@agent-native/core 0.118.0 → 0.118.1

package/corpus/templates/crm/actions/apply-crm-proposals.ts

@@ -1,203 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { z } from "zod";
-
-import { isConnectedCrmProvider } from "../server/crm/adapter.js";
-import { getDb, schema } from "../server/db/index.js";
-import {
-  isSafeCrmMutationFields,
-  parseJsonRecord,
-  requireCrmScope,
-} from "./_crm-action-utils.js";
-
-function conditionalMutationMessage(provider: "hubspot" | "salesforce") {
-  const label = provider === "hubspot" ? "HubSpot" : "Salesforce";
-  return `${label} did not apply this update because this connection has not proved an atomic expected-revision write path. Refresh the record and make this change in ${label}.`;
-}
-
-function updateAffectedRows(result: unknown): number {
-  if (!result || typeof result !== "object") return 0;
-  const value = result as {
-    rowsAffected?: unknown;
-    rowCount?: unknown;
-    count?: unknown;
-    changes?: unknown;
-    meta?: { changes?: unknown };
-  };
-  for (const count of [
-    value.rowsAffected,
-    value.rowCount,
-    value.count,
-    value.changes,
-    value.meta?.changes,
-  ]) {
-    if (typeof count === "number") return count;
-  }
-  return 0;
-}
-
-export default defineAction({
-  description:
-    "Review one pending HubSpot or Salesforce provider proposal. The initial release records approval and fails closed unless the connection proves an atomic expected-revision write path; otherwise make the change upstream after review.",
-  schema: z.object({
-    proposalId: z.string().trim().min(1).max(128),
-  }),
-  needsApproval: true,
-  audit: {
-    target: (_args, result) => {
-      const response = result as {
-        recordId: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-record",
-        id: response.recordId,
-        ownerEmail: response.ownerEmail,
-        orgId: response.orgId,
-        visibility: response.visibility,
-      };
-    },
-    summary: (args) => `Reviewed CRM proposal ${args.proposalId}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    await assertAccess("crm-mutation", args.proposalId, "editor");
-    const db = getDb();
-    const [proposal] = await db
-      .select()
-      .from(schema.crmMutations)
-      .where(
-        and(
-          eq(schema.crmMutations.id, args.proposalId),
-          accessFilter(
-            schema.crmMutations,
-            schema.crmMutationShares,
-            undefined,
-            "editor",
-          ),
-        ),
-      )
-      .limit(1);
-    if (!proposal) throw new Error("CRM proposal was not found.");
-    if (proposal.target !== "provider" || proposal.operation !== "update") {
-      throw new Error(
-        "Only pending provider update proposals can be reviewed in this phase.",
-      );
-    }
-    if (proposal.status !== "pending") {
-      throw new Error(
-        `CRM proposal is ${proposal.status} and cannot be reviewed.`,
-      );
-    }
-    if (!proposal.recordId || !proposal.connectionId) {
-      throw new Error(
-        "CRM proposal is missing its record or connection reference.",
-      );
-    }
-    await assertAccess("crm-record", proposal.recordId, "editor");
-    await assertAccess("crm-connection", proposal.connectionId, "editor");
-    const [[record], [connection]] = await Promise.all([
-      db
-        .select()
-        .from(schema.crmRecords)
-        .where(
-          and(
-            eq(schema.crmRecords.id, proposal.recordId),
-            accessFilter(
-              schema.crmRecords,
-              schema.crmRecordShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        )
-        .limit(1),
-      db
-        .select()
-        .from(schema.crmConnections)
-        .where(
-          and(
-            eq(schema.crmConnections.id, proposal.connectionId),
-            accessFilter(
-              schema.crmConnections,
-              schema.crmConnectionShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        )
-        .limit(1),
-    ]);
-    if (!record || record.tombstone || !connection) {
-      throw new Error(
-        "CRM proposal no longer has an available record and connection.",
-      );
-    }
-    if (!isConnectedCrmProvider(connection.provider)) {
-      throw new Error(
-        "Only HubSpot and Salesforce provider proposals are enabled in this release.",
-      );
-    }
-    if (!connection.workspaceConnectionId) {
-      throw new Error(
-        "CRM connection is missing its workspace connection reference.",
-      );
-    }
-    if (!proposal.expectedRemoteRevision) {
-      throw new Error(
-        "CRM proposal has no remote revision and must be recreated from a refreshed record.",
-      );
-    }
-    const patch = parseJsonRecord(proposal.patchJson);
-    const fields = patch.fields;
-    if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
-      throw new Error("CRM proposal has an invalid field patch.");
-    }
-    const fieldPatch = fields as Record<string, unknown>;
-    if (!isSafeCrmMutationFields(fieldPatch)) {
-      throw new Error("CRM proposal contains an unsafe field patch.");
-    }
-
-    const scope = requireCrmScope(ctx);
-    const now = new Date().toISOString();
-    const message = conditionalMutationMessage(connection.provider);
-    const claim = await db
-      .update(schema.crmMutations)
-      .set({
-        status: "rejected",
-        approvedBy: scope.ownerEmail,
-        approvedAt: now,
-        error: message,
-        updatedAt: now,
-      })
-      .where(
-        and(
-          eq(schema.crmMutations.id, proposal.id),
-          eq(schema.crmMutations.status, "pending"),
-          accessFilter(
-            schema.crmMutations,
-            schema.crmMutationShares,
-            undefined,
-            "editor",
-          ),
-        ),
-      );
-    if (updateAffectedRows(claim) !== 1) {
-      throw new Error(
-        "CRM proposal was already claimed by another application attempt.",
-      );
-    }
-    return {
-      proposalId: proposal.id,
-      recordId: record.id,
-      status: "rejected" as const,
-      message,
-      ownerEmail: record.ownerEmail,
-      orgId: record.orgId,
-      visibility: record.visibility,
-    };
-  },
-});

