@teleporthq/teleport-plugin-next-workflows 0.43.75 → 0.44.1

package/src/auth-generator.ts

@@ -13,6 +13,7 @@ import {
   generateLocalizedEmailCopyFn,
   WELCOME_EMAIL_CONFIG_KEYS,
 } from './transactional-email-code'
+import { TableAccess } from '@teleporthq/teleport-shared'
 import { generateSessionTokenResolverCode } from './session-cookie-resolver'
 
 // GUI provider id → the actual next-auth v4 provider MODULE name, for the few
@@ -1117,6 +1118,7 @@ module.exports = function nextAuthRoute(req, res) {
 export interface WelcomeEmailOptions {
   emailProvider?: string | null
   fromEmail?: string
+  fromName?: string
   emailSecretEnvName?: string | null
   emailSubject?: string
   emailBodyHtml?: string
@@ -1165,6 +1167,7 @@ const sanitizeUser = authUtils.sanitizeUser;`
     welcomeHelpers = `
 const WELCOME_EMAIL_PROVIDER = ${JSON.stringify(welcomeProvider)};
 const WELCOME_EMAIL_FROM = ${JSON.stringify(welcome.fromEmail || '')};
+const WELCOME_EMAIL_FROM_NAME = ${JSON.stringify(welcome.fromName || '')};
 const WELCOME_EMAIL_SECRET_ENV_NAME = ${JSON.stringify(welcome.emailSecretEnvName || '')};
 const WELCOME_EMAIL_SUBJECT = ${JSON.stringify(welcome.emailSubject || 'Welcome')};
 const WELCOME_EMAIL_BODY_HTML = ${JSON.stringify(welcome.emailBodyHtml || '')};
@@ -1200,7 +1203,7 @@ async function sendWelcomeEmail(toEmail, tokenValues, userId, locale) {
   var copy = resolveWelcomeEmailCopy(locale);
   var subject = fillTemplate(copy.subject, tokenValues);
   var html = fillTemplate(copy.body, tokenValues);
-  await __sendProviderEmail({ from: from, to: toEmail, subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
+  await __sendProviderEmail({ from: from, fromName: WELCOME_EMAIL_FROM_NAME, to: toEmail, subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
 }
 `
 
@@ -1413,6 +1416,70 @@ const selfGuardedRoutePatternOf = (protection: {
   return base === '/' ? `/[${differentiator}]` : `${base}/[${differentiator}]`
 }
 
+/** The same-site path the project redirects `/` to, or null (absent, `/` itself, or off-site). */
+const resolveHomeRedirect = (auth: UIDLAuthentication): string | null => {
+  const value = typeof auth.homeRedirect === 'string' ? auth.homeRedirect : ''
+  const path = value.split('?')[0].split('#')[0]
+  if (!path.startsWith('/') || path.startsWith('//') || path.indexOf('\\') !== -1) {
+    return null
+  }
+  const normalized = path.length > 1 ? path.replace(/\/+$/, '') : path
+  return normalized === '/' ? null : normalized
+}
+
+/**
+ * Where a signed-in visitor without the role a page asks for lands. A project
+ * whose home page is not redirected keeps the code it always had. One that
+ * redirects `/` (e.g. to an admin dashboard) only sends a visitor home when
+ * that page admits them; otherwise to sign-in, saying why.
+ */
+const generateRoleDeniedRedirectCode = (
+  signInRoute: string,
+  homeRedirect: string | null
+): string => {
+  if (!homeRedirect) {
+    return `// Where to send an authenticated user who lacks the required role. Normally the
+// home page ("you don't have access, here's the public site"). But when "/" is
+// itself a protected page (e.g. an admin dashboard published at the root), a
+// redirect to "/" re-enters this middleware and loops forever — so fall back to
+// the sign-in page (with a callbackUrl) in that case.
+function roleDeniedRedirect(request, pathname) {
+  if (pathname !== '/' && !protectedRoutes['/']) {
+    return redirectWithinLocale(request, '/');
+  }
+  return redirectWithinLocale(request, '${signInRoute}', pathname);
+}`
+  }
+  return `// The project redirects "/" here before this middleware ever runs.
+var homeRedirect = ${JSON.stringify(homeRedirect)};
+
+// Whether "/" is a way out for this visitor: the page it redirects to is not
+// the one being left, and admits their role. Otherwise sending them home would
+// land them right back on a page that refuses them — a redirect loop.
+function homeAdmitsRole(pathname, userRole) {
+  var landing = normalizeMatchPath(homeRedirect);
+  if (landing === normalizeMatchPath(pathname)) return false;
+  var protection = resolveProtection(landing).matched;
+  if (!protection) return true;
+  if (protection.requiresSubscription) return false;
+  var roles = protection.allowedRoles || [];
+  return roles.length === 0 || roles.indexOf(userRole) >= 0;
+}
+
+// Where to send an authenticated user who lacks the required role: home when
+// home admits them, else the sign-in page, which is told why (error=forbidden)
+// and keeps a callbackUrl for an account that may open the page.
+function roleDeniedRedirect(request, pathname, userRole) {
+  if (pathname !== '/' && !protectedRoutes['/'] && homeAdmitsRole(pathname, userRole)) {
+    return redirectWithinLocale(request, '/');
+  }
+  var target = new URL(localizePathname(request, '${signInRoute}'), request.url);
+  target.searchParams.set('callbackUrl', localizePathname(request, pathname));
+  target.searchParams.set('error', 'forbidden');
+  return NextResponse.redirect(target);
+}`
+}
+
 export const generateMiddlewareFile = (
   auth: UIDLAuthentication,
   options: MiddlewareOptions = {}
@@ -1506,20 +1573,19 @@ export const generateMiddlewareFile = (
     delete protectedRoutes[route]
   }
 
