@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/src/security-scanner.ts

@@ -16,6 +16,11 @@
  * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
  *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
  *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ *   - the runtime shadow in nodes/general/general-custom-js.ts
+ * (`__tests__/security-lists-parity.test.ts` fails when they drift). Every
+ * secret TeleportHQ keeps for the site (`SYSTEM_MANAGED_SECRET_NAMES`, GUI and
+ * worker) is one of them: the app secret signs every session and is what the
+ * site's own server code presents to its routes.
  */
 
 export const PROTECTED_ENV_NAMES = [
@@ -29,6 +34,15 @@ export const PROTECTED_ENV_NAMES = [
   'PDF_SERVICE_API_KEY',
   'TELEPORT_CRON_SECRET',
   'TELEPORT_CRON_SECRET_PREVIOUS',
+  'NEXTAUTH_SECRET',
+  'AUTH_PEPPER_SECRET',
+  'VERCEL_AUTOMATION_BYPASS_SECRET',
+  'TQ_CACHE_SECRET',
+  // The site's newsletter service key and the services worker's address: only
+  // the admin panel's newsletter route reads them.
+  'NEWSLETTER_SERVICE_TOKEN',
+  'NEWSLETTER_SERVICE_URL',
+  // The password wall's secret. Only the wall reads it.
   'TELEPORT_WALL_SECRET',
 ] as const
 
@@ -43,6 +57,112 @@ export const PROTECTED_ENV_NAMES = [
 export const PROTECTED_ENV_NAME_PATTERN =
   /^(?:CONFIGURATION_)?(?:STRIPE|PAYPAL|MOLLIE|RAZORPAY|SQUARE|PADDLE|COINGATE)_[A-Z0-9_]+$/
 
