Production Multi-Tenant Workflow Starter Kit

Orchestrate & embed durable DAG workflows in your SaaS.

Ship a complete visual automation platform with @xyflow/react, an isolated BullMQ + PostgreSQL execution worker, AES-256-GCM AAD credential encryption, and a drop-in React embed SDK.

⚡ Live Canvas ControllerRun #1284

1. Select Trigger Source

2. Slide Deal Amount (reroutes IF/ELSE branch live)$640/mo → TRUE (AI + Slack)

Open Visual Builder Quick Start Docs

enterprise-upgrade-pipeline.dagv4 pinned

BullMQ Worker Active

Selected Node Telemetryai.text_generate

AI Account Brief (184ms)

expr: Summarize upgrade for {{ trigger.payload.customer.email }}

{
  "provider": "openai",
  "model": "gpt-4o-mini",
  "priority": "P0_ENTERPRISE",
  "brief": "Account upgraded ($640/mo). Provision dedicated onboarding.",
  "tokensUsed": 162
}

11 Nodes

Triggers, IF/ELSE, Transform, Delay, HTTP, Resend, Slack & AI

AES-256 GCM

Key-versioned envelope vault bound to tenant + resource AAD

SSRF Guarded

Blocks RFC1918, loopback, link-local & DNS rebinding attacks

5-Role RBAC

Owner, Admin, Developer, Editor & Viewer + scoped API keys

End-to-End Execution Architecture

Engineered like a real distributed control plane—not a mockup.

Every stage of a workflow lifecycle is backed by strict Zod schemas, PostgreSQL transactional state transitions, and isolated BullMQ worker processes.

STAGE 01Author & Compile

Topological DAG Planner & Version Pinning

Validates node graphs with Kahn's cycle-detection algorithm, compiles execution waves, and snapshots an immutable SHA-256 checksummed version so in-flight runs never break when drafts change.

compileWorkflowPlan(definition) → { waves, topologicalOrder }

STAGE 02Queue & Isolate

Durable BullMQ Worker & Non-Blocking Delays

Dispatches runs to an independent worker service. Delay nodes persist WAITING state and schedule delayed BullMQ jobs—freeing worker threads immediately and recovering interrupted runs on restart.

status: PENDING → QUEUED → RUNNING → WAITING → COMPLETED

STAGE 03Decrypt & Dispatch

Just-in-Time AAD Decryption & Expression Engine

Resolves {{ trigger.payload.* }} and {{ nodes.<id>.output.* }} tokens safely without eval(), decrypts bound vault credentials in worker memory, and redacts secrets from all execution logs.

decryptCredentialWithAAD(envelope, { workspaceId, credentialId })

Interactive SSRF & DNS-Rebinding Firewall

packages/workflow-integrations/src/http.ts

Test outbound HTTP requests against the built-in SSRF guard

Because tenants configure custom webhook & HTTP URLs, every outbound request resolves DNS and blocks private, loopback, and cloud metadata IPs before opening a socket.

GET http://169.254.169.254/latest/meta-data/iamBLOCKED

Blocked link-local / cloud metadata range (169.254.0.0/16)IP: 169.254.169.254

Safe Expression ResolverNo eval / Function

Bind upstream node outputs declaratively

Click any token expression below to inspect how the runtime resolves upstream execution context while blocking __proto__ and constructor traversal:

Evaluated Output

"P0_ENTERPRISE"

@shiptemplates/workflow-embed

Drop a white-label workflow studio straight into your SaaS.

Mint short-lived, workspace-scoped emb_v1.* tokens on your backend and render <WorkflowBuilder /> in edit or read-only view mode for your customers.

Explore Interactive Quick Start & Embed Docs

CustomerPortalWorkflowTab.tsxScoped Token · workflow.write

import { WorkflowBuilder } from "@shiptemplates/workflow-embed";

export function CustomerAutomationTab({ embedToken }: { embedToken: string }) {
  return (
    <WorkflowBuilder
      apiBaseUrl="https://workflows.your-saas.com"
      embedToken={embedToken} // emb_v1.<payload>.<hmac_sha256>
      workflowId="wf_stripe_vip_routing"
      mode="edit"
      permissions={["workflow.read", "workflow.write", "workflow.execute"]}
      theme="dark"
    />
  );
}

Modular Node Registry

11 production-hardened nodes included

Every node ships with strict input/output/config Zod schemas, timeout enforcement, and retry policies.

trigger.webhookTriggers

HMAC Webhook Trigger

Constant-time HMAC-SHA256 verification with 300s timestamp replay guard.

Rate-limited · 256KB maxInspect Schema →

trigger.scheduleTriggers

IANA Cron Schedule

Timezone-aware cron expressions with duplicate-dispatch protection.

IANA TZ · IdempotentInspect Schema →

trigger.manualTriggers

Manual / SDK Trigger

One-click studio run or programmatic execution via stk_live_* API keys.

RBAC enforcedInspect Schema →

logic.if_elseLogic

IF / ELSE Branching

Declarative multi-operator condition evaluation routing true/false handles.

Zero eval() · DeterministicInspect Schema →

logic.transformLogic

Declarative Transform

Shapes and maps upstream JSON payloads using safe path expressions.

Prototype-pollution safeInspect Schema →

logic.delayLogic

Non-Blocking Delay

Persists WAITING state and schedules a BullMQ delayed job without blocking threads.

Durable · Crash-safeInspect Schema →

ai.text_generateAI

Multi-Provider AI Node

Unified OpenAI, Anthropic, and Gemini adapter with structured JSON mode & token metering.

30s timeout · 2 retriesInspect Schema →

action.httpActions

SSRF-Guarded HTTP

Full REST client with DNS-rebinding & private IP blocking plus vault auth injection.

15s timeout · 3 retriesInspect Schema →

action.email_resendActions

Resend Transactional Email

Sends HTML/text emails via Resend with execution-scoped idempotency keys.

Idempotent · 3 retriesInspect Schema →

action.slackActions

Slack Channel Dispatch

Posts formatted alerts and threaded updates to Slack channels via bot tokens.

10s timeout · 3 retriesInspect Schema →

utility.logUtilities

Structured Audit Logger

Writes structured telemetry to execution_logs with automatic secret redaction.

Redacts tokens & keysInspect Schema →

Ready to wire your first multi-tenant workflow?

Open your workspace dashboard, launch a pre-wired blueprint on the visual DAG canvas, and execute it against the live PostgreSQL & BullMQ runtime.

Open Visual Workflow Studio Read Quick Start & SDK Docs