@teleporthq/teleport-plugin-next-workflows 0.43.53 → 0.43.55

package/src/executor-generator.ts

@@ -501,6 +501,35 @@ function resolveConfig(config, context) {
       resolved[key] = resolveScalarValue(val, context);
     }
   }
+  // Component-bodied email nodes carry their merge values as \`templateParams\`
+  // and their body/subject as \`{{token}}\` templates. Filling them HERE — the one
+  // function every execution path funnels a node config through — is what makes
+  // the fill unmissable.
+  //
+  // It used to be pasted at the individual call sites instead, and it was only
+  // ever pasted at three of the sixteen: the client executor, and the loop-body
+  // + main loops of the cron/webhook route. The MAIN loop of
+  // \`generateServerSegmentAPIRoute\` — which is where every ordinary page
+  // workflow's email node actually executes — never had it, so withdrawal
+  // confirmations, withdrawal owner notifications, review notifications,
+  // order notifications and the password-reset email all shipped with their
+  // tokens verbatim: literal "{{customerName}}" in the body, "{{orderNumber}}"
+  // in the subject, and \`href="{{resetUrl}}"\` on the reset button (an invalid
+  // relative URL, which mail clients drop — so the button had no link at all).
+  // The abandoned-cart reminder was the only one that worked, because its send
+  // node sits inside a loop body AND on a cron route: the two paths that had
+  // the paste.
+  //
+  // Runs after resolution on purpose: \`templateParams[].value\` is itself a
+  // workflow-context ref that the loop above has just resolved.
+  if (Array.isArray(resolved.templateParams)) {
+    if (typeof resolved.body === 'string') {
+      resolved.body = applyTemplateParams(resolved.body, resolved.templateParams);
+    }
+    if (typeof resolved.subject === 'string') {
+      resolved.subject = applyTemplateParams(resolved.subject, resolved.templateParams);
+    }
+  }
   return resolved;
 }
 
@@ -809,17 +838,9 @@ async function executeNodes(nodes, edges, context, nodeHandlers, workflowConfig,
         throw new Error(configError);
       }
 
-      // Component-bodied send-email node: fill {{token}} merge fields in the
-      // serialized template body/subject from the resolved templateParams
-      // (resolveConfig already resolved each param value against context).
-      if (resolvedConfig && Array.isArray(resolvedConfig.templateParams)) {
-        if (typeof resolvedConfig.body === 'string') {
-          resolvedConfig.body = applyTemplateParams(resolvedConfig.body, resolvedConfig.templateParams);
-        }
-        if (typeof resolvedConfig.subject === 'string') {
-          resolvedConfig.subject = applyTemplateParams(resolvedConfig.subject, resolvedConfig.templateParams);
-        }
-      }
+      // NOTE: the component-bodied email fill used to live here. It now runs
+      // inside resolveConfig itself, so every execution path gets it exactly
+      // once — see the comment there.
 
       if (node.type === 'general-if-statement') {
         const condResult = evaluateCondition(resolvedConfig, context);
@@ -1217,7 +1238,44 @@ function collectBranchNodes(startId, allNodes, edges, excludeParentId) {
   return ids;
 }
 
+/**
+ * Headers a server-side node must send when this deployment calls its OWN API
+ * routes over HTTP (every data node does: \`fetch(__baseUrl + '/api/data/…')\`).
+ *
+ * ⛔ Without them, a deployment behind Vercel Deployment Protection answers its
+ * own request with 401 "Protected deployment". The page renders — the visitor's
+ * browser holds the bypass cookie — but every data node silently returns
+ * \`{ rows: [] }\`, so the app looks alive while nothing reads or writes. On the
+ * shipped AI-chat store this made the whole knowledge base invisible: the RAG
+ * search returned zero rows for every question and the assistant answered "I
+ * don't have enough information in my knowledge base" every single time.
+ *
+ * Two credentials, in order of what actually exists at the time:
+ *  - the visitor's own cookies, which already carried them past the protection
+ *    to reach this route. Forwarding them makes the self-call exactly as
+ *    authorized as the page load was, and nothing more.
+ *  - \`VERCEL_AUTOMATION_BYPASS_SECRET\`, the only thing that works when there is
+ *    no browser behind the request (a cron trigger, an inbound webhook).
+ *
+ * Same-origin only: these go to \`__baseUrl\`, which is derived from this
+ * request's own host, so no credential is forwarded anywhere else.
+ */
+function internalRequestHeaders(req) {
+  const headers = {};
+  if (req && req.headers && req.headers.cookie) {
+    headers.cookie = req.headers.cookie;
+  }
+  const bypassSecret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+  if (bypassSecret) {
+    headers['x-vercel-protection-bypass'] = bypassSecret;
+    // Tells Vercel not to hand the bypass back to the caller as a cookie.
+    headers['x-vercel-set-bypass-cookie'] = 'false';
+  }
+  return headers;
+}
+
 module.exports = {
+  internalRequestHeaders,
   resolveValue,
   resolveSecret,
   resolveConfig,

package/src/nodes/ai/ai-custom-prompt.ts

@@ -7,7 +7,7 @@ import {
 
 declare function __ai_resolveTextField(val: any): string
 declare function __ai_resolveToken(token: any): string
-declare function __ai_detectProvider(modelId: any): string
+declare function __ai_resolveProvider(config: any): string
 declare function __ai_clampTemperature(temp: any, provider: string): number
 declare function __ai_callProvider(params: any): Promise<any>
 declare function __ai_handleStreamingCall(
@@ -40,7 +40,7 @@ async function ai_custom_prompt(
     return { error: true, message: err.message, code: 'authentication_error' }
   }
 
