packages/stack-shared/src/config/schema.ts (1)

143-152: Workflows schema: guard against empty strings

Consider ensuring displayName and tsSource aren’t empty to avoid silent misconfigs.

Apply:

-      displayName: yupString(),
-      tsSource: yupString(),
+      displayName: yupString().trim().min(1),
+      tsSource: yupString().trim().min(1),

Will users commonly toggle only “enabled” via overrides without setting displayName/tsSource? If yes, confirm that warning handling remains acceptable when these fields are missing at override time.

packages/stack-shared/src/utils/arrays.tsx (2)

205-216: Deduplicate with a generic isArrayOf helper; add a “plain object” variant to avoid ambiguity.

• The three primitives share identical structure; factor via a reusable helper.
• isObjectArray currently treats arrays as “object” (true) and excludes functions; the TS type object includes functions, so the runtime/type semantics can surprise callers. Consider leaving isObjectArray as-is but also exporting isPlainObjectArray that excludes arrays and nulls and narrows to Record<string, unknown>[].

Apply this diff:

+const isArrayOf = <T>(pred: (v: unknown) => v is T) =>
+  (arr: unknown): arr is T[] =>
+    Array.isArray(arr) && arr.every(pred);
+
-export function isStringArray(arr: unknown): arr is string[] {
-  return Array.isArray(arr) && arr.every((item) => typeof item === "string");
-}
+export const isStringArray = isArrayOf((item): item is string => typeof item === "string");
 
-export function isNumberArray(arr: unknown): arr is number[] {
-  return Array.isArray(arr) && arr.every((item) => typeof item === "number");
-}
+export const isNumberArray = isArrayOf((item): item is number => typeof item === "number");
 
-export function isBooleanArray(arr: unknown): arr is boolean[] {
-  return Array.isArray(arr) && arr.every((item) => typeof item === "boolean");
-}
+export const isBooleanArray = isArrayOf((item): item is boolean => typeof item === "boolean");
 
 export function isObjectArray(arr: unknown): arr is object[] {
   return Array.isArray(arr) && arr.every((item) => typeof item === "object" && item !== null);
 }
+
+export function isPlainObjectArray(arr: unknown): arr is Record<string, unknown>[] {
+  return Array.isArray(arr)
+    && arr.every((item) => typeof item === "object" && item !== null && !Array.isArray(item));
+}

---

217-228: Broaden tests to lock in semantics (functions, array-of-arrays, and plain objects).

Add cases to document behavior explicitly and cover the new isPlainObjectArray.

Apply this diff:

 import.meta.vitest?.test("is<Type>Array", ({ expect }) => {
   expect(isStringArray([])).toBe(true);
   expect(isNumberArray([1, 2, 3])).toBe(true);
   expect(isBooleanArray([true, false, true])).toBe(true);
   expect(isObjectArray([{ a: 1 }, { b: 2 }, { c: 3 }])).toBe(true);
+  expect(isPlainObjectArray([{ a: 1 }, { b: 2 }])).toBe(true);
+  expect(isObjectArray([[1], [2]])).toBe(true);           // arrays are objects
+  expect(isPlainObjectArray([[1], [2]])).toBe(false);     // but not “plain objects”
+  expect(isObjectArray([() => {}])).toBe(false);          // functions are not typeof "object"
   expect(isStringArray([1, 2, 3])).toBe(false);
   expect(isNumberArray(["a", "b", "c"])).toBe(false);
   expect(isBooleanArray([1, 2, 3])).toBe(false);
   expect(isObjectArray([1, 2, 3])).toBe(false);
   expect(isObjectArray([{ a: 1 }, null, { b: 2 }])).toBe(false);
   expect(isObjectArray([{ a: 1 }, undefined, { b: 2 }])).toBe(false);
 });

apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/workflows/[workflowId]/page.tsx (3)

4-4: Use inline Alert for blocking errors and disable Save when unchanged.

Per dashboard UI guideline, prefer alerts (not toasts) for blocking errors. Also prevent no-op saves.