-  let sawAdminRoute = false
-  let adminRoles: string[] = ['admin']
-  for (const k of Object.keys(protectedRoutes)) {
-    if (k === '/admin' || k.indexOf('/admin/') === 0) {
-      sawAdminRoute = true
-      const ar = protectedRoutes[k]?.allowedRoles
-      if (ar && ar.length > 0) {
-        adminRoles = ar
-        break
-      }
-    }
-  }
+  // `/admin` itself, and every admin page the map has no entry for (one an
+  // owner added without protection), admit the admin panel's own roles — its
+  // folder's — never the first admin route's, which may also admit another
+  // role (a staff dashboard).
+  const sawAdminRoute = Object.keys(protectedRoutes).some(
+    (k) => k === '/admin' || k.indexOf('/admin/') === 0
+  )
   if (sawAdminRoute && !protectedRoutes['/admin']) {
-    protectedRoutes['/admin'] = { requiresAuth: true, allowedRoles: adminRoles }
+    const panelRoles = TableAccess.resolveAdminPanelRoles(auth)
+    protectedRoutes['/admin'] = {
+      requiresAuth: true,
+      allowedRoles: panelRoles.length > 0 ? panelRoles : ['admin'],
+    }
   }
 
   const protectedRoutesJson = JSON.stringify(protectedRoutes, null, 2)
@@ -1530,6 +1596,7 @@ export const generateMiddlewareFile = (
     options.subscriptionFallbackRoute && options.subscriptionFallbackRoute.startsWith('/')
       ? options.subscriptionFallbackRoute
       : '/'
+  const homeRedirect = resolveHomeRedirect(auth)
 
   return `import { NextResponse } from 'next/server';
 import { getToken } from 'next-auth/jwt';
@@ -1642,17 +1709,7 @@ function redirectWithinLocale(request, pathname, callbackPath) {
   return NextResponse.redirect(target);
 }
 
-// Where to send an authenticated user who lacks the required role. Normally the
-// home page ("you don't have access, here's the public site"). But when "/" is
-// itself a protected page (e.g. an admin dashboard published at the root), a
-// redirect to "/" re-enters this middleware and loops forever — so fall back to
-// the sign-in page (with a callbackUrl) in that case.
-function roleDeniedRedirect(request, pathname) {
-  if (pathname !== '/' && !protectedRoutes['/']) {
-    return redirectWithinLocale(request, '/');
-  }
-  return redirectWithinLocale(request, '${signInRoute}', pathname);
-}
+${generateRoleDeniedRedirectCode(signInRoute, homeRedirect)}
 