+/**
+ * Every `TELEPORT_DB_` name: the TeleportHQ database the platform provisions —
+ * `TELEPORT_DB_CONNECTION_STRING`, the HOST / PORT / USER / PASSWORD / NAME /
+ * SSL parts a self-hosted site may set instead, and whatever part a later one
+ * names. Platform secrets like the list above (the GUI refuses them in a node
+ * config too). Mirror of the GUI's `PLATFORM_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export const PLATFORM_ENV_NAME_PATTERN = /^TELEPORT_DB_[A-Z0-9_]+$/
+
+/**
+ * Every `__` name: what TeleportHQ's integrations keep for the editor
+ * (`__gsc_*`, `__google_merchant_*`, `__social_oauth_<platform>_*`, another
+ * member's sign-in). A build published before 2026-10-26 carries them in its
+ * environment. Mirror of the GUI's `INTEGRATION_ENV_NAME_PATTERN`; the runtime
+ * guard in `general-custom-js.ts` denies the same names.
+ */
+export const INTEGRATION_ENV_NAME_PATTERN = /^__[A-Za-z0-9_]+$/
+
+/**
+ * Such a name read from `env` (`env.__x`, `env['__x']`). Only in that
+ * position: `__proto__` or `__dirname` elsewhere in the code is not one.
+ */
+const INTEGRATION_ENV_READ = /\benv\s*(?:\.\s*|\[\s*["'`])(__[A-Za-z0-9_]+)/g
+
+/**
+ * Sandbox escapes the runtime's `process` shadow cannot stop: the Function
+ * constructor reached through any function's `constructor` runs in the real
+ * global scope (`(function(){}).constructor('return process')()`,
+ * `Function.prototype.constructor(...)`, an async or generator function's),
+ * `process.env` read through a property descriptor or `Reflect`, and a scan of
+ * the global object for something that looks like `process`. Matched against
+ * the code with comments stripped and escapes decoded.
+ *
+ * SAME ENTRIES, kept in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/sandbox-escape-patterns.ts
+ *   - teleport-services-worker/src/modules/vercel/security/sandbox-escape-patterns.ts
+ */
+export const SANDBOX_ESCAPE_PATTERNS: ReadonlyArray<{
+  ruleId: 'sandbox-escape-constructor' | 'indirect-process-access' | 'global-enumeration'
+  message: string
+  pattern: RegExp
+}> = [
+  {
+    ruleId: 'sandbox-escape-constructor',
+    message:
+      'reaches a function constructor through .constructor (compare it or read .name instead)',
+    pattern: /\.\s*constructor\b(?!\s*(?:[!=]==?|\.\s*name\b))/,
+  },
+  {
+    ruleId: 'sandbox-escape-constructor',
+    message: 'names "constructor" as a key',
+    pattern: /["'`]constructor["'`]/,
+  },
+  {
+    ruleId: 'sandbox-escape-constructor',
+    message: 'destructures constructor',
+    pattern: /[{,]\s*constructor\s*[:,}=]/,
+  },
+  {
+    ruleId: 'indirect-process-access',
+    message: 'reads process through a property descriptor or Reflect',
+    pattern:
+      /\b(?:Object\s*\.\s*getOwnPropertyDescriptors?|Reflect\s*\.\s*(?:get|getOwnPropertyDescriptor|ownKeys|has))\s*\(\s*(?:(?:globalThis|global)\s*\.\s*)?process\b/,
+  },
+  {
+    ruleId: 'indirect-process-access',
+    message: 'returns this from a plain function (the global object outside strict mode)',
+    pattern: /\bfunction\b[^{}]*\{\s*return\s+this\s*;?\s*\}/,
+  },
+  {
+    ruleId: 'global-enumeration',
+    message: 'enumerates the global object',
+    pattern:
+      /\b(?:Object\s*\.\s*(?:keys|values|entries|getOwnPropertyNames|getOwnPropertyDescriptors)|Reflect\s*\.\s*ownKeys)\s*\(\s*(?:globalThis|global)\s*\)/,
+  },
+  {
+    ruleId: 'global-enumeration',
+    message: 'iterates the global object',
+    pattern: /\bfor\s*\(\s*(?:var|let|const)?\s*\w+\s+(?:in|of)\s+(?:globalThis|global)\b/,
+  },
+]
+
+/**
+ * Joins adjacent string literals (`'const' + 'ructor'` → `'constructor'`), so a
+ * name split to slip past the patterns is matched whole. The patterns are
+ * matched against the folded code. Same function in the two other copies.
+ */
+export const foldStringConcatenations = (code: string): string => {
+  const pair = /(["'])((?:(?!\1)[^\\\n])*)\1\s*\+\s*(["'])((?:(?!\3)[^\\\n])*)\3/g
+  let previous = ''
+  let folded = code
+  while (folded !== previous) {
+    previous = folded
+    folded = folded.replace(
+      pair,
+      (whole: string, _open: string, left: string, _next: string, right: string) => {
+        const joined = left + right
+        const quote = joined.indexOf("'") === -1 ? "'" : joined.indexOf('"') === -1 ? '"' : ''
+        return quote ? quote + joined + quote : whole
+      }
+    )
+  }
+  return folded
+}
+
 export interface CodegenSecurityViolation {
   workflowId: string
   workflowName?: string
@@ -78,20 +198,28 @@ interface WorkflowLike {
 
 interface WorkflowsContainer {
   workflows?: Record<string, WorkflowLike>
+  customNodes?: Record<string, WorkflowLike>
 }
 