- import { Button, Card, CardContent, CardHeader, CardTitle, toast } from "@stackframe/stack-ui";
+ import { Button, Card, CardContent, CardHeader, CardTitle, toast, Alert, AlertDescription } from "@stackframe/stack-ui";

- const [workflowContent, setWorkflowContent] = useState("");
+ const [workflowContent, setWorkflowContent] = useState("");
+ const [errorMsg, setErrorMsg] = useState<string | null>(null);
+ const hasChanges = workflowContent !== (workflow?.tsSource ?? "");

   const handleSave = async () => {
     setIsLoading(true);
     try {
+      setErrorMsg(null);
       await project.updateConfig({
         [`workflows.availableWorkflows.${workflowId}.tsSource`]: workflowContent
       });
       toast({ title: "Workflow saved successfully" });
     } catch (error) {
-      toast({ title: "Failed to save workflow", variant: "destructive" });
+      setErrorMsg("Failed to save workflow. Please try again.");
     } finally {
       setIsLoading(false);
     }
   };

-          <Button onClick={handleSave} size="sm" disabled={isLoading}>
+          <Button onClick={handleSave} size="sm" disabled={isLoading || !hasChanges}>
             <Save className="h-4 w-4 mr-2" />
             {isLoading ? "Saving..." : "Save"}
           </Button>

           <CardContent>
             <div className="relative">
+              {errorMsg && (
+                <Alert variant="destructive" className="mb-3">
+                  <AlertDescription>{errorMsg}</AlertDescription>
+                </Alert>
+              )}
               <textarea
                 value={workflowContent}
                 onChange={(e) => setWorkflowContent(e.target.value)}
                 className="w-full min-h-[600px] p-4 font-mono text-sm bg-muted/50 border rounded-md resize-none focus:outline-none focus:ring-2 focus:ring-primary"
                 spellCheck={false}
                 placeholder="Enter your workflow code here..."
                 disabled={isLoading}
               />
             </div>
           </CardContent>

Also applies to: 23-25, 32-44, 73-76, 88-99

---

54-55: Render the workflow id as code; avoid JSON.stringify in UI text.

-          <p className="text-muted-foreground mb-4">The workflow {JSON.stringify(workflowId)} was not found.</p>
+          <p className="text-muted-foreground mb-4">The workflow <code>{workflowId}</code> was not found.</p>

---

80-80: Avoid always-on scrollbars; use overflow-auto and Tailwind basis.

-      <div className="flex gap-6 flex-1" style={{ flexBasis: "0px", overflow: "scroll" }}>
+      <div className="flex gap-6 flex-1 basis-0 overflow-auto">

apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/workflows/workflow-list.tsx (2)

9-14: Export Workflow type for reuse across pages (remove anys elsewhere).

-type Workflow = {
+export type Workflow = {
   id: string,
   displayName: string,
   tsSource: string,
   enabled: boolean,
 };

---

127-134: Consider limiting content search for performance on large tsSource.

For better UX on big sources: search id/displayName by default and add a “Search code” toggle, or debounce and skip tsSource when query < 3 chars.

apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/workflows/page.tsx (4)

113-114: Remove unsupported width prop on Input; use className or style.

-              onChange={(e) => setDisplayName(e.target.value)}
-              width="200px"
+              onChange={(e) => setDisplayName(e.target.value)}
+              className="w-[200px]"

---

11-11: Type workflows explicitly and fix blocking error toast in Edit form.
Reuse Workflow type; use inline Alert for validation instead of toast.

-import { WorkflowList } from "./workflow-list";
+import { WorkflowList, type Workflow } from "./workflow-list";

-  const [showEditDialog, setShowEditDialog] = useState(false);
-  const [editingWorkflow, setEditingWorkflow] = useState<any>(null);
+  const [showEditDialog, setShowEditDialog] = useState(false);
+  const [editingWorkflow, setEditingWorkflow] = useState<Workflow | null>(null);

-  const handleEditWorkflow = (workflow: any) => {
+  const handleEditWorkflow = (workflow: Workflow) => {

-  const handleDuplicateWorkflow = async (workflow: any) => {
+  const handleDuplicateWorkflow = async (workflow: Workflow) => {

-  const handleToggleEnabled = async (workflow: any) => {
+  const handleToggleEnabled = async (workflow: Workflow) => {

-  workflow: any,
+  workflow: Workflow,

-  const [displayName, setDisplayName] = useState(workflow.displayName);
-  const [tsSource, setTsSource] = useState(workflow.tsSource);
-  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [displayName, setDisplayName] = useState<string>(workflow.displayName);
+  const [tsSource, setTsSource] = useState<string>(workflow.tsSource);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [formError, setFormError] = useState<string | null>(null);