 // Route keys carry no trailing slash, so neither may the path we match with.
 // Next.js serves "/orders/ORD-42/" and "/orders/ORD-42" as the same route;
@@ -1839,7 +1896,7 @@ async function middleware(request) {
     }
     var userRole = getUserRoleFromToken(sessionUser);
     if (userRole == null || allowedRoles.indexOf(userRole) < 0) {
-      return roleDeniedRedirect(request, pathname);
+      return roleDeniedRedirect(request, pathname${homeRedirect ? ', userRole' : ''});
     }
   }
 

package/src/booking-calendar-feed-route-generator.ts

@@ -0,0 +1,293 @@
+/**
+ * The bookings' calendar feeds: `pages/api/bookings/ical/[file].js`, emitted
+ * when the UIDL carries `bookingCalendars.feedStatement`.
+ *
+ * Each calendar link of a site's bookings is an iCalendar (RFC 5545) feed that
+ * Airbnb, Booking.com, Vrbo or Google Calendar import to block the dates the
+ * site has booked. The editor builds the one statement behind every feed (its
+ * tables and columns are the editor's business); the generated route only runs
+ * it with the link's key and writes the rows out as a calendar.
+ */
+import { FileType, ProjectPluginStructure } from '@teleporthq/teleport-types'
+import { generatePgClientCode } from './pg-client-code'
+import { getDatabaseDriverDependencies } from './auth-generator'
+
+/**
+ * The route's source (CommonJS). GET or HEAD `/api/bookings/ical/<key>.ics`:
+ *  - another method → 405 with `Allow: GET, HEAD`;
+ *  - a key of the wrong shape, or one the statement returns no calendar row
+ *    for → 404 (the key is the link's only credential, so both look the same);
+ *  - a failed query → 500 'Calendar unavailable', the cause logged only;
+ *  - else 200 with the calendar, never cached. An event row with a missing or
+ *    invalid value is left out rather than failing the whole feed.
+ */
+export const generateBookingCalendarFeedRoute = (feedStatement: string): string => {
+  return `'use strict';
+
+// GENERATED — see generateBookingCalendarFeedRoute in
+// @teleporthq/teleport-plugin-next-workflows/src/booking-calendar-feed-route-generator.ts.
+//
+// The iCalendar feed of one calendar link of the site's bookings: Airbnb,
+// Booking.com, Vrbo or Google Calendar poll it and block the booked dates.
+${generatePgClientCode()}
+
+// Built by the editor: $1 is the link's key. It returns one 'calendar' row and
+// one 'event' row per blocked period.
+var FEED_STATEMENT = ${JSON.stringify(feedStatement)};
+var FEED_FILE_RE = /^([A-Za-z0-9_-]{20,80})[.]ics$/;
+var DATE_RE = /^([0-9]{4})([0-9]{2})([0-9]{2})$/;
+var DATE_TIME_RE = /^([0-9]{4})([0-9]{2})([0-9]{2})T([0-9]{2})([0-9]{2})([0-9]{2})Z$/;
+var TEXT_TYPE = 'text/plain; charset=utf-8';
+var CALENDAR_TYPE = 'text/calendar; charset=utf-8';
+var CRLF = String.fromCharCode(13, 10);
+var BACKSLASH = String.fromCharCode(92);
+// RFC 5545: a content line is at most 75 octets, the line break excluded.
+var MAX_LINE_OCTETS = 75;
+
+// RFC 5545 TEXT: a backslash, semicolon or comma is escaped with a backslash
+// and every line break is written as the two characters backslash and n.
+// Other control characters are not allowed in TEXT, so they are dropped.
+function icalText(value) {
+  var text = String(value == null ? '' : value);
+  var out = '';
+  for (var i = 0; i < text.length; i++) {
+    var ch = text.charAt(i);
+    var code = text.charCodeAt(i);
+    if (ch === BACKSLASH || ch === ';' || ch === ',') {
+      out += BACKSLASH + ch;
+    } else if (code === 13 || code === 10) {
+      // CRLF, a lone CR and a lone LF are each one line break.