 /**
- * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
- * any `general-custom-js` body trips the scanner.
+ * Walks the UIDL workflow definitions and custom nodes and throws
+ * `CodegenSecurityError` if any `general-custom-js` body trips the scanner.
+ * A custom node's code runs on the server too (its own segment routes, and
+ * in process inside the cron, webhook and automation routes that call it):
+ * its violation names the custom node (`workflowId` is the custom node's id).
  *
  * Per `general-custom-js` the only place a user can write JS is the `code`
  * config field, so we look only there. Other node types use structured
  * configs we don't touch.
  */
 export function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer | undefined): void {
-  if (!workflowsContainer?.workflows) return
+  if (!workflowsContainer) return
   const violations: CodegenSecurityViolation[] = []
-  for (const [wfId, wf] of Object.entries(workflowsContainer.workflows)) {
+  const owners = [
+    ...Object.entries(workflowsContainer.workflows || {}),
+    ...Object.entries(workflowsContainer.customNodes || {}),
+  ]
+  for (const [wfId, wf] of owners) {
     if (!wf || !Array.isArray(wf.nodes)) continue
     for (const node of wf.nodes) {
       const nodeAsUnknown = node as unknown as {
@@ -100,9 +228,13 @@ export function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer
         id?: string
       }
       if (nodeAsUnknown?.type !== 'general-custom-js') continue
-      const code = nodeAsUnknown.config?.code
-      if (typeof code !== 'string' || !code.trim()) continue
-      const findings = scanForObviousViolations(code)
+      const code = nodeAsUnknown.config?.code as unknown
+      if (code === undefined || code === null || code === '') continue
+      // Code the runtime would resolve before compiling it (a token, a context
+      // value, a secret, an inserted value) is whatever it resolves to.
+      const findings = isAuthoredText(code)
+        ? scanForObviousViolations(code)
+        : [{ rule: 'unreadable-step-code', message: REFERENCE_CODE_MESSAGE }]
       for (const finding of findings) {
         violations.push({
           workflowId: wfId,
@@ -122,13 +254,92 @@ interface ScannerFinding {
   message: string
 }
 
+/**
+ * `process.env` read as a value — the whole environment — or with a key the
+ * code does not spell out: the editor's `process-without-property` and
+ * `dynamic-env-access` (teleport-gui `workflow-schema/src/security/scan-custom-js.ts`,
+ * and the worker's copy), read from the text. A `process.env` only tested for
+ * its truth (`!process.env`, `process.env ? … : …`, `process.env && …`), or
+ * named into a variable whose properties are read, is not one; a key written
+ * as a string, or as a variable the code sets to one, is spelled out.
+ */
+const ENV_READ = /\bprocess\s*(?:\?\.|\.)\s*env\b/g
+
+function envReadFindings(code: string): ScannerFinding[] {
+  let bare = false
+  let dynamic = false
+  ENV_READ.lastIndex = 0
+  for (let match = ENV_READ.exec(code); match !== null; match = ENV_READ.exec(code)) {
+    const before = code.slice(0, match.index)
+    const after = code.slice(match.index + match[0].length)
+    const key = /^\s*(?:\?\.\s*)?\[\s*([^\]]*?)\s*\]/.exec(after)
+    if (key) {
+      const spelled =
+        /^(["'`])[^"'`\\]*\1$/.test(key[1]) ||
+        (/^[A-Za-z_$][\w$]*$/.test(key[1]) &&
+          new RegExp(
+            `\\b(?:const|let|var)\\s+${key[1].replace(/\$/g, '\\$')}\\s*=\\s*(["'\`])[^"'\`]*\\1`
+          ).test(code))
+      if (!spelled) {
+        dynamic = true
+      }
+      continue
+    }
+    if (/^\s*(?:\?\.|\.|\[)/.test(after)) {
+      continue
+    }
+    if (/^\s*(?:\?(?![.?])|&&|\|\||[!=]==?)/.test(after)) {
+      continue
+    }
+    if (
+      /(?:!|\btypeof|\bif\s*\(|\bwhile\s*\(|\bBoolean\s*\(|&&|\|\||\b(?:const|let|var)\s+[\w$]+\s*=)\s*$/.test(
+        before
+      )
+    ) {
+      continue
+    }
+    bare = true
+  }
+  const out: ScannerFinding[] = []
+  if (bare) {
+    out.push({
+      rule: 'process-without-property',
+      message: 'uses process.env as a value, which exposes every variable',
+    })
+  }
+  if (dynamic) {
+    out.push({
+      rule: 'dynamic-env-access',
+      message: 'reads process.env with a key it does not spell out',
+    })
+  }
+  return out
+}
+
+const REFERENCE_CODE_MESSAGE =
+  'uses a reference as its code (a {{…}} token, a context value, a secret or an inserted value): the server would compile whatever it resolves to'
+
+/**
+ * Text the author wrote, which the runtime compiles as it is
+ * (`isAuthoredText` / `resolveNodeConfig` in executor-generator.ts): a string with no inserted
+ * value, not a whole `{{…}}` token, not a secret reference. Mirrors
+ * teleport-gui `workflow-schema/src/security/compiled-code.ts` and the worker's
+ * `security-precheck.ts` (`isAuthoredText`).
+ */
+export const isAuthoredText = (value: unknown): value is string =>
+  typeof value === 'string' &&
+  value.indexOf('context-value-inline') === -1 &&
+  !/^\s*\{\{[\s\S]*\}\}\s*$/.test(value) &&
+  value.indexOf('WORKFLOW_SECRET_') !== 0 &&
+  value.indexOf('teleporthq.secrets.') !== 0
+
 /**
  * Regex-based scan. Sufficient at the codegen layer because:
  *   - the GUI's AST scanner has already vetted the code.
  *   - the services-worker re-runs the full AST scan on the publish payload.
  *   - the runtime `process` Proxy preamble denies even successful escapes.
  */
-function scanForObviousViolations(rawCode: string): ScannerFinding[] {
+export function scanForObviousViolations(rawCode: string): ScannerFinding[] {
   const out: ScannerFinding[] = []
   const code = stripCommentsAndDecodeEscapes(rawCode)
 