-    if (!displayName) {
-      toast({ title: "Please fill in all required fields", variant: "destructive" });
-      return;
-    }
+    if (!displayName) {
+      setFormError("Please fill in all required fields");
+      return;
+    }
+    setFormError(null);

   return (
     <>
       <div className="space-y-4">
+        {formError && (
+          <Alert variant="destructive">
+            <AlertDescription>{formError}</AlertDescription>
+          </Alert>
+        )}
         <div>
           <Label htmlFor="edit-workflow-id">Workflow ID</Label>
           <Input
             id="edit-workflow-id"
             value={workflow.id}
             disabled
             className="bg-muted"
           />
         </div>

Also applies to: 136-137, 158-161, 185-189, 207-214, 293-299, 301-306, 315-345

---

232-232: Avoid inline overflow:scroll; use Tailwind utilities.

-        <div className="flex gap-6 flex-1" style={{ flexBasis: "0px", overflow: "scroll" }}>
+        <div className="flex gap-6 flex-1 basis-0 overflow-auto">

---

186-195: Optional: make duplicate IDs robust against races.
If two duplicates happen quickly, the while-loop on a stale snapshot can collide. Consider using generateUuid() for the new id or delegating uniqueness to the backend.

packages/stack-shared/src/utils/numbers.tsx (3)

15-25: Avoid string math in the loop; keep it numeric until the final format.

Reduces conversions and clarifies intent. Also adds a graceful clamp when exceeding the last suffix.

-  let current = toFixedMax(num, 1);
-  let lastSuffix = "";
-  for (const [difference, suffix] of magnitudes) {
-    if (+current >= difference) {
-      current = toFixedMax(+current / difference, 1);
-      lastSuffix = suffix;
-    } else {
-      break;
-    }
-  }
-  return current + lastSuffix;
+  let value = num;
+  let lastSuffix = "";
+  for (const [, suffix] of magnitudes) {
+    if (value >= 1_000) {
+      value = value / 1_000;
+      lastSuffix = suffix;
+    } else {
+      break;
+    }
+  }
+  // Optional: clamp when we run out of suffixes (prevents "1000T"/"1000Q")
+  const maxSuffix = magnitudes[magnitudes.length - 1][1];
+  if (lastSuffix === maxSuffix && value >= 1_000) {
+    return toFixedMax(value, 1) + lastSuffix + "+";
+  }
+  return toFixedMax(value, 1) + lastSuffix;

---

1-7: Nit: This file has no JSX; consider .ts instead of .tsx.

Minor build/IDE signal improvement.

---

38-43: Adjust magnitude suffixes and test expectations for short-scale abbreviations
Mapping entries ("bn", "bln", "trln") and the corresponding tests in packages/stack-shared/src/utils/numbers.tsx must be updated to use “B”, “T”, “Q” when switching to short-scale symbols.

packages/stack-shared/src/utils/promises.tsx (1)

416-418: Update timeoutThrow to match the new timeout signature

The timeoutThrow function should also accept the new union type to maintain API consistency with timeout.

-export async function timeoutThrow<T>(promise: Promise<T>, ms: number): Promise<T> {
+export async function timeoutThrow<T>(promiseOrFunc: Promise<T> | (() => Promise<T>), ms: number): Promise<T> {
-  return Result.orThrow(await timeout(promise, ms));
+  return Result.orThrow(await timeout(promiseOrFunc, ms));
}

apps/backend/prisma/schema.prisma (2)

776-787: Consider stronger typing and indexing for DataVaultEntry.

• If hashedKey has a fixed/hash length, constrain it (e.g., @db.VarChar(64)).
• encrypted appears to carry binary data encoded as JSON strings. Prefer a structured JSON with explicit fields and length checks, or split into Bytes fields to avoid double-encoding overhead.
• If lookups happen by hashedKey alone, add an index on [tenancyId, hashedKey] to avoid relying solely on the composite unique.

Example diff:

 model DataVaultEntry {
-  hashedKey String
-  encrypted Json // Contains { edkBase64, ciphertextBase64 } from encryptWithKms()
+  hashedKey String @db.VarChar(64)
+  // Contains { edkBase64, ciphertextBase64 } from encryptWithKms()
+  encrypted Json
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt

   @@id([tenancyId, id])
   @@unique([tenancyId, storeId, hashedKey])
   @@index([tenancyId, storeId])
+  @@index([tenancyId, hashedKey])
 }

---

824-835: Double-check concurrency semantics for CurrentlyCompilingWorkflow.