+      if (code === 13 && text.charCodeAt(i + 1) === 10) {
+        i += 1;
+      }
+      out += BACKSLASH + 'n';
+    } else if (code === 9 || (code >= 32 && code !== 127)) {
+      out += ch;
+    }
+  }
+  return out;
+}
+
+// One content line, folded: a continuation line starts with one space (which
+// counts toward its 75 octets), and no fold splits a UTF-8 character.
+function icalFold(line) {
+  var out = '';
+  var used = 0;
+  for (var i = 0; i < line.length; i++) {
+    var ch = line.charAt(i);
+    var code = line.charCodeAt(i);
+    var octets = code < 0x80 ? 1 : code < 0x800 ? 2 : 3;
+    if (code >= 0xd800 && code <= 0xdbff) {
+      var low = line.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        // A surrogate pair is one 4-octet character.
+        ch = line.slice(i, i + 2);
+        octets = 4;
+        i += 1;
+      }
+    }
+    if (used + octets > MAX_LINE_OCTETS) {
+      out += CRLF + ' ';
+      used = 1;
+    }
+    out += ch;
+    used += octets;
+  }
+  return out + CRLF;
+}
+
+// all_day as Postgres hands it over: a boolean, or 't' / 'f' / 'true' / 'false'.
+// null for anything else.
+function icalAllDay(value) {
+  if (value === true || value === false) {
+    return value;
+  }
+  var text = String(value == null ? '' : value).trim().toLowerCase();
+  if (text === 't' || text === 'true') {
+    return true;
+  }
+  if (text === 'f' || text === 'false') {
+    return false;
+  }
+  return null;
+}
+
+// 'YYYYMMDD' (all day) or 'YYYYMMDDTHHMMSSZ' naming a real day and time, else
+// null — a value like 20260231 would otherwise reach the importing calendar.
+function icalDateValue(value, allDay) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  var text = value.trim();
+  var match = (allDay ? DATE_RE : DATE_TIME_RE).exec(text);
+  if (!match) {
+    return null;
+  }
+  var parts = [];
+  for (var i = 1; i <= 6; i++) {
+    parts.push(allDay && i > 3 ? 0 : Number(match[i]));
+  }
+  var date = new Date(Date.UTC(parts[0], parts[1] - 1, parts[2], parts[3], parts[4], parts[5]));
+  var actual = [
+    date.getUTCFullYear(),
+    date.getUTCMonth() + 1,
+    date.getUTCDate(),
+    date.getUTCHours(),
+    date.getUTCMinutes(),
+    date.getUTCSeconds(),
+  ];
+  return actual.join(',') === parts.join(',') ? text : null;
+}
+
+// The VEVENT lines of one event row, or null when a value is missing or invalid.
+function icalEventLines(row, stamp) {
+  var uid = row.uid == null ? '' : String(row.uid).trim();
+  var allDay = icalAllDay(row.all_day);
+  if (uid === '' || allDay === null) {
+    return null;
+  }
+  var start = icalDateValue(row.start_value, allDay);
+  var end = icalDateValue(row.end_value, allDay);
+  // The end is exclusive, so it must come after the start. Two values of the
+  // same format compare correctly as strings.
+  if (start === null || end === null || end <= start) {
+    return null;
+  }
+  var valueParam = allDay ? ';VALUE=DATE:' : ':';
+  return [
+    'BEGIN:VEVENT',
+    'UID:' + icalText(uid),
+    'DTSTAMP:' + stamp,
+    'DTSTART' + valueParam + start,
+    'DTEND' + valueParam + end,
+    'SUMMARY:' + icalText(row.summary),
+    'TRANSP:OPAQUE',
+    'END:VEVENT',
+  ];
+}
+
+// 'YYYYMMDDTHHMMSSZ' of an instant, in UTC.
+function icalStamp(date) {
+  var iso = date.toISOString();
+  return (
+    iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) + 'T' +
+    iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) + 'Z'
+  );
+}
+
+function icalCalendar(calendarRow, rows, now) {
+  var stamp = icalStamp(now);