@@ -140,15 +351,40 @@ function scanForObviousViolations(rawCode: string): ScannerFinding[] {
       })
     }
   }
-  const credentialNames = (code.match(/\b[A-Z][A-Z0-9_]+\b/g) || []).filter((word) =>
-    PROTECTED_ENV_NAME_PATTERN.test(word)
+  const words = code.match(/\b[A-Z][A-Z0-9_]+\b/g) || []
+  const platformNames = words.filter(
+    (word) =>
+      PLATFORM_ENV_NAME_PATTERN.test(word) &&
+      (PROTECTED_ENV_NAMES as ReadonlyArray<string>).indexOf(word) === -1
   )
+  for (const name of Array.from(new Set(platformNames))) {
+    out.push({
+      rule: 'protected-env-access',
+      message: `references protected platform secret "${name}"`,
+    })
+  }
+  const credentialNames = words.filter((word) => PROTECTED_ENV_NAME_PATTERN.test(word))
   for (const name of Array.from(new Set(credentialNames))) {
     out.push({
       rule: 'protected-env-access',
       message: `references payment credential "${name}"`,
     })
   }
+  const integrationNames: string[] = []
+  INTEGRATION_ENV_READ.lastIndex = 0
+  for (
+    let read = INTEGRATION_ENV_READ.exec(code);
+    read !== null;
+    read = INTEGRATION_ENV_READ.exec(code)
+  ) {
+    integrationNames.push(read[1])
+  }
+  for (const name of Array.from(new Set(integrationNames))) {
+    out.push({
+      rule: 'protected-env-access',
+      message: `reads integration secret "${name}"`,
+    })
+  }
   if (/\beval\s*\(/.test(code)) {
     out.push({ rule: 'sandbox-escape-eval', message: 'calls eval(...)' })
   }
@@ -187,6 +423,13 @@ function scanForObviousViolations(rawCode: string): ScannerFinding[] {
       message: 'reaches process via globalThis / global',
     })
   }
+  const folded = foldStringConcatenations(code)
+  for (const escape of SANDBOX_ESCAPE_PATTERNS) {
+    if (escape.pattern.test(folded)) {
+      out.push({ rule: escape.ruleId, message: escape.message })
+    }
+  }
+  out.push(...envReadFindings(code))
   // Mass enumeration of process.env
   if (
     /\bObject\.(?:keys|values|entries|assign|fromEntries|getOwnProperty(?:Names|Symbols|Descriptors))\s*\(\s*(?:[^)]*,\s*)?process\.env\b/.test(