package/corpus/templates/crm/actions/attach-call-evidence.ts

@@ -1,170 +0,0 @@
-import { defineAction } from "@agent-native/core/action";
-import { assertAccess } from "@agent-native/core/sharing";
-import { and, eq, inArray } from "drizzle-orm";
-import { z } from "zod";
-
-import { isSafeCrmEvidenceExcerpt } from "../server/crm/crm-field-firewall.js";
-import { getDb, schema } from "../server/db/index.js";
-import { isDurableClipsEvidenceUrl } from "../shared/crm-automation-recipes.js";
-import { requireCrmScope } from "./_crm-action-utils.js";
-
-const httpsUrl = z
-  .string()
-  .url()
-  .max(2_048)
-  .refine(
-    (value) => /^https:\/\//i.test(value),
-    "sourceUrl must be an https URL",
-  );
-
-export default defineAction({
-  description:
-    "Attach bounded call evidence to a CRM record. Store only an artifact reference, URL, optional short quote, speaker, timestamp, and summary; never submit a transcript or media payload.",
-  schema: z
-    .object({
-      recordId: z.string().trim().min(1).max(128).optional(),
-      recordIds: z
-        .array(z.string().trim().min(1).max(128))
-        .min(1)
-        .max(20)
-        .optional(),
-      interactionId: z.string().trim().min(1).max(128).optional(),
-      artifactId: z.string().trim().min(1).max(256),
-      sourceUrl: httpsUrl,
-      sourceApp: z.string().trim().min(1).max(80).default("clips"),
-      artifactType: z.string().trim().min(1).max(80).default("call-evidence"),
-      quote: z
-        .string()
-        .trim()
-        .max(1_200)
-        .refine(
-          isSafeCrmEvidenceExcerpt,
-          "quote must be a bounded human-readable excerpt, not transcript, media, binary, base64, or data-url content",
-        )
-        .optional(),
-      speaker: z.string().trim().max(240).optional(),
-      startSeconds: z.number().finite().min(0).max(86_400).optional(),
-      endSeconds: z.number().finite().min(0).max(86_400).optional(),
-      summary: z
-        .string()
-        .trim()
-        .max(2_000)
-        .refine(
-          isSafeCrmEvidenceExcerpt,
-          "summary must be a bounded human-readable excerpt, not transcript, media, binary, base64, or data-url content",
-        )
-        .optional(),
-      capturedAt: z.string().datetime({ offset: true }).optional(),
-    })
-    .superRefine((value, issue) => {
-      if (
-        (!value.recordId && !value.recordIds) ||
-        (value.recordId && value.recordIds)
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message: "Provide exactly one of recordId or recordIds",
-          path: ["recordId"],
-        });
-      }
-      if (
-        value.endSeconds !== undefined &&
-        value.startSeconds !== undefined &&
-        value.endSeconds < value.startSeconds
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message: "endSeconds must be after startSeconds",
-          path: ["endSeconds"],
-        });