+  var lines = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'PRODID:-//TeleportHQ//Bookings//EN',
+    'CALSCALE:GREGORIAN',
+    'METHOD:PUBLISH',
+    'X-WR-CALNAME:' + icalText(calendarRow.calendar_name),
+    'REFRESH-INTERVAL;VALUE=DURATION:PT30M',
+    'X-PUBLISHED-TTL:PT30M',
+  ];
+  for (var i = 0; i < rows.length; i++) {
+    if (rows[i] && rows[i].kind === 'event') {
+      var eventLines = icalEventLines(rows[i], stamp);
+      if (eventLines) {
+        lines = lines.concat(eventLines);
+      }
+    }
+  }
+  lines.push('END:VCALENDAR');
+  var body = '';
+  for (var j = 0; j < lines.length; j++) {
+    body += icalFold(lines[j]);
+  }
+  return body;
+}
+
+// Never cached: a booking can block a date between two polls. A HEAD request
+// gets the headers GET would, without the body.
+function icalSend(res, status, contentType, body, headOnly) {
+  res.statusCode = status;
+  res.setHeader('Content-Type', contentType);
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf8')));
+  if (headOnly) {
+    res.end();
+  } else {
+    res.end(body);
+  }
+}
+
+module.exports = async function handler(req, res) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    res.setHeader('Allow', 'GET, HEAD');
+    return icalSend(res, 405, TEXT_TYPE, 'Method not allowed', false);
+  }
+  var headOnly = req.method === 'HEAD';
+  var file = req.query && typeof req.query.file === 'string' ? req.query.file : '';
+  var fileMatch = FEED_FILE_RE.exec(file);
+  if (!fileMatch) {
+    return icalSend(res, 404, TEXT_TYPE, 'Not found', headOnly);
+  }
+
+  var rows = null;
+  var client = null;
+  try {
+    client = getClient();
+    await client.connect();
+    var result = await client.query(FEED_STATEMENT, [fileMatch[1]]);
+    rows = result && Array.isArray(result.rows) ? result.rows : [];
+  } catch (e) {
+    console.error('[bookings-ical] calendar feed query failed:', e && e.message ? e.message : e);
+  } finally {
+    if (client) {
+      try { await client.end(); } catch (e) {}
+    }
+  }
+  if (rows === null) {
+    return icalSend(res, 500, TEXT_TYPE, 'Calendar unavailable', headOnly);
+  }
+
+  var calendarRow = null;
+  for (var i = 0; i < rows.length && calendarRow === null; i++) {
+    if (rows[i] && rows[i].kind === 'calendar') {
+      calendarRow = rows[i];
+    }
+  }
+  if (calendarRow === null) {
+    return icalSend(res, 404, TEXT_TYPE, 'Not found', headOnly);
+  }
+  res.setHeader('Content-Disposition', 'inline; filename="' + file + '"');
+  return icalSend(res, 200, CALENDAR_TYPE, icalCalendar(calendarRow, rows, new Date()), headOnly);
+};
+`
+}
+
+/**
+ * Emits the feed route when the UIDL names a feed statement, plus the `pg`
+ * driver it connects with (already present on a project with a Teleport
+ * database, which every bookings site has).
+ */
+export const generateBookingCalendarFeedFiles = (structure: ProjectPluginStructure): void => {
+  const feedStatement = structure.uidl.bookingCalendars?.feedStatement
+  if (typeof feedStatement !== 'string' || feedStatement.trim() === '') {
+    return
+  }
+
+  structure.files.set('bookings-ical-feed-route', {
+    path: ['pages', 'api', 'bookings', 'ical'],
+    files: [
+      {
+        name: '[file]',
+        fileType: FileType.JS,
+        content: generateBookingCalendarFeedRoute(feedStatement),
+      },
+    ],
+  })
+
+  const driverDependencies = getDatabaseDriverDependencies('teleport')
+  for (const [pkg, version] of Object.entries(driverDependencies)) {
+    if (!structure.dependencies[pkg]) {
+      structure.dependencies[pkg] = version
+    }
+  }
+}