Primary key [tenancyId, workflowId, sourceHash] permits multiple “compiling” rows per workflow across source revisions. If only one compile may run per workflow/source, this is fine; otherwise, consider a uniqueness guard on (tenancyId, workflowId) for active compiles (enforced via status column or separate “active” table). Also consider a TTL/cleanup job for stale rows.

apps/backend/src/lib/workflows.tsx (5)

61-74: Guard against unknown triggers at runtime.

If registeredTriggers.get(triggerData.type) is undefined, calling it will throw a vague TypeError. Fail fast with a clear error.

Apply:

-        const trigger = registeredTriggers.get(triggerData.type);
-        return {
-          triggerOutput: trigger(triggerData.data),
-        };
+        const trigger = registeredTriggers.get(triggerData.type);
+        if (!trigger) {
+          throw new Error(\`Unknown trigger: \${triggerData.type}\`);
+        }
+        return { triggerOutput: trigger(triggerData.data) };

---

85-123: Timeout handling is good; also consider honoring workflow.enabled.

You check existence but not enabled. If disabled workflows should not compile, gate here.

Example:

-  const workflow = tenancy.config.workflows.availableWorkflows[workflowId];
+  const workflow = tenancy.config.workflows.availableWorkflows[workflowId];
+  if (workflow.enabled === false) {
+    return Result.error({ compileError: `Workflow ${workflowId} is disabled` });
+  }

---

178-184: Unimplemented getCompiledWorkflows blocks triggerWorkflows.

This currently throws. Add a minimal DB-backed implementation with a serializable transaction to avoid races: compute source hashes, upsert “compiling” rows, perform compile with timeout, write results to CompiledWorkflow, then return a Map of latest compiled artifacts.

I can draft an implementation sketch with Prisma transaction boundaries if you’d like.

---

191-197: Replace placeholder secrets with tenancy-aware values before shipping.

Hardcoded placeholders for STACK_PUBLISHABLE_CLIENT_KEY and STACK_SECRET_SERVER_KEY will break runtime behavior.

Would you like me to thread these from tenancy.config and add validation that they’re present for non-test environments?

---

231-237: Surface per-workflow results and handle partial failures.

Promise.all will reject on the first failure and mask others. Consider Promise.allSettled and returning a map of successes/failures for observability.

Apply:

 export async function triggerWorkflows(tenancy: Tenancy, trigger: WorkflowTrigger) {
   const compiledWorkflows = await getCompiledWorkflows(tenancy);
-  const promises = [...compiledWorkflows].map(async ([workflowId, compiledWorkflow]) => {
-    await triggerWorkflow(tenancy, compiledWorkflow, trigger);
-  });
-  await Promise.all(promises);
+  const promises = [...compiledWorkflows].map(([_, cw]) => triggerWorkflow(tenancy, cw, trigger));
+  await Promise.allSettled(promises);
 }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/backend/src/lib/workflows.tsx (3)

16-16: Include "compile" in the registered trigger type union.

compileWorkflowSource registers a "compile" trigger and tests assert it; the union excludes it, forcing unsafe casts.

Apply:

-type WorkflowRegisteredTriggerType = "sign-up";
+type WorkflowRegisteredTriggerType = "compile" | "sign-up";

---

318-332: Return execution metadata from triggerWorkflowRaw.

You generate triggerId and executionId but discard them. Persisting triggers/executions later needs these IDs to correlate callback chains; return them alongside the result.