-      }
-      if (
-        value.sourceApp.trim().toLowerCase() === "clips" &&
-        !isDurableClipsEvidenceUrl(value.sourceUrl)
-      ) {
-        issue.addIssue({
-          code: "custom",
-          message:
-            "Clips evidence must use a durable /share/<id> or /r/<id> page URL without an access token, media endpoint, or transcript fragment",
-          path: ["sourceUrl"],
-        });
-      }
-    }),
-  audit: {
-    target: (args, result) => {
-      const value = result as {
-        evidence?: Array<{
-          ownerEmail: string;
-          orgId: string | null;
-          visibility: "private" | "org";
-        }>;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      const evidence = value.evidence?.[0] ?? value;
-      return {
-        type: "crm-record",
-        id: args.recordId ?? args.recordIds?.[0] ?? "unknown",
-        ownerEmail: evidence.ownerEmail,
-        orgId: evidence.orgId,
-        visibility: evidence.visibility,
-      };
-    },
-    summary: (args) =>
-      `Attached call evidence to ${args.recordIds?.length ?? 1} CRM record${args.recordIds?.length === 1 ? "" : "s"}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx) => {
-    const recordIds = args.recordId
-      ? [args.recordId]
-      : [...new Set(args.recordIds ?? [])];
-    await Promise.all(
-      recordIds.map((recordId) =>
-        assertAccess("crm-record", recordId, "editor"),
-      ),
-    );
-    if (args.interactionId)
-      await assertAccess("crm-interaction", args.interactionId, "viewer");
-    const db = getDb();
-    const scope = requireCrmScope(ctx);
-    const now = new Date().toISOString();
-    const rows = recordIds.map((recordId) => ({
-      id: crypto.randomUUID(),
-      interactionId: args.interactionId ?? null,
-      recordId,
-      sourceApp: args.sourceApp,
-      artifactType: args.artifactType,
-      artifactId: args.artifactId,
-      sourceUrl: args.sourceUrl,
-      quote: args.quote ?? "",
-      speaker: args.speaker ?? null,
-      startSeconds: args.startSeconds ?? null,
-      endSeconds: args.endSeconds ?? null,
-      summary: args.summary ?? "",
-      capturedAt: args.capturedAt ?? now,
-      ...scope,
-      createdAt: now,
-      updatedAt: now,
-    }));
-    await db.transaction(async (tx) => {
-      await tx.insert(schema.crmCallEvidence).values(rows);
-    });
-    const evidence = await db
-      .select()
-      .from(schema.crmCallEvidence)
-      .where(
-        and(
-          inArray(
-            schema.crmCallEvidence.id,
-            rows.map((row) => row.id),
-          ),
-          eq(schema.crmCallEvidence.ownerEmail, scope.ownerEmail),
-        ),
-      )
-      .limit(recordIds.length);
-    if (evidence.length !== recordIds.length)
-      throw new Error("Call evidence could not be verified after saving.");
-    return args.recordId ? evidence[0] : { evidence };
-  },
-});