package/src/data-api-route-generator.ts

@@ -101,7 +101,12 @@ export const generateDataAPIRoute = (options: DataAPIRouteOptions = {}): string
       ? options.lowStockThreshold
       : 5
 
-  return `const { Client } = require('pg');
+  return `const { Client, types: pgTypes } = require('pg');
+// A DATE stays the day it names, whatever the server's time zone: node-pg would read it as
+// local midnight, which a server east of UTC sends as the day before.
+if (pgTypes && typeof pgTypes.setTypeParser === 'function') {
+  pgTypes.setTypeParser(1082, (value) => value);
+}
 ${
   // The session cookie is resolved from the REQUEST rather than from
   // process.env.NEXTAUTH_URL — see session-cookie-resolver.ts. Reading it the

package/src/executor-generator.ts

@@ -387,8 +387,19 @@ function applyTemplateParams(text, params) {
 function finalizeResolvedConfig(nodeType, config) {
   var isDataNode = typeof nodeType === 'string' && nodeType.indexOf('data-') === 0;
   var error = null;
+  // A config value may be a live element (a trigger's target handed to a
+  // custom-js node) or an object that refers back to itself: walking into a
+  // DOM node follows its React fibers forever (a page's every element-bound
+  // behavior died with "Maximum call stack size exceeded"). Elements are
+  // left as they are; an object is walked once.
+  var seen = typeof WeakSet === 'function' ? new WeakSet() : null;
   function walk(obj, insideFilters) {
     if (!obj || typeof obj !== 'object') return;
+    if (typeof obj.nodeType === 'number' && typeof obj.nodeName === 'string') return;
+    if (seen) {
+      if (seen.has(obj)) return;
+      seen.add(obj);
+    }
     if (Array.isArray(obj)) {
       for (var ai = 0; ai < obj.length; ai++) walk(obj[ai], insideFilters);
       return;
@@ -1398,15 +1409,31 @@ var SEGMENT_REPLY_PRIVATE_KEYS = {
 // be echoed back wholesale (every earlier node's result, the trigger, the whole
 // page state), so each round trip carried the page twice over and the network
 // tab showed every node's data on every hop.
+//
+// A node marked \`keepResultOnServer\` is the exception: its result serves the
+// nodes after it in the same segment and never leaves the server (a statement's
+// rows read only to build what the browser may see, a sender's recipients).
+// Nothing in a later segment can read it.
+// The nodes whose result the client branches on: never kept on the server.
+function isBranchingNodeType(type) {
+  return type === 'general-if-statement' || type === 'general-switch';
+}
+
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = {};
   var own = {};
+  var kept = {};
   var nodes = (segmentConfig && segmentConfig.nodes) || [];
-  for (var ni = 0; ni < nodes.length; ni++) own[nodes[ni].id] = true;
+  for (var ni = 0; ni < nodes.length; ni++) {
+    own[nodes[ni].id] = true;
+    if (nodes[ni].config && nodes[ni].config.keepResultOnServer === true && !isBranchingNodeType(nodes[ni].type)) {
+      kept[nodes[ni].id] = true;
+    }
+  }
   var keys = Object.keys(context);
   for (var i = 0; i < keys.length; i++) {
     var key = keys[i];
-    if (SEGMENT_REPLY_PRIVATE_KEYS[key]) continue;
+    if (SEGMENT_REPLY_PRIVATE_KEYS[key] || kept[key]) continue;
     var value = context[key];
     if (value === undefined) continue;
     if (own[key] || !snapshot || !Object.prototype.hasOwnProperty.call(snapshot, key)) {
@@ -1497,6 +1524,7 @@ module.exports = {
   fatalNodeResultMessage,
   continuesOnError,
   isFireAndForgetNode,
+  isBranchingNodeType,
   startFireAndForgetNode,
   registerPendingNodePromise,
   settlePendingNodePromises
@@ -1821,25 +1849,19 @@ function findStreamingAINodes(allNodes, allEdges) {
     const n = allNodes[ni];
     if (aiTypes.indexOf(n.type) >= 0 && n.config && n.config.streaming) {
       let onStreamEdge = null;
-      let onEndEdge = null;
       for (let ei = 0; ei < allEdges.length; ei++) {
-        if (allEdges[ei].source === n.id) {
-          if (allEdges[ei].sourceHandle === 'on-stream') onStreamEdge = allEdges[ei];
-          if (allEdges[ei].sourceHandle === 'on-end') onEndEdge = allEdges[ei];
-        }
+        if (allEdges[ei].source === n.id && allEdges[ei].sourceHandle === 'on-stream') onStreamEdge = allEdges[ei];
       }
       const onStreamNodes = onStreamEdge ? utils.collectBranchNodes(onStreamEdge.target, allNodes, allEdges, n.id) : [];
-      const onEndNodes = onEndEdge ? utils.collectBranchNodes(onEndEdge.target, allNodes, allEdges, n.id) : [];
-      map[n.id] = { node: n, onStreamNodes: onStreamNodes, onEndNodes: onEndNodes };
+      map[n.id] = { node: n, onStreamNodes: onStreamNodes };
     }
   }
   return map;
 }
 