Apply:

-async function triggerWorkflowRaw(tenancy: Tenancy, compiledWorkflowCode: string, trigger: WorkflowTrigger): Promise<Result<unknown, string>> {
+async function triggerWorkflowRaw(
+  tenancy: Tenancy,
+  compiledWorkflowCode: string,
+  trigger: WorkflowTrigger
+): Promise<Result<{ result: unknown, triggerId: string, executionId: string }, string>> {
   const triggerId = generateUuid();
   const executionId = trigger.type === "callback" ? trigger.executionId : generateUuid();

   const freestyle = new Freestyle();
   const freestyleRes = await freestyle.executeScript(compiledWorkflowCode, {
     envVars: {
       STACK_WORKFLOW_TRIGGER_DATA: JSON.stringify(trigger),
       STACK_PROJECT_ID: tenancy.project.id,
       STACK_PUBLISHABLE_CLIENT_KEY: "insert actual publishable client key here",
       STACK_SECRET_SERVER_KEY: "insert actual secret server key here",
     },
   });
-  return Result.map(freestyleRes, (data) => data.result);
+  return Result.map(freestyleRes, (data) => ({
+    result: data.result,
+    triggerId,
+    executionId,
+  }));
 }

---

334-361: Fix incorrect database associations and use generated IDs for proper execution tracking.

The current implementation has critical issues:

1. Uses compiledWorkflow.id (the compiled workflow ID) as the execution ID in the where clause, which is incorrect
2. Doesn't preserve the triggerId and executionId generated in triggerWorkflowRaw
3. Always tries to connectOrCreate with incorrect IDs instead of creating new executions

Apply this fix to properly track executions and triggers:

 async function triggerWorkflow(tenancy: Tenancy, compiledWorkflow: CompiledWorkflow, trigger: WorkflowTrigger): Promise<Result<void, string>> {
   if (compiledWorkflow.compiledCode === null) {
     return Result.error(`Workflow ${compiledWorkflow.id} failed to compile: ${compiledWorkflow.compileError}`);
   }
   const res = await triggerWorkflowRaw(tenancy, compiledWorkflow.compiledCode, trigger);
   const prisma = await getPrismaClientForTenancy(tenancy);
-  await prisma.workflowTrigger.create({
-    data: {
-      triggerData: trigger,
-      ...(res.status === "ok" ? { output: (res.data ?? Prisma.JsonNull) as any } : { error: res.error }),
-      execution: {
-        connectOrCreate: {
-          where: {
-            tenancyId_id: {
-              tenancyId: tenancy.id,
-              id: compiledWorkflow.id,
-            },
-          },
-          create: {
-            tenancyId: tenancy.id,
-            compiledWorkflowId: compiledWorkflow.id,
-          },
-        },
-      },
-    },
-  });
+  if (res.status === "ok") {
+    await prisma.workflowTrigger.create({
+      data: {
+        tenancyId: tenancy.id,
+        id: res.data.triggerId,
+        triggerData: trigger,
+        output: (res.data.result ?? Prisma.JsonNull) as any,
+        execution: {
+          create: {
+            tenancyId: tenancy.id,
+            id: res.data.executionId,
+            compiledWorkflowId: compiledWorkflow.id,
+          },
+        },
+      },
+    });
+  } else {
+    // Generate IDs for failed executions too, for tracking
+    await prisma.workflowTrigger.create({
+      data: {
+        tenancyId: tenancy.id,
+        id: generateUuid(),
+        triggerData: trigger,
+        error: res.error,
+        execution: {
+          create: {
+            tenancyId: tenancy.id,
+            id: generateUuid(),
+            compiledWorkflowId: compiledWorkflow.id,
+          },
+        },
+      },
+    });
+  }
   return Result.ok(undefined);
 }

apps/backend/src/lib/workflows.tsx (1)

287-287: Remove console.log statement.

Debug logging should use proper logging infrastructure instead of console.log.

-        console.log(`Compiled workflow ${workflowId}`);
+        // Use proper logging infrastructure if needed
+        // logger.info(`Compiled workflow ${workflowId}`);

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/backend/src/lib/freestyle.tsx (1)

2-5: Nice: replaced raw JSON.parse with parseJson and Result flow

Prevents accidental throws in error paths and aligns with Result usage.

apps/backend/prisma/schema.prisma (1)

804-821: Enforce output XOR error; cascade on execution delete; add recent-by-execution index.

• Add onDelete: Cascade on execution to avoid orphans.
• Add DB CHECK to ensure exactly one of output or error is set.
• Add index for recent triggers per execution.