package/corpus/templates/crm/actions/configure-crm-connection.ts

@@ -1,126 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { z } from "zod";
-
-import { createConnectedCrmAdapter } from "../server/crm/adapter.js";
-import { getDb, schema } from "../server/db/index.js";
-import { requireCrmScope, toJson } from "./_crm-action-utils.js";
-
-const idList = z.array(z.string().trim().min(1).max(160)).max(50).default([]);
-
-export default defineAction({
-  description:
-    "Register an authorized HubSpot or Salesforce workspace Connection as a scoped CRM companion connection. Provider credentials remain in workspace Connections.",
-  schema: z.object({
-    provider: z.enum(["hubspot", "salesforce"]).default("hubspot"),
-    workspaceConnectionId: z.string().trim().min(1).max(160).optional(),
-    label: z.string().trim().min(1).max(160).optional(),
-    mode: z.enum(["connected", "hybrid"]).default("connected"),
-    selectedPipelineIds: idList,
-    selectedObjectTypes: z
-      .array(z.string().trim().min(1).max(120))
-      .min(1)
-      .max(50)
-      .optional(),
-  }),
-  audit: {
-    target: (_args, result) => {
-      const connection = result as {
-        id: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-connection",
-        id: connection.id,
-        ownerEmail: connection.ownerEmail,
-        orgId: connection.orgId,
-        visibility: connection.visibility,
-      };
-    },
-    summary: (_args, result) =>
-      `Configured CRM connection ${(result as { id?: string })?.id ?? ""}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    const scope = requireCrmScope(ctx);
-    const adapter = await createConnectedCrmAdapter({
-      provider: args.provider,
-      connectionId: args.workspaceConnectionId,
-      userEmail: scope.ownerEmail,
-      orgId: scope.orgId,
-    });
-    const id = adapter.connection.connectionId;
-    const db = getDb();
-    const [existing] = await db
-      .select({ id: schema.crmConnections.id })
-      .from(schema.crmConnections)
-      .where(
-        and(
-          eq(schema.crmConnections.workspaceConnectionId, id),
-          accessFilter(schema.crmConnections, schema.crmConnectionShares),
-        ),
-      )
-      .limit(1);
-    const now = new Date().toISOString();
-    const selectedObjectTypes =
-      args.selectedObjectTypes ??
-      (args.provider === "hubspot"
-        ? ["companies", "contacts", "deals"]
-        : ["Account", "Contact", "Opportunity"]);
-    const accessScopeKey = `workspace:${id}:${adapter.connection.actorId ?? scope.ownerEmail}`;
-    const values = {
-      provider: args.provider,
-      workspaceConnectionId: id,
-      label:
-        args.label ?? (args.provider === "hubspot" ? "HubSpot" : "Salesforce"),
-      accountId: adapter.connection.accountId ?? null,
-      mode: args.mode,
-      status: "connected" as const,
-      selectedPipelinesJson: toJson(args.selectedPipelineIds, 8_000),
-      selectedObjectTypesJson: toJson(selectedObjectTypes, 8_000),
-      accessScopeKey,
-      accessScopeJson: toJson(
-        {
-          key: accessScopeKey,
-          actorId: adapter.connection.actorId,
-          mode: adapter.connection.actorId ? "user" : "service-account",
-          recordVisibility: adapter.connection.actorId ? "actor" : "unknown",
-        },
-        4_000,
-      ),
-      lastError: null,
-      updatedAt: now,
-    };
-    const localId = existing?.id ?? id;
-
-    if (existing) {
-      await assertAccess("crm-connection", existing.id, "editor");
-      await db
-        .update(schema.crmConnections)
-        .set(values)
-        .where(
-          and(
-            eq(schema.crmConnections.id, existing.id),
-            accessFilter(
-              schema.crmConnections,
-              schema.crmConnectionShares,
-              undefined,
-              "editor",
-            ),
-          ),
-        );
-    } else {
-      await db.insert(schema.crmConnections).values({
-        id: localId,
-        ...values,
-        ...scope,
-        createdAt: now,
-      });
-    }
-
-    return { id: localId, ...scope, provider: args.provider };
-  },
-});

package/corpus/templates/crm/actions/configure-native-crm.ts

@@ -1,44 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { z } from "zod";
-
-import { configureNativeCrmConnection } from "../server/crm/native-adapter.js";
-import { requireCrmScope } from "./_crm-action-utils.js";
-
-export default defineAction({
-  description:
-    "Initialize a local-authoritative Native SQL CRM with accounts, people, and opportunities. It requires no provider connection or credential and uses the configured SQLite, Postgres, or D1 database.",
-  schema: z.object({
-    label: z.string().trim().min(1).max(160).optional(),
-  }),
-  audit: {
-    target: (_args, result) => {
-      const connection = result as {
-        id: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-connection",
-        id: connection.id,
-        ownerEmail: connection.ownerEmail,
-        orgId: connection.orgId,
-        visibility: connection.visibility,
-      };
-    },
-    summary: (_args, result) =>
-      `Configured Native SQL CRM ${(result as { id?: string })?.id ?? ""}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    const result = await configureNativeCrmConnection({
-      label: args.label,
-      ownership: requireCrmScope(ctx),
-    });
-    return {
-      ...result,
-      provider: "native" as const,
-      mode: "native" as const,
-    };
-  },
-});