-  const provider = __ai_detectProvider(model)
+  const provider = __ai_resolveProvider(config)
   temperature = __ai_clampTemperature(temperature, provider)
 
   let systemMessage = config.systemMessage ? __ai_resolveTextField(config.systemMessage) : undefined

package/src/nodes/ai/ai-detect-language.ts

@@ -7,7 +7,7 @@ import {
 
 declare function __ai_resolveTextField(val: any): string
 declare function __ai_resolveToken(token: any): string
-declare function __ai_detectProvider(modelId: any): string
+declare function __ai_resolveProvider(config: any): string
 declare function __ai_clampTemperature(temp: any, provider: string): number
 declare function __ai_callProvider(params: any): Promise<any>
 declare function __ai_parseJSON(text: any): any
@@ -40,7 +40,7 @@ async function ai_detect_language(
     return { error: true, message: err.message, code: 'authentication_error' }
   }
 
-  const provider = __ai_detectProvider(model)
+  const provider = __ai_resolveProvider(config)
   const temperature = __ai_clampTemperature(0, provider)
 
   let systemPrompt

package/src/nodes/ai/ai-generate-text-embedding.ts

@@ -4,17 +4,55 @@ import { generateAIProviderUtils, AI_PROVIDER_DEPENDENCIES } from './ai-provider
 declare function __ai_resolveTextField(val: any): string
 declare function __ai_resolveToken(token: any): string
 
+/**
+ * Text embeddings, always through OpenAI's embeddings API.
+ *
+ * ## `config.optional`
+ *
+ * A node result carrying `error: true` is FATAL — `isFatalNodeResult` in the
+ * executor throws on it and the whole workflow stops. That is right for a
+ * pipeline whose output is the embedding, and wrong for one where the
+ * embedding only powers a nice-to-have branch.
+ *
+ * The AI Assistant Chat is the second case: its retrieval is a hybrid of a
+ * vector search and a keyword search running in parallel, and the keyword half
+ * answers perfectly well on its own. A chat whose provider is Anthropic or
+ * Google may legitimately have no OpenAI key at all (embeddings are OpenAI-only
+ * because that is what the knowledge base was indexed with), and that must
+ * degrade to keyword-only search rather than break every message.
+ *
+ * With `optional: true` the node reports failure as data — `skipped: true` plus
+ * an empty `embedding` — so downstream nodes can branch on it. Consumers must
+ * check `embedding.length` before using it, which the chat's semantic-query
+ * builder already does.
+ */
 async function ai_generate_text_embedding(config: any, context: Record<string, unknown>) {
+  const optional = config.optional === true
+
+  function fail(message: string, code: string) {
+    if (optional) {
+      return {
+        embedding: [],
+        vectorLiteral: '',
+        dimensions: 0,
+        skipped: true,
+        skipReason: message,
+        code,
+      }
+    }
+    return { error: true, message, code }
+  }
+
   const text = __ai_resolveTextField(config.text)
   if (!text) {
-    return { error: true, message: 'Text to embed is required', code: 'missing_text' }
+    return fail('Text to embed is required', 'missing_text')
   }
 
   let token
   try {
     token = __ai_resolveToken(config.token)
   } catch (err: any) {
-    return { error: true, message: err.message, code: 'authentication_error' }
+    return fail(err.message, 'authentication_error')
   }
 
   const model = config.model || 'text-embedding-3-small'
@@ -40,12 +78,19 @@ async function ai_generate_text_embedding(config: any, context: Record<string, u
 
     const embeddingData = response.data && response.data[0]
     if (!embeddingData || !embeddingData.embedding) {
-      return { error: true, message: 'No embedding returned from API', code: 'empty_response' }
+      return fail('No embedding returned from API', 'empty_response')
     }
 
     const usage = response.usage || {}
     return {
       embedding: embeddingData.embedding,
+      // pgvector's literal form, ready to bind as a `$N` param and cast with
+      // `::vector`. The raw `embedding` array cannot do that job: a JS array
+      // bound as a query parameter is serialized as a Postgres ARRAY literal
+      // (`{0.1,0.2}`), which no cast turns into a vector. Without this field a
+      // vector search has to assemble its SQL in a general-custom-js node —
+      // whose output is relayed to the browser, leaking the schema.
+      vectorLiteral: '[' + embeddingData.embedding.join(',') + ']',
       model: response.model || model,
       dimensions: embeddingData.embedding.length,
       usage: {
@@ -54,7 +99,7 @@ async function ai_generate_text_embedding(config: any, context: Record<string, u
       },
     }
   } catch (err: any) {
-    return { error: true, message: err.message || String(err), code: 'provider_error' }
+    return fail(err.message || String(err), 'provider_error')
   }
 }