package/src/segment-splitter.ts

@@ -25,8 +25,11 @@ const resolveExecutionEnv = (
   // function (which has its own client/server segments). The server handler is
   // a stub — if this node is placed in a server segment the nested workflow
   // never runs and downstream references to its output resolve to the marker.
+  // The exception is a call of a node only server code may run (`serverOnly`,
+  // which the editor marks `executionEnv: 'server'`): it stays in its caller's
+  // server segment, whose route runs it (server-custom-node-call.ts).
   if (node.type === 'general-custom-node') {
-    return 'client'
+    return node.executionEnv === 'server' ? 'server' : 'client'
   }
 
   const registered = nodeRegistry[node.type]
@@ -412,9 +415,14 @@ const ROUTE_ONLY_ACCOUNT_CONFIG_KEYS = new Set<string>([
   ...WELCOME_EMAIL_CONFIG_KEYS,
   'domain',
   'deletedEmailPattern',
+  'resetPagePath',
 ])
 
-const ROUTE_BACKED_ACCOUNT_NODE_TYPES = new Set(['account-signup', 'account-delete-current'])
+const ROUTE_BACKED_ACCOUNT_NODE_TYPES = new Set([
+  'account-signup',
+  'account-delete-current',
+  'account-request-password-reset',
+])
 
 const redactRouteOnlyAccountConfig = (config: Record<string, unknown>): Record<string, unknown> => {
   const safe: Record<string, unknown> = {}

package/src/segment-trust.ts

@@ -1,6 +1,8 @@
 import { UIDLWorkflowEdge, UIDLWorkflowNode } from '@teleporthq/teleport-types'
 import { isFireAndForgetSegment } from './await-result'
 import { WorkflowSegment } from './types'
+import { collectMessageTrust, MessageTrust } from './nodes/email/message-trust'
+import { isOutboundMessageNodeType } from './nodes/general/visitor-request'
 
 /**
  * What a server segment route may believe about the context a request hands
@@ -22,8 +24,26 @@ import { WorkflowSegment } from './types'
  * - `previousFrom`: when the segment right before this one runs on the
  *   server, the node whose result the caller must hand on as
  *   `__previousNodeResult` (the runtime sets it from that node's signed result).
+ *
+ * What a signature binds (see the server runtime): the workflow (`workflowId`),
+ * the segment that produced the result (`signedBy`, and `segmentId` for this
+ * route's own), the run it belongs to and when it was made. A run is opened by
+ * the first server segment of the graph (`opensRun`), which never adopts one a
+ * request names; every later segment continues the run its request carries.
+ *
+ * `session` says which of the visitor's identity this route reads, so it is
+ * taken from the session cookie on the server and never from the request:
+ * - `identityNodes`: the graph's current-user readers (`account-get-current`,
+ *   `account-refresh-session`). They run in the browser; the route rebuilds
+ *   their result from the session.
+ * - `identityReads`: the `data-select` / `data-count` nodes of this segment
+ *   filtered by the visitor's identity, with those columns. Without an
+ *   identity (a guest) such a read matches nothing, never the whole table.
+ * Absent when the segment reads no identity.
  */
 export interface SegmentGraph {
+  /** The workflow (or custom node) the graph belongs to. */
+  id?: string
   nodes: UIDLWorkflowNode[]
   edges: UIDLWorkflowEdge[]
   /** Every segment of the graph, in the order the runtime executes them. */
@@ -36,11 +56,164 @@ export interface SegmentBranchGate {
   branches: Array<{ when: string; nodeIds: string[] }>
 }
 