Prisma schema and migration changes:

 model WorkflowTrigger {
@@
-  execution WorkflowExecution @relation(fields: [tenancyId, executionId], references: [tenancyId, id])
+  execution WorkflowExecution @relation(fields: [tenancyId, executionId], references: [tenancyId, id], onDelete: Cascade)
 
   @@id([tenancyId, executionId, id])
+  @@index([tenancyId, executionId, createdAt(sort: Desc)], name: "WorkflowTrigger_byExecution_recent")
 }

Migration SQL (add to the corresponding migration):

ALTER TABLE "WorkflowTrigger"
ADD CONSTRAINT "workflowtrigger_output_xor_error"
CHECK (
  (("output" IS NULL) <> ("error" IS NULL))
);

apps/backend/src/lib/workflows.tsx (3)

21-23: Type union missing "compile".

registeredTriggers can include "compile" (see tests). Expand the union to avoid unsafe casts.

Apply:

-type WorkflowRegisteredTriggerType = "sign-up";
+type WorkflowRegisteredTriggerType = "compile" | "sign-up";

---

340-384: Preserve trigger/execution IDs and return them to callers.

You generate triggerId/executionId but discard them. Return both for persistence and correlation.

Apply:

-async function triggerWorkflowRaw(tenancy: Tenancy, compiledWorkflowCode: string, trigger: WorkflowTrigger): Promise<Result<unknown, string>> {
+async function triggerWorkflowRaw(
+  tenancy: Tenancy,
+  compiledWorkflowCode: string,
+  trigger: WorkflowTrigger,
+): Promise<Result<{ result: unknown, triggerId: string, executionId: string }, string>> {
@@
-    return Result.map(freestyleRes, (data) => data.result);
+    return Result.map(freestyleRes, (data) => ({
+      result: data.result,
+      triggerId,
+      executionId,
+    }));

---

386-416: Incorrect Execution association (bug) and missing ID persistence.

You connectOrCreate WorkflowExecution using compiledWorkflow.id as the execution ID — that’s wrong and collapses all runs into one execution. Use the IDs from triggerWorkflowRaw; persist them.

Apply:

   if (compiledWorkflow.compiledCode === null) {
     return Result.error(`Workflow ${compiledWorkflow.id} failed to compile: ${compiledWorkflow.compileError}`);
   }
-  const res = await triggerWorkflowRaw(tenancy, compiledWorkflow.compiledCode, trigger);
-  if (res.status === "error") {
-    console.log(`Compiled workflow failed to process trigger: ${res.error}`, { trigger, compiledWorkflowId: compiledWorkflow.id, res });
-  }
-  const prisma = await getPrismaClientForTenancy(tenancy);
-  await prisma.workflowTrigger.create({
-    data: {
-      triggerData: trigger,
-      ...(res.status === "ok" ? { output: (res.data ?? Prisma.JsonNull) as any } : { error: res.error }),
-      execution: {
-        connectOrCreate: {
-          where: {
-            tenancyId_id: {
-              tenancyId: tenancy.id,
-              id: compiledWorkflow.id,
-            },
-          },
-          create: {
-            tenancyId: tenancy.id,
-            compiledWorkflowId: compiledWorkflow.id,
-          },
-        },
-      },
-    },
-  });
+  const res = await triggerWorkflowRaw(tenancy, compiledWorkflow.compiledCode, trigger);
+  const prisma = await getPrismaClientForTenancy(tenancy);
+  if (res.status === "ok") {
+    await prisma.workflowTrigger.create({
+      data: {
+        tenancyId: tenancy.id,
+        id: res.data.triggerId,
+        triggerData: trigger,
+        output: (res.data.result ?? Prisma.JsonNull) as any,
+        execution: {
+          create: {
+            tenancyId: tenancy.id,
+            id: res.data.executionId,
+            compiledWorkflowId: compiledWorkflow.id,
+          },
+        },
+      },
+    });
+  } else {
+    console.log(`Compiled workflow failed to process trigger: ${res.error}`, { trigger, compiledWorkflowId: compiledWorkflow.id, res });
+    await prisma.workflowTrigger.create({
+      data: {
+        tenancyId: tenancy.id,
+        id: generateUuid(),
+        triggerData: trigger,
+        error: res.error,
+        execution: {
+          create: {
+            tenancyId: tenancy.id,
+            id: generateUuid(),
+            compiledWorkflowId: compiledWorkflow.id,
+          },
+        },
+      },
+    });
+  }

packages/template/src/lib/stack-app/apps/interfaces/server-app.ts (1)

52-53: No breaking call-site changes needed; add JSDoc for thrown errors
All usages simply await sendEmail(...) and none inspect a result wrapper. Update the interface to document thrown error types:

-    sendEmail(options: SendEmailOptions): Promise<void>,
+    /**
+     * Sends email to one or more users.
+     * Throws on failure (e.g. RequiresCustomEmailServer, SchemaError, UserIdDoesNotExist).
+     */
+    sendEmail(options: SendEmailOptions): Promise<void>,

packages/template/src/lib/stack-app/apps/implementations/server-app-impl.ts (1)

1119-1121: sendEmail now awaits and returns void — align consumer expectations and add JSDoc here too

Matches the interface change; ensure no callers rely on a Result. Consider adding a short JSDoc here mirroring the interface to list notable thrown errors.