package/corpus/templates/crm/actions/create-crm-record.ts

@@ -1,148 +0,0 @@
-import { defineAction, type ActionRunContext } from "@agent-native/core/action";
-import { accessFilter } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { z } from "zod";
-
-import {
-  configureNativeCrmConnection,
-  createNativeCrmAdapter,
-} from "../server/crm/native-adapter.js";
-import { getDb, schema } from "../server/db/index.js";
-import type { CrmValue } from "../shared/crm-contract.js";
-import {
-  crmInitiatedBy,
-  isSafeCrmMutationFields,
-  MAX_CRM_FIELDS_PER_MUTATION,
-  requireCrmScope,
-  scopedCrmIdempotencyKey,
-} from "./_crm-action-utils.js";
-
-const kindToObjectType = {
-  account: "accounts",
-  person: "people",
-  opportunity: "opportunities",
-} as const;
-
-export const nativeRecordFieldsSchema = z
-  .record(z.string().trim().min(1).max(120), z.unknown())
-  .refine(
-    (fields) => Object.keys(fields).length <= MAX_CRM_FIELDS_PER_MUTATION,
-    `Provide at most ${MAX_CRM_FIELDS_PER_MUTATION} fields.`,
-  )
-  .refine(
-    isSafeCrmMutationFields,
-    "CRM fields and values cannot contain media, transcripts, data URLs, base64, or oversized JSON.",
-  );
-
-export default defineAction({
-  description:
-    "Create an account, person, or opportunity in Native SQL CRM. The record is local-authoritative, access-scoped, idempotent, audited, and has no upstream provider write.",
-  schema: z.object({
-    connectionId: z.string().trim().min(1).max(128).optional(),
-    kind: z.enum(["account", "person", "opportunity"]),
-    displayName: z.string().trim().min(1).max(500),
-    fields: nativeRecordFieldsSchema.optional(),
-    idempotencyKey: z.string().trim().min(1).max(256).optional(),
-  }),
-  audit: {
-    target: (_args, result) => {
-      const record = result as {
-        recordId: string;
-        ownerEmail: string;
-        orgId: string | null;
-        visibility: "private" | "org";
-      };
-      return {
-        type: "crm-record",
-        id: record.recordId,
-        ownerEmail: record.ownerEmail,
-        orgId: record.orgId,
-        visibility: record.visibility,
-      };
-    },
-    summary: (args) =>
-      `Created Native SQL CRM ${args.kind} ${args.displayName}`,
-    recordInputs: false,
-  },
-  run: async (args, ctx?: ActionRunContext) => {
-    const ownership = requireCrmScope(ctx);
-    const db = getDb();
-    const connectionRows = await db
-      .select({ id: schema.crmConnections.id })
-      .from(schema.crmConnections)
-      .where(
-        and(
-          eq(schema.crmConnections.provider, "native"),
-          ...(args.connectionId
-            ? [eq(schema.crmConnections.id, args.connectionId)]
-            : []),
-          accessFilter(
-            schema.crmConnections,
-            schema.crmConnectionShares,
-            undefined,
-            "editor",
-          ),
-        ),
-      )
-      .limit(args.connectionId ? 1 : 2);
-    if (!connectionRows.length && args.connectionId) {
-      throw new Error(
-        "The selected Native SQL CRM is unavailable or you do not have editor access.",
-      );
-    }
-    if (!args.connectionId && connectionRows.length > 1) {
-      throw new Error(
-        "More than one Native SQL CRM is available. Provide connectionId to choose one.",
-      );
-    }
-    const connectionId =
-      connectionRows[0]?.id ??
-      (
-        await configureNativeCrmConnection({
-          ownership,
-        })
-      ).id;
-    const objectType = kindToObjectType[args.kind];
-    const remoteId = crypto.randomUUID();
-    const fields = {
-      ...(args.fields as Record<string, CrmValue> | undefined),
-      displayName: args.displayName,
-      ...(args.kind === "person" ? {} : { name: args.displayName }),
-    };
-    const idempotencyKey = await scopedCrmIdempotencyKey({
-      ...ownership,
-      recordId: `${connectionId}:${objectType}`,
-      key: args.idempotencyKey ?? crypto.randomUUID(),
-    });
-    const adapter = await createNativeCrmAdapter({
-      connectionId,
-      initiatedBy: crmInitiatedBy(ctx),
-    });
-    const result = await adapter.applyMutation({
-      operation: "create",
-      record: {
-        connectionId,
-        provider: "native",
-        objectType,
-        kind: args.kind,
-        remoteId,
-      },
-      fields,
-      idempotencyKey,
-    });
-    if (result.status !== "applied" || !result.record?.ref.localId) {
-      throw new Error(
-        result.message ?? "Native SQL CRM record was not created.",
-      );
-    }
-    return {
-      recordId: result.record.ref.localId,
-      connectionId,
-      provider: "native" as const,
-      kind: args.kind,
-      displayName: result.record.displayName,
-      revision: result.remoteRevision,
-      ...ownership,
-    };
-  },
-});