+export interface SegmentSessionNeeds {
+  identityNodes: Record<string, string>
+  identityReads: Record<string, string[]>
+}
+
 export interface SegmentTrust {
   signedNodeIds: string[]
+  signedBy: Record<string, string>
   branchGates: SegmentBranchGate[]
   loopBodies: Record<string, string[]>
   previousFrom: { nodeId: string; fireAndForget: boolean } | null
+  workflowId: string
+  segmentId: string
+  opensRun: boolean
+  session?: SegmentSessionNeeds
+  /**
+   * Only for a segment with an email/SMS node: the graph's node results the
+   * send guard may trust (owner recipients, trusted HTML; see
+   * nodes/email/message-trust).
+   */
+  messageTrust?: MessageTrust
+}
+
+/** The nodes whose result is the signed-in visitor (see `session` above). */
+export const IDENTITY_NODE_TYPES: ReadonlySet<string> = new Set([
+  'account-get-current',
+  'account-refresh-session',
+  'account-login',
+])
+
+const IDENTITY_READ_NODE_TYPES: ReadonlySet<string> = new Set(['data-select', 'data-count'])
+
+/** A `{{Current User.<field>}}` / `{{currentUser.<field>}}` / `{{state.currentUser…}}` token. */
+const CURRENT_USER_TOKEN = /\{\{\s*(?:Current User|currentUser|state\.currentUser)\b/
+
+/** Any mention of the visitor's identity or of the page state that carries it. */
+const READS_IDENTITY = /Current User|currentUser|__stateValues/
+
+const asContextRef = (value: unknown): { nodeId: string; path: unknown[] } | null => {
+  const ref = value as { type?: unknown; nodeId?: unknown; path?: unknown } | null
+  return ref && typeof ref === 'object' && ref.type === 'workflowContext'
+    ? {
+        nodeId: typeof ref.nodeId === 'string' ? ref.nodeId : '',
+        path: Array.isArray(ref.path) ? ref.path : [],
+      }
+    : null
+}
+
+/** Whether a filter value names the visitor: a current-user token or a reader's result. */
+/** The node ids the inline context chips of a rich-text value point at. */
+const chipNodeIds = (value: string): string[] => {
+  const ids: string[] = []
+  const chip = /data-ctx-node-id=(["'])([^"']*)\1/g
+  let match = chip.exec(value)
+  while (match) {
+    ids.push(match[2])
+    match = chip.exec(value)
+  }
+  return ids
+}
+
+const isIdentityValue = (value: unknown, identityNodes: Record<string, string>): boolean => {
+  if (typeof value === 'string') {
+    return (
+      CURRENT_USER_TOKEN.test(value) ||
+      chipNodeIds(value).some((id) => Object.prototype.hasOwnProperty.call(identityNodes, id))
+    )
+  }
+  if (Array.isArray(value)) {
+    return value.some((part) => isIdentityValue(part, identityNodes))
+  }
+  const ref = asContextRef(value)
+  if (!ref) {
+    return false
+  }
+  if (Object.prototype.hasOwnProperty.call(identityNodes, ref.nodeId)) {
+    return true
+  }
+  // A read of the page state's `currentUser`, wherever the bag is reached from.
+  const walk = [ref.nodeId, ...ref.path]
+  for (let i = 0; i < walk.length - 1; i++) {
+    if (walk[i] === '__stateValues' && walk[i + 1] === 'currentUser') {
+      return true
+    }
+  }
+  return false
+}
+
+const identityColumnsOf = (
+  node: UIDLWorkflowNode,
+  identityNodes: Record<string, string>
+): string[] => {
+  const filters = (node.config as { filters?: unknown } | undefined)?.filters
+  if (!Array.isArray(filters)) {
+    return []
+  }
+  const columns: string[] = []
+  for (const filter of filters) {
+    const f = (filter || {}) as Record<string, unknown>
+    // Read as data-select reads a filter: `destination` before `value`.
+    const column = f.column || f.source || f.field
+    const value = f.destination !== undefined ? f.destination : f.value
+    if (typeof column === 'string' && column && isIdentityValue(value, identityNodes)) {
+      if (columns.indexOf(column) === -1) {
+        columns.push(column)
+      }
+    }
+  }
+  return columns
+}
+
+const buildSessionNeeds = (
+  segment: WorkflowSegment,
+  graph: SegmentGraph
+): SegmentSessionNeeds | undefined => {
+  const identityNodes: Record<string, string> = {}
+  for (const node of graph.nodes) {
+    if (IDENTITY_NODE_TYPES.has(node.type)) {
+      identityNodes[node.id] = node.type
+    }
+  }
+  const identityReads: Record<string, string[]> = {}
+  let readsIdentity = Object.keys(identityNodes).length > 0
+  for (const node of segment.nodes) {
+    if (IDENTITY_READ_NODE_TYPES.has(node.type)) {
+      const columns = identityColumnsOf(node, identityNodes)
+      if (columns.length > 0) {
+        identityReads[node.id] = columns
+      }
+    }
+    if (!readsIdentity && READS_IDENTITY.test(JSON.stringify(node.config || {}))) {
+      readsIdentity = true
+    }
+  }
+  return readsIdentity || Object.keys(identityReads).length > 0
+    ? { identityNodes, identityReads }
+    : undefined
+}
+
+/**
+ * The graph's id when the caller names it; otherwise one derived from its
+ * node ids, so two different graphs never share signatures.
+ */
+const graphIdOf = (graph: SegmentGraph): string => {
+  if (typeof graph.id === 'string' && graph.id) {
+    return graph.id
+  }
+  const text = graph.nodes
+    .map((n) => n.id)
+    .sort()
+    .join('|')
+  let hash = 5381
+  for (let i = 0; i < text.length; i++) {
+    // tslint:disable-next-line:no-bitwise
+    hash = ((hash << 5) + hash + text.charCodeAt(i)) | 0
+  }
+  // tslint:disable-next-line:no-bitwise
+  return `graph-${(hash >>> 0).toString(16)}-${graph.nodes.length}`
 }
 
