fn)`
+    // embed `fn.toString()` — a snapshot of whatever `fn` was actually named
+    // at the moment it's read. When this package is bundled and minified by a
+    // consumer (e.g. teleport-gui's browser packer worker, built with
+    // Next.js/Terser), the minifier freely renames `fn`'s declaration: nothing
+    // in the bundle calls it by name, only `.toString()` reads it at runtime,
+    // which is invisible to the minifier. The naive
+    // `nodeType.replace(/-/g, '_')` name would then reference an identifier
+    // that no longer exists in the embedded source — a Vercel-only
+    // "Collecting page data" ReferenceError, since local dev never runs a
+    // minifier. resolveHandlerEntryName reads the name the source text
+    // ACTUALLY declares instead of assuming it matches the convention.
+    const entries = exportNames
+      .map((t, index) => {
+        const source = handlers[index].trim()
+        const entryFn = this.resolveHandlerEntryName(source, t)
+        return `  '${t}': (function () {\n${source}\nreturn ${entryFn};\n})()`
+      })
+      .join(',\n')
 
     return `// Auto-generated workflow node handlers (${env})
 
-${handlers.join('\n\n')}
-
 module.exports = {
-${exports}
+${entries}
 };
 `
   }
 
+  // Resolves the name a handler's entry function is ACTUALLY declared with in
+  // `source`, rather than assuming it always equals the
+  // `nodeType.replace(/-/g, '_')` convention name (see the comment above
+  // `generateNodeHandlerFile`'s `entries` for why that assumption can break
+  // under minification).
+  //
+  // Handlers composed from string-literal templates (not `fn.toString()`) are
+  // immune to that class of breakage — a minifier never rewrites the contents
+  // of a string literal — so the convention name is still correct for those;
+  // this only needs to look further when it's genuinely absent from `source`.
+  private resolveHandlerEntryName(source: string, nodeType: string): string {
+    const conventionName = nodeType.replace(/-/g, '_')
+    const conventionNameUsed = new RegExp(`(?:^|[^\\w$])${conventionName}\\s*\\(`).test(source)
+    if (conventionNameUsed) {
+      return conventionName
+    }
+
+    // `source` came from `handlerToString(fn)` on a real, possibly-minified
+    // function — its ENTIRE text is that one function's declaration, so
+    // whatever name follows the leading `function`/`async function` keyword
+    // is the name it was actually assigned at runtime.
+    const leadingDeclaration = source.match(/^(?:async\s+)?function\s*([A-Za-z0-9_$]+)\s*\(/)
+    if (leadingDeclaration) {
+      return leadingDeclaration[1]
+    }
+
+    throw new Error(
+      `generateNodeHandlerFile: could not resolve the entry function for workflow node type "${nodeType}" — ` +
+        `expected a "${conventionName}" declaration or a single toString()'d function, found neither.`
+    )
+  }
+
   private getDefaultRouteUrl(uidl: ProjectUIDL, strategy: ProjectStrategy): string | null {
     const routeDef = uidl.root?.stateDefinitions?.route
     if (!routeDef?.values || !routeDef.defaultValue) {
@@ -972,6 +1051,10 @@ ${exports}
         (cn.nodes || []).map((n: any) => ({
           ...n,
           config: redactServerNodeConfig(n.config, resolveNodeExecutionEnv(n)),
+          // Runtime marker consumed by clientExecutableBranchNodes (client
+          // runtime) so streaming on-stream/on-end branches never execute
+          // server nodes (whose config was just redacted) client-side.
+          executionEnv: resolveNodeExecutionEnv(n),
         }))
       )
       const edgesJson = JSON.stringify(cn.edges)