Run the same repository-wide checks suggested in the interface comment to update call sites.

-  async sendEmail(options: SendEmailOptions): Promise<void> {
+  /**
+   * Throws on delivery/config/schema/user errors propagated by the backend.
+   */
+  async sendEmail(options: SendEmailOptions): Promise<void> {
     await this._interface.sendEmail(options);
   }

docker/dependencies/docker.compose.yaml (1)

178-184: Fix stale port in comment and keep config self-explanatory

The comment still points to 8119 while the mapping exposes 8080 on 8122. Suggest correcting to avoid confusion.

-      - "8122:8080"       # POST http://localhost:8119/execute/v1/script
+      - "8122:8080"       # POST http://localhost:8122/execute/v1/script

apps/e2e/tests/js/email.test.ts (1)

32-37: Use resolves.toBeUndefined() (or just await) instead of resolves.not.toThrow()

toThrow() is a matcher for functions, not resolved values; the current assertions pass vacuously. Assert resolution explicitly or simply await the call.

-  await expect(serverApp.sendEmail({
+  await expect(serverApp.sendEmail({
     userIds: [user.id],
     html: "<h1>Test Email</h1><p>This is a test email with HTML content.</p>",
     subject: "Test Subject",
-  })).resolves.not.toThrow();
+  })).resolves.toBeUndefined();

-  await expect(serverApp.sendEmail({
+  await expect(serverApp.sendEmail({
     userIds: [user.id],
     templateId: DEFAULT_TEMPLATE_IDS.sign_in_invitation,
     variables: {
       teamDisplayName: "Test Team",
       signInInvitationLink: "https://example.com",
     },
     subject: "Welcome!",
-  })).resolves.not.toThrow();
+  })).resolves.toBeUndefined();

-  await expect(serverApp.sendEmail({
+  await expect(serverApp.sendEmail({
     userIds: [user1.id, user2.id],
     html: "<p>Bulk email test</p>",
     subject: "Bulk Email Test",
-  })).resolves.not.toThrow();
+  })).resolves.toBeUndefined();

-  await expect(serverApp.sendEmail({
+  await expect(serverApp.sendEmail({
     userIds: [user.id],
     html: "<p>Themed email test</p>",
     subject: "Themed Email",
     themeId: DEFAULT_EMAIL_THEME_ID,
-  })).resolves.not.toThrow();
+  })).resolves.toBeUndefined();

-  await expect(serverApp.sendEmail({
+  await expect(serverApp.sendEmail({
     userIds: [user.id],
     html: "<p>Notification email test</p>",
     subject: "Notification Email",
     notificationCategoryName: "Transactional",
-  })).resolves.not.toThrow();
+  })).resolves.toBeUndefined();

Alternatively:

// simpler and reads well
await serverApp.sendEmail({...});

Also applies to: 48-57, 73-78, 89-95, 106-112

apps/e2e/tests/backend/workflows.test.ts (4)

5-28: Consider isolating email server config to a shared helper to reduce repetition and coupling to these tests

configureEmailAndWorkflow mixes workflow registration with SMTP setup; moving SMTP config to a project bootstrap helper will shorten tests and avoid accidental changes to SMTP defaults when only workflows are intended.

---

30-38: Make mailbox wait configurable and surface debug info for flakes

Hard-coded 10×1s retries can be tight under CI load. Add options for attempts/interval and include last message count in the error.