 /** A switch branch is taken by a case id; this prefix keeps it apart from 'default'. */
@@ -112,13 +285,21 @@ const lastNodeByStep = (segment: WorkflowSegment): UIDLWorkflowNode | undefined
 export const buildSegmentTrust = (segment: WorkflowSegment, graph: SegmentGraph): SegmentTrust => {
   const inSegment = new Set(segment.nodes.map((n) => n.id))
   const serverNodeIds = new Set<string>()
+  const producedBy: Record<string, string> = {}
   for (const seg of graph.segments) {
     if (seg.env === 'server') {
-      seg.nodes.forEach((n) => serverNodeIds.add(n.id))
+      seg.nodes.forEach((n) => {
+        serverNodeIds.add(n.id)
+        producedBy[n.id] = seg.id
+      })
     }
   }
 
   const signedNodeIds = Array.from(serverNodeIds).filter((id) => !inSegment.has(id))
+  const signedBy: Record<string, string> = {}
+  for (const id of signedNodeIds) {
+    signedBy[id] = producedBy[id]
+  }
 
   const branchGates: SegmentBranchGate[] = []
   for (const node of graph.nodes) {
@@ -166,5 +347,27 @@ export const buildSegmentTrust = (segment: WorkflowSegment, graph: SegmentGraph)
         }
       : null
 