-// A streaming AI node's on-stream / on-end branches are collected from the
-// FULL workflow node list, so they may contain server nodes (e.g. the SQL
-// insert persisting a chat answer). Those already execute inside their own
-// server segments with full configs; the browser bundle only ships their
+// A streaming AI node's on-stream branch is collected from the FULL workflow
+// node list, so it may contain server nodes. Those already execute inside their
+// own server segments with full configs; the browser bundle only ships their
 // config redacted down to the client-safe whitelist (segment-splitter's
 // redactServerNodeConfig), so executing them here with CLIENT handlers both
 // double-executes them and crashes on the missing config. Emitted nodes carry
@@ -1852,7 +1874,6 @@ function clientExecutableBranchNodes(branchNodes) {
 async function callStreamingServerSegment(segmentUrl, context, streamingInfo, allNodes, allEdges, clientHandlers, workflowConfig, executionId, stateKeys) {
   const prunedContext = pruneContext(context, stateKeys);
   const handledNodeIds = {};
-  const streamedNodeIds = {};
   // Same relative-URL problem as callServerSegment above — required even
   // for streaming segments because a server-side caller (e.g. an AI
   // chat webhook) would otherwise fail to parse the URL.
@@ -1899,7 +1920,6 @@ async function callStreamingServerSegment(segmentUrl, context, streamingInfo, al
       try { data = JSON.parse(jsonStr); } catch(e) { continue; }
 
       if (data.type === 'chunk' && data.nodeId) {
-        streamedNodeIds[data.nodeId] = true;
         context[data.nodeId] = { chunk: data.chunk, fullResponse: data.fullResponse };
         const info = streamingInfo[data.nodeId];
         if (info && info.onStreamNodes.length > 0) {
@@ -1914,22 +1934,13 @@ async function callStreamingServerSegment(segmentUrl, context, streamingInfo, al
       } else if (data.type === 'node-result' && data.nodeId) {
         context[data.nodeId] = data.result;
       } else if (data.type === 'done') {
+        // The on-end branch is not run here: its steps sit in the segments after
+        // this one, and the caller runs those in graph order, so a browser step
+        // waits for the server steps before it (the chat's "Bump Conversation
+        // After Reply" -> "Get Chat Messages for Final Update").
         if (data.results) {
           mergeServerResults(context, data.results, workflowConfig && workflowConfig.triggerNodeId);
         }
-        const streamedKeys = Object.keys(streamedNodeIds);
-        for (let sk = 0; sk < streamedKeys.length; sk++) {
-          const endInfo = streamingInfo[streamedKeys[sk]];
-          if (endInfo && endInfo.onEndNodes.length > 0) {
-            const runnableEndNodes = clientExecutableBranchNodes(endInfo.onEndNodes);
-            if (runnableEndNodes.length > 0) {
-              await utils.executeNodes(runnableEndNodes, allEdges, context, clientHandlers, workflowConfig, null, executionId);
-            }
-            for (let eni = 0; eni < endInfo.onEndNodes.length; eni++) {
-              handledNodeIds[endInfo.onEndNodes[eni].id] = true;
-            }
-          }
-        }
       } else if (data.type === 'error') {
         throw new Error(data.error || 'Streaming workflow segment failed');
       }