Apply this diff:

-async function waitForMailboxSubject(mailbox: Mailbox, subject: string) {
-  for (let i = 0; i < 10; i++) {
-    const messages = await mailbox.fetchMessages();
-    const message = messages.find((m) => m.subject === subject);
-    if (message) return;
-    await wait(1_000);
-  }
-  throw new Error(`Message with subject ${subject} not found after 10 tries`);
+async function waitForMailboxSubject(
+  mailbox: Mailbox,
+  subject: string,
+  { attempts = 20, intervalMs = 1_000 }: { attempts?: number; intervalMs?: number } = {},
+) {
+  let lastCount = 0;
+  for (let i = 0; i < attempts; i++) {
+    const messages = await mailbox.fetchMessages();
+    lastCount = messages.length;
+    if (messages.some((m) => m.subject === subject)) return;
+    await wait(intervalMs);
+  }
+  throw new Error(`Message with subject "${subject}" not found after ${attempts} tries (last mailbox size=${lastCount})`);
 }

---

137-137: Replace fixed sleeps with polling to reduce flakiness and cut test time

Static waits (12s) slow the suite and are brittle. Prefer polling until a condition is (not) met with a max timeout.

You can add this helper near the top of the file:

async function waitUntil(check: () => Promise<boolean>, { timeoutMs = 15_000, intervalMs = 500 } = {}) {
  const start = Date.now();
  for (;;) {
    if (await check()) return;
    if (Date.now() - start >= timeoutMs) throw new Error("waitUntil: timeout");
    await wait(intervalMs);
  }
}

Example replacement for Line 231:

await waitUntil(async () => {
  const me = await niceBackendFetch("/api/v1/users/me", { accessType: "server" });
  return me.body.is_anonymous === false && me.body.server_metadata?.[markerKey] === me.body.primary_email;
});

Also applies to: 223-223, 231-231, 257-257, 275-275

---

161-170: Tiny safety nit: keep the “bad compile” source minimally valid TS

Using return return is effective but can confuse tooling/highlighters. A shorter invalid snippet like @ or class { avoids any accidental lexing differences across TS versions.

apps/backend/prisma/migrations/20250903003239_workflow_triggers/migration.sql (1)

1-15: Add index for expiry-based cleanup and consider FK to tenancy for integrity

• Create an index on (tenancyId, expiresAt) to speed up background deletions of expired tokens.
• If your convention allows, add a foreign key to the tenancy table with ON DELETE CASCADE to prevent orphans. If FKs are intentionally avoided in this schema, ignore.

Suggested additions:

-- Speeds up pruning jobs
CREATE INDEX "WorkflowTriggerToken_tenancyId_expiresAt_idx"
  ON "WorkflowTriggerToken"("tenancyId", "expiresAt");

-- If you use FKs for tenancy (adjust table/column names to your schema)
-- ALTER TABLE "WorkflowTriggerToken"
--   ADD CONSTRAINT "WorkflowTriggerToken_tenancy_fkey"
--   FOREIGN KEY ("tenancyId") REFERENCES "Tenancy"("id") ON DELETE CASCADE;

apps/backend/src/route-handlers/smart-request.tsx (2)

278-280: Minor: fold “rare path” into bundled queries later.

As noted by the TODO, moving this to rawQueryAll would remove one extra roundtrip. Not urgent.

---

171-175: Optional: add telemetry around workflow-token auth.

A span or attributes (e.g., has-workflow-token: true, tenancyId) would help observability for these requests.

apps/backend/prisma/schema.prisma (1)

823-837: Execution relation hygiene and lookup speed.

• Consider onDelete: Cascade from CompiledWorkflow to WorkflowExecution.
• Add index on compiledWorkflowId for quick fetches per compiled workflow (e.g., dashboards).

Apply:

 model WorkflowExecution {
@@
-  compiledWorkflow   CompiledWorkflow @relation(fields: [tenancyId, compiledWorkflowId], references: [tenancyId, id])
+  compiledWorkflow   CompiledWorkflow @relation(fields: [tenancyId, compiledWorkflowId], references: [tenancyId, id], onDelete: Cascade)
@@
   @@id([tenancyId, id])
+  @@index([tenancyId, compiledWorkflowId], name: "WorkflowExecution_byCompiledWorkflow")
 }

apps/backend/src/lib/workflows.tsx (2)

17-19: Pin external package versions for reproducible builds.

'latest' is volatile. Use a pinned version (from lockfile/config), or inject via config.

---

324-335: Observability for compile timeouts/cleanup.

Consider logging retryInfo and adding metrics (count of deleted stale rows) to ease debugging intermittent compile stalls.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.