-  return { signedNodeIds, branchGates, loopBodies, previousFrom }
+  const firstServer = graph.segments.find((s) => s.env === 'server')
+  const session = buildSessionNeeds(segment, graph)
+
+  return {
+    signedNodeIds,
+    signedBy,
+    branchGates,
+    loopBodies,
+    previousFrom,
+    workflowId: graphIdOf(graph),
+    segmentId: segment.id,
+    opensRun: !firstServer || firstServer.id === segment.id,
+    ...(session ? { session } : {}),
+    ...(segment.nodes.some((n) => isOutboundMessageNodeType(n.type))
+      ? {
+          messageTrust: collectMessageTrust({
+            nodes: graph.nodes,
+            edges: graph.edges,
+            serverNodeIds,
+          }),
+        }
+      : {}),
+  }
 }

package/src/self-call-headers.ts

@@ -0,0 +1,46 @@
+/**
+ * How a generated site's server code calls its own API routes outside the
+ * workflow runtime (whose nodes get the same from `internalRequestHeaders`,
+ * executor-generator): the data API's low-stock alert, the legacy payment
+ * webhooks' invoice and order-notification calls, the invoice PDF upload, the
+ * automations' dispatch kick.
+ *
+ * Every such call presents the app secret (only server code can read
+ * NEXTAUTH_SECRET) and, on a deployment behind Vercel's password wall (a
+ * workspace not paying for hosting, or an owner's own password), the
+ * deployment's protection bypass — `VERCEL_AUTOMATION_BYPASS_SECRET`, which
+ * the services worker sets on such a deployment. Without it the site's own
+ * call meets the wall and answers 401, and nothing it should do happens.
+ *
+ * One emitted function, `__selfCallHeaders(headers)`: the headers given
+ * (`Content-Type`, for one), plus those. Inlined into each route that calls
+ * itself, so no route needs another module to exist.
+ */
+export const SELF_CALL_HEADERS_FUNCTION = '__selfCallHeaders'
+
+/**
+ * Emitted statements that add the deployment's protection bypass to the
+ * headers object named `target`, where the deployment has one — the one place
+ * the bypass header is built. `__selfCallHeaders` below, the workflow
+ * runtime's `internalRequestHeaders` (executor-generator.ts: the visitor's
+ * cookies and the bypass, never the app secret) and the push send route's
+ * relay (web-push/routes-source.ts in the Next project generator) all emit it.
+ * `indent` is the indentation of the `if`.
+ */
+export const generateProtectionBypassHeaderStatements = (target: string, indent = '  '): string =>
+  `${indent}if (process.env.VERCEL_AUTOMATION_BYPASS_SECRET) {
+${indent}  ${target}['x-vercel-protection-bypass'] = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+${indent}  // Vercel would otherwise hand the bypass back as a cookie.
+${indent}  ${target}['x-vercel-set-bypass-cookie'] = 'false';
+${indent}}`
+
+export const generateSelfCallHeadersCode =
+  (): string => `// The headers this deployment's server code calls its own routes with: the app
+// secret, and the password wall's bypass where the deployment has one (see
+// self-call-headers.ts in the code generators).
+function ${SELF_CALL_HEADERS_FUNCTION}(headers) {
+  var out = Object.assign({}, headers || {});
+  out['x-internal-data-secret'] = process.env.NEXTAUTH_SECRET || '';
+${generateProtectionBypassHeaderStatements('out')}
+  return out;
+}`

package/src/sent-email-log/index.ts

@@ -55,3 +55,19 @@ export const ensureSentEmailLogModule = (structure: ProjectPluginStructure): voi
     }
   }
 }
+
+/**
+ * In a project with automations, files a send made by an automation handler
+ * under the automation and the event's order (see the `attribution` option of
+ * `generateSentEmailLogCode`). Rewrites the module when something already
+ * required it; a project whose automations send no mail has none to rewrite.
+ */
+export const enableSentEmailAttribution = (structure: ProjectPluginStructure): void => {
+  const entry = structure.files.get(SENT_EMAIL_LOG_FILE_KEY)
+  if (!entry || !entry.files[0]) {
+    return
+  }
+  const { dataSourceType } = resolveInvoiceDataSource(structure)
+  const pgSupported = 'pg' in getDatabaseDriverDependencies(dataSourceType)
+  entry.files[0].content = generateSentEmailLogCode({ pgSupported, attribution: